用友某系统任意文件删除漏洞

简要描述： 用友FE协同办公系统某处验证不严，导致任意文件删除漏洞 详细说明： 漏洞影响版本V5.5.2 漏洞文件：/sys/filesetup/deletefolder.jsp?path= 漏洞参数：path /sys/filesetup/deletefolder.jsp源代码如下： --------------------------------------------- alert"删除成功！"; var reloadSrc=parent.westFrame; reloadSrc.location.href=reloadSrc.location.href;...

用友FE办公平台通用SQL注入（2个）

简要描述： 用友FE办公平台通用SQL注入（2个） 详细说明： SQL注入1 漏洞文件及参数 /witapprovemanage/report/depReimburse.jsp?depid=1 漏洞证明： sqlmap.py -u "http://oa.shunhengli.com:9090/witapprovemanage/report/depReimburse.jsp?depid=1" sqlmap.py -u "http://oa.shunhengli.com:9090/witapprovemanage/report/depReimburse.jsp?depid=1" --dbs...

用友协作办公平台通用多处SQL注入

简要描述： RT 详细说明： 开发公司：用友软件 程序名称：FE协作办公平台 漏洞类型：SQL注入（GET） 漏洞文件：assetsGroupReport目录下多文件存在注入 /assetsGroupReport/vendorContacts.jsp?unitCode=11&cVenCode=22&startDate=2012-01-01&endDate=2012-02-01...

用友某系统存在通用SQL注入

简要描述： 用友某系统存在通用SQL注入 详细说明： 用友FE协作办公平台最新版 漏洞url: /security/roleadduser.jsp?dept=1&roleid=2&searchValue=3 部分代码 其中searchValue存在注入。 证明： http://oa.jiada.cc:9090/security/roleadduser.jsp?dept=1&roleid=2&searchValue=3 http://oa.shunhengli.com:9090/security/rolead...

用友某办公自动化平台漏洞之2-任意文件下载

简要描述： 程序未对下载目录做限制导致任意文件下载 详细说明： FE协作办公平台 FE协作办公平台 测试版本：5.2.1 版本大于5.2.1未受影响 ，小于5.2.1的版本未测 在网上用百度找了一下 直接传递文件的路径即可下载任意文件 http://218.249.130.74/download.fe?filePath=e:/OA/Media/TemplateOfTaohong//../../../OA/database/feapp5.mdf 漏洞证明： FE协作办公平台 FE协作办公平台 测试版本：5.2.1 版本大于5.2.1未受影响 ，小于5.2.1的版本未测 在网上用百度找了一下...

CVE-2011-3146

librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service NULL pointer dereference and possibly execute arbitrary code via a SVG file with a node with the element name starting with "fe," which is misidentified as ...

CVE-2012-3005: Undefined Security Weakness

Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware Application Server, Wonderware Information Server, Foxboro Control Software, InFusion CE/FE/SCADA, InBatch, and Wonderware Historian, allows local users to gain privileges via a Trojan horse...

Heap overflow

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA...

Heap overflow

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA...

PT-2012-2444

Name of the Vulnerable Software and Affected Versions Invensys Wonderware Application Server versions 2012 and earlier Foxboro Control Software version 3.1 and earlier InFusion CE/FE/SCADA version 2.5 and earlier Wonderware Information Server version 4.5 and earlier ArchestrA Application Object...

PT-2012-2443

Name of the Vulnerable Software and Affected Versions Invensys Wonderware Application Server versions 2012 and earlier Foxboro Control Software version 3.1 and earlier InFusion CE/FE/SCADA version 2.5 and earlier Wonderware Information Server version 4.5 and earlier ArchestrA Application Object...

CVE-2012-0258: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA...

CVE-2012-0257: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA...

Sql injection

SQL injection vulnerability in the FE user statistic festat extension before 0.2.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2010-4952

The CVE-2010-4952 issue affects the TYPO3 FE user statistics extension festat, vulnerable in versions before 0.2.4 due to an SQL injection flaw that allows remote attackers to execute arbitrary SQL via unspecified vectors. The vulnerability can impact confidentiality, integrity, and availability ...

CVE-2010-4952: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the FE user statistic festat extension before 0.2.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

GalleryPal FE 1.5 - Authentication Bypass

GalleryPal FE 1.5 - Authentication Bypass ------------------------------------------------------------ GalleryPal FE v1.5Auth Bypass TYPE:Remote SQL Injection Vulnerability ---------------------------------------------------------- author: R3d-D3v!L Date: 15.11.2008 Home: www.ahacker.net contact:...

GalleryPal FE v1.5(Auth Bypass)

Exploit for unknown platform in category web applications =============================== GalleryPal FE v1.5Auth Bypass =============================== ALERT FR0M THE DARKNESS BY 7h3 REd-D3v!L Exploit: username : admin password : X' or ' 1=1-- demo: server/GalleryPalFEDemo/login.asp 0day.today...

GalleryPal FE 1.5 - Authentication Bypass

------------------------------------------------------------ GalleryPal FE v1.5Auth Bypass TYPE:Remote SQL Injection Vulnerability ---------------------------------------------------------- author: R3d-D3v!L Date: 15.11.2008 Home: www.ahacker.net contact: N/A...

CVE-2009-2365

SQL injection vulnerability in login.asp in DataCheck Solutions GalleryPal FE 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...