CVE-2014-9523

The CVE-2014-9523 entries describe CSRF and XSS vulnerabilities affecting the WordPress plugin Our Team Showcase (our-team-enhanced) in versions before 1.3. An attacker can hijack administrator sessions to change plugin settings via unspecified vectors and trigger XSS through the sc_our_team_memb...

WordPress Our Team Showcase Plugin <= 1.2 - Multiple CSRF and XSS

Because of these cross-site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way, they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...

Wordpress Email 1.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress Email 1.1 Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/email/ Software Link : https://downloads.wordpress.org/plugin/email.1.1.zip Date :...

libevent -- integer overflow in evbuffers

Debian Security Team reports: Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this fla...

Wordpress sumome 1.6 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress sumome 1.6 Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sumome/ Software Link :https://downloads.wordpress.org/plugin/sumome.zip Date : 2015-01-0...

WordPress Banner Effect Header 1.2.6 XSS / CSRF

|||||||||||||||||||||||||||||||||||||||||||||||||| |-------------------------------------------------------------------------| | Exploit Title: Wordpress Banner Effect Header 1.2.6 Plugin XSS, CSRF Vulnerability | | Date : Date: 2015-01-02 | | Exploit Author: Ashiyane Digital Security Team | |...

DLA-128-1 sox - security update

Bulletin has no description...

ReviewPost 2.84 - Multiple Vulnerabilities

ReviewPost 2.84 - Multiple Vulnerabilities ReviewPost Multiple Vulnerabilities Vendor: All Enthusiast, Inc. Product: ReviewPost Version: = 2.84 Website: http://www.reviewpost.com/ BID: 12159 CVE: CVE-2005-0270 CVE-2005-0271 CVE-2005-0272 OSVDB: 12703 12704 12705 12706 12707 12708 SECUNIA: 13697...

PhotoPost Classifieds 2.01 - Multiple Vulnerabilities

PhotoPost Classifieds 2.01 - Multiple Vulnerabilities PhotoPost Classifieds Multiple Vulnerabilities Vendor: All Enthusiast, Inc. Product: PhotoPost Classifieds Version: = 2.01 Website: http://www.photopost.com/class/ BID: 12156 OSVDB: 12728 12729 12730 12731 12732 12733 12734 12735 12736 12737...

Incom CMS SQL Injection Vulnerability

Incom CMS suffers from an authentication bypass vulnerability via remote SQL injection. Exploit Title: Incom Cms Admin Bypass Vulnerability Google Dork: intext:"incom cms" . intext:"site by overron" . intitle:"INCOM CMS" Date: 2014-12-29 Exploit Author: Xodiak Vendor Homepage:...

Wireless N ADSL 2/2+ Modem Router - DT5130 - Xss / URL Redirect / Command Injection

Product: Wireless N ADSL 2/2+ Modem Router Firmware Version : V2.05.C29GV Modem Type : ADSL2+ Router Modem Vendor : Technicolor Model: DT5130 Bugs: 1- Unauth Xss - CVE-2014-9142 user=teste&password=teste&...

PHP-Calendar 0.10.1 - Arbitrary File Inclusion

PHP-Calendar 0.10.1 - Arbitrary File Inclusion PHP-Calendar Arbitrary File Inclusion Vendor: Sean Proctor Product: PHP-Calendar Version: = 0.10.1 Website: http://php-calendar.sourceforge.net/ BID: 12127 CVE: CVE-2004-1423 OSVDB: 12700 12701 SECUNIA: 22516 PACKETSTORM: 35563 Description: I was...

[SECURITY] [DLA 124-1] unzip security update

Package : unzip Version : 6.0-4+deb6u1 CVE ID : CVE-2014-8139 CVE-2014-8140 CVE-2014-8141 Debian Bug : 773722 Michele Spagnuolo of the Google Security Team discovered that unzip, an extraction utility for archives compressed in .zip format, is affected by heap-based buffer overflows within the...

DSA-3113-1 unzip - security update

Bulletin has no description...

From the source perspective on the ntpd stack buffer overflow vulnerability(CVE-2 0 1 4-9 2 9 5)analysis-vulnerability warning-the black bar safety net

Recently, the ntp's official website released a Update Patch: A total of 6 vulnerabilities 4 CVE number, both of Google Security Team found and submitted. Wherein the CVE-2 0 1 4-9 2 9 5 includes a 3 stack overflow: a This article from the source code perspective, these three stack overflow,...

[oCERT-2014-010] SoX input sanitization errors

2014-010 SoX input sanitization errors Description: The SoX project is an open source tool for sound processing. The sox command line tool is affected by two heap-based buffer overflows, respectively located in functions startread and AdpcmReadBlock. A specially crafted wav file can be used to...

Facebook Bug Bounty #17 - Migrate Privacy Vulnerability

Document Title: =============== Facebook Bug Bounty 17 - Migrate Privacy Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1370 Facebook Security ID: 216850649 Vulnerability Magazine:...

[oCERT-2014-011] UnZip input sanitization errors

2014-011 UnZip input sanitization errors Description: The UnZip tool is an open source extraction utility for archives compressed in the zip format. The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification, the testcompreb and the getZip64Data functions...

[oCERT-2014-012] JasPer input sanitization errors

2014-012 JasPer input sanitization errors Description: The JasPer project is an open source implementation for the JPEG-2000 codec. The library is affected by a double-free vulnerability in function jasiccattrvaldestroy as well as a heap-based buffer overflow in function jp2decode. A specially...

Debian Security Advisory DSA 3106-1 (jasper - security update)

Jose Duart of the Google Security Team discovered a double free flaw CVE-2014-8137 and a heap-based buffer overflow flaw CVE-2014-8138 in JasPer, a library for manipulating JPEG-2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary...