HTTP Commander AJS v3.1.9 - Client Side Exception Vulnerability

Document Title: =============== HTTP Commander AJS v3.1.9 - Client Side Exception Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1329 Release Date: ============= 2014-10-02 Vulnerability Laboratory ID VL-ID:...

F5 Networks BIG-IP : Client-side component flaw (SOL14468)

A flaw in a BIG-IP APM or FirePass client-side F5-signed component may allow a third-party to install files on the client machine. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution SOL14468. The text description...

F5 Networks BIG-IP : OpenSSL vulnerability (K15325)

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessio...

F5 Networks BIG-IP : OpenSSL vulnerability (K15356)

The dtls1reassemblefragment function in d1both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow a...

HTTP Commander AJS 3.1.9 Exception Cross Site Scripting

Document Title: =============== HTTP Commander AJS v3.1.9 - Client Side Exception Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1329 Release Date: ============= 2014-10-02 Vulnerability Laboratory ID VL-ID:...

HTTP Commander v3.1.9 - CS Exception Vulnerability

Document Title: =============== HTTP Commander v3.1.9 - CS Exception Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1329 Release Date: ============= 2014-10-01 Vulnerability Laboratory ID VL-ID: ==================================== 1329...

live800在线沟通平台客户端存储型XSS可攻击客服

简要描述： 帮朋友测试项目时无意间发现的。 详细说明： 我没有做过大量统计和测试，但根据我这几个月零零散散的测试我认为仍然存有大量的桌面应用，web应用和浏览器插件存有一摸一样的问题。 所以，这个XSS的输入点还是文件名。 漏洞证明： 首先我们构造这样的文件名： .jpg 随后通过http://x55.me/800.htm向客服发送文件，如下图： 现在切换到客服的应用界面，看发生了什么？...

Syslog LogAnalyzer 3.6.5 - Stored XSS Exploit

Exploit for multiple platform in category web applications Vulnerability title: Syslog LogAnalyzer 3.6.5 Stored XSS Author: Dolev Farhi Contact: dolevf at yahoo dot com @dolevff Application: LogAnalyzer 3.6.5 Date: 8.2.2014 Relevant CVEs: CVE-2014-6070 Vulnerable version: alert"xss", and sending ...

JQuery 1.4.2 Cross Site Scripting Vulnerability

JQuery version 1.4.2 suffers from a create object option in runtime client-side cross site scripting vulnerability. XSS Reflected JQuery 1.4.2 - Create object option in runtime client-side From: Mauro Risonho de Paula Assumpção Date: 02.09.2014 13:21:20 -0300 VSLA Security Advisory...

JQuery 1.4.2 Cross Site Scripting

XSS Reflected JQuery 1.4.2 - Create object option in runtime client-side From: Mauro Risonho de Paula Assumpção Date: 02.09.2014 13:21:20 -0300 VSLA Security Advisory FIRE-XSS-Reflected-Jquery 1.4.2 2014-001: XSS Reflected JQuery 1.4.2 LEVEL: MEDIUM In our tests authorized by the customer, we can...

Fedora 20 : subversion-1.8.10-1.fc20 (2014-9636)

This update includes the latest stable release of Apache Subversion, version 1.8.10. Client-side bugfixes: - guard against md5 hash collisions when finding cached credentials - raserf: properly match wildcards in SSL certs. - raserf: ignore the CommonName in SSL certs where there are Subject Alt...

Delphi and C++ Builder VCL library Buffer Overflow

1. Advisory Information Title: Delphi and C++ Builder VCL library Buffer Overflow Advisory ID: CORE-2014-0004 Advisory URL:http://www.coresecurity.com/core-labs/advisories/delphi-and-c-builder-vcl-library-buffer-overflow Date published: 2014-08-20 Date of last update: 2014-08-20 Vendors contacted...

程氏舞曲CMS最新版v3.5存储型XSS

简要描述： 绕过过滤再来一发。。 详细说明： 问题页面：发表文章 news.php : $news'cscontent'=$this-CsdjSkins-uhtml$this-input-post'cscontent'; //内容 过滤代码： function uhtml$str $farr = array "/\s+/", //过滤多余的空白 "/?/isU", //过滤 ona-zA-Z+\s=^/isU", //过滤javascrīpt的on事件 ; $tarr = array " ", " ", "\1\2", ; $str = pregreplace...

用友人力资源管理软件SQL注入漏洞（无需登录，影响所有版本）

简要描述： 详细说明： 用友软件： 涉及客户非常多。都是大型国企、银行、能源、金融重要单位。 举例如下： 大连银行 http://zpyc.bankofdl.com 顺德农商行 http://career.sdebank.com 中国海洋石油总公司 http://zhaopin.cnooc.com.cn 北京市建筑设计研究院 www.biad.com.cn:88/ 民生银行 http://ehr.creditcard.cmbc.com.cn 中国中铁 http://61.232.6.108/ ....等等单位 直接谷歌搜 inurl:hrss/login.jsp inurl:hrss/r...

Barracuda Networks Spam&Virus Firewall v6.0.2 (600 & Vx) - Client Side Cross Site Vulnerability

Document Title: =============== Barracuda Networks Spam&Virus Firewall v6.0.2 600 & Vx - Client Side Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=890 Barracuda Networks Security ID BNSEC: BNSEC-1176...

Zenoss Monitoring System 4.2.5-2108 64bit - Stored XSS

No description provided by source. Exploit Title: Stored XSS vulnerability in Zenoss core open source monitoring system Date: 12/05/2014 Exploit author: Dolev Farhi dolevatopenflare.org Vendor homepage: http://zenoss.com Software Link: http://www.zenoss.com Version: Core 4.2.5-2108 64bit Tested o...

Zenoss Monitoring System 4.2.5-2108 Cross Site Scripting

Exploit Title: Stored XSS vulnerability in Zenoss core open source monitoring system Date: 12/05/2014 Exploit author: Dolev Farhi dolevatopenflare.org Vendor homepage: http://zenoss.com Software Link: http://www.zenoss.com Version: Core 4.2.5-2108 64bit Tested on: Kali Linux Vendor alerted:...

Barracuda Spam&Virus FW #39 - CS Cross Site Vulnerability

Document Title: =============== Barracuda Spam&Virus FW 39 - CS Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1118 Barracuda Networks Security ID BNSEC: BNSEC-1052 https://www.barracuda.com/support/knowledgebase/501600000013lYI...

Zenoss Monitoring System 4.2.5-2108 64bit - Stored XSS Vulnerability

Cross-site scripting XSS vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web script or HTML via the title of a device. Exploit Title: Stored XSS vulnerability in Zenoss core open source monitoring system Date: 12/05/2014 Exploit author: Dolev Farhi dolevatopenflare.org...

Zenoss Monitoring System 4.2.5-2108 (x64) - Persistent Cross-Site Scripting

Exploit Title: Stored XSS vulnerability in Zenoss core open source monitoring system Date: 12/05/2014 Exploit author: Dolev Farhi dolevatopenflare.org Vendor homepage: http://zenoss.com Software Link: http://www.zenoss.com Version: Core 4.2.5-2108 64bit Tested on: Kali Linux Vendor alerted:...