WordPress Organizer 1.2.1 Cross Site Scripting / Directory Traversal

Hello list! After previous vulnerabilities in plugin Organizer, I'll present five more security vulnerabilities in plugin Organizer for WordPress. This is the fourth in series of advisories concerning vulnerabilities in this plugin. These are Directory Traversal, Cross-Site Scripting and Full pat...

IAA, Redirector and XSS vulnerabilities in WordPress

Hello 3APA3A! I want to warn you about security vulnerabilities in WordPress. These are Insufficient Anti-automation, Redirector and Cross-Site Scripting vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are WordPress 2.0 - 3.3.1. ---------- Detail...

DoS vulnerabilities in Firefox, Internet Explorer and Opera

Hello 3APA3A! I want to warn you about Denial of Service vulnerability in Mozilla Firefox, Internet Explorer and Opera. Earlier there was published DoS vulnerability in browser Opera 10.10 found by Inj3ct0r http://securityvulns.com/news/Opera/1002.html. And some time ago I've checked this exploit...

XSS, CSRF and AFU vulnerabilities in Organizer for WordPress

Hello 3APA3A! I want to warn you about multiple security vulnerabilities in plugin Organizer for WordPress. This is the second in series of advisories concerning vulnerabilities in this plugin. These are Cross-Site Scripting reflected and persistent, Cross-Site Request Forgery and Arbitrary File...

WordPress Organizer 1.2.1 XSS / CSRF / Shell Upload

Exploit for php platform in category web applications I want to warn you about multiple security vulnerabilities in plugin Organizer for WordPress. This is the second in series of advisories concerning vulnerabilities in this plugin. These are Cross-Site Scripting reflected and persistent,...

WordPress Organizer 1.2.1 XSS / CSRF / Shell Upload

Hello list! I want to warn you about multiple security vulnerabilities in plugin Organizer for WordPress. This is the second in series of advisories concerning vulnerabilities in this plugin. These are Cross-Site Scripting reflected and persistent, Cross-Site Request Forgery and Arbitrary File...

WordPress Organizer 1.2.1 Cross Site Scripting / Path Disclosure

Hello list! I want to warn you about multiple security vulnerabilities in plugin Organizer for WordPress. This is the first in series of advisories concerning vulnerabilities in this plugin. These are Cross-Site Scripting reflected and persistent and Full path disclosure vulnerabilities...

New XSS vulnerabilities in Register Plus Redux for WordPress

Hello 3APA3A! I want to warn you new about security vulnerabilities in Register Plus Redux for WordPress. These are Cross-Site Scripting vulnerabilities. After finding and fixing of 36 vulnerabilities in plugin Register Plus Redux in the end of previous year, I've released my version of the plugi...

Многочисленные уязвимости в EJBCA

Здравствуйте 3APA3A! Сообщаю вам о найденных мною 17.01.2012 многочисленных уязвимостях в Enterprise Java Beans Certificate Authority EJBCA. Это Cross-Site Scripting, Brute Force и Abuse of Functionality уязвимости. EJBCA - это PKI сервер. По информации из официального сайта: A Certification...

Multiple CSRF, DoS and XSS vulnerabilities in D-Link DAP 1150

Hello 3APA3A! I want to warn you about new security vulnerabilities in D-Link DAP 1150 Wi-Fi Access Point and Router. These are Cross-Site Request Forgery, Denial of Service and Cross-Site Scripting vulnerabilities. This is my fourth advisory from series of advisories about vulnerabilities in...

D-Link DAP 1150 CSRF / XSS / Denial Of Service

Hello list! I want to warn you about new security vulnerabilities in D-Link DAP 1150 Wi-Fi Access Point and Router. These are Cross-Site Request Forgery, Denial of Service and Cross-Site Scripting vulnerabilities. This is my fourth advisory from series of advisories about vulnerabilities in D-Lin...

Register Plus 3.5.1 Cross Site Scripting / Code Execution

Hello list! I want to warn you about multiple new vulnerabilities in plugin Register Plus for WordPress. These are Cross-Site Scripting, Code Execution and Full path disclosure vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are Register Plus 3.5...

CSRF, DT and AB vulnerabilities in D-Link DSL-500T ADSL Router

Hello 3APA3A! I want to warn you about new security vulnerabilities in D-Link DSL-500T ADSL Router. Which I've found and disclosed last week. These are Cross-Site Request Forgery, Directory Traversal and Authentication Bypass vulnerabilities. This is my fifth advisory 3 and 4 were announced and...

Vulnerabilities in D-Link DAP 1150

Hello 3APA3A! I want to warn you about security vulnerabilities in D-Link DAP 1150 WiFi Access Point and Router. These are Predictable Resource Location, Brute Force and Cross-Site Request Forgery vulnerabilities. This is my second advisory from series of advisories about vulnerabilities in D-Lin...

Vulnerabilities in D-Link DSL-500T ADSL Router

Hello 3APA3A! I want to warn you about security vulnerabilities in D-Link DSL-500T ADSL Router. These are Predictable Resource Location, Brute Force and Cross-Site Request Forgery vulnerabilities. This is my first advisory from series of advisories about vulnerabilities in D-Link products...

Zeema CMS Cross Site Scripting / SQL Injection

Hello list! I want to warn you about Cross-Site Scripting, SQL Injection and Information Leakage vulnerabilities in Zeema CMS. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are all versions of Zeema CMS. ---------- Details:...

Zeema CMS Cross Site Scripting / Path Disclosure

Hello list! I want to warn you about Brute Force, Cross-Site Scripting and Full path disclosure vulnerabilities in Zeema CMS. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are all versions of Zeema CMS. ---------- Details:...

Новые уязвимости в poMMo

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Information Leakage, Insufficient Anti-automation и Abuse of Functionality уязвимостях в poMMo. Information Leakage WASC-13: После введения емайла на subscribe.php, на странице http://site/pommo/user/process.php выводится pendingcode в качестве...

Strictly social XSS уязвимость в WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в WordPress. Которую я нашёл ещё 15.10.2008 и к которой уязвимы все версии WordPress. В WordPress имеет место Cross-Site Scripting уязвимость, в данном случае Strictly social XSS http://websecurity.com.ua/5469/, на...

poMMo Aardvark PR16.1 Cross Site Scripting

Hello list! I want to warn you about multiple security vulnerabilities in poMMo. These are Cross-Site Scripting, Brute Force and Insufficient Anti-automation vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are all versions of poMMo poMMo Aardvark...