WordPress Share Drafts Publicly Plugin <= 1.1.4 - Authenticated Information Disclosure Vulnerability

Because of this vulnerability, a user would now need to have access to a valid nonce to be able to make a draft public. WordPress Share Drafts Publicly users don’t have access to a draft could use the functionality to view it since the AJAX request was accessible to anyone logged in to WordPress...

Thycotic Secret Server Open Redirect Vulnerability

Thycotic Secret Server is a set of password protection software from the American company Thycotic. An open redirection vulnerability exists in the share function in versions of Thycotic Secret Server prior to 10.2.000019. A remote attacker could exploit this vulnerability to redirect users to...

share-with.com XSS vulnerability

Open Bug Bounty ID: OBB-282914 Description| Value ---|--- Affected Website:| share-with.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Kandi Car Share Android app has an override access vulnerability

Car Sharing app is a new energy car time-sharing platform. The Kandi Car Sharing Android app suffers from an override access vulnerability. An attacker using this vulnerability can view arbitrary account information and disclose the user's name, ID number, and cell phone number...

elektrollart.de XSS vulnerability

Vulnerable URL: http://www.elektrollart.de/wp-content/plugins/share-on-diaspora/newwindow.php?url=!%22%3E%3Cimg%20src=x%20onerror=confirm%22OPENBUGBOUNTY%22%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

WordPress Share-On-Diaspora Cross Site Scripting

Title: WordPress share-on-diaspora Plugin Cross Site Scripting XSS + Date: 2017/08/17 + Author: APA Golestan - GuCert + Vendor Homepage: www.WordPress.org + Tested on: Windows 10 & Kali Linux + Vulnerable File: /newwindow.php + Dorks :...

AddToAny Share Buttons <= 1.7.14 - Conditional Host Header Injection

Plugin description: "AddToAny is the universal sharing platform, and AddToAny’s plugin is the most popular share plugin for WordPress, making sites social media ready since 2006." Active installs according to https://wordpress.org/plugins/add-to-any/: 400,000+ checked on 15. Aug 2017 It's possibl...

WordPress AddToAny Share Buttons plugin <=1.7.14 - Conditional Host Header Injection vulnerability

Conditional Host Header Injection vulnerability found by Paul Dannewitz in WordPress AddToAny Share Buttons plugin. Vulnerable plugin version used Host header instead of homeurl thus allows custom Hostheader injection by crafted link, web cache poisoning and it may end up with sharing malicious...

Akamai Is Named A Leader In Gartner's Magic Quadrant For Web Application Firewalls

"Don't work for recognition, but do work worthy of recognition" - H. Jackson Brown. A friend sent this quote to me after I explained to her my ambivalence about being recognized by Gartner as a "Leader" in their Web Application Firewall Magic Quadrant. I had mixed feelings because I wanted to...

Quora: XSS when clicking "Share to Twitter" at quora.com/widgets/embed_iframe?path=...

Summary: The endpoint at https://language.quora.com/widgets/embediframe?path=pathtoanswerinsamelanguage shows the answer you specify in path like /Question/answer/User in a format useful to embed. There is one button Share that when clicked shows another button Share to Twitter. The href attribut...

Intrusion Detection Avoidance Payload Generator: NPS_Payload

This script will generate payloads for basic intrusion detection avoidance. It utilizes publicly demonstrated techniques from several different sources. Written by Larry Spohn @Spoonman1091 Payload written by Ben Mauch @Ben0xA aka dirtyben. This tool provides a way to generate a PowerShell payloa...

samba: symlink race permits opening files outside share directory

A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories in areas of the server file system not exported under the share definitions...

CVE-2017-11725

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...

CVE-2017-11725

CVE-2017-11725 affects IBM Security Secret Server (Thycotic Secret Server) prior to 10.2.000019. The vulnerability resides in the share function where the Back Button is mishandled, causing unintended redirections (open redirect-like behavior) and potential user confusion or credential exposure r...

CVE-2017-11725

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...

WordPress Share Buttons by AddThis plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) Vulnerability

WordPress Share Buttons by AddThis plugin addthisAsyncLoading function doesn’t check for a valid nonce to prevent CSRF. Solution Update the plugin...

ownCloud Multiple Vulnerabilities (May 2017)

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if description...

CVE-2017-9339

A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...

CVE-2017-9339

A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...

Code injection

A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...