Load Library Safely

Dynamically loading libraries in an application can lead to vulnerabilities if not secured properly. In this blog post we talk about loading a library using LoadLibraryEx API and make use of options to make it safe. Know the defaults: The library file name passed to LoadLibrary / LoadLibraryEx ca...

CVE-2014-2558

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...

PT-2014-4779

Name of the Vulnerable Software and Affected Versions File Gallery plugin versions prior to 1.7.9.2 Description The issue allows remote administrators to execute arbitrary PHP code due to improper string escaping in the setting fields. This can be achieved by injecting a backslash quote in the...

CVE-2014-2558: Improper Control of Generation of Code

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...

CVE-2013-7234

Simple Machines Forum SMF before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header...

Design/Logic Flaw

Simple Machines Forum SMF before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header...

CVE-2013-7234

Simple Machines Forum SMF before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header...

CVE-2013-7234

CVE-2013-7234 affects Simple Machines Forum (SMF). The vulnerability exists in SMF versions prior to 1.1.19 and prior to 2.0.6, where an improper handling of the page framing allows remote attackers to perform clickjacking via an X-Frame-Options header. The NVD entry lists this as a remote, heade...

PT-2014-3296

Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF versions prior to 1.1.19 Simple Machines Forum SMF versions 2.x prior to 2.0.6 Description The issue allows remote attackers to conduct clickjacking attacks. This is possible due to the lack of an appropriate...

CVE-2013-7234: Improper Input Validation

Simple Machines Forum SMF before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header...

Localize: OPTIONS Method Enabled

HTTP OPTIONS method is enabled on the web server of Localize. The OPTIONS method provides a list of the methods that are supported by the web server, it represents a request for information about the communication options available on the request/response chain identified by the Request-URI. This...

CVE-2014-2288

The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualifyfrequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service crash via a PJSIP endpoint that does not...

Respondly: x-frame options-sameorigin warning

As the x-frame options set to same-origin it still may be vulnerable to clickjacking attacks how? by using this code Better explanation: http://www.skeletonscribe.net/2012/06/x-frame-options-sameorigin-warning.html...

CVE-2014-2288: Improper Input Validation

The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualifyfrequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service crash via a PJSIP endpoint that does not...

PT-2014-4607

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 12.x through 12.1.0 Description The issue allows remote attackers to cause a denial of service crash via a PJSIP endpoint that does not have an associated outgoing request, when qualify frequency is enabled on an...

Localize: ClickJacking

It allows remote attackers to do some clickjacking which can be used for adding arbitrary tasks . Why? Almost all of your page has missing X-FRAME-OPTIONS header. Websites are at risk of a clickjacking attack when they allow content to be embedded within a frame. An attacker may use this risk to...

CVE-2014-2431

Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect availability via unknown vectors related to Options...

CVE-2014-2431

Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect availability via unknown vectors related to Options...

CVE-2014-2431

Disclaimer: This data contains information about vulnerable...

CVE-2014-2431: Undefined Security Weakness

Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect availability via unknown vectors related to Options...