MGASA-2015-0460 Updated python-cryptography packages fix security vulnerability

The OpenSSL backend prior to 1.0.2 made extensive use of assertions to check response codes where our tests could not trigger a failure. However, when Python is run with -O these asserts are optimized away. If a user ran Python with this flag and got an invalid response code this could result in...

用友项目管理系统设计不当可以登入获取大量敏感信息

简要描述： 用友项目管理系统设计不当可以登入获取大量敏感信息 详细说明： 用友产品缺陷管理系统使用了JIRA，对外网开放了后台访问和注册权限，导致可以任意注册用进行登录查看相关项目信息 泄露后台：http://123.103.9.112/login.jsp 注册地址：http://123.103.9.112/secure/Signup!default.jspa 漏洞证明：...

ecshop某处通杀存储型xss直达后台漏洞

简要描述： 测试了2.7.3-2.7.4 都存在这个漏洞 应该是通杀吧：） 详细说明： 随便找一个商品购买 数量填999999999999 然后会让你填写缺货登记 数据随便填 然后利用burp抓包 修改掉email中的数据提交 然后坐等管理员审核缺货登记。。。 漏洞证明： 过滤...

glibc: data corruption while reading the NSS files database

It was discovered that the nssfiles backend for the Name Service Switch in glibc would return incorrect data to applications or corrupt the heap depending on adjacent heap contents. A local attacker could potentially use this flaw to execute arbitrary code on the system...

CVE-2006-0553

PostgreSQL 8.1.0 through 8.1.2 allows authenticated database users to gain additional privileges via "knowledge of the backend protocol" using a crafted SET ROLE to other database users, a different vulnerability than CVE-2006-0678...

CVE-2004-1880

Memory leak in the back-bdb backend for OpenLDAP 2.1.12 and earlier allows remote attackers to cause a denial of service memory consumption...

Web Hosting Service 000webhost Hacked, Information of 13 Million Leaked

Information on nearly 14 million users of 000webhost, a Lithuanian web hosting service, was spilled earlier this year when a hacker exploited an old version of the company’s website and gained access to the backend. 13.5 million customer usernames, plaintext passwords, email addresses, IP...

用友某系统直接登录Getshell(修复不当哦)

简要描述： ... 详细说明： 用友某系统Websphere https://211.144.131.98:9043/ibm/console/ 输入admin进入后台 http://211.144.131.98:9080/safetest/index.jsp 马 然后就是： WooYun: 用友某系统Websphere直接登录Getshell 内网什么的. 运维不够负责啊 漏洞证明： ···...

Joomla Content History SQLi Remote Code Execution

This module exploits a SQL injection vulnerability found in Joomla versions 3.2 up to 3.4.4. The vulnerability exists in the Content History administrator component in the core of Joomla. Triggering the SQL injection makes it possible to retrieve active Super User sessions. The cookie can be used...

iGENUS 邮件系统 V5.0 任意文件读取漏洞

login.php 文件中，选择语言环境后会读取语言文件，并加载到页面，后台接到请求后，没有对 Lang 参数过滤，就直接读取文件，从而造成任意文件读取漏洞。 http://221.130.182.230/igenus/login.php?Lang=../../../../../../../../../../etc/passwd%00.jpg...

Debian DSA-3369-1 : zendframework - security update

Multiple vulnerabilities were discovered in Zend Framework, a PHP framework : - CVE-2015-5723 It was discovered that due to incorrect permissions masks when creating directories, local attackers could potentially execute arbitrary code or escalate privileges. - ZF2015-08 no CVE assigned Chris...

Liferay Portal 6.2 EE SP13 Cross Site Scripting

Hey guys, during a penatrationtest I have found an unknown persistent xss in liferay portal backend. General Information Manufacture description: Liferay Portal is an enterprise-web-platform for the development of business solutions, which provides quick results and long-term values. Details ·...

Information Disclosure in extension "LDAP" (eu_ldap)

It has been discovered that the extension "LDAP" euldap is susceptible to Information Disclosure. Release Date: September 30, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 2.8.18 and below Vulnerability Type:...

DEBIAN-CVE-2015-5400

Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cachepeer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request...

openSUSE Security Update : cyrus-imapd (openSUSE-2015-606)

This update provides version 2.4.18 of cyrus-imapd - Security fix: handle urlfetch range starting outside message range - A bunch of cleanups and fixes to compiling - A bunch of sieve cleanups - Enhanced SSL/TLS configuration options - Disable use of SSLv2/SSLv3 - Allow SQL backend for mboxlist a...

DianYiPS V3.0建站系统后台sql注入漏洞

南宁典意数码科技有限公司，简称典意设计（http://www.dianyisheji.com/），注入点位于网站后台登陆用户名处，案例具体寻找办法可以通过谷歌搜索：powered by DianYiPS，找到案例后在域名后面加/dianyi/即是管理后台，可以用万能密码admin' or '1'='1登陆。...

How to Display Custom Error Pages by Using NetScaler Responder Policies

This article contains information about configuring Responder policies that redirect user requests to custom error pages during a maintenance period of a back end web server farm. Background You can create custom error page and redirect the user requests to it. For example, you might want to host...

NindonCMS /plug/comment/commentList.asp sql注入漏洞

漏洞描述：NindonCMS系统对访问者提交的数据参数过滤不严，导致攻击者可以随时提交构造好的SQL语句查询数据库获取敏感信息。同时，系统默认后台地址也相当容易暴露。漏洞详情：由于NindonCMS系统是基于开源ASPCMS开发，所以如果开发人员在开发过程中不注意，则会导致很多现在已经补上的ASPCMS漏洞在二次开发的CMS系统上重现。这个漏洞源于ASPCMS系统，但是既然是做二次开发，就应该尽力去弥补安全上的不足。其原理很明确：NindonCMS在处理浏览器提交的数据时使用filterPara函数过滤，这个函数接着调用了PreventSqlin和Checkxss两个函数进行字符过滤，P...

ManageEngine EventLog Analyzer < 10.6 build 10060 - SQL Execution

Exploit Title: ManageEngine EventLog Analyzer SQL query execution Product: ManageEngine EventLog Analyzer Vulnerable Versions: v10.6 build 10060 and previous versions Tested Version: v10.6 build 10060 Windows Advisory Publication: 14/09/2015 Vulnerability Type: authenticated SQL query execution...

Amazon Linux: Security Advisory (ALAS-2015-560)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...