WordPress Update Fixes XSS, SQL Injection Vulnerabilities

Developers with WordPress fixed three security issues this week, including a cross-site scripting and a SQL injection vulnerability, with the latest version of the CMS. The update, 4.7.2, was pushed Thursday, only two weeks after developers released the previous version. Aaron Campbell, a WordPre...

WordPress 4.2.0-4.7.1 - Press This UI Available to Unauthorised Users

...

WordPress: Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-auth

Description This report is a variant on report 110801 but with broader vector. 110801 was a XSRF SSRF that allowd unintended GET requests to 0.0.0.0 on port 80, 443 and 8080. This vulnerability uses same entry vector of the press this scrape function but entirely bypasses the ip and port filter...

New Relic: Cookie Misconfiguration

1 install add ons "Edit this Cookie" in google chrome" 2 login your account/create an account 3 get the cookie using "edit this cookie" 4 logout the account 5 delete the current cookie using edit this cookie and put the cookie what you copy and refresh the tab Video...

DEBIAN-CVE-2016-2222

The wphttpvalidateurl function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery SSRF attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php...

hull.thisisads.co.uk XSS vulnerability

Vulnerable URL: https://hull.thisisads.co.uk/index.php?popup=alert"OPENBUGBOUNTY"...

Linux ASLR vulnerabilities: an attacker with unlimited disable ASLR（CVE-2 0 1 6-3 6 7 2-the vulnerability warning-the black bar safety net

! Recently, security personnel repair a Linux ASLR in a relatively old vulnerability, with x86 devices on the 3 2-bit application usage rights of any user, by the RLIMITSTACK resource is set to“unlimited”you can disable ASLR. The vulnerability CVE number CVE-2 0 1 6-3 6 7 2, The CNNVD number of...

Design This Home - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Design This Home published at the 'play' market has multiple vulnerabilities...

Chess - Analyze This (Free) - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Chess - Analyze This Free published at the 'play' market has multiple vulnerabilities...

Automattic: Internal GET SSRF via CSRF with Press This scan feature

Description ----------------------------------- The url http://xxx.xxx.xxx.xxx/wp-admin/press-this.php?u=URLTOSCRAPE&url-scan-submit=Scan does not validate that user intends to send a scrape request. The filter does not validate for 0.0.0.0:PORT and allows the attacker to make the victim send GET...

openSUSE Security Update : Linux Kernel (openSUSE-2015-302)

The Linux kernel was updated to fix bugs and security issues : Following security issues were fixed: CVE-2015-2830: A flaw was found in the way the Linux kernels 32-bit emulation implementation handled forking or closing of a task with an int80 entry. A local user could have potentially used this...

FreeBSD : wordpress -- multiple vulnerabilities (5e135178-8aeb-11e4-801f-0022156e8794)

MITRE reports : wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message. wp-includes/http.php in WordPress before 3.7.5,...

DSA-3085-1 wordpress - security update

Bulletin has no description...

CVE-2014-9035

Cross-site scripting XSS vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

DEBIAN-CVE-2014-9035

Cross-site scripting XSS vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-9035

Cross-site scripting XSS vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-9035

CVE-2014-9035 is an XSS in WordPress “Press This” exposed before WordPress 4.0.1 (affecting 3.7.x–3.9.x and 4.x prior to 4.0.1). Exploitation could allow remote attackers to inject arbitrary scripts via unspecified vectors. Public references in Debian/ Mageia/ Fedora advisories and OpenVAS/Nessus...

WordPress <= 4.0.0 - XSS #2

Because of this vulnerability in the "Press This" function, the attackers can inject arbitrary web script or HTML via unspecified vectors. Related records: http://db.threatpress.com/vulnerability/wordpress/wordpress-4-0-0-xss http://db.threatpress.com/vulnerability/wordpress/wordpress-4-0-0-xss-3...

OpenJDK: Bytecode verification does not prevent ctor calls to this() and super() (Hotspot, 8035119)

Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot...