CVE-2014-9398

Cross-site request forgery CSRF vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the mashtlbtwitterusername parameter in the...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the mashtlbtwitterusername parameter in the...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Post to Twitter plugin 0.7 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 idptttwitterusername or 2 idptttweetprefi...

CVE-2014-9398

Cross-site request forgery CSRF vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the mashtlbtwitterusername parameter in the...

CVE-2014-9398

The CVE-2014-9398 entry concerns the WordPress Twitter LiveBlog plugin (versions 1.1.2 and earlier). The vulnerability is a CSRF flaw that allows an attacker to hijack an administrator’s authenticated session to perform actions that may enable XSS via the mashtlb_twitter_username parameter in twi...

Lazarus Guestbook 1.22 XSS / SQL Injection

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Exploit Title: Lazarus Guestbook 1.22 Multiple Persistent Cross-Site Scripting - Sql Injection Vulnerability Date: 23/12/2014 Url Vendor:...

X (Formerly Twitter): POODLE Bug: 199.16.156.44, 199.16.156.108, mx4.twitter.com

Hi! Looks like there is SSLv3 Padding Oracle vuln on: 199.16.156.44, 199.16.156.108, mx4.twitter.com...

WordPress Twitter 0.7 CSRF / XSS

Title: CSRF / Stored XSS Vulnerability in Post to Twitter Wordpress Plugin Author: Manideep K CVE-ID: CVE-2014-9393 Plugin Homepage: https://wordpress.org/plugins/post-to-twitter/ Version Affected: 0.7 probably lower versions Severity: High Description: Vulnerable Parameter: all three fields, to...

Twitter Liveblog <= 1.1.2 - Multiple CSRF

Plugin is still affected and has been closed...

WordPress Twitter LiveBlog 1.1.2 CSRF / XSS

Title: CSRF / Stored XSS Vulnerability in Twitter LiveBlog Wordpress Plugin Author: Manideep K CVE-ID: CVE-2014-9398 Plugin Homepage: https://wordpress.org/plugins/twitter-liveblog/ Version Affected: 1.1.2 probably lower versions Severity: High Description: Vulnerable Parameter:...

X (Formerly Twitter): Open redirection in fabric.io

Hi dear, Once the person is logged into his account he can be redirected to any website . https://www.fabric.io/login?redirecturl=@ for example : https://www.fabric.io/[email protected] Tested on updated firefox and chrome...

WordPress Twitter LiveBlog Plugin <= 1.1.2 - CSRF and XSS

Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...

WordPress WP to Twitter Plugin <= 0.7 - Multiple CSRF and XSS

Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...

RSform!Pro 1.3.0 Remote Shell Upload

RSform!Pro There is a reflected XSS Vulnerability in the form .. Birthdate parameter alert1337...

WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload

WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload !/usr/bin/python Exploit Name: Wordpress WP Symposium 14.11 Shell Upload Vulnerability Vulnerability discovered by Claudio Viviani Exploit written by Claudio Viviani 2014-11-27: Discovered vulnerability 2014-12-01: Vendor Notification...

Flat Calendar 1.1 HTML Injection

!/usr/bin/perl -w Title : Flat Calendar v1.1 HTML Injection Exploit Download : http://www.circulargenius.com/flatcalendar/FlatCalendar-v1.1.zip Author : ZoRLu / [email protected] Website : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Test : Windows7 Ultima...

Microsoft Windows Kerberos - Privilege Escalation (MS14-068)

Microsoft Windows Kerberos - Privilege Escalation MS14-068 !/usr/bin/python MS14-068 Exploit Author ------ Sylvain Monne Contact : sylvain dot monne at solucom dot fr http://twitter.com/bidord import sys, os from random import getrandbits from time import time, localtime, strftime from kek.ccache...

Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution Exploit

This Metasploit module exploits Windows OLE Automation Array Vulnerability known as CVE-2014-6332. The vulnerability affects Internet Explorer 3.0 until version 11 within Windows95 up to Windows 10. Powershell is required on the target machine. On Internet Explorer versions using Protected Mode,...

Insecure management of login credentials in PicsArt Photo Studio for Android [STIC-2014-0426]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Fundacion Dr. Manuel Sadosky - Programa STIC Advisory http://www.fundacionsadosky.org.ar Insecure management of login credentials in PicsArt Photo Studio for Android 1. Advisory Information Title: Insecure management of login credentials in PicsArt...

X (Formerly Twitter): Abuse of "Remember Me" functionality.

Steps to Reproduce:- 1. Navigate to https://twitter.com/login, Fill up the required details and click on the "Log in" button. Make sure you have checked "Remember Me" check-box. 2. Login Successfully, Analyze the cookie using FireBug, specially "authtoken" and "remembercheckedon". These cookies...