cPanel 管理系统多个安全漏洞

cPanel是一款基于多种语言的空间管理面板，可通过域名来管理整个站点 cPanel存在多个安全漏洞，允许恶意用户劫持域和操作部分数据： 1，暂停账户时存在错误，可被利用操作某些文件 2，处理DNSAdmin集群请求时cpsrvd存在错误，可被利用操作其他账户的DNS域 3，当处理停放域时不正确校验权限，可被利用劫持托管在同一台服务器或DNS集群上的域 4，"Purchase and Install an SSL Certificate"功能存在错误，可被利用覆盖任意文件 0 cPanel 11.x 厂商解决方案 cPanel 11.32.6.17, 11.34.1.25,...

shopEx 4.8.5 /api_b2b_2_0_payment_cfg.php SQL 注入

缺陷文件： \core\api\payment\2.0\apib2b20paymentcfg.php core\api\payment\1.0\apib2b20paymentcfg.php 第44行 $data'columns' 未做过滤导致注入 code?php settimelimit0; obflush; echo 'Test: http://localhost:808'."\r\n"; $sql = 'columns= from sdbpaymentcfg WHERE 1 and select 1 fromselect count,concatselect select SELE...

Oracle MySQL 5.6.x < 5.6.12 Multiple Vulnerabilities

Binary data 6934.prm...

CVE-2013-3795

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language...

CVE-2013-3793

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language...

Design/Logic Flaw

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language...

CVE-2013-3795

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language...

Design/Logic Flaw

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language...

CVE-2013-3795

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language...

CVE-2013-3793

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language...

CVE-2013-3795

CVE-2013-3795 concerns the MySQL Server (Oracle MySQL) before or at 5.6.11 with a Data Manipulation Language related issue allowing a remote authenticated user to affect availability. Connected sources provide concrete technical details: multiple PT Security advisories describe related MySQL Serv...

CVE-2013-3793

Disclaimer: This data contains information about vulnerable...

CVE-2013-3793

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language...

CVE-2013-3795

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language...

CVE-2013-3793

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language...

PT-2013-4632 · Mysql Server +2 · Mysql Server +2

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.5.31 and earlier MySQL Server versions 5.6.11 and earlier Description: The issue affects the availability of the system, allowing remote authenticated users to exploit it via unknown vectors related to Data Manipulatio...

MySQL 5.5 < 5.5.32 Multiple Vulnerabilities

The version of MySQL 5.5.x installed on the remote host is prior to 5.5.32. It is, therefore, affected by multiple vulnerabilities in the following components : - Audit Log - Data Manipulation Language - Full Text Search - GIS - Server : Optimizer - Server : Parser - Server : Replication C Tenabl...

MySQL 5.6.x < 5.6.12 Multiple Vulnerabilities

The version of MySQL installed on the remote host is 5.6.x older than 5.6.12. As such, it is reportedly affected by vulnerabilities in the following components : - Audit Log - Data Manipulation Language - Full Text Search - GIS - InnoDB - Locking - MemCached - Server Optimizer - Server Privileges...

Security feature bypass

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5, and Silverlight 5 before 5.1.20513.0, does not properly prevent changes to data in multidimensional arrays of structures, which allows remote attackers to execute arbitrary code via 1 a crafted .NET Framework application or 2 a crafted...

Mandriva Linux Security Advisory : nfs-utils (MDVSA-2013:178)

Updated nfs-utils packages fix security vulnerability It was reported that rpc.gssd in nfs-utils is vulnerable to DNS spoofing due to it depending on PTR resolution for GSSAPI authentication. Because of this, if a user where able to poison DNS to a victim's computer, they would be able to trick...