SA-CONTRIB-2015-003 - PHPlist Integration Module - SQL Injection

The PHPlist Integration module provides an integration between a Drupal website and phpList newsletter manager. The module provides two main features: user sync and sending a node as a newsletter. The module introduces a SQL Injection vulnerability to the phpList database. The Drupal database is...

SA-CONTRIB-2015-009 - Linkit - Cross Site Scripting (XSS)

Linkit provides an easy interface for internal and external linking with wysiwyg editors and fields by using an autocomplete field. The module doesn't sufficiently sanitize node titles in the result list if the node search plugin is enabled. This vulnerability is mitigated by the fact that an...

Microweber CMS 0.95 - SQL Injection

Microweber CMS 0.95 - SQL Injection Exploit Title: SQL Injection in Microweber CMS 0.95 Google Dork: N/A Date: 12/16/2014 Exploit Author: Pham Kien Cuong [email protected] and ITAS Team www.itas.vn Vendor Homepage: Microweber https://microweber.com/ Software Link:...

Microweber CMS 0.95 - SQL Injection

Exploit Title: SQL Injection in Microweber CMS 0.95 Google Dork: N/A Date: 12/16/2014 Exploit Author: Pham Kien Cuong [email protected] and ITAS Team www.itas.vn Vendor Homepage: Microweber https://microweber.com/ Software Link: https://github.com/microweber/microweber Version: 0.95 Tested on:...

SA-CONTRIB-2015-004 - Context - Open Redirect

Context allows you to manage contextual conditions and reactions for different portions of your site. Context UI module wasn't checking for external URLs in the HTTP GET destination parameter when redirecting users that are activating/deactivating the Context UI inline editor dialog, thereby...

SA-CONTRIB-2015-002 - Course - Cross Site Scripting (XSS)

Course module enables you to create e-learning courses with any number of requirements for completion. The module doesn't sufficiently filter node title displays when being used in a course. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to creat...

Microweber CMS 0.95 SQL Injection

Exploit Title: SQL Injection in Microweber CMS 0.95 Google Dork: N/A Date: 12/16/2014 Exploit Author: Pham Kien Cuong [email protected] and ITAS Team www.itas.vn Vendor Homepage: Microweber https://microweber.com/ Software Link: https://github.com/microweber/microweber Version: 0.95 Tested on:...

SA-CONTRIB-2015-007 - Htaccess - Cross Site Request Forgery (CSRF)

The Htaccess module allows the creation and deployment of .htaccess files based on custom settings. Some administration links were not properly protected from Cross Site Request Forgery CSRF. A malicious user could cause an administrator to deploy or delete .htaccess files by getting the...

Microweber CMS 0.95 - SQL Injection Vulnerability

Microweber CMS version 0.95 suffers from a remote SQL injection vulnerability. Exploit Title: SQL Injection in Microweber CMS 0.95 Google Dork: N/A Date: 12/16/2014 Exploit Author: Pham Kien Cuong email protected and ITAS Team www.itas.vn Vendor Homepage: Microweber https://microweber.com/ Softwa...

Malvertising Campaign Hits AOL Ad Network, Leads to Exploit Kit

Researchers have detected a malvertising campaign running on a pair of sites owned by Huffington Post that is using ads distributed through an AOL ad network. The attack is sending victims through a series of redirects that eventually brings them to a landing page that is running an exploit kit...

WordPress Plugin Our Team Showcase (our-team-enhanced) Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability in WordPress plugin Our Team Showcase our-team-enhanced versions prior to 1.3 allo...

Vulnerability in OpenSSL - RSA silently downgrades to EXPORT_RSA [Client]

An OpenSSL client will accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. A server could present a weak temporary key and downgrade the security of the session...

CVE-2014-9523

Multiple cross-site request forgery CSRF vulnerabilities in the Our Team Showcase our-team-enhanced plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Our Team Showcase our-team-enhanced plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site...

CVE-2014-9523

The CVE-2014-9523 entries describe CSRF and XSS vulnerabilities affecting the WordPress plugin Our Team Showcase (our-team-enhanced) in versions before 1.3. An attacker can hijack administrator sessions to change plugin settings via unspecified vectors and trigger XSS through the sc_our_team_memb...

WordPress Our Team Showcase Plugin <= 1.2 - Multiple CSRF and XSS

Because of these cross-site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way, they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...

Wordpress Email 1.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress Email 1.1 Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/email/ Software Link : https://downloads.wordpress.org/plugin/email.1.1.zip Date :...

libevent -- integer overflow in evbuffers

Debian Security Team reports: Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this fla...

Wordpress sumome 1.6 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress sumome 1.6 Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sumome/ Software Link :https://downloads.wordpress.org/plugin/sumome.zip Date : 2015-01-0...

WordPress Banner Effect Header 1.2.6 XSS / CSRF

|||||||||||||||||||||||||||||||||||||||||||||||||| |-------------------------------------------------------------------------| | Exploit Title: Wordpress Banner Effect Header 1.2.6 Plugin XSS, CSRF Vulnerability | | Date : Date: 2015-01-02 | | Exploit Author: Ashiyane Digital Security Team | |...