CVE-2012-2917

CVE-2012-2917 affects the WordPress plugin Share and Follow (version ≤ 1.80.3). The vulnerability is a Cross-site Scripting (XSS) flaw triggered when attackers inject script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php. The NVD entry reports a medium...

WordPress Share and Follow Plugin <= 1.80.3 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

Share And Follow <= 1.80.3 - Cross Site Scripting

Plugin is still affected and has been closed...

WordPress Plugin Share and Follow 1.80.3 - 'admin.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/53533/info The Share and Follow plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

WordPress Plugin Share and Follow 1.80.3 - admin.php Cross-Site Scripting

WordPress Plugin Share and Follow 1.80.3 - admin.php Cross-Site Scripting source: https://www.securityfocus.com/bid/53533/info The Share and Follow plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may...

WordPress Share And Follow 1.80.3 Cross Site Scripting

Hi We have used our tool, THAPS, to identify vulnerabilities in this WordPress plugin. We have confirmed at least one of the reported vulnerabilities and created a working exploit located below. Attached is one or more log files containing the output of our tool, identifying the location of the...

SA-CONTRIB-2012-045 - AddToAny - Cross Site Scripting

CVE: CVE-2012-2072 This module enables you to add Lockerz/AddToAny's universal sharing buttons to your site. Previously, the module did not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fac...

Microsoft Expression 'wintab32.dll' DLL Loading Arbitrary Code Execution Vulnerability

Description Microsoft Expression is prone to a vulnerability that lets attackers execute arbitrary code. An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link...

Java Web Start initial heap size command injection

Added: 03/02/2012 CVE: CVE-2012-0500 BID: 52015 OSVDB: 79227 Background Sun Java Web Start allows standalone Java applications, called JNLP files, to be executed by the Java Runtime Environment JRE. Problem A vulnerability in Java Web Start allows arbitrary command-line argument injection through...

Java Web Start initial heap size command injection

Added: 03/02/2012 CVE: CVE-2012-0500 BID: 52015 OSVDB: 79227 Background Sun Java Web Start allows standalone Java applications, called JNLP files, to be executed by the Java Runtime Environment JRE. Problem A vulnerability in Java Web Start allows arbitrary command-line argument injection through...

DEBIAN-CVE-2011-5081

Cross-site scripting XSS vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi...

CVE-2011-5081

Cross-site scripting XSS vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi...

CVE-2011-5081

Cross-site scripting XSS vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi...

PT-2012-2059

Name of the Vulnerable Software and Affected Versions: BackupPC versions 3.1.0 through 3.2.1 Description: A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the share parameter in a "RestoreFile" action to "index.cgi". Recommendations: For versions 3.1...

Mobile, Android Threats Continued Sharp Growth in 2011

The occurrence of mobile malware increased by 155 percent across all platforms in 2011, and, according to Juniper Network’s 2011 Mobile Threat Report, malware specifically targeting the Android operating system saw its own increase of more than 3,000 percent. Juniper Networks attributes Android’s...

Microsoft Windows Color Control Panel Remote Code Execution Vulnerability (2643719)

This host is missing an important security update according to Microsoft Bulletin MS12-012. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

SciTools Understand 2.6 DLL Loading Code Execution

/ SciTools Understand 2.6 wintab32.dll DLL Loading Arbitrary Code Execution Vendor: Scientific Toolworks, Inc. Product web page: http://www.scitools.com Affected version: 2.6 build 598 Summary: Understand is a static analysis tool for maintaining, measuring, and analyzing critical or large code...

Windows Object Packager Insecure Execution

Added: 01/24/2012 CVE: CVE-2012-0009 BID: 51297 OSVDB: 78212 Background Windows Object Packager is a tool that can be used to create a package that can be inserted into a file. Problem A vulnerability exists in the way the Windows Object Packager registers and implements packages stored on networ...

Windows Object Packager Insecure Execution

Added: 01/24/2012 CVE: CVE-2012-0009 BID: 51297 OSVDB: 78212 Background Windows Object Packager is a tool that can be used to create a package that can be inserted into a file. Problem A vulnerability exists in the way the Windows Object Packager registers and implements packages stored on networ...

Windows Object Packager Insecure Execution

Added: 01/24/2012 CVE: CVE-2012-0009 BID: 51297 OSVDB: 78212 Background Windows Object Packager is a tool that can be used to create a package that can be inserted into a file. Problem A vulnerability exists in the way the Windows Object Packager registers and implements packages stored on networ...