SDCMS某功能限制不严导致可CSRF劫持账户

简要描述： SDCMS邮件绑定csrf可劫持账户 详细说明： 1、在SDCMS的邮件绑定处，未作任何防御，导致csrf None 2、我们在本地打开poc： 3、然后看看邮箱，成功修改： 4、由于通过csrf可以绑定任意用户任意邮箱，所以可以通过找回密码，发送密码到我们绑定的邮箱中，从而劫持会员账户。 漏洞证明： 见详细说明...

openstack-keystone: Authentication bypass when using LDAP backend

OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password...

Updated java-1.6.0-openjdk packages fix security vulnerabilities

Multiple flaws were discovered in the ImagingLib and the image attribute, channel, layout and raster processing in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption CVE-2013-2470, CVE-2013-2471, CVE-2013-2472...

OpenJDK: exclusive port binding (Networking, 7170730)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Networking. NOTE: the previous...

OpenJDK: exclusive port binding (Networking, 7170730)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Networking. NOTE: the previous...

Novell iPrint Client IPP Response URI handling buffer overflow

Added: 07/05/2013 CVE: CVE-2013-1091 BID: 59612 OSVDB: 92938 Background Novell iPrint is an application which allows users to install and manage printers. Novell iPrint installs the Novell iPrint Control ActiveX control named ienipp.ocx. Problem A buffer overflow vulnerability within the handling...

openstack-keystone: Authentication bypass when using LDAP backend

OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password...

OpenJDK: exclusive port binding (Networking, 7170730)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Networking. NOTE: the previous...

Fedora Update for libxcb FEDORA-2013-9156

Check for the Version of libxcb OpenVAS Vulnerability Test Fedora Update for libxcb FEDORA-2013-9156 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

[SECURITY] Fedora 18 Update: libxcb-1.9-3.fc18

The X protocol C-language Binding XCB is a replacement for Xlib featuring a small footprint, latency hiding, direct access to the protocol, improved threading support, and extensibility...

International Airlines any user is bound to any phone,any reset a user's password-vulnerability warning-the black bar safety net

In my information point to modify the phone to send the verification code to set up burpsuite cut package Phone=1 5 0&userName=admin Modify your mobile phone number and want to reset the password of the username there is a very magical thing to modify is successful will directly jump to you to...

VMware security updates for vCenter Server

a. vCenter Server AD anonymous LDAP binding credential by-passvCenter Server when deployed in an environment that uses Active Directory AD with anonymous LDAP binding enabled doesn't properly handle login credentials. In this environment, authenticating to vCenter Server with a valid user name an...

VMSA-2013-0006:VMware security updates for vCenter Server

VMSA-2013-0006.1 VMware security updates for vCenter Server VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2013-0006.1 VMware Security Advisory Synopsis: VMware security updates for vCenter Server VMware Security Advisory Issue date: 2013-04-25 VMware Security Advisory Update...

Type confusion

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-1488 a...

CVE-2013-2436

Technical details for CVE-2013-2436 are not publicly provided in the connected documents. The initial entry contains general vulnerability information but no affected product/version specifics or root-cause. Monitor for updates from authoritative sources for any concrete details.

Google Chrome Multiple Vulnerabilities-02 March 2013 (Windows)

This host is installed with Google Chrome and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbgooglechromemultvuln02mar13win.nasl 6074 2017-05-05 09:03:14Z teissa $ Google Chrome Multiple Vulnerabilities-02 March 2013 Windows Authors: Thanga Prakash S Copyright: Copyright ...

CVE-2013-0908

Google Chrome before 25.0.1364.152 does not properly manage bindings of extension processes, which has unspecified impact and attack vectors...

CVE-2013-0908

Google Chrome before 25.0.1364.152 does not properly manage bindings of extension processes, which has unspecified impact and attack vectors...

Mozilla: Address space layout leaked in XBL objects (MFSA 2013-11)

The XBL.proto.toString implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 makes it easier for remote attackers to bypass the ASLR...

CVE-2011-5245

CVE-2011-5245 affects RESTEasy (JBoss REST framework). The vulnerability arises in the readFrom function of providers.jaxb.JAXBXmlTypeProvider, allowing an XML External Entity (XXE) injection that lets an attacker read arbitrary files via an external entity reference in JAXB input. Affected versi...