PHPYUN最新版XML注入及SQL注入获取管理员账号（无视任何防御）

简要描述： 早上提交了个XML实体读取任意文件的，结果厂商说是数字被提交了，顿时无语了。 这里还有一个XML注入及SQL注入，如果说又是数字被提交了，我保证不在挖你们的漏洞了！！！ 详细说明： 首先我们来说一说$GLOBALS"HTTPRAWPOSTDATA"这个东东，他会吧POST过来的内容原封不动的传进来，所以phpyun的那些铜墙铁壁的防御也就没用了！！！ 还是文件：weixin/model/index.class.php XML实体注入： private function responseMsg $postStr = $GLOBALS"HTTPRAWPOSTDATA"; if...

[SECURITY] Fedora 19 Update: mingw-curl-7.37.0-1.fc19

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

[SECURITY] Fedora 20 Update: mingw-curl-7.37.0-1.fc20

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

Fedora 19 : mingw-curl-7.37.0-1.fc19 (2014-6921)

Update to 7.37.0 - Fixes CVE-2014-0138 and CVE-2014-0139 RHBZ 1080880 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 20 : mingw-curl-7.37.0-1.fc20 (2014-6912)

Update to 7.37.0 - Fixes CVE-2014-0138 and CVE-2014-0139 RHBZ 1080880 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Mandriva Linux Security Advisory : curl (MDVSA-2014:110)

Updated curl packages fix security vulnerabilities : Paras Sethia discovered that libcurl would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same server, sending requests for one user over the connection authenticated as a different user CVE-2014-0015...

Wordpress Plugin CopySafe PDF Protection Shell Upload (0day) Vulnerability

Exploit for php platform in category web applications Title : Wordpress Plugin CopySafe PDF Protection Shell Upload Vulnerability Author : Aloulou Date : 01/06/2014 Facebook : http://www.facebook.com/Aloulou.TN Email: email protected Vendor : wordpress.org Google Dork :...

Liffy - Local File Inclusion Exploitation Tool

Liffy is a tool written in Python designed to exploit local file inclusion vulnerabilities using three different techniques that will get you a working web shell. The first two make use of the built-in PHP wrappers php://input and data://. The third makes use of the process control extension call...

CentOS Update for curl CESA-2014:0561 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedHat Update for curl RHSA-2014:0561-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 6 : curl (CESA-2014:0561)

Updated curl packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

curl, libcurl security update

CentOS Errata and Security Advisory CESA-2014:0561 Updated curl packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System...

RHEL 6 : curl (RHSA-2014:0561)

Updated curl packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Oracle Linux 6 : curl (ELSA-2014-0561)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0561 advisory. - fix re-use of wrong HTTP NTLM connection CVE-2014-0015 - fix connection re-use when using different log-in credentials CVE-2014-0138 Tenable has...

curl: wrong re-use of connections in libcurl

The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses 1 SCP, 2 SFTP, 3 POP3, 4 POP3S, 5 IMAP, 6 IMAPS, 7 SMTP, 8 SMTPS, 9 LDAP, and 10 LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015...

Moderate: Red Hat Security Advisory: curl security and bug fix update

Updated curl packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

curl: re-use of wrong HTTP NTLM connection in libcurl

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request...

WPScan - WordPress Security Scanner

WPScan is a black box WordPress vulnerability scanner. Features Username enumeration from author querystring and location header Weak password cracking multithreaded Version enumeration from generator meta tag and from client side files Vulnerability enumeration based on version Plugin enumeratio...

SuSE 11.3 Security Update : curl (SAT Patch Number 9133)

This curl update fixes the following security issues : - wrong re-use of connections. CVE-2014-0138. bnc868627 - IP address wildcard certificate validation. CVE-2014-0139. bnc868629 - --insecure option inappropriately enforcing security safeguard. bnc870444 %NASLMINLEVEL 70300 C Tenable Network...

Wordpress Theme Echea Shell Upload Vulnerability

Exploit for php platform in category web applications Title : Wordpress Theme Echea Shell Upload Vulnerability Author : Aloulou Date : 15/05/2014 Facebook : http://www.facebook.com/Aloulou.TN Email: email protected Vendor : www.themeforest.net Google Dork : inurl:/wp-content/themes/echea/ Tested ...