BlinkSale Bug Bounty #1 - Encode & Validation Vulnerability

Document Title: =============== BlinkSale Bug Bounty 1 - Encode & Validation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1416 Release Date: ============= 2015-02-06 Vulnerability Laboratory ID VL-ID: ====================================...

云锁最新版1.3.145绕过webshell检测

简要描述： webshell检测绕过 详细说明： 一句话马+大马绕过检测 漏洞证明： 1.一句话木马，单纯用这种方式肯定会被检测到，我们采用这种方式： 结果发现只有一开始说的那种文件被检测到： 2.大马，采用base64+gzinflate压缩编码，大马文件如下： ?php function CLsI$ZzvSWE $ZzvSWE=gzinflatebase64decode$ZzvSWE; for$i=0;$istrlen$ZzvSWE;$i++ $ZzvSWE$i = chrord$ZzvSWE$i-1; return $ZzvSWE;...

UBUNTU-CVE-2014-5271

Heap-based buffer overflow in the encodeslice function in libavcodec/proresenckostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via...

CVE-2014-5271

Heap-based buffer overflow in the encodeslice function in libavcodec/proresenckostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via...

trex.uqam.ca XSS vulnerability

Open Bug Bounty ID: OBB-52064 Description| Value ---|--- Affected Website:| trex.uqam.ca Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

Perl Command Encoder

This encoder uses perl to avoid commonly restricted characters. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Perl Command Encoder', 'Description' = %q This encoder uses perl to avoid commonl...

tgs cms 0.x (xss/sql/fd) Multiple Vulnerabilities

No description provided by source. | | | / | | / | | | \ / | | | / / | |/ \ / / |/ | |/| | | ' \ / | / / | | | | | | | | | | | | | |/ / ||//\||| |||| ||,/| +-+-+-+-+ |C|r|e|w| +-+-+-+-+ TGS CMS Cross Site Scripting,SQL injection,Blind SQL/XPath injection,Source code disclosure, Multiple...

Linksys系列未明远程代码执行漏洞

No description provided by source. !/usr/bin/php ?php / Exploit for 0day linksys unauthenticated remote code execution vulnerability. As exploited by TheMoon worm; Discovered in the wild on Feb 13, 2013 by Johannes Ullrich. I was hoping this would stay under-wraps until a firmware patch could be...

WHMCompleteSolution (WHMCS) 4.x5.x - Multiple Web Vulnerabilities

WHMCompleteSolution WHMCS 4.x5.x - Multiple Web Vulnerabilities Exploit Title: WHMCS v4.x & v5.x - Multiple Web Vulnerabilities Date: 2013-12-10 Exploit Author: ahwak2000 Vendor Homepage: http://whmcs.com/ Version: 4.x , 5.x Tested on: win 7 +------------------+ | Vulnerability |...

PHP 5.4.x < 5.4.16 Multiple Vulnerabilities

According to its banner, the version of PHP 5.4.x installed on the remote host is prior to 5.4.16. It is, therefore, potentially affected by the following vulnerabilities: - An error exists in the mimetype detection of 'mp3' files that could lead to a denial of service. Bug 64830 - An error exist...

Cuppa CMS - alertConfigField.php LocalRemote File Inclusion

Cuppa CMS - alertConfigField.php LocalRemote File Inclusion Exploit Title : Cuppa CMS File Inclusion Date : 4 June 2013 Exploit Author : CWH Underground Site : www.2600.in.th Vendor Homepage : http://www.cuppacms.com/ Software Link : http://jaist.dl.sourceforge.net/project/cuppacms/cuppacms.zip...

Active Perl Modules Multiple Vulnerabilities (Windows)

The host is installed with Active Perl and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbactiveperlmodulesmultvulnwin.nasl 6115 2017-05-12 09:03:25Z teissa $ Active Perl Modules Multiple Vulnerabilities Windows Authors: Arun Kallavi Copyright: Copyright c 2012 Greenbone...

DEBIAN-CVE-2012-6548

The udfencodefh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application...

UBUNTU-CVE-2012-6548

The udfencodefh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application...

USN-1643-1: Perl vulnerabilities

It was discovered that the decodexs function in the Encode module is vulnerable to a heap-based buffer overflow via a crafted Unicode string. An attacker could use this overflow to cause a denial of service. CVE-2011-2939 It was discovered that the 'new' constructor in the Digest module is...

Security fix for the ALT Linux 6 package perl-Encode version 2.47-alt0.M60P.1

Oct. 30, 2012 Vladimir Lettiev 2.47-alt0.M60P.1 - Backported to p6 including fix for CVE-2011-2939...

typo3 -- Multiple vulernabilities in TYPO3 Core

Typo Security Team reports: It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting, Information Disclosure, Insecure Unserialize leading to Arbitrary Code Execution. TYPO3 Backend Help System - Due to a missing signature HMAC for a parameter in the viewhelp.php file, an...

Persistent xss flaw in the revision history (of comments).

Whilst a comment is html encoded /sanitized when displayed within an answer to a question the revision history page for an edited comment does not sanitize or html encode the content of the current and previous comments. Therefore an attacker can exploit this issue to craft a persistent xss attac...

PT-2012-1162 · Openjpeg +3 · Openjpeg +3

Name of the Vulnerable Software and Affected Versions: OpenJPEG versions 1.3 through 1.5 Description: The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image. This is due to the tcd free encode function...

Debian DSA-2445-1 : typo3-src - several vulnerabilities

Several remote vulnerabilities have been discovered in the TYPO3 web content management framework : - CVE-2012-1606 Failing to properly HTML-encode user input in several places, the TYPO3 backend is susceptible to Cross-Site Scripting. A valid backend user is required to exploit these...