Posted by Markus Wulftange on Aug 03
Hi Brandon,
we found two injection points. One in the BinaryFileHandler class:
POST /servlet/ConsoleServlet HTTP/1.1
Host: 192.168.40.133:8443
Content-Type: application/x-www-form-urlencoded
Content-Length: 51
Cookie: JSESSIONID=D739FA0884EB78B31B1D23AEA899C175
ActionType=BinaryFile&Action=EXISTS&GUID=0’or’1’=’1
And one in the ExpRecordHandler class:
POST /servlet/ConsoleServlet…
[SECURITY] [DSA 3323-1] icu security update
[SECURITY] [DSA 3324-1] icedove security update
[SECURITY] [DSA 3325-1] apache2 security update
[SECURITY] [DSA 3326-1] ghostscript security update
After years of discussions, disagreements, and digressions, the Do Not Track header is supported by all of the major browsers. But because there’s no real requirement for sites or advertisers to respect it, DNT is not as effective as it could be. Now, the EFF, Disconnect, and several other organizations are publishing a new DNT standard […]
Besides Apple Music, iOS 9, and watchOS 2, this June was an exciting month for Mac developers with Apple’s presentation of OS X El Capitan at its Worldwide Developers Conference.
The post Mac AV ready for OS X 10.11 alias El Capitan appeared first on Avira Blog.
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.
Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.
WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.