Cross site scripting

Cross-site scripting XSS vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20, and other versions allows remote attackers to inject arbitrary web script or HTML via CSS expressions in style attributes...

CVE-2014-4958

Cross-site scripting XSS vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20, and other versions allows remote attackers to inject arbitrary web script or HTML via CSS expressions in style attributes...

CVE-2014-4958

CVE-2014-4958 is a stored XSS vulnerability in Telerik UI for ASP.NET AJAX RadEditor control. It affects versions including 2014.1.403.35 and 2009.3.1208.20, enabling an attacker to inject script via CSS expressions in style attributes. The issue is confirmed in multiple connected documents (IV: ...

ClassApps SelectSurvey.net - Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Multiple SQL Injection Vulnerabilities in SelectSurvey.net Google Dork: intitle:SelectSurvey Date: Sep 03 2014 Vendor Homepage: https://www.classapps.com/ Software Link: https://www.classapps.com/SelectSurveyNETOverview.asp...

ClassApps SelectSurvey.net - Multiple SQL Injections

ClassApps SelectSurvey.net - Multiple SQL Injections Exploit Title: Multiple SQL Injection Vulnerabilities in SelectSurvey.net Google Dork: intitle:SelectSurvey Date: Sep 03 2014 Vendor Homepage: https://www.classapps.com/ Software Link: https://www.classapps.com/SelectSurveyNETOverview.asp...

ClassApps SelectSurvey.net - Multiple SQL Injections

Exploit Title: Multiple SQL Injection Vulnerabilities in SelectSurvey.net Google Dork: intitle:SelectSurvey Date: Sep 03 2014 Vendor Homepage: https://www.classapps.com/ Software Link: https://www.classapps.com/SelectSurveyNETOverview.asp Version: 4.124.004 Tested on: Windows 2008 R2/SQL Server...

ClassApps SelectSurvey.net 4.124.004 SQL Injection

Details ========== Software: ClassApps SelectSurvey.net Description: Multiple SQL Injection Vulnerabilities Version: 4.124.004 Homepage: https://www.classapps.com/SelectSurveyNETOverview.asp Vendor Fix: 4.125.002 CVE: 2014-6030 Timeline ========== Aug 28 2014 - Vendor Notified Aug 28 2014 - CVE...

shop7z投票处post 注入

简要描述： vote.asp 详细说明： vote.asp 14-22 if rad"" and request.cookies"votestat""Y" then sql="update ediaocha2 set shuliang=shuliang+1 where id="&rad 'response.write sql 'response.end conn.executesql votenews="1" response.cookies"votestat"="Y" end if % 漏洞证明： F:\sqlmappython sqlmap.py -u...

Denial of service

Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly use a hash table for request data, which allows remote attackers to cause a denial of service resource consumption and ASP.NET performance degradation via crafted requests, aka ".NET Framewo...

CVE-2014-4072

Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly use a hash table for request data, which allows remote attackers to cause a denial of service resource consumption and ASP.NET performance degradation via crafted requests, aka ".NET Framewo...

MS14-053: Vulnerability in .NET Framework Could Allow Denial of Service (2990931)

The remote Windows host has a version of the Microsoft .NET Framework that is affected by a vulnerability that allows a remote attacker to cause a denial of service by sending specially crafted requests to an ASP.NET web application running on the affected system. Note that ASP.NET is not install...

September 2014 Microsoft Patch Tuesday security bulletins

The Operation SnowMan espionage campaign, which targeted military intelligence earlier this year via an Internet Explorer zero day, exposed a weak spot in Microsoft’s vulnerability management efforts. What was unique about the SnowMan operation is that it included a check as to whether the...

MS14-053: Vulnerability in the .NET Framework could allow denial of service: September 9, 2014

Resolves a vulnerability in the .NET Framework that could allow denial of service if an attacker sends a few specially crafted requests to an affected .NET-enabled website.View products that this article applies to.IntroductionThis update resolves a vulnerability in the Microsoft .NET Framework...

Kesion网校培训系统注入漏洞

简要描述： rt。 详细说明： kesion网校平台，商业收费版，不提供下载。 demo站点：http://e.kesion.com 注册登陆，http://e.kesion.com/user/course/MyCourseOrder.aspx，我的订单，3个框框都无过滤，可注入： 课程名称处search型注入：test%' and @@version0 and '%'=' SQL server 2000 起止时间也可以注入。 最新版应该是2.6，老版本的还有一处注入： 官网的一个案例：http://www.weekedu.com/...

Crescendo - Sales CRM Authentication Bypass Vulnerability

Exploit for asp platform in category web applications Crescendo - Sales CRM Authentication Bypass Vulnerability Exploit Title: Crescendo - Sales CRM Authentication Bypass Vulnerability Sql Injection Google Dork: N/A Date: July 15 , 2014 Exploit Author: Monendra Sahu email protected Vendor Homepag...

Crescendo - Sales CRM SQL Injection

Crescendo - Sales CRM Authentication Bypass Vulnerability Exploit Title: Crescendo - Sales CRM Authentication Bypass Vulnerability Sql Injection Google Dork: N/A Date: July 15 , 2014 Exploit Author: Monendra Sahu [email protected] Vendor Homepage: http://dejavuprotech.com/crecendo.php Test...

Shop7z sql注入1

简要描述： 详细说明： http://www.shop7z.com/Demo/orderprint.asp?id=1 17:09:55 INFO the back-end DBMS is Microsoft Access web server operating system: Windows 2003 or XP web application technology: ASP.NET, Microsoft IIS 6.0 back-end DBMS: Microsoft Access 17:09:55 INFO fetching tables for database:...

BPRealestate Real Estate Authentication Bypass Vulnerability

No description provided by source. / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...

GotoCode Online Bookstore Multiple Vulnerabilities

No description provided by source. Exploit Title : GotoCode Online Bookstore Multiple Vulnerabilities Vulnerability : Privilege Escalation / Remote Database Download Date : 03/10/2011 Author : Nathaniel Carew Email : [email protected] Impact : High Software Link :...

Ferdows CMS Pro <= 1.1.0 - Multiple Vulnerabilities

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: Ferdows CMS Pro =1.1.0 Multiple Vulnerabilities Vendor: www.fcms.ir Exploit: Available Vulnerable Version: 1.1.0 Pro Impact: Medium Original Advisory: http://www.bugreport.ir/index77.htm Fix: N/A 1...