9524 matches found
ECSHOP存在持久型XSS风险
简要描述： ECSHOP某些地方存在XSS风险,可获取管理员cookies. ECSHOP过滤做的很好,但是百密一疏..... 详细说明： 首先随意购买商品,在购买信息处,在收件地址 或 收件地址写入XSS代码,提交订单后在后台查看订单是肯定被过滤的,但是这个时候不要紧. 这个时候在用户中心查看我的订单,点击刚才我们购买的订单号 这个时候也可以发现没有做过滤 但是这里不是我们想要的 自己的cookies有什么好用的..... 现在看页面地址 http://127.0.0.1/user.php?act=orderdetail&orderid=68 这个是我的...
httpd: mod_log_config does not properly handle logging certain cookies resulting in DoS
The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service segmentation fault and daemon crash via a crafted cookie that is not properly handled during truncation...
CVE-2014-3740 - SpiceWorks Cross-site scripting
Exploit Title: Multiple Stored XSS vulnerabilities in SpiceWorks Ticketing system CVE: CVE-2014-3740 Vendor: SpiceWorks Product: SpiceWorks IT ticketing system Affected versions: any version below 7.2.00195 Fixed version: 7.2.00195 1. About the application: ======================= SpiceWorks is a...
openSUSE Security Update : opera (openSUSE-SU-2013:0686-1)
Opera 12.15 is a recommended upgrade offering security and stability enhancements. It provides : -fixed an issue where the search bar's default engine could be overridden by third-party apps; -fixed a moderately severe issue; -added safeguards against attacks on the RC4 encryption protocol; see o...
openSUSE Security Update : namazu (openSUSE-SU-2011:1327-1)
This update fixes the following security issues : - 732323: CVE-2011-4345: namazu: XSS flaw by processing HTTP cookies CVE-2011-4345 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update namazu-5528...
openSUSE Security Update : gnash (openSUSE-SU-2012:0369-1)
gnash used predictable and world readable temporary file names to store HTTP cookies %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-164. The text description of this plugin is C...
openSUSE Security Update : tomcat6 (openSUSE-SU-2011:0082-1)
This update fixes a cross-site scripting vulnerability that affects the session list screen. This can be used to steal session cookies because tomcat 6 does not use the httpOnly flag for its cookies. CVE-2010-4172 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...
openSUSE Security Update : namazu (openSUSE-SU-2011:1327-1)
This update fixes the following security issues : - 732323: CVE-2011-4345: namazu: XSS flaw by processing HTTP cookies CVE-2011-4345 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update namazu-5528...
openSUSE Security Update : gnash (openSUSE-SU-2012:0330-1)
gnash used predictable and world readable temporary file names to store HTTP cookies CVE-2011-4328. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update gnash-5931. The text description of this...
Openfiler NAS/SAN Appliance 2.99 XSS / Traversal / Command Injection
Tested on Openfiler NAS/SAN Appliance version 2.99 Author: MiDoveteMollare Date: 10 June 2014 OS Command Injection after authentication 1 page: servicesiscsitarget.html paramenter: password POST /admin/servicesiscsitarget.html HTTP/1.1 Host: IP:446 Accept: / Accept-Language: en User-Agent:...
SpiceWorks IT Ticketing System Cross Site Scripting
Exploit Title: Multiple Stored XSS vulnerabilities in SpiceWorks Ticketing system CVE: CVE-2014-3740 Vendor: SpiceWorks Product: SpiceWorks IT ticketing system Affected versions: any version below 7.2.00195 Fixed version: 7.2.00195 1. About the application: ======================= SpiceWorks is a...
YiDaCms v3.2 sql注入+逻辑错误
简要描述： rt 详细说明： admin\CheckAdmin.asp username = request.Cookies"username" password = request.Cookies"password" cookiesmd5 = request.Cookies"cookiesmd5" dim adminname,adminpass,adminqx,adminaqx set rs = server.createobject"adodb.recordset" sql="select from shuaiwebvipadministrator where...
FanFootage: Cookie fixation
Hey there I found out that the cookies are being fixed before and after logout that results in session fixation and eventually account hijacking...
MGASA-2014-0254 Updated wordpress package fixes multiple vulnerabilities
Updated wordpress package fixes security vulnerabilities: WordPress before 3.7.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php CVE-2014-0165. The wpvalidateauthcookie...
Updated wordpress package fixes multiple vulnerabilities
Updated wordpress package fixes security vulnerabilities: WordPress before 3.7.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php CVE-2014-0165. The wpvalidateauthcookie...
WebCookiesSniffer - Capture Web site cookies
WebCookiesSniffer is a packet sniffer tool that captures all Web site cookies sent between the Web browser and the Web server and displays them in a simple cookies table. The upper pane of WebCookiesSniffer displays the cookie string and the Web site/host name that sent or received this cookie...
WePay: Session fixation in wepay.com
Hey there i found out that your cookies are actually being fixed before an after login this allows an attacker to perform a sessino fixation attack and hijack the user's session by capturing the cookies before logging in of the user and replaying it afterwars. Here are my fixed cookies...
ThinkSAAS 2.2-beta 存储型XSS
简要描述： 富文本过滤不严格导致可植入恶意脚本盗取用户cookies 详细说明： 对比了一下 WooYun: Thinksaas存储型XSS ，发现确实更新了。我就无耻的来了。 下面是对富文本过滤的代码片段： function cleanJs$text $text = trim $text ; //$text = stripslashes $text ; // 完全过滤注释 $text = pregreplace '//', '', $text ; // 完全过滤动æ€ä»£ç $text = pregreplace '//', '',...
FineCMS存储型XSS（可打指定用户）
简要描述： 我来了，还是无耻的我 还是富文本过滤过滤 详细说明： 短消息功能存在存储型XSS漏洞，已经在官方复现。 1.给受害者发送短消息，在短消息中先插入百度地图： 2.插入地图成功后，通过firebug对这段HTML代码进行修改。修改完成后会是这样： PS:貌似过滤了alert，所以用eval重新拼接了一下。 漏洞证明： 受害者收到攻击者的短消息： 当受害者打开短消息时，攻击者植入的恶意脚本将自动触发： 虽然没有演示受害者cookies窃取（因为累了），但是100%可以的。...
InVision: Sensitive information in cookies
I observed sensitive information stored in cookies. eg. This are my extracted cookies. █████ You can clearly see user's email-id in the cookie ███████ You should not pass sensitive information in cookies. If cookies are stolen, this will result in compromising data of user. If you have more...