Debian: Security Advisory (DSA-3254-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : wordpress -- 2 XSS vulnerabilities (d86890da-f498-11e4-99aa-bcaec565249c)

Samuel Sidler reports : The Genericons icon font package, which is used in a number of popular themes and plugins, contained an HTML file vulnerable to a cross-site scripting attack. All affected themes and plugins hosted on WordPress.org including the Twenty Fifteen default theme have been updat...

Dynamic display block - Less Critical - Access bypass - SA-CONTRIB-2015-104

This module enables you to showcase featured content at a prominent place on the front page of the site in an attractive way. The module doesn't sufficiently protect access to content a user has no access to. In certain scenarios a user with the "administer ddblock" permission can see titles of...

suricata -- TLS/DER Parser Bug (DoS)

OISF Development Team reports: The OISF development team is pleased to announce Suricata 2.0.8. This release fixes a number of issues in the 2.0 series. The most important issue is a bug in the DER parser which is used to decode SSL/TLS certificates could crash Suricata. This issue was reported b...

Entityform Block - Moderately Critical - Access Bypass - SA-CONTRIB-2015-106

This module enables you to display an entityform as a block. The module doesn't sufficiently check permissions on the entityform under scenarios where the form is locked to a certain role. CVE identifiers issued CVE-2015-5493 Versions affected Entityform Block 7.x-1.x versions prior to 7.x-1.3...

HUAWEI MobiConnect 23.9.17.216 - Privilege Escalation

Document Title: =============== HUAWEI MobiConnect 23.9.17.216 - Privilege Escalation References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1389 Release Date: ============= 2015-05-04 Vulnerability Laboratory ID VL-ID: ==================================== 1389...

Cisco Finesse Server Cross-Site Scripting Vulnerability

A vulnerability in Cisco Finesse Server could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks. The vulnerability is due to improper input validation of certain parameters passed via HTTP GET or POST methods to an affected device. An unauthenticated, remote...

WordPress 3.5.1 Lightbox Plus RCE

Remote Code Execution in the Wordpress core using maybeunserialize and the simplehtmldomnode class Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

WordPress SP Project & Document Manager 2.5.3 SQL Injection

SQL Injection vulnerability in WordPress SP Project & Document Manager plugin pid parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

WordPress Cart66 Lite SQL Injection

SQL Injection vulnerability in WordPress Cart66 plugin id parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

WordPress Advanced Video Embed File Disclosure

File disclosure vulnerability in WordPress Advanced Video Embed plugin Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

WordPress Simple Ads Manager File Upload

File upload vulnerability in WordPress Simple Ads Manager plugin sam-ajax-admin.php Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

WeBid 1.1.1 File Upload

File upload vulnerability in WeBid ajax.php Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

WordPress Work The Flow File Upload

File upload vulnerability in WordPress Work The Flow File Upload plugin Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

WordPress CP Multi View Event Calendar 1.1.4 SQL Injection

SQL Injection vulnerability in CP Multi View Event Calendar plugin Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

WordPress NEX-Forms 3.0 SQL Injection

SQL Injection vulnerability in WordPress NEX-Forms plugin nexformsId parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

Novell ZENworks Configuration Management UploadServlet File Upload

File upload vulnerability in Novell ZENworks Configuration Management UploadServlet Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

DSA-3242-1 chromium-browser - security update

Bulletin has no description...

Views - Critical - Access Bypass - SA-CONTRIB-2015-103

The Views module provides a flexible method for Drupal site designers to control how lists and tables of content, users, taxonomy terms and other data are presented. Access bypass due cache inconsistency Due to an issue in the caching mechanism of Views it's possible that configured filters lose...

Camtasia Relay - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-100

This module enables you to integrate your Drupal site with TechSmith Relay software. The module doesn't sufficiently sanitize user input under the meta access tab. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "view meta information". CVE...