WordPress MDC Private Message Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports in PHP and MySQL server set up a personal blog site . MDC Private Message is one of the plug-ins used to send private messages . A cross-site scripting vulnerability...

WordPress Plugin MDC Private Message 1.0.0 - Persistent Cross-Site Scripting

Exploit Title: WordPress MDC Private Message Persistent XSS Date: 8/20/15 Exploit Author: Chris Kellum Vendor Homepage: http://medhabi.com/ https://wordpress.org/plugins/mdc-private-message/ Version: 1.0.0 ===================== Vulnerability Details ===================== The 'message' field doesn...

CentOS 6 : augeas (CESA-2013:1537)

Updated augeas packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which...

DEBIAN-CVE-2014-3509

Race condition in the sslparseserverhellotlsext function in t1lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service memory overwrite and client application crash or possibly have...

UBUNTU-CVE-2014-3505

Double free vulnerability in d1both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service application crash via crafted DTLS packets that trigger an error condition...

UBUNTU-CVE-2014-3507

Memory leak in d1both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service memory consumption via zero-length DTLS fragments that trigger improper handling of the return value of a certain...

NewP News Publishing System 1.0 Class.Database.PHP Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20893/info NewP News Publishing system is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the applicatio...

Service d'upload 1.0.0 - Shell Upload Vulnerability

No description provided by source...

Joomla Component OrgChart com_orgchart Local File Inclusion Vulnerability

No description provided by source. ============================================================================================================== o Joomla Component OrgChart Local File Inclusion Vulnerability Software : comorgchart version 1.0.0 Vendor : http://blueflyingfish.no-ip.biz/orgchart/...

Experts (answer.php) 1.0.0 - Remote SQL Injection Vulnerability

No description provided by source. ========================================================= Experts answer.php Remote SQL Injection Vulnerability ========================================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacki...

Odysseus Blog 1.0 Blog.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/21128/info Odysseus Blog is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the...

SQL-Ledger 2.6.x/LedgerSMB 1.0 Terminal Parameter Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/19960/info SQL-Ledger and LedgerSMB are prone to a remote directory-traversal vulnerability. An attacker can exploit this issue to include arbitrary files located on the vulnerable computer in the context of the webserver...

OpenSSL <= 0.9.8k, 1.0.0-beta2 DTLS Remote Memory Exhaustion DoS

No description provided by source. / cve-2009-1378.c OpenSSL = 0.9.8k, 1.0.0-beta2 DTLS Remote Memory Exhaustion DoS Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1378 In dtls1processoutofseqmessage the check if the...

WordPress Plugin WP Rss Poster - '/wp-admin/admin.php' SQL Injection

source: https://www.securityfocus.com/bid/68557/info WP Rss Poster plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to compromise the application, access or modify data, or exploit...

Code injection

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...

augeas security, bug fix, and enhancement update

1.0.0-5 - Don't package lenses in tests/ subdirectory. related: rhbz817753 1.0.0-4 - Rebase to Augeas 1.0.0 resolves: rhbz817753 - Add dependency on libxml2-devel. - Remove all patches all upstream and included in 1.0.0. - Print tests/test-suite.log when the tests fail. - Add fix for regression...

iVote - details.php SQL Injection

iVote - details.php SQL Injection source: https://www.securityfocus.com/bid/61086/info iVote is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

RiteCMS - CSRF/XSS Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

WordPress Plugin Content Flow 3D 1.0.0 - Arbitrary File Upload

WordPress Plugin Content Flow 3D 1.0.0 - Arbitrary File Upload Exploit Title: Wordpress content-flow3d Arbitrary File Upload Google Dork: inurl:plugins/content-flow3d/ Date: 10June2012 Exploit Author: g11tch Vendor Homepage: http://wordpress.org/extend/plugins/content-flow3d/ Software Link:...

e107 1.0 - view SQL Injection

e107 1.0 - view SQL Injection source: https://www.securityfocus.com/bid/52821/info e107 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application...