1405 matches found
SUSE-SU-2015:2183-1 Security update for strongswan
The strongswan package was updated to fix the following security issue: - CVE-2015-8023: Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin bsc953817...
CVE-2015-7683: Absolute Path Traversal in the Font WordPress Plugin
Details ================ Software: Font Version: 7.5 Homepage: https://wordpress.org/plugins/font/ CVE: CVE-2015-7683 Pending CVSS: 6.3 Medium; AV:N/AC:M/Au:S/C:C/I:N/A:N CWE: CWE-22 Description ================ An absolute path traversal vulnerability in Font 7.5 allows WordPress admins read...
WordPress Easy2Map 1.2.9 Cross Site Scripting
Vulnerability title: A Reflected XSS in Easy2Map version 1.2.9 WordPress plugin CVE: CVE-2015-7668 Vendor: Steven Ellis Product: Easy2Map Affected version: 1.2.9 Fixed version: 1.3.0 Reported by: Ibéria Medeiros Vulnerability Details: ===================== It was discovered that no protection...
WordPress Pie Register Plugin <= 2.0.18 - XSS
This vulnerability allows an attacker to inject arbitrary web script or HTML via the invitaioncode parameter in a pie-register page to the default URL. Solution Update the plugin...
xPinner Lite <= 2.2 - Cross-Site Scripting (XSS) & CSRF
The xpinner-lite WordPress plugin was affected by a Cross-Site Scripting XSS & CSRF security vulnerability...
sourceAFRICA <= 0.1.3 - Unauthenticated Cross-Site Scripting (XSS)
The sourceafrica WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability...
CP Image Store with Slideshow <= 1.0.6 - Purchase ID Brute Force Prevention
The CP Image Store with Slideshow WordPress plugin was affected by a Purchase ID Brute Force Prevention security vulnerability...
SEO SearchTerms Tagging 2 <= 1.535 - XSS & Authenticated SQL Injection
Plugin is still affected and has been closed...
Design/Logic Flaw
The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...
WordPress Advanced XML Reader Plugin <= 0.1.1 - Arbitrary File Disclosure
This plugin is prone to a XML external entity data parsing arbitrary file disclosure vulnerability. It allows attackers to read system files. Solution Update the plugin...
WordPress Plugin Freshmail 1.5.8 - shortcode.php SQL Injection
WordPress Plugin Freshmail 1.5.8 - shortcode.php SQL Injection Exploit Title: Unauthenticated SQL Injection on Wordpress Freshmail 1 Google Dork: N/A Date: 05/05/2015 Exploit Author: Felipe Molina de la Torre @felmoltor Vendor Homepage: http://freshmail.com/ Software Link:...
SUSE-SU-2015:0921-1 Security update for gstreamer-0_10-plugins-bad
gstreamer-010-plugins-bad was updated to fix a security issue, a buffer overflow in mp4 parsing bnc927559 CVE-2015-0797. Security Issues: CVE-2015-0797...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the AB Google Map Travel AB-MAP plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 lat Latitude, 2 long Longitude, 3...
WordPress Sliding Social Icons 1.61 CSRF / XSS
Title: WordPress 'Sliding Social Icons' plugin - CSRF/XSS Version: 1.61 Reported by: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2014/12/12 Download: https://wordpress.org/plugins/sliding-social-icons/ Notified WordPress: 2014/11/27...
CM Download Manager <= 2.0.0 - Unauthenticated Code Injection
The plugin does not validate and sanitise the CMDsearch parameter which used to create a custom function. This allows attacker to run arbitrary command on the remote server PoC GET /cmdownloads/?CMDsearch=".phpinfo." HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:33....
WordPress XCloner Plugin - Multiple Vulnerabilities
XCloner plugin is prone to multiple vulnerabilities, such as: unauthenticated remote access to backup files via easily guessable file names, arbitrary command execution and authenticated remote file access. Also, clear text MySQL password exposure through HTML text box. Solution Upgrade the plugi...
WordPress WP-Ban 1.62 Bypass
Details ================ Software: WP-Ban Version: 1.62 Homepage: http://wordpress.org/plugins/wp-ban/ Advisory report: https://security.dxw.com/advisories/vulnerability-in-wp-ban-allows-visitors-to-bypass-the-ip-blacklist-in-some-configurations/ CVE: CVE-2014-6230 CVSS: 5 Medium;...
GroupDocs Comparison <= 1.0.2 - Multiple Parameter XSS
The GroupDocs.Comparison for Cloud WordPress plugin was affected by a Multiple Parameter XSS security vulnerability...