Tuleap PHP Unserialize Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Tuleap PHP Unserialize Code Execution', 'Description' = %q This module exploits a PHP object injection vulnerability in Tuelap...

php云越权关注

简要描述： 版本v3.1 9.23 1.关注，可以让招聘者关注你，或者求职者关注你 2.关注问题。你发表问题可以让大家关注 其中uid是注册的时候自增的值 详细说明： 1.代码位置 upload/model/ajax.class.php function Atnaction function Atnaction $id=int$POST'id'; ifint$POST'id'0 if$this-uid0 if$POST'id'==$this-uid echo 4;die; $atninfo = $this-obj-DBselectonce"atn","uid='".$this-uid."...

Potential Security Concerns in Comcast Hotspot Class-Action

Cable and Internet service conglomerate Comcast is facing a class-action lawsuit stemming from its use of customer routers as personal home Wi-Fi networks as well as public-facing wireless hotspots available for other Comcast-Xfinity customers. Toyer Grear and Jocelyn Harris, themselves and on...

Struts2 vulnerability analysis and research S2-0 0 5 vulnerability analysis-vulnerability warning-the black bar safety net

1, Overview S2-0 0 5 is due to the official patch S2-0 0 3 not fully lead to bypass the patch caused. We all know that access Ognl context object must use thesymbol, S2-0 0 3Number for the filter, but does not take into account the unicode encoding, resulting in\u0023 or 8-ary\4 3 bypass. S2-0 0 ...

UBUNTU-CVE-2014-8959

Directory traversal vulnerability in libraries/gis/GISFactory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter...

Tuleap PHP Unserialize Code Execution

This module exploits a PHP object injection vulnerability in Tuleap use exploit/unix/webapp/tuleap/unserializeexec msf undefinedunserializeexec show actions ...actions... msf undefinedunserializeexec set ACTION msf undefinedunserializeexec show options ...show and set options... msf...

CVE-2014-9034: Undefined Security Weakness

wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service CPU consumption via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016...

OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797)

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries...

OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797)

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries...

JDK: privilege escalation via shared class cache

Unspecified vulnerability in IBM Java Runtime Environment JRE 7 R1 before SR2 7.1.2.0, 7 before SR8 7.0.8.0, 6 R1 before SR8 FP2 6.1.8.2, 6 before SR16 FP2 6.0.16.2, and before SR16 FP8 5.0.16.8 allows local users to execute arbitrary code via vectors related to the shared classes cache...

OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797)

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries...

JDK: privilege escalation via shared class cache

Unspecified vulnerability in IBM Java Runtime Environment JRE 7 R1 before SR2 7.1.2.0, 7 before SR8 7.0.8.0, 6 R1 before SR8 FP2 6.1.8.2, 6 before SR16 FP2 6.0.16.2, and before SR16 FP8 5.0.16.8 allows local users to execute arbitrary code via vectors related to the shared classes cache...

RHEL 6 : jakarta-commons-fileupload (RHSA-2013:1428)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2013:1428 advisory. The Apache Commons FileUpload component can be used to add a file upload capability to your applications. A flaw was found in the way the DiskFileIte...

ThinkSNS第二弹 － SQL注入

简要描述： ThinkSNS漏洞系列第二弹，某处处理不当导致SQL注入 详细说明： 漏洞点出现在Comment Widget里： \addons\widget\CommentWidget\CommentWidget.class.php:138 / 添加评论的操作 @return array 评论添加状态和提示信息 / public function addcomment // 返回结果集默认值 $return = array 'status' = 0, 'data' = L 'PUBLICCONCENTISERROR' ; // 获取接收数据 $data = $POST; // 安全过滤...

hdwiki sql注射漏洞

简要描述： rt 详细说明： control/doc.php：docreate方法 …… 流程条件省略 …… else//点击发布词条 if$this-setting'checkcode'!=3 && $this-setting'docverificationcreatecode' && strtolower$this-post'code'!=$ENV'user'-getcode $this-message$this-view-lang'codeError','BACK',0;...

[SECURITY] Fedora 21 Update: python-oauth2-1.5.211-8.fc21

Oauth2 was originally forked from Leah Culver and Andy Smith's oauth.py code. Some of the tests come from a fork by Vic Fryzel, while a revamped Request class and more tests were merged in from Mark Paschal's fork. A number of notable differences exist between this code and its forefathers: - 100...

CVE-2014-8082

The CVE-2014-8082 issue affects TestLink versions up to 1.9.12 (pre-1.9.13). The vulnerability is in lib/functions/database.class.php and stems from debug output (debug_print_backtrace) revealing the installation path in error messages, enabling information disclosure. Public advisories describe ...

[SECURITY] Fedora 20 Update: python-oauth2-1.5.211-8.fc20

Oauth2 was originally forked from Leah Culver and Andy Smith's oauth.py code. Some of the tests come from a fork by Vic Fryzel, while a revamped Request class and more tests were merged in from Mark Paschal's fork. A number of notable differences exist between this code and its forefathers: - 100...

[SECURITY] Fedora 19 Update: python-oauth2-1.5.211-8.fc19

Oauth2 was originally forked from Leah Culver and Andy Smith's oauth.py code. Some of the tests come from a fork by Vic Fryzel, while a revamped Request class and more tests were merged in from Mark Paschal's fork. A number of notable differences exist between this code and its forefathers: - 100...

F5 Networks BIG-IP : Linux kernel vulnerability (SOL15746)

block/scsiioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SGIO ioctl call that leverages overlapping opcodes.CVE-2012-4542 C Tenable Network...