Adobe CVE-2011-2461 Remains Exploitable Via Flex Four Years After Patch

UPDATE: This article has been updated to add commentary and clarification from Adobe. A four year old Adobe Flash patch did not properly resolve a vulnerable Flex application, and attackers can exploit the bug, which is said to affect some 30 percent of Alexa’s top 10 most popular sites in the...

All-in-One WP Migration <= 2.0.4 - Unauthenticated Database Export

Unauthenticated users can export a complete copy of the WordPress database, all plugins, themes, and uploaded files...

KLA10491 Multiple vulnerabilities in WordPress plugins

Multiple serious vulnerabilities have been found in WordPress plugins and themes. Malicious users can exploit these vulnerabilities to execute or inject arbitrary code, bypass security and read local files. Below is a complete list of vulnerabilities 1. Multiple XSS vulnerabilities were found in...

Vane - WordPress Vulnerability Scanner (A GPL fork of WPScan)

Vane is a GPL fork of the now non-free popular WordPress vulnerability scanner WPScan. INSTALL Prerequisites Windows not supported Ruby = 1.9 RubyGems Git Installing on Debian/Ubuntu sudo apt-get install libcurl4-gnutls-dev libopenssl-ruby libxml2 libxml2-dev libxslt1-dev ruby-dev git clone...

Google Chrome < 39.0.2171.65 Multiple Vulnerabilities

Binary data 8580.pasl...

WebRTC Found Leaking Local IP Addresses

A recently publicized hole in WebRTC, a protocol for web communication, is revealing the local IP addresses of users, even those who go to extra lengths to hide theirs by using a virtual private network. Daniel Roesler, a San Francisco-based researcher who’s dabbled in encryption, posted a...

Wordpress Video Gallery Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugins - Wordpress Video Gallery Arbitrary File Download Vulnerability Date: 17/01/2015 Exploit Author: X-Line Empire North From Tetouan Vendor Homepage: Dork : www.hdflvplayer.net Software Link:...

CVE-2014-9587

Multiple cross-site request forgery CSRF vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to 1 address book operations or the 2 ACL or 3 Managesieve plugins...

CVE-2014-9587

Multiple cross-site request forgery CSRF vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to 1 address book operations or the 2 ACL or 3 Managesieve plugins...

Integer overflow

Multiple integer signedness errors in DirectShowDemuxFilter, as used in Divx Web Player, Divx Player, and other Divx plugins, allow remote attackers to execute arbitrary code via a 1 negative or 2 large value in a Stream Format STRF chunk in an AVI file, which triggers a heap-based buffer overflo...

CVE-2014-10024

CVE-2014-10024 involves multiple integer signedness errors in DirectShowDemuxFilter, used by Divx Web Player, Divx Player, and other Divx plugins. The flaw arises when parsing the Stream Format (STRF) chunk in an AVI file, where a negative or excessively large value can trigger a heap-based buffe...

CVE-2014-10024: Undefined Security Weakness

Multiple integer signedness errors in DirectShowDemuxFilter, as used in Divx Web Player, Divx Player, and other Divx plugins, allow remote attackers to execute arbitrary code via a 1 negative or 2 large value in a Stream Format STRF chunk in an AVI file, which triggers a heap-based buffer overflo...

Fedora 21 : roundcubemail-1.0.4-2.fc21 (2014-17450)

This update provides Roundcube 1.0.4. This is a stable security update: the security fix is described by upstream as 'Fix possible CSRF attacks to some address book operations as well as to the ACL and Managesieve plugins.' More details on the update are available at...

Fedora 20 : roundcubemail-1.0.4-2.fc20 (2014-17461)

This update provides Roundcube 1.0.4. This is a stable security update: the security fix is described by upstream as 'Fix possible CSRF attacks to some address book operations as well as to the ACL and Managesieve plugins.' More details on the update are available at...

[SECURITY] Fedora 19 Update: claws-mail-plugins-3.11.1-1.fc19

Additional plugins for Claws Mail...

Fedora Update for claws-mail-plugins FEDORA-2014-14237

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-9397

Cross-site request forgery CSRF vulnerability in the twimp-wp plugin for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the messageformat parameter in the twimp-wp.php page to...

WordPress Simple Visitor Stat Cross Site Scripting

Title: WordPress 'Simple Visitor Stat' plugin - Stored XSS Reported by: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2014/12/12 Download: https://wordpress.org/plugins/simple-visitor-stat/ ---------------------------------------------------------------- Description:...

[SECURITY] Fedora 19 Update: nrpe-2.15-2.fc19

Nrpe is a system daemon that will execute various Nagios plugins locally on behalf of a remote monitoring host that uses the checknrpe plugin. Various plugins that can be executed by the daemon are available at: http://sourceforge.net/projects/nagiosplug This package provides the core agent...

CVE-2014-4703

lib/parseini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4701...