Heeroa /info/infoshowaction.do 任意文件下载漏洞

No description provided by source...

Anymacro 邮件系统任意文件下载漏洞（需登陆）

简要描述： 详细说明： 在mailattrFw.php中 其中$Fcid可控，从客户端获取，可以通过../跳转字符，跳转到相应目录进行读取。。 如默认状态下$SESSION'maildir'为：/mail/xxx.com/xxx/Maildir/ $Fcid可设置为：../../../../../etc/passwd 即可读取passwd内容 漏洞证明：...

[oss-security] CVE request: Pyplate multiple vulnerabilities

Hello list, My friend Teemu V. "requested" security audit for Pyplate. While quickly checking quality of this software I noticed following issues. This is not a full security audit as I don't have much free time. Tested version: v0.08 still beta Vendor notification: 2014-05-13 Issue 1. Installati...

mountor /down.aspx 任意文件下载

using System; using System.Data; using System.Configuration; using System.Collections; using System.Web; using System.Web.Security; using System.Web.UI; using System.Web.UI.WebControls; using System.Web.UI.WebControls.WebParts; using System.Web.UI.HtmlControls; using System; using System.IO; publ...

大汉Jvideo两处漏洞小合集（可能导致管理后台权限劫持）

简要描述： 两处。 详细说明： 一个是任意文件下载，一个是sql注入。 先看任意文件下载吧，任意文件下载可以下载到setup的相关安装信息，从而可以登录setup目录的管理后台 http://222.66.10.88:8081/jvideo/down.jsp?pathfile=WEB-INF/web.xml 来点好东西 http://222.66.10.88:8081/jvideo/down.jsp?pathfile=WEB-INF/ini/merpserver.ini 可以看见setup下Admin的密码（屏蔽了），登录成功 另外一个网站...

ezEIP 3 /download.ashx 任意文件下载漏洞

No description provided by source...

Hanweb JCMS 2010 /down.jsp 任意文件下载漏洞

No description provided by source...

用友某办公自动化平台漏洞之2-任意文件下载

简要描述： 程序未对下载目录做限制导致任意文件下载 详细说明： FE协作办公平台 FE协作办公平台 测试版本：5.2.1 版本大于5.2.1未受影响 ，小于5.2.1的版本未测 在网上用百度找了一下 直接传递文件的路径即可下载任意文件 http://218.249.130.74/download.fe?filePath=e:/OA/Media/TemplateOfTaohong//../../../OA/database/feapp5.mdf 漏洞证明： FE协作办公平台 FE协作办公平台 测试版本：5.2.1 版本大于5.2.1未受影响 ，小于5.2.1的版本未测 在网上用百度找了一下...

vSphere Client任意文件下载漏洞

Bugtraq ID:66772 CVE ID:CVE-2014-1209 VMware vCenter是VMware vSphere套件中一个强大的主机和虚拟机集中管理组件。 VMware vSphere Client 4.0, 4.1, 5.0 Update 3之前版本, 5.1 Update 2之前版本没有正确验证Client文件的更新，这可使远程攻击者触发任意程序的下载和执行。 0 VMWare vSphere Client 5.x VMWare vSphere Client 4.x 目前厂商已经发布了升级补丁以修复漏洞，请下载使用：...

PyHttpShell - Python HTTP Shell

PyHttpShell is a shell written in python, traffic is over http protocol using a server in the middle. Video: https://vimeo.com/91085876 Features Transport over HTTP/HTTPS. Supports System Proxy Settings. Multiple Hosts/Connections. Download files to client machine. Change Sleep time remotely. Wor...

Hewlett-Packard SiteScope SOAP Arbitrary File Download and Denial of Service Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard SiteScope. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. The issue lies in failure to require...

Some Zhengwu /ShowIssueContentAction.class 任意文件下载漏洞

No description provided by source...

Microsoft Access Snapshot Viewer ActiveX Control Arbitrary File Download - Ver2 (CVE-2008-2463)

Microsoft Snapshot Viewer is an application that allows viewing of snapshots created with any version of Microsoft Access. A remote code execution vulnerability has been discovered in the Snapshot Viewer for Microsoft Access. The vulnerability is due to an error in the Snapshot Viewer ActiveX...

[security bulletin] HPSBMU02933 rev.2 - HP SiteScope, issueSiebelCmd and loadFileContents SOAP Requests, Remote Code Execution, Arbitrary File download, Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03969435 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03969435 Version: 2 HPSBMU02933 rev....

Cybozu Garoon vulnerable to SQL injection

Overview Cybozu Garoon contains a SQL injection vulnerability. Note that this vulnerability is different from JVN91153528. Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an issue in the process of downloading files, which may result in SQL injection. Impact A user w...

Cybozu Garoon vulnerable to directory traversal

Overview Cybozu Garoon contains a directory traversal vulnerability. Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains a directory traversal vulnerability in the process of downloading files. Impact A user who can log in to the product may obtain files on the server...

JVN#71045461: Cybozu Garoon vulnerable to SQL injection

Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an issue in the process of downloading files, which may result in SQL injection. Impact A user who can log in to the system may obtain or alter information on the system. Solution For Cybozu Garoon 3.7: Apply the Patch...

Internet Bug Bounty: Flash local-with-fileaccess Sandbox Bypass

The proof of concept attached will exploit the implementation of flash in some browsers that will bypass the local-with-fileaccess sandbox. By encoding in ignored file:// uri characters, and navigating to another page with a decoder script. one is able to read arbitrary files AND parse it to the...

JIS /JIS/down.jsp 任意文件下载漏洞

No description provided by source...

CVE-2014-1480

The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site...