183 matches found
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter in an addComment action to ajax/profilefunctions.php, 2 composetext parameter in a sendMail action to...
Sql injection
SQL injection vulnerability in ajax/mailfunctions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action...
CVE-2014-8810
SQL injection vulnerability in ajax/mailfunctions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action...
CVE-2014-8809
WP Symposium plugin for WordPress (pre-14.11) contains multiple XSS vulnerabilities. Attack vectors include: (1) text parameter in addComment via ajax/profile_functions.php, (2) compose_text in sendMail via ajax/mail_functions.php, (3) comment in add_comment via ajax/lounge_functions.php, and (4)...
CVE-2014-8810
WP Symposium plugin for WordPress (
CVE-2014-8809
Multiple cross-site scripting XSS vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter in an addComment action to ajax/profilefunctions.php, 2 composetext parameter in a sendMail action to...
Wordpress Wp Symposium 14.11 - Unauthenticated Shell Upload Exploit
Exploit for php platform in category web applications !/usr/bin/python Exploit Name: Wordpress WP Symposium 14.11 Shell Upload Vulnerability Vulnerability discovered by Claudio Viviani Exploit written by Claudio Viviani 2014-11-27: Discovered vulnerability 2014-12-01: Vendor Notification Twitter...
WP Symposium <= 14.11 - Unauthenticated Shell Upload
The wp-symposium WordPress plugin was affected by an Unauthenticated Shell Upload security vulnerability...
WordPress WP Symposium 14.11 Shell Upload
WP Symposium Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the /wp-symposium/server/fileuploadform.php script does not properly verify or sanitize user-uploaded files. By uploading a .php file, the remote system will pla...
WordPress Symposium Plugin 14.10 - SQL Injection
This WordPress Symposium plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update to version 14.11...
WordPress Plugin Symposium 14.10 - SQL Injection
Exploit Title: WP Symposium 14.10 SQL Injection Date: 22-10-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link: https://downloads.wordpress.org/plugin/wp-symposium.14.10.zip Category: webapps CVE: CVE-2014-8810 1. Description $POST'tray' ...
WordPress Plugin Symposium 14.10 - SQL Injection
WordPress Plugin Symposium 14.10 - SQL Injection Exploit Title: WP Symposium 14.10 SQL Injection Date: 22-10-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link: https://downloads.wordpress.org/plugin/wp-symposium.14.10.zip Category: webap...
WP Symposium <= 14.10 - XSS & SQL Injection
The wp-symposium WordPress plugin was affected by a XSS & SQL Injection security vulnerability...
WordPress Symposium Plugin <= 14.10 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the 4 parameters: "composetext" in a sendMail action to ajax/mailfunctions.php, "text" in an addComment action to ajax/profilefunctions.php, "comment" in an addcomment action to ajax/loungefunctions.php, o...
CVE-2014-7055
The NCCI's Annual Issues Symposium aka com.quickmobile.ais14 application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Design/Logic Flaw
The NCCI's Annual Issues Symposium aka com.quickmobile.ais14 application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-7055
The CVE-2014-7055 entry describes the NCCI Annual Issues Symposium Android app (1.0) not verifying X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive data via a crafted certificate. Root cause: missing SSL certificate verification in th...
Android Side-Channel Hack Leads to Data Loss at USENIX
A weakness in Android, one that’s likely also found in other leading operating systems, allows an attacker to infer what’s happening on a victim’s user interface and launch an appropriate secondary attack resulting in data loss. Researchers from the University of Michigan and the University of...
New Facebook Internet Defense Prize Pays Out $50,000 Award
Large technology companies may already have bug bounty programs in place that reward researchers who attack and find holes in software or web platforms. Slowly, some are also starting to institute programs that pay for defensive measures. Facebook is the latest to do so with the implementation of...