Design/Logic Flaw

J-Web in Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D35, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D10, 12.3X48 before 12.3X48-D10, 12.2 before 12.2R9, 12.3 before 12.3R7, 13.2 before 13.2R6, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R5, 14.1 before 14.1R3, 14.1X53 befor...

CVE-2015-3004: Improper Input Validation

J-Web in Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D35, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D10, 12.3X48 before 12.3X48-D10, 12.2 before 12.2R9, 12.3 before 12.3R7, 13.2 before 13.2R6, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R5, 14.1 before 14.1R3, 14.1X53 befor...

WordPress Ya'aburnee / Dignitas Privilege Escalation Vulnerabilities

This vulnerability allows an attacker to escalate previleges on the site and have an admin account which may lead to a full site takeover ------------------------------------------------------------------------------ WordPress Different-Themes Previlage Escalation...

PT-2015-6048

Name of the Vulnerable Software and Affected Versions Junos versions 11.4 through 11.4R11, 12.1X44 through 12.1X44-D34, 12.1X46 through 12.1X46-D24, 12.1X47 through 12.1X47-D9, 12.3X48 through 12.3X48-D9, 12.2 through 12.2R8, 12.3 through 12.3R6, 13.2 through 13.2R5, 13.2X51 through 13.2X51-D19,...

Netsparker 4 - Easier to Use, More Automation and Much More Web Security Checks

Netsparker Web Application Security Scanner version 4. The main highlight of this new version is the new fully automated Form Authentication mechanism; it does not require you to record anything, supports 2 factor authentication and other authentication mechanisms that require a one time code to...

Kadimus - LFI Scan & Exploit Tool

Kadimus is a tool to check sites to lfi vulnerability , and also exploit it Features: Check all url parameters /var/log/auth.log RCE /proc/self/environ RCE php://input RCE data://text RCE Source code disclosure Multi thread scanner Command shell interface through HTTP Request Proxy support...

Debian DLA-19-1 : postgresql-8.4 update

New upstream minor release. Users should upgrade to this version at their next scheduled maintenance window. Noteworthy change : Secure Unix-domain sockets of temporary postmasters started during make check Noah Misch Any local user able to access the socket file could connect as the server's...

(Mobile Pwn2Own) Google Android DHCP Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Google Android. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the DHCP options in a DHCP ACK packet. The vulnerability is triggered wh...

Wordpress Fusion Theme Arbitrary File Upload Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL.Fusion is one of the corporate themes. An arbitrary file upload vulnerability exists in the 'fusionoptions' function in the...

Linux Kernel 3.15.6 - PPP-over-L2TP Socket Level Handling Crash (PoC)

Linux Kernel 3.15.6 - PPP-over-L2TP Socket Level Handling Crash PoC / ---------------------------------------------------------------------------------------------------- cve-2014-4943poc.c The PPPoL2TP feature in net/l2tp/l2tpppp.c in the Linux kernel through 3.15.6 allows local users to gain...

Yelp: Missing X-Frame-Options header

URL https://staging.seatme.us/ Vulnerability: The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in...

PT-2015-5655

Name of the Vulnerable Software and Affected Versions Fusion theme version 3.1 for Wordpress Description The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension in a fusion save action. This is due to an unrestricted file upload...

WordPress plugin CrossSlide jQuery cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . CrossSlide jQuery is one of the implementation of the slide show animation effect of the plugin . A cross-site...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the CrossSlide jQuery crossslide-jquery-plugin-for-wordpress plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings or conduct cross-site scripting XSS...

PT-2015-5596

Name of the Vulnerable Software and Affected Versions crossslide-jquery-plugin-for-wordpress version 2.0.5 Description The issue allows remote attackers to hijack the authentication of administrators for requests, potentially leading to changes in plugin settings or cross-site scripting XSS...

CVE-2015-2039: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings or 2 conduct cross-site scripting XSS attacks via the acobottok...

PT-2015-5560

Name of the Vulnerable Software and Affected Versions Acobot Live Chat & Contact Form plugin version 2.0 Description The issue allows remote attackers to hijack the authentication of administrators for requests, enabling them to change plugin settings or conduct cross-site scripting XSS attacks...

Cross site scripting

Cross-site scripting XSS vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php...

PT-2015-5482

Name of the Vulnerable Software and Affected Versions Google Doc Embedder plugin versions prior to 2.5.19 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to...

CVE-2015-1879: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php...