CVE-2015-1110

The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data...

Design/Logic Flaw

The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data...

CVE-2015-1110

The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data...

Verizon Allows Opt Out of UIDH Mobile Supercookie

Verizon Wireless has made a change that now allows customers to opt out of the ad-targeting program that relies on the so-called supercookie identifier that was inserted into Web requests users send. The use of the identifier, known as a UIDH, drew the ire of privacy advocates and users when it w...

About.com Cross Site Scripting

About Group about.com All Topics At least 99.88% links Vulnerable to XSS & Iframe Injection Security Attacks, About.com Open Redirect Security Vulnerabilities Vulnerability Description: About.com all "topic sites" are vulnerable to XSS Cross-Site Scripting and Iframe Injection Cross Frame Scripti...

CVE-2014-9400

Multiple cross-site request forgery CSRF vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 gtdefaultheader or 2...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 gtdefaultheader or 2...

CVE-2014-9400

CVE-2014-9400 concerns the WordPress plugin “WP Unique Article Header Image” (version 1.0 and earlier). The connected sources confirm CSRF vulnerabilities that allow an attacker to hijack an administrator’s authentication for requests leading to cross-site scripting (XSS) via the parameters gt_de...

CVE-2014-9400: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 gtdefaultheader or 2...

PT-2014-8991

Name of the Vulnerable Software and Affected Versions Wp Unique Article Header Image plugin version 1.0 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the gt...

WordPress Wp Unique Article Header Image Plugin <= 1.0 - Multiple CSRF and XSS

Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution There is no solution, because plugin is...

WordPress wpCommentTwit 0.5 CSRF / XSS

Title: CSRF/XSS Vulnerability in wpCommentTwit WP Plugin Author: Manideep K CVE-ID: CVE-2014-9340 Plugin Homepage: https://wordpress.org/plugins/wpcommenttwit/ Version Affected: 0.5 probably lower versions Severity: High About Plugin: wpCommentTwit is a plugin that will notify you of a new commen...

WordPress yURL ReTwitt WP 1.4 CSRF / XSS

Title: CSRF/XSS Vulnerability in yURL ReTwitt WP Plugin Author: Manideep K CVE-ID: CVE-2014-9341 Plugin Homepage: https://wordpress.org/plugins/yurl-retwitt/ Version Affected: 1.4 probably lower versions Severity: High About Plugin: This plugin will allow your readers to publish a RT Re-Twitt on...

CouchDB: Denial of service

Background Apache CouchDB is a distributed, fault-tolerant and schema-free document-oriented database. Description CouchDB does not properly sanitize the count parameter for Universally Unique Identifiers UUID requests. Impact A remote attacker could send a specially crafted request to CouchDB,...

Google Releases Open Source XSS Web App Scanner

UPDATE: A previous version of this story incorrectly reported that Firing Range is a scanner when in reality Firing Range is a tool that tests Web application security scanners. Google today released to open source tool called Firing Range, which is designed as a test bed for Web application...

X (Formerly Twitter): getting emails of users/removing them from victims account [using typical attack]

Hey Hi, I would like to explain a typical type of attack combined with a brute force attack leading to email disclosure. conditions : should be having email notifications ON . Every time someone follows me , favs my tweet i get a notification on my email, and the footer of the email . click here ...

Verizon Wireless Injects Identifiers to Track Mobile Customers’ Online Activities

The Nation's largest telecom operator 'Verizon Wireless' is tracking its customers' mobile internet traffic by adding a token to Web requests traveling over its network, in order to facilitate targeted advertising even if a user has opted out of their Customer Proprietary Network Information CPNI...

zeromq: Man-in-the-middle downgrade and replay attack

CVE-2014-7202 downgrade attack A bug in streamengine.cpp allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request. - CVE-2014-7203 replay attack libzmq did not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks...

CVE-2014-4114

creationtimestamp| type| source ---|---|--- 2014-10-14 10:29:22+00:00| seen| MISP/543cfad1-5780-4e69-b6de-474f950d210b 2014-10-14 11:40:40+00:00| seen| MISP/543d042c-3504-42d2-b2ef-44c6950d210b 2014-10-14 14:18:05+00:00| seen| MISP/543d0bd9-02d8-43b1-9feb-4286950d2109 2014-10-20 00:00:00+00:00|...

Assessing Risk for the October 2014 Security Updates

Today we released eight security bulletins addressing 24 unique CVE’s. Three bulletins have a maximum severity rating of Critical, and five have a maximum severity rating of Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment...