MobileIron VSP/Sentry 'j_username'参数XPath注入漏洞

Bugtraq ID:66595 CVE ID:CVE-2014-1409 MobileIron是一个虚拟智能终端平台，包含VSP,Sentry等组件。 MobileIron VSP/Sentry管理接口存在验证绕过漏洞，https://target/mics/jspringsecuritycheck中的脚本不正确过滤'jusername'参数，允许未验证攻击者进行XPath注入攻击，可获取XML文档数据，如配置文件等。 0 MobileIron VSP 5.9.1 MobileIron Sentry 5.0 MobileIron VSP 5.9.1和MobileIron Sentry...

FreeBSD : nginx -- SPDY heap buffer overflow (fc28df92-b233-11e3-99ca-f0def16c5c1b)

The nginx project reports : A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution CVE-2014-0133. The problem...

nginx -- SPDY heap buffer overflow

The nginx project reports: A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution CVE-2014-0133. The problem...

PHPMYWIND 后台Getshell的一种方法

简要描述： 过滤不严。 详细说明： phpmywind 和 dedecms 都挺像的。 在修改配置文件的时候 过滤掉了单引号 防止闭合单引号 Getshell。 $cfgwebname = '我的网站'; $cfgweburl = 'http://127.0.0.1'; $cfgwebpath = '/phpmywind'; $cfgauthor = ''; $cfggenerator = 'PHPMyWind CMS'; $cfgkeyword = ''; $cfgdescription = ''; 配置文件 单引号保护。 然后过滤掉单引号。 看似无法从配置文件这里下手 其实还是可以的...

CVE-2013-6304

CVE-2013-6304 affects IBM Algo One’s Algo Risk Application (ARA) 2.x and 4.x (2.4.0.1–4.9.1). The vulnerability is a directory traversal flaw allowing remote authenticated users to bypass access restrictions by submitting crafted pathnames for (1) a configuration file or (2) a JAR file. Impact de...

Yahoo!: http://conf.member.yahoo.com configuration file disclosure

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...

Oracle Demantra 12.2.1 - Arbitrary File Disclosure

Exploit for windows platform in category web applications Details: The Team discovered a Local File Include LFI vulnerability. A file inclusion vulnerability occurs when a file from the target system is injected into a page on the attacked server page. The vulnerable page is: /demantra/GraphServl...

CVE-2014-0774

Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server OFS TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLUOFS33 - 3.35, TLXCDLTOFS33 - 3.35, and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file...

Stack overflow

Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server OFS TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLUOFS33 - 3.35, TLXCDLTOFS33 - 3.35, and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file...

CVE-2014-0774 Schneider Electric OFS Stack Buffer Overflow

Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server OFS TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLUOFS33 - 3.35, TLXCDLTOFS33 - 3.35, and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file...

Cisco Adaptive Security Appliance Phone Proxy sec_db Race Condition Vulnerability

A vulnerability in the TFTP request function of the Phone Proxy feature of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to pass traffic from an untrusted phone through the ASA. The vulnerability is due to a limitation in processing the TFTP request for...

MGASA-2014-0058 Updated augeas package fixes security vulnerabilities

Multiple flaws were found in the way Augeas handled configuration files when updating them. An application using Augeas to update configuration files in a directory that is writable to by a different user for example, an application running as root that is updating files in a directory owned by a...

Design/Logic Flaw

Secunia CSI Agent 6.0.0.15017 and earlier, 6.0.1.1007 and earlier, and 7.0.0.21 and earlier, when running on Red Hat Linux, uses world-readable and world-writable permissions for /etc/csiaconfig.xml, which allows local users to change CSI Agent configuration by modifying this file...

CVE-2013-5364

Secunia CSI Agent 6.0.0.15017 and earlier, 6.0.1.1007 and earlier, and 7.0.0.21 and earlier, when running on Red Hat Linux, uses world-readable and world-writable permissions for /etc/csiaconfig.xml, which allows local users to change CSI Agent configuration by modifying this file...

Updated cups packages fix a security vulverability

Updated cups packages fix security vulnerability: Jann Horn discovered that the CUPS lppasswd tool incorrectly read a user configuration file in certain configurations. A local attacker could use this to read sensitive information from certain files, bypassing access restrictions CVE-2013-6891...

PHPJabbers Appointment Scheduler 2.0多个漏洞

No description provided by source. Appointment Scheduler V2.0 - Multiple Vulnerabilities ========================================================================= .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

MySQL debian.cnf Plaintext Credential Disclosure

The version of MySQL installed on the remote host is 5.5.x prior to 5.5.33. It is, therefore, potentially affected by a race condition in the post-installation script of the MySQL server package mysql-server-5.5.postinst that creates the configuration file '/etc/mysql/debian.cnf' with...

Atmail 6 /config/dbconfig.ini 信息泄露漏洞

No description provided by source...

BlogEngine.net information disclosure vulnerability

Overview BlogEngine.net 2.8.0.0 and earlier versions contain an information disclosure vulnerability which could allow an attacker to gain access to credentials. Description CWE-200: Information ExposureBlogEngine.net 2.8.0.0 and earlier contain an information disclosure vulnerability which could...

Authentication flaw

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors...