MCMS 3.1.3 最新版sql注入与任意文件读取

简要描述： rt 详细说明： 先看看任意文件读取。 上次提交的这个 WooYun: mcms v3.1.0 sql注入+任意文件读取。 厂商的做法是 $wx=new weixin; $GET = H::sqlxss$GET; $POST = H::sqlxss$POST; ........... function responsemsg global $dbm,$C; $postStr = $GLOBALS"HTTPRAWPOSTDATA"; if!empty$postStr $postObj = simplexmlloadstring$postStr,...

Apache Camel XPath Arbitrary File Read Vulnerability

Apache Camel is an open source project under the Apache Foundation , it is a rule-based routing and mediation engine that provides an enterprise integration model of the implementation of the Java object , through the application program interface or known as declarative Java domain-specific...

Red Hat redhat-access-plugin for OpenStack Dashboard Arbitrary File Read Vulnerability

Red Hat redhat-access-plugin for OpenStack Dashboard horizon is a technology preview plugin from Red Hat, Inc. that provides seamless, integrated access to Red Hat's subscription services from the Red Hat OpenStack Management Portal. A security vulnerability exists in the 'log-viewing' function i...

PT-2015-4555 · Red Hat · Redhat-Access-Plugin

Name of the Vulnerable Software and Affected Versions: Red Hat redhat-access-plugin versions prior to 6.0.3 for OpenStack Dashboard horizon Description: The issue allows remote attackers to read arbitrary files via a crafted path in the log-viewing function. Recommendations: For versions prior to...

ETouch Systems SamePage Enterprise Edition Directory Traversal Vulnerability

ETouch Systems SamePage Enterprise Edition is an enterprise version of the Wiki WiKi solution for wikis and blogs from ETouch Systems, USA. The solution supports team collaboration, role management and document management. A directory traversal vulnerability exists in the cm/newui/blog/export.jsp...

dashboard: log file arbitrary file retrieval

It was found that the local log-viewing function of the redhat-access-plugin for OpenStack Dashboard horizon did not sanitize user input. An authenticated user could use this flaw to read an arbitrary file with the permissions of the web server...

JBPM jbpm-designer XML External Entity Vulnerability

JBPM full name Java Business Process Management, Business Process Management is a set of open source executable process language framework. jbpm-designer is one of the Web-based jBPM process design tool . JBPM jbpm-designer version 6.0.x and 6.2.x version of the...

Magento Server MAGMI plugin directory traversal vulnerability

Magento is the United States Magento company's set of professional open source PHP e-commerce system , it provides rights management , search engine and payment gateway features such as Magento Server is the Magento server . MAGMI aka Magento Mass Importer is one of the product catalogs used to...

Multiple Vulnerabilities in UberFire Framework

UberFire Framework is a rich client platform architecture software. The software supports high-availability deployments. An arbitrary code execution and file read vulnerability exists in UberFire Framework version 0.3.x, which stems from the program failing to properly restrict paths. A remote...

Mozilla Firefox/Thunderbird Arbitrary File Read Vulnerability

Mozilla Firefox/Thunderbird is a web browser/email client released by Mozilla. An arbitrary file read vulnerability exists in Mozilla Firefox/Thunderbird, which can be exploited by an attacker to read arbitrary files in the user context of a running application...

WordPress Elegant Themes Divi Theme Directory Traversal Vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.Elegant Themes Divi is one of the Elegant Themes. A directory traversal vulnerability exists in the WordPress Elegant...

eTouch SamePage 4.4.0.0.239 - Multiple Vulnerabilities

eTouch SamePage 4.4.0.0.239 - Multiple Vulnerabilities eTouch SamePage v4.4.0.0.239 multiple vulnerabilities http://www.etouch.net/products/samepage/index.html Enterprise trial was installed in an Ubuntu virtual machine with MySQL. By default, the listening port is 18080. Required on the Ubuntu...

eTouch SamePage 4.4.0.0.239 - Multiple Vulnerabilities

eTouch SamePage v4.4.0.0.239 multiple vulnerabilities http://www.etouch.net/products/samepage/index.html Enterprise trial was installed in an Ubuntu virtual machine with MySQL. By default, the listening port is 18080. Required on the Ubuntu machine to install the SamePage binary successfully: sud...

Ektron CMS 'ServerControlWS.asmx' XML External Entity Injection Vulnerability

Ektron CMS is a content management system. An external entity injection vulnerability exists in the Ektron CMS 'ServerControlWS.asmx' XML due to the application failing to properly filter user-supplied input before dynamically generating content. An attacker could use this vulnerability to read t...

CVE-2015-1306

The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors...

OpenStack Image Registry Delivery Service Arbitrary File Manipulation Vulnerability

The OpenStack Image Registry Delivery Service is an OpenStack project that stores, queries, and retrieves virtual machine images. An arbitrary file manipulation vulnerability exists in OpenStack Image Registry Delivery Service versions prior to 2014.1.4, and 2014.2.x versions prior to 2014.2.2,...

EMC M&R/ViPR SRM Directory Traversal Vulnerability

EMC M&R Watch4Net is an IT performance management application.EMC ViPR SRM is a storage resource management application. A directory traversal vulnerability exists in EMC M&R versions prior to 6.5u1 and ViPR SRM versions prior to 3.6.1, which allows remote authenticated users to read arbitrary...

UBUNTU-CVE-2013-6892

WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit...

CVE-2014-8790

GetSimple CMS 3.1.1–3.3.x (before 3.3.5 Beta 1) is affected by an XML External Entity (XXE) vulnerability in admin/api.php. The issue arises from passing unsanitized POST data to simplexml_load_string(), enabling an attacker to disclose arbitrary files via the data parameter. Impact is consistent...

N-Central Remote Support Manager 14.2.7.171 Code Execution Exploit

N-Central Remote Support Manager version 14.2.7.171 suffers from code execution via file upload and arbitrary file read vulnerabilities. Proof of concepts included. N-central Remote Support Manager Multiple Vulnerabilities Affected Versions: Verified in Version 14.2.7.171 PDF:...