Jouko Pynnönen

The issue is related to reflected XSS, which occurs via the `skin` parameter. This allows for potential malicious script injection and execution.

The issue concerns a CSRF vulnerability that leads to stored XSS. This occurs in the `frs save` function, allowing for malicious input to be stored and executed.

The issue concerns a CSRF vulnerability in the PageLines theme for WordPress. It affects the "wp-admin/admin-post.php?page=pagelines" endpoint.

A cross-site scripting (XSS) issue exists due to insufficient input validation in the `column title` function. This allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name.

The issue allows remote attackers to bypass intended redirection restrictions.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is due to a vulnerability in the `wp get attachment link` function. The estimated number of potentially affected devices worldwide is not specified.

The issue allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to `wp-admin/includes/ajax-actions.php` and `wp-admin/revision.php`.

The issue allows remote attackers to bypass intended access restrictions and remove a category attribute from a post.

The issue allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.

A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

The issue allows remote attackers to bypass nonce checks and perform arbitrary actions. This is achieved by sending a request that contains an action POST parameter, an action GET parameter, and a valid nonce for the action GET parameter.

The issue allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file to notes.exe. This is related to an argument injection vulnerability.

Name of the Vulnerable Software and Affected Versions: Solaris versions 2.6 through 9 Description: A stack-based buffer overflow issue exists in the runtime linker, ld.so.1, which allows local users to gain root privileges by setting a long `LD PRELOAD` environment variable. Recommendations: For Solaris versions 2.6 through 9, as a temporary workaround, consider restricting the use of the `LD PRELOAD` environment variable to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

The issue allows remote attackers to list directories even when an index.html or other file is present, or obtain unprocessed source code for a JSP file. This can be achieved via a URL containing a null character. URLs with null characters could result in file contents being returned or a directory listing being returned even when a welcome file was defined.

The issue allows remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions, such as the `check prefs()` function in db.pgsql, as demonstrated using the "mailbox.php3" endpoint.