CakePHP 3.0.4 Released

CakePHP 3.0.4 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 3.0.4. This is a maintenance release that contains security fixes and bugfixes. Security Fixes There are two issues that can impact the security of a CakePHP application: CsrfComponent fails to...

New Atlanta BlueDragon Directory Traversal Vulnerability

New Atlanta BlueDragon is a ColdFusion Markup Language engine. A directory traversal vulnerability in New Atlanta BlueDragon's CFChart servlet allows an attacker to read or delete arbitrary files due to a failure to adequately filter the 'QUERYSTRING' value in the cfchart.cfchart file...

Magento Server MAGMI plugin cross-site scripting vulnerability

Magento is the United States Magento company's set of professional open source PHP e-commerce system , it provides rights management , search engine and payment gateway features such as Magento Server is the Magento server . MAGMI aka Magento Mass Importer is one of the product catalogs used to...

WordPress plugin WooCommerce cross-site scripting vulnerability (CNVD-2015-01281)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.WooCommerce is one of the e-commerce plug-ins. A cross-site scripting vulnerability exists in WordPress WooCommerce...

CVE-2015-2069

Cross-site scripting XSS vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING in the wc-reports page to wp-admin/admin.php...

PT-2015-5581

Name of the Vulnerable Software and Affected Versions Magento Server with MAGMI plugin affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the MAGMI plugin. These vulnerabilities allow remote attackers to inject arbitrary web script ...

PT-2015-5582

Name of the Vulnerable Software and Affected Versions WooCommerce plugin versions prior to 2.2.11 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the QUERY STRING in the "wc-reports" page to "wp-admin/admin.php". Recommendations For...

PT-2015-5032

Name of the Vulnerable Software and Affected Versions e107 version 1.0.4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the e107 files/ file path in the QUERY STRING. This could potentially lead to unauthorized actions on the affect...

CVE-2014-10012

Cross-site scripting XSS vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI...

Cross site scripting

Cross-site scripting XSS vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI...

PT-2015-3656 · WordPress · Wordpress Classifieds Plugin

Name of the Vulnerable Software and Affected Versions: Another WordPress Classifieds Plugin affected versions not specified Description: The issue allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI, which is a cross-site scripting XSS...

WordPress Another WordPress Classifieds Plugin - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the query string to the default URI. Solution Update the plugin...

CVE-2014-10012: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI...

IPCop Cross-Site Scripting Vulnerability

IPCop is a Linux-based firewall suite developed by IPCop team, which is mainly for home and SOHO users, providing firewall functions and allowing monitoring and management of various information through some TCP/IP business rules. A cross-site scripting vulnerability exists in versions prior to...

D-link IP camera DCS-2103 with firmware cross-site scripting vulnerability

D-link IP camera DCS-2103 is a camera for IP surveillance solution. A cross-site scripting vulnerability exists in D-link IP camera DCS-2103 with firmware versions prior to 1.20, which allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING parameter in vb.htm...

PT-2015-3578

Name of the Vulnerable Software and Affected Versions IPCop aka IPCop Firewall versions prior to 2.1.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via the QUERY STRING in the cgi-bin/ipinfo.cgi endpoint. This can be used to bypass the cross-site request...

PT-2014-9009

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.0-rc2 Description The issue allows remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY STRING to serendipity/index.php, potentially leading to cross-site scripting XSS attacks...

CVE-2014-9243

Multiple cross-site scripting XSS vulnerabilities in WebsiteBaker 2.8.3 allow remote attackers to inject arbitrary web script or HTML via the 1 QUERYSTRING to wb/admin/admintools/tool.php or 2 sectionid parameter to editmodulefiles.php, 3 news/addpost.php, 4 news/modifygroup.php, 5...

PT-2014-8871

Name of the Vulnerable Software and Affected Versions Eleanor CMS affected versions not specified Description The issue allows remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks. This is achieved by manipulating a URL in the QUERY STRING...

WordPress Paid Memberships Pro Plugin 1.7.14 - Directory Traversal

This vulnerability is in the services/getfile.php, It allows the attackers to read arbitrary files in the QUERYSTRING in a getfile action to wp-admin/admin-ajax.php. Solution Update the plugin...