CVE-2015-5734

Cross-site scripting XSS vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string...

DEBIAN-CVE-2015-5734

Cross-site scripting XSS vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string...

CVE-2015-5734

Cross-site scripting XSS vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string...

CVE-2015-5734

WordPress 4.2.4 patch fixes CVE-2015-5734: XSS in the legacy theme preview (wp-includes/theme.php) that allowed remote injection via a crafted string. Affected: WordPress prior to 4.2.4. Impact noted as cross-site scripting; remediation is upgrading to WordPress 4.2.4 (security release). Exploita...

CVE-2015-5734

Cross-site scripting XSS vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string...

xpshop网店系统sql注入(demo演示)

简要描述： 详细说明： 漏洞位置:xpshop.webui.MyRefund protected void PageLoadobject sender, EventArgs e if Utils.requestbase.Request.QueryString"type" && Utils.requestbase.Request.QueryString"Action" string text = base.Request.QueryString"Action"; if text != null if !text == "GetImg" if text == "GetPackageGID"...

Apple qlmanage - SceneKit::daeElement::setElementName Heap Overflow

Source: https://code.google.com/p/google-security-research/issues/detail?id=467 There is a heap overflow in daeElement::setElementName. The vulnerable method uses a fixed size 128 bytes heap-allocated buffer to copy the name of an arbitrary element. By setting the name of the element to something...

Apple qlmanage - SceneKit::daeElement::setElementName Heap Overflow

Apple qlmanage - SceneKit::daeElement::setElementName Heap Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=467 There is a heap overflow in daeElement::setElementName. The vulnerable method uses a fixed size 128 bytes heap-allocated buffer to copy the name of a...

WordPress Landing Pages 1.8.4 Cross Site Scripting ( CVE-2015-4065 )

插件: https://downloads.wordpress.org/plugin/landing-pages.1.8.4.zip 漏洞文件位置在 shared/shortcodes/inbound-shortcodes.php Line 761 preview.php?sc=&post=' width="285" scrollbar='true' frameborder="0" id="inbound-shortcodes-preview" 从上述文件可以看到 GET 方式传过来的参数 post 直接输出到 html 中造成了XSS 触发 url 如下...

[SECURITY] [DLA 294-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb6u7 CVE ID : CVE-2015-2213 CVE-2015-5622 CVE-2015-5731 CVE-2015-5732 CVE-2015-5734 Several vulnerabilities have been fixed in Wordpress, the popular blogging engine. CVE-2015-2213 SQL Injection allowed a remote attacker to compromise the site...

foreman: cross-site scripting (XSS) flaw in template preview screen

A cross-site scripting XSS flaw was found in Foreman's template preview screen. A remote attacker could use this flaw to perform cross-site scripting attacks by tricking a user into viewing a malicious template. Note that templates are commonly shared among users...

foreman: cross-site scripting (XSS) flaw in template preview screen

A cross-site scripting XSS flaw was found in Foreman's template preview screen. A remote attacker could use this flaw to perform cross-site scripting attacks by tricking a user into viewing a malicious template. Note that templates are commonly shared among users...

Unspecified vulnerability in WordPress legacy theme

WordPress is a use of PHP language development blog platform, users can support PHP and MySQL database server set up their own weblog. WordPress has a legacy theme preview unspecified vulnerability, no detailed vulnerability details are currently available...

Microsoft released an emergency update: serious remote code execution vulnerability, affecting all versions of Windows-vulnerability warning-the black bar safety net

! Microsoft today released an emergency update that fixes the relates to all versions of Windows in high-risk remote code execution vulnerability. Whether you are using what version of Windows System, we recommend that you have to update it-this one high-risk vulnerability could allow an attacker...

Envoy: Stored XSS

Hello Security Team, I Have Found A Stored XSS Vulnerability in iPad Settings Page .. So .. Here Is How To Reproduce The Vulnerability: 1. Login To Your Account In Envoy 2. Change Your Company Name From Settings Page .. And Set It To Your Payload Like . Or You Can Create A New Account With This...

CVE-2014-3653

Cross-site scripting XSS vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template...

Cross site scripting

Cross-site scripting XSS vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the posttitle parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview...

CVE-2012-6692

Cross-site scripting XSS vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the posttitle parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview...

Yoast SEO <= 2.1.1 - Authenticated Stored DOM XSS

The "snippet preview" functionality of the Yoast WordPress SEO plugin was susceptible to cross-site scripting in versions before 2.2. PoC Vulnerable URL: /wp-admin/post-new.php?posttitle= Vulnerable Code wordpress-seo/js/wp-seo-metabox.js: function ystcleanstr if str == '' || str == undefined...

DEBIAN-CVE-2015-2938

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file...