From the client game bug looking of security risks-vulnerability warning-the black bar safety net

Although the now app development a growing trend in web applications, large-scale software also makes extensive use of the existing framework with the existing frameworks and engines improve, the vast majority of security issues have been resolved. But encountered some customization needs,...

PT-2015-6372

Name of the Vulnerable Software and Affected Versions TheCartPress eCommerce Shopping Cart plugin for WordPress versions prior to 1.3.9.3 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct directory...

PT-2015-6142

Name of the Vulnerable Software and Affected Versions TheCartPress eCommerce Shopping Cart plugin for WordPress versions prior to 1.3.9.3 Description A directory traversal issue exists, allowing remote administrators to read arbitrary files. This is achieved by using a .. dot dot in the tcp box...

PDF Converter & Editor 2.1 iOS - File Include Vulnerability

Document Title: =============== PDF Converter & Editor 2.1 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1480 Release Date: ============= 2015-05-06 Vulnerability Laboratory ID VL-ID: ===================================...

WordPress Plugin Community Events 1.3.5 - SQL Injection

======================================================================= title: SQL Injection product: WordPress Community Events Plugin vulnerable version: 1.3.5 and probably below fixed version: 1.4 CVE number: CVE-2015-3313 impact: CVSS Base Score 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P homepage:...

Wecenter最新版注入之二（黑盒测试技巧）

简要描述： 无视GPC注入 详细说明： 设置useragent 注入语句为 ' andselect 1 fromselect count,concatselect concatpassword,0x23,salt,0x23 from awsusers limit 0,1,floorrand02x from informationschema.tables group by xa 然后挂着页面几分钟 再去访问任意页面就可以了 可以看到报错了 Database error ------ SQL: UPDATE awsusersonline SET uid = '2', lastactive ...

CVE-2 0 1 4-4 4 2 3 analysis process and findings-vulnerability warning-the black bar safety net

Primer Some time ago the“steamed rice”on his blog published the article“on a non-jailbroken iPhone 6 iOS 8.1.3 on phishing attacks stealing App Store passwords”, see the article later to try to reproduce the whole process. Since the“steamed rice”the entire process is described more clearly, combi...

Microsoft-Office-Word-2007-RTF

Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass Date : 28/02/2015 Author : R-73eN Software : Microsoft Office Word 2007 Tested : Windows 7 Starter import sys Windows Message Box / all versions shellcode =...

dedecms v5. 7 files contains lead to arbitrary code execution(tasteless into the background)-bug warning-the black bar safety net

Security box team www.secbox.cn today found the woven dream dedecms a code execution vulnerability, the vulnerability to execute arbitrary code caused getshell, the Affected versions:≤V5. 7SP1 official Edition2014-06-27 Overview: Security box team in the audit of the woven dream dedecms when foun...

Microsoft Word 2007 - RTF Object Confusion (ASLR + DEP Bypass)

Microsoft Word 2007 - RTF Object Confusion ASLR + DEP Bypass Title : Microsoft Office Word 2007 - RTF Object Confusion ASLR and DEP bypass Date : 28/02/2015 Author : R-73eN Software : Microsoft Office Word 2007 Tested : Windows 7 Starter import sys Windows Message Box / all versions . Thanks to...

tipask注入漏洞2

简要描述： 没有啥条件限制，如果说要gpc 、 全局变量条件限制的都不是好漏洞。 详细说明： 众测来打洞，然后白盒代码就读起来了。。。（0day http://ce.wooyun.org/content/7045 function onaddcomment if isset$this-post'content' $content = htmlspecialchars$this-post'content'; $answerid = intval$this-post'answerid'; $replyauthorid = intval$this-post'replyauthor';...

AVM FRITZ!Box protection bypass

Image integrity protection bypass...

[RT-SA-2014-010] AVM FRITZ!Box Firmware Signature Bypass

Advisory: AVM FRITZ!Box: Firmware Signature Bypass The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if t...

Mouse-Box — An Entire Computer inside a Mouse

Smartphones in our pockets are exponentially smaller and more powerful that they don't realize the need to carry laptops with us everywhere. Now imagine if a small mouse meets the need of the entire PC? Not just imagination, it has been proved and done by the engineers at a Polish startup...

AVM FRITZ!Box Firmware Signature Bypass Vulnerability

The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if the victim confirms an update on the webinterface...

AVM FRITZ!Box Firmware Signature Bypass

Advisory: AVM FRITZ!Box: Firmware Signature Bypass The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if t...

WordPress Plugin Facebook Like Box (cardoza-facebook-like-box) Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress plugin Facebook Like Box cardoza-facebook-like-box versions...

CVE-2014-9524

Multiple cross-site request forgery CSRF vulnerabilities in the Facebook Like Box cardoza-facebook-like-box plugin before 2.8.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Facebook Like Box cardoza-facebook-like-box plugin before 2.8.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct...

CVE-2014-9524

Multiple cross-site request forgery CSRF vulnerabilities in the Facebook Like Box cardoza-facebook-like-box plugin before 2.8.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct...