ImpressCMS 1.3.5 - Multiple Vulnerabilities

No description provided by source. I have discovered two vulnerabilities in ImpressCMS. These have been fixed in the new 1.3.6 version, which you can get at https://sourceforge.net/projects/impresscms/files/ImpressCMS%20Official%20Releases/ImpressCMS%201.3%20Branch/ImpressCMS%201.3.6/. One is an...

realnetworks realarcade 1.2 .0.994 Multiple Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/12494/info Multiple remote vulnerabilities reportedly affect RealNetworks RealArcade. The first issue allows for arbitrary file deletion due to an input validation issue. The second issue is an integer overflow issue...

DouPHP轻量级企业建站系统后台任意文件删除缺陷

简要描述： 某处未验证删除的文件路径，导致可以删除任意文件。 官网演示站测试通过 详细说明： 漏洞文件: /admin/backup.php 第161行 / +---------------------------------------------------------- 备份删除 +---------------------------------------------------------- / if $REQUEST'rec' == 'del' $sqlfilename = $GET'sqlfilename'; if $POST'confirm' if...

Zoomla x1.5 /ftb.imagegallery.aspx 任意文件删除漏洞

No description provided by source...

Cisco Unified Communications Manager Real-Time Monitoring Tool Multiple Vulnerabilities

A vulnerability in the Real-Time Monitoring Tool RTMT of Cisco Unified Communications Manager could allow an authenticated, remote attacker to download or delete files from arbitrary locations on the filesystem. The vulnerability is due to insufficient input validation. An attacker could exploit...

Design/Logic Flaw

The Real Time Monitoring Tool RTMT implementation in Cisco Unified Communications Manager Unified CM allows remote authenticated users to 1 read or 2 delete arbitrary files via a crafted URL, aka Bug IDs CSCuo17302 and CSCuo17199...

大汉版通JCMS某处越权+任意文件文件上传漏洞（反删除）

简要描述： 有删除文件的操作，可“反”之。 详细说明： 漏洞点： jcms/m57/replace/oprimportinfo.jsp 部分系统还存在越权。fnbillstatus为1时可以直接访问该页面无需验证： http://www.shanting.gov.cn/jcms/m57/replace/oprimportinfo.jsp?fnbillstatus=1 http://tuoshan.yzwh.gov.cn/jcms/m57/replace/oprimportinfo.jsp?fnbillstatus=1 漏洞证明： 扯下代码 // 基本变量初始化 String...

Maccms V8 XSS可打后台 #3

简要描述： 刚发了个后台getshell，但是屌丝的攻城狮要怎么进入后台呢？XSS呀 本应该两个洞一起发的，xss+后台getshell=getshell，手快发早了，只好再找个其它的接口来充数了 详细说明： 在留言板本处 插入即可 打后台 漏洞证明： 结合后台漏洞攻击： 1. 后台任意文件删除，可删除install.lock导致重装 接口 http://localhost/maccms8/admin/?m=extend-picdel post参数： fname%5B%5D=..%2Fupload%2Fart%2F..%5C%5C..%5C%5C\inc\install.lock 2...

Deserialization of Untrusted Data in core - ownCloud

Due to the deserialization of unstrusted data in core an attacker might be able to delete arbitrary files from the filesystem or executing arbitrary SQL queries. This issue has been found in a widely used third-party library, we have removed the component due to general quality concerns from the...

CVE-2012-6648

gdm/guest-session-cleanup.sh in gdm-guest-session 0.24 and earlier, as used in Ubuntu Linux 10.04 LTS, 10.10, and 11.04, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT from CVE-2012-0943 per ADT1/ADT2 due to different...

CVE-2012-6648

gdm/guest-session-cleanup.sh in gdm-guest-session 0.24 and earlier, as used in Ubuntu Linux 10.04 LTS, 10.10, and 11.04, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT from CVE-2012-0943 per ADT1/ADT2 due to different...

ThinkSAAS可CSRF删除任意文件 （后台）

简要描述： RT 详细说明： POC : http://localhost/thinksaas/index.php?app=system&ac=sql&ts=delete&sql=../../CHANGELOG.TXT case "delete": $sql = tsFilter$GET'sql'; rmrf'data/baksql/'.$sql; qiMsg'删除成功！如果有其他卷文件请一同删除!'; break; 没有做任何的检查 而且tsFilter貌似是防止SQL注入的吧..... / 删除目录下所有文件 @param unknown $dir / function rmrf$d...

Arbitrary file deletion

Multiple use-after-free vulnerabilities in net/websockets/websocketjob.cc in the WebSockets implementation in Google Chrome before 34.0.1847.137 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to WebSocketJob deletion...

Arbitrary file deletion

The ShellExecute API in Windows Shell in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly implement file associations, which allows local...

Arbitrary file deletion

tag.py in eyeD3 aka python-eyed3 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file...

Arbitrary file deletion

lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp. temporary file...

Arbitrary file deletion

lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic. temporary file...

74CMS多处任意文件删除（后台）

简要描述： 详细说明： 74CMS后台存在多处任意文件删除漏洞 第一，二处： 文件admin/adminarticle.php elseif$act == 'delimg' checktoken; $id=intval$GET'id'; $img=$GET'img'; $sql="update ".table'article'." set Smallimg='' where id=".$id." LIMIT 1"; $db-query$sql; @unlink$upfilesdir.$img; @unlink$thumbdir.$img; adminmsg"删除缩略图成功！",2;...

NULL NUKE CMS 2.2 - Multiple Vulnerabilities

NULL NUKE CMS version 2.2 suffers from cross site request forgery, cross site scripting, arbitrary file deletion, remote command execution, arbitrary file access, directory traversal, open redirection, and remote shell upload vulnerabilities NULL NUKE CMS v2.2 Multiple Vulnerabilities Vendor:...

NULL NUKE CMS 2.2 - Multiple Vulnerabilities

NULL NUKE CMS v2.2 Multiple Vulnerabilities Vendor: nullwanton Product web page: http://sourceforge.net/projects/nullnuke/ Affected version: 2.2 and 2.1 rc3 Summary: NULL-8x3-NUKE is a fast, powerful and secure cross platform CMS for windows and Linux using base or full drive paths. Desc: NULL...