方维团购4.3版本注射又一枚

简要描述： ..... 详细说明： ..... 漏洞证明： http://t1.fanwe.net:93/t1/index.php?m=Goods&a=showcate&id=46 Target: http://t1.fanwe.net:93/t1/index.php?m=Goods&a=showcate&id=46 Host IP: 112.124.32.200 Web Server: IIS Powered-by: WAF/2.0 Powered-by: WAF/2.0 DB Server: MySQL =5 Resp. Timeavg: 487 ms Compile OS: Win...

United.com Insecure Transit

United Airwaysr united.com Insecure Transmission of User Credentials Revision Date: May 6th, 2014 Reason for Revision: Issue has been fixed by united.com Systems: www.united.com Severity: Critical Category: Information Disclosure Author: Michael Scheidell, CCISO – Managing Director, Security...

Remote Access Hack Compromises POS Vendor

A popular point of sale vendor may have suffered a data breach earlier this year that could affect customers of a handful of Pacific Northwest restaurants. Vancouver, Wash.-based Information Systems & Supplies, a supplier of POS systems to restaurants such as Dairy Queen, Buffalo Wild Wings and...

POS Machine Vendor Warns of Possible Payment Card Breach at Restaurants

Due to the better track inventory and accuracy of records, Point-of-sale POS systems are being used in most of the industries including restaurants, lodging, entertainment, and museums around the world. It can be easily set-up depending on the nature of the business. Despite that, Point-of-sale P...

Simple Chat 1.x User Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7168/info Simple Chat! does not restrict access to sensitive information by default. An attacker could use this information to launch attacks against other users. http://www.example.com/chat/data/usr...

phpMyFAQ <= 2.7.0 (ajax_create_folder.php) Remote Code Execution

No description provided by source. ?php / ------------------------------------------------------------------------ phpMyFAQ = 2.7.0 ajaxcreatefolder.php Remote Code Execution Exploit ------------------------------------------------------------------------ author............: Egidio Romano aka Egi...

HiveMail 1.2.2/1.3 index.php $_SERVER['PHP_SELF'] XSS

No description provided by source. source: http://www.securityfocus.com/bid/16591/info HiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection. The PHP code-execution issues are the result ...

Business Classified Listing SQL Injection Vulnerability

No description provided by source. Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title:Business Classified Listing SQl Vulnerable Vendor url:http://www.webvolume.co.uk Version:8 Price:n/a Published: 2010-06-15 Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to...

CompleteFTP Server Directory Traversal

No description provided by source. Exploit Title: CompleteFTP Server Directory Traversal Date: 2010-03-30 Author: zombiefx [email protected]:[email protected] Software Link: http://www.enterprisedt.com/products/completeftp/download/CompleteFTPSetup.exe Version: CompleteFTP Server v 3.3....

CuteNews 1.4.5 show_news.php Query String XSS

No description provided by source. source: http://www.securityfocus.com/bid/21233/info CuteNews is prone to multiple input-validation vulnerabilities, including an HTML-injection vulnerability, cross-site scripting vulnerabilities, and information-disclosure vulnerabilities. An attacker could...

WordPress SCORM Cloud plugin <= 1.0.6.6 - SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress SCORM Cloud plugin = 1.0.6.6 SQL Injection Vulnerability Date: 2011-09-07 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/scormcloud.1.0.6.6.zip Version: 1.0.6.6 tested...

Cyber Attack On 'Code Spaces' Puts Hosting Service Out of Business

Code Spaces, a code-hosting and software collaboration platform used by different organizations for project management and development needs, was forced to shut down operations after an attacker compromised its internal system and deleted its customer’s data and backups as well. This is really a...

Millions of LinkedIn Users at Risk of Man-in-the-Middle Attack

Two year back in 2012, one of the most popular online social networking sites Linkedin spent between $500,000 and $1 million on forensic work after millions of its users’ account passwords were compromised in a major security data breach. But, it seems that the company hasn't learned any lesson...

Hacker Puts Hosting Service Code Spaces Out of Business

Code Spaces, a code-hosting and software collaboration platform, has been put out of business by an attacker who deleted the company’s data and backups. Officials wrote a lengthy explanation and apology on the company’s website, promising to spend its current resources helping customers recover...

AT&T Suffers Data Breach, Customers' Personal Information Compromised

AT&T has confirmed a security data breach in which attackers have compromised the security of a number of its mobile customers and stolen personal information including Social Security numbers and call records. Back in April this year, AT&T suffered a data breach in which some of its customer...

AT&T Warns Customers of Data Breach

AT&T has notified some of its mobile customers that employees of one of its contractors accessed some customer information, including birth dates and Social Security numbers, in an effort to generate codes that could be used to unlock devices. The company did not specify how many customers were...

Hackers Breach Dominos France, Demand Ransom Payment

A group of hackers calling itself ‘Rex Mundi’ claims it has breached vulnerable servers belonging to Domino’s France and Belgium, stealing the sensitive information of nearly 600,000 customers. The group is demanding a payment of €30,000 from Domino’s in exchange for information about the...

PF Chang's China Bistro Confirms Credit and Debit Card Breach

Following the massive data breaches at eBay, Neiman Marcus Group and Michaels Stores, yet another private equity company Centerbridge Partners-backed restaurant chain P.F. Chang’s China Bistro suffered a potential Credit and Debit card data breach. The Asian-themed casual dining restaurant chain...

Mail.ru: SQL Injection on 11x11.mail.ru

Приветствую! SQL Inject boolean-based True http://11x11.mail.ru/xml/games/champ.php?act=groups&division=6&tournament=66+and+1=ifsubstr@@version,1,5=0x352e302e37,1,2%23 Сезон 22, Дивизион 3-C False...

InVision: Sensitive information in cookies

I observed sensitive information stored in cookies. eg. This are my extracted cookies. █████ You can clearly see user's email-id in the cookie ███████ You should not pass sensitive information in cookies. If cookies are stolen, this will result in compromising data of user. If you have more...