dedecms v5. 7 files contains lead to arbitrary code execution(tasteless into the background)-bug warning-the black bar safety net

Security box team www.secbox.cn today found the woven dream dedecms a code execution vulnerability, the vulnerability to execute arbitrary code caused getshell, the Affected versions:≤V5. 7SP1 official Edition2014-06-27 Overview: Security box team in the audit of the woven dream dedecms when foun...

CVE-2015-0889

KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, and consequently execute arbitrary code, via vectors involving an article...

Code injection

KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, and consequently execute arbitrary code, via vectors involving an article...

CVE-2015-0889

KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, and consequently execute arbitrary code, via vectors involving an article...

Internet Bug Bounty: Heap overflow in H. Spencer’s regex library on 32 bit systems

The IBB's programs provide a great incentive for me to find vulnerabilities in open source software. With this one I set out to find a vulnerability in PHP and discovered that the vulnerability that I found exists in a wider constellation of applications, including BSD libc's. IBB's Alex Rice's...

eduwind 1.6.3 /protected/modules/cms/controllers/ArticleController.php SQL注入漏洞

No description provided by source...

SOL16057 - GHOST: glibc gethostbyname buffer overflow vulnerability CVE-2015-0235

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not...

Mao10CMS v3.1.0存储型xss

简要描述： rt 详细说明： 在发布文章处，插入xss代码 然后查看文章，直接执行了插入的js代码 在测试demo的时候被阿里云的防护拦截了 漏洞证明：...

F5 Networks BIG-IP : Libtiff vulnerabilities (SOL15863)

CVE-2012-1173 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution SOL15863. The text description of this plugin is C F5 Networks. include"compat.inc"; if description scriptid80447; scriptversion"1.5";...

Redaxscript 2.2.0 XSS Vulnerability

Exploit for php platform in category web applications | | | || / | |/' | | || | / / | /| \ / /\ | / / \ |/ / alertString.fromCharCode48, 120, 57, 55 or "alertdocument.cookie ======== Credits: ======== Vulnerability found and advisory written by Ahmet Agar. =========== References: ===========...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in diafan.CMS before 5.1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify articles via a savepost action to admin/news/saveNEWSID/, 2 modify settings via a savepost action to admin/site/save2/...

CVE-2014-9400

Multiple cross-site request forgery CSRF vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 gtdefaultheader or 2...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 gtdefaultheader or 2...

CVE-2014-9400

CVE-2014-9400 concerns the WordPress plugin “WP Unique Article Header Image” (version 1.0 and earlier). The connected sources confirm CSRF vulnerabilities that allow an attacker to hijack an administrator’s authentication for requests leading to cross-site scripting (XSS) via the parameters gt_de...

WordPress Wp Unique Article Header Image Plugin <= 1.0 - Multiple CSRF and XSS

Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution There is no solution, because plugin is...

Free Article Submissions 1.0 - SQL Injection

Exploit Title: Free Article Submissions SQL Injection Vulnerability Google Dork: inurl:/category.php?id=22 "Affiliate Programs Portal" inurl:/category.php?id=2 "Arts & Entertainment" Date: 07/12/2014 Exploit Author: BarrabravaZ Vendor Homepage: http://www.articlesetup.com/ Software Link: download...

Updated mediawiki packages fix security vulnerabilies

In MediaWiki before 1.23.7, a missing CSRF check could allow reflected XSS on wikis that allow raw HTML CVE-2014-9276. MediaWiki's mangling, in MediaWiki before 1.23.7, could allow an article editor to inject code into API consumers that blindly unserialize PHP representations of the page from th...

XOOPS articlephp SQL Injection (CVE-2008-2094)

An SQL injection vulnerability has been reported in Xoops Article Module. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Apple Releases Security Updates for QuickTime

Apple has released QuickTime 7.7.6 for Windows 7, Vista, XP SP2 or later to address multiple vulnerabilities, some of which may allow remote attackers to execute arbitrary code or cause a denial of service. Users and administrators are encouraged to review Apple Support Article HT6493 and apply a...

Oracle Patches Bash Vulnerabilities

Oracle has released security updates to address bash vulnerabilities found across multiple products. US-CERT recommends users and administrators review the Oracle Security Article for additional details, and apply updates as necessary. This product is provided subject to this Notification and thi...