ThemeMakers WordPress Themes Information Disclosure

WordPress 'ALL Themes' Developed By "ThemeMakers" File Information Exposure CWE: CWE-538 Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 15/05/2015 Vendor Homepage: http://themeforest.net/user/ThemeMakers/portfolio ALL THEMES Google Dork:...

WordPress Crayon Syntax Highlighter Plugin <= 2.6.10 - Defacement

Because of this vulnerability, attackers can craft the user provided parameters in such a way that it becomes possible to overwrite base themes with arbitrary CSS. Solution Update plugin...

WordPress Multiple XSS

According to its version number, the WordPress application running on the remote web server is either version 3.7.x prior to 3.7.8, 3.8.x prior to 3.8.8, 3.9.x prior to 3.9.6, 4.1.x prior to 4.1.5, or 4.2.x prior to 4.2.2. It is, therefore, potentially affected by multiple cross-site scripting...

FreeBSD : wordpress -- 2 XSS vulnerabilities (d86890da-f498-11e4-99aa-bcaec565249c)

Samuel Sidler reports : The Genericons icon font package, which is used in a number of popular themes and plugins, contained an HTML file vulnerable to a cross-site scripting attack. All affected themes and plugins hosted on WordPress.org including the Twenty Fifteen default theme have been updat...

WordPress Slider Revolution Shell Upload

Description Note: The Construct, Echelon, Fusion, Method, Modular and Myriad affected themes are from the Mysitemyway, who went out of business, and the themes have been forked by BackStop Themes who does not use Revslider...

Moodle < 2.6 / 2.6.x < 2.6.9 / 2.7.x < 2.7.6 / 2.8.x < 2.8.4 Multiple Vulnerabilities

Binary data 8726.prm...

Multiple iThemes plugins, themes and add-ons - XSS via add_query_arg() and remove_query_arg()

...

WordPress Ya'aburnee / Dignitas Privilege Escalation Vulnerabilities

This vulnerability allows an attacker to escalate previleges on the site and have an admin account which may lead to a full site takeover ------------------------------------------------------------------------------ WordPress Different-Themes Previlage Escalation...

Mozilla Firefox lightweight theme installation allows bypass vulnerability

Mozilla Firefox is a web browser released by Mozilla. A security vulnerability exists in Mozilla Firefox that allows a man-in-the-middle attacker to spoof Moziall subdomains to bypass user consent information to install Firefox lightweight themes...

Add-on lightweight theme installation approval bypassed through MITM attack — Mozilla

Security researcher Armin Ebert discovered that a man-in-the-middle MITM attacker spoofing a Mozilla sub-domain could bypass user approval messages to install a Firefox lightweight theme. This was possible because add-on installations of the lightweight themes do not require the use of HTTP over...

All-in-One WP Migration <= 2.0.4 - Unauthenticated Database Export

Unauthenticated users can export a complete copy of the WordPress database, all plugins, themes, and uploaded files...

KLA10491 Multiple vulnerabilities in WordPress plugins

Multiple serious vulnerabilities have been found in WordPress plugins and themes. Malicious users can exploit these vulnerabilities to execute or inject arbitrary code, bypass security and read local files. Below is a complete list of vulnerabilities 1. Multiple XSS vulnerabilities were found in...

Desert Falcons: First Arabic Cyberespionage Operation Uncovered

CANCUN, Mexico — A Middle Eastern cyberespionage gang is capitalizing on subpar security practices in the region to backdoor a mix of business, political and military targets. Dubbed Desert Falcons, the gang is thought to be the first Arabic APT operation, according to researchers at Kaspersky La...

CVE-2015-1579

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734...

Directory traversal

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734...

CVE-2015-1579

A directory traversal vulnerability exists in the Elegant Themes Divi theme for WordPress. The flaw stems from a failure to adequately filter the img parameter within the revslider_show_image action in the wp-admin/admin-ajax.php script. A remote attacker can use .. (dot dot) sequences to read ar...

CVE-2015-1579

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734...

PT-2015-5366

Name of the Vulnerable Software and Affected Versions Elegant Themes Divi theme for WordPress affected versions not specified Description A directory traversal issue exists in the Elegant Themes Divi theme for WordPress, allowing remote attackers to read arbitrary files. This is achieved by...

CVE-2015-1579: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in administrator.php in Epignosis eFront Open Source Edition before 3.6.15.3 build 18022 allow remote attackers to hijack the authentication of administrators for requests that 1 delete modules via the deletemodule parameter, 2 deactivate...