CVE-2016-5366

Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to modify configuration data via vectors related to a "file injection vulnerability," aka HWPSIRT-2016-05052...

Huawei WS851 Injection Vulnerability

The Huawei WS851 is a wireless router product from Huawei China. A security vulnerability exists in Huawei WS851 versions prior to 1.1.21.1, which stems from the program not restricting ports. An attacker can exploit this vulnerability to inject arbitrary files...

Security Advisory - Several Vulnerabilities in Huawei Honor Routers

Huawei Honor routers do not verify some parameters. As a result, sensitive information may be displayed, causing the leak of sensitive information. Vulnerability ID: HWPSIRT-2016-05053 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2016-5367. Huawei Honor...

Nagios XI < 5.2.7 命令执行漏洞

参考来源：GNUSEC 多个文件存在命令注入漏洞 POC URL = GET /nagiosxi/includes/components/nagiosim/nagiosim.php?mode=update&token=&incidentid=&title=&status= PARAMETER = title POC PAYLOAD = title'; touch /tmp/FILE; echo ' URL = GET /nagiosxi/includes/components/perfdata/graphApi.php?host=&start=&end= PARAMETERS =...

OnionShare Competitive Conditions Loophole

OnionShare is an open source file encryption transfer or sharing software developed by Brazilian software developer Micah Lee. A competitive condition vulnerability exists in OnionShare that stems from the program failing to properly create temporary files. An attacker could use this vulnerabilit...

RoundCube Webmail Cross-Site Scripting Vulnerability (CNVD-2016-02711)

RoundCube Webmail is a browser-based IMAP client mail client. A cross-site scripting vulnerability exists in RoundCube Webmail, which can be exploited to inject arbitrary web script or HTML with the help of specially crafted Svg image files...

The vulnerability of the microprogramming software for Micrologix 1100 and 1400 allows a intruder to inject content from an arbitrary file into the FRAME element.

The vulnerability of the microprogrammed logic controllers Micrologix 1100 and 1400 lies in the lack of restrictions on the download of files. Exploiting this vulnerability allows a malicious actor to inject any file content into the FRAME element remotely...

Magento Bug Bounty #19 - Persistent Filename Vulnerability

Document Title: =============== Magento Bug Bounty 19 - Persistent Filename Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1570 ID: APPSEC-1059 Release Date: ============= 2015-09-11 Vulnerability Laboratory ID VL-ID:...

Netgear FVS318 Router Multiple Vulnerabilities

Multiple Vulnerabilities in Netgear FVS318 Router ------------------------------------------------------------------------ SUMMARY The Netgear FVS318 is "an easy to use, firewall/router designed for home users and small businesses". SecuriNews Research has found 2 vulnerabilities in the router, o...

Cisco TelePresence Video Communication Server Expressway Arbitrary File Injection Vulnerability

A vulnerability in the command-line interface CLI of the Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, local attacker to inject arbitrary arguments to a script on an affected system. The vulnerability is due to insufficient input validation of content ...

Microsoft Windows ClientCopyImage Improper Object Handling Exploit

This Metasploit module exploits improper object handling in the win32k.sys kernel mode driver. This Metasploit module has been tested on vulnerable builds of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64. This module requires Metasploit: http://metasploit.com/download Current source:...

CVE-2015-2934

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xmlparse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file...

Sierra Wireless AirCard 760S/762S/763S Mobile Hotspot CRLF Injection

Sierra Wireless AirCard 760S/762S/763S Mobile Hotspot CRLF Injection Overview Sierra Wireless produces a mobile wi-fi hotspot device that is popular amongst telecommunication companies for re-branding to suit local markets. The AirCard 760S/762S/763S Web-based Administrative Console suffers from ...

Kofax e-Transactions Sender Sendbox File Injection Vulnerability

Kofax e-Transactions Sender Sendbox is an add-on application to a suite of Kofax conversion modules from Kofax USA that automates the electronic transfer of documents to business processes via secure e-mail. A file injection vulnerability exists in Kofax e-Transactions Sender Sendbox, which allow...

PHPOK 存储型 xss两处

简要描述： 前台功能存在存储型 xss，可攻击后台，获取管理员权限。 详细说明： 第一处xss漏洞： 留言功能。 后台的输出点有一处输出如下： 可以看出，我们留言的标题直接输出在 onclick 事件中了，可简单构造 '+alert1+'，管理员删除留言时触发： 此时输出： 第二处xss漏洞： PHPOK 过滤 XSS 的函数如下： function safehtml$info if!$info return false; $tmp = "//isU"; $info = pregreplace$tmp,"",$info; //$info =...

TigerCom iFolder+ v1.2 iOS - Multiple Vulnerabilities

Document Title: =============== TigerCom iFolder+ v1.2 iOS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1284 Release Date: ============= 2014-07-30 Vulnerability Laboratory ID VL-ID: ==================================== 1284...

Depot WiFi 1.0.0 iOS - Multiple Vulnerabilities

Document Title: =============== Depot WiFi v1.0.0 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1259 Release Date: ============= 2014-04-23 Vulnerability Laboratory ID VL-ID: ==================================== 1259...

hdwiki注入导致任意文件下载

简要描述： RT。为一个朋友找的。 详细说明： hdwiki上传附件处文件名过滤不严，导致可以注入： function douploadimg $imgname=$FILES'photofile''name'; $extname=file::extname$imgname; $destfile=$ENV'attachment'-makepath$extname; $arrupload=file::uploadfile$FILES'photofile',$destfile; if$arrupload'result'==true ifisset$this-setting'watermark'...

Ruby Gem Features 0.3.0 Injection

Title: Features 0.3.0 Ruby gem file injection vulnerability Date: 9/1/2013 Author: Larry W. Cashdollar @larry0 Download: http://rubygems.org/gems/features Description: "Plaintext User Stories Parser supporting native programming languages. Especially Objective-C" Same vulnerability as...

[email protected]

Title: ====== ePhoto Transfer v1.2.1 iOS - Multiple Web Vulnerabilities Date: ===== 2013-07-17 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1017 VL-ID: ===== 1017 Common Vulnerability Scoring System: ==================================== 6.6 Introduction: ============...