Pornhub: CSV Macro injection in Video Manager (CEMI)

Missing character escaping in video title delivery of an executable CSV payload to when exporting stats to file...

American Fuzzy Lop Utilities: afl-utils

Utilities for automated crash sample processing/analysis, easy afl-fuzz job management and corpus optimization afl-utils is a collection of utilities to assist fuzzing with american-fuzzy-lop afl . afl-utils includes tools for: automated crash sample collection, verification, reduction and analys...

ROPInjector - Convert any Shellcode in ROP and patch it into a given Portable Executable (PE)

A tool written in C Win32 to convert any shellcode in ROP and patch it into a given portable executable PE. It supports only 32-bit target PEs and the x86 instruction set. Published in Blackhat USA 2015, "ROPInjector: Using Return Oriented Programming for Polymorphism and Antivirus Evasion" More...

Call & SMS Stats - Exported components, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Call & SMS Stats published at the 'play' market has multiple vulnerabilities...

espn.com.ar XSS vulnerability

Vulnerable URL: http://www.espn.com.ar/mlb/deportes/stats/fielding?order=true%22%3E%3Ch1/onmouseover=%27alert%28/XSSPOSED/%29%27%3EYVTALE Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 08:04 GMT Vulnerability type:| XSS Vulnerability status:|...

CVE-2015-8797

Cross-site scripting XSS vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI...

WordPress Clik stats plugin <= 0.8 - Open Redirect vulnerability

WordPress Clik stats plugin 0.8 version is vulnerable to Open Redirection. Solution No patched version exists...

WordPress Social Essentials Social Stats And Sharing Buttons 1.3.1 XSS Vulnerability

WordPress Social Essentials Social Stats and Sharing Buttons plugin version 1.3.1 suffers from a cross site scripting vulnerability. WordPress Social Essentials Social Stats And Sharing Buttons 1.3.1 XSS Vulnerability Plugin Name : Social Essentials Social Stats and Sharing Buttons Effected Versi...

WordPress Social Essentials Social Stats And Sharing Buttons 1.3.1 XSS

Plugin Name : Social Essentials Social Stats and Sharing Buttons Effected Version : 1.3.1 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : Th...

WordPress WP Stats Dashboard <= 2.9.4 - Blind SQL Injection

Because of this vulnerability, authenticated administrators can execute arbitrary SQL commands via "type" parameter. Solution Update the plugin...

WP-Stats-Dashboard <= 2.9.4 - Authenticated Blind SQL Injection

The wp-stats-dashboard WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...

Mac OS X < 10.10.4 Multiple Vulnerabilities

Binary data 8801.prm...

CVE-2015-3718

systemstatsd in the System Stats subsystem in Apple OS X before 10.10.4 does not properly interpret data types encountered in interprocess communication, which allows attackers to execute arbitrary code with systemstatsd privileges via a crafted app, related to a "type confusion" issue...

Mac OS X Multiple Vulnerabilities (Security Update 2015-005) (GHOST) (Logjam)

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-005. It is, therefore, affected multiple vulnerabilities in the following components : - Admin Framework - afpserver - apache - AppleFSCompression - AppleGraphicsControl -...

Mac OS X 10.10.x < 10.10.4 Multiple Vulnerabilities (GHOST) (Logjam)

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.4. It is, therefore, affected multiple vulnerabilities in the following components : - Admin Framework - afpserver - apache - AppleFSCompression - AppleGraphicsControl - AppleThunderboltEDMService - ATS - Bluetooth -...

WordPress WP-Stats plugin has multiple vulnerabilities

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. WordPress can also be used as a content management system CMS. HTML injection vulnerability and cross-site scripting vulnerability exis...

WordPress Stats Plugin <= 2.51 - Multiple Vulnerabilities

This plugin is prone to cross site scripting and cross site request forgery vulnerabilities. Solution Update the plugin...

WordPress WP-Stats plugin <= 2.51 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS discovered by Sebastian Wolfgang Kraemer in WordPress WP-Stats plugin versions = 2.51. Solution Update the WordPress WP-Stats plugin to the latest available version at least 2.52...

WP-Stats <= 2.51 - CSRF & Stored Cross-Site Scripting (XSS)

Stored XSS in wordpress-admin-panel enabled by CSRF vulnerability in the admin-menu. Discovered by the HSASec-Team...

Multiple Cross-Site Request Forgery Vulnerabilities in osCMax

osCMax is a PHP-based open source e-commerce system/shopping cart application that supports multi-language, SSL-secured transactions, multiple payment methods, regional shipping conversion, printing invoices and more. Multiple cross-site request forgery vulnerabilities exist in versions of osCMax...