SUSE-SU-2015:1810-1 Security update for python-Django

This update for python-Django fixes the following security issues: - Prevent Denial-of-service possibility by filling session store. bsc937522, CVE-2015-5143 - Prevent Header injection possibility. bsc937523, CVE-2015-5144 - A remote denial of service resource exhaustion attack against the django...

Multiple SQL Injection Vulnerabilities in Beijing Jinhe C6 Collaborative Management Platform

Jinhe OA is developed with asp.net and sqlserver technology and is used by many users. There are multiple SQL injection vulnerabilities in the OA system. However, these injections need to log in to the system to be able to use the OA system for sql filtering, but the filtering is not strict enoug...

GoAutoDial CE 3.3-1406088000 - Authentication Bypass Arbitrary File Upload Command Injection

GoAutoDial CE 3.3-1406088000 - Authentication Bypass Arbitrary File Upload Command Injection Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory:...

Debian DLA-68-1 : fex security update

CVE-2014-3875 When inserting encoded newline characters into a request to rup, additional HTTP headers can be injected into the reply, as well as new HTML code on the top of the website. CVE-2014-3876 The parameter akey is reflected unfiltered as part of the HTML page. Some characters are forbidd...

某政府系统两处注入打包

简要描述： RT 详细说明： 山东农友软件公司官网:http://www.nongyou.com.cn/ 和这个漏洞 WooYun: 某政府系统三处注入打包 是同一文件的但是不是同一目录下的注入，不知道算不算重复啊 第一处： http://61.133.119.187:8091/symItemView/ItemSixth.aspx?id=1 http://222.135.76.147:8200/symItemView/ItemSixth.aspx?id=1 http://222.135.127.190:7200/symItemView/ItemSixth.aspx?id=1...

某校园建站系统同一文件多处sql注入漏洞

简要描述： sql 详细说明： 使用量非常多 http://www.dlwsxx.com/ws2004/model/login1.asp http://www.fzjcxx.cn/ws2004/model/login1.asp http://www.nxyancgjzx.com/ws2004/model/login1.asp http://www.sgtjb.com/ws2004/model/login1.asp http://www.sdwhys.com/ws2004/model/login1.asp...

WordPress Plugin SEO by Yoast 1.7.3.3 - Blind SQL Injection

WordPress Plugin SEO by Yoast 1.7.3.3 - Blind SQL Injection Title: WordPress SEO by Yoast = 1.7.3.3 - Blind SQL Injection Version/s Tested: 1.7.3.3 Patched Version: 1.7.4 CVSSv2 Base Score: 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C CVSSv2 Temporal Score: 7...

SolarWinds Netflow Traffic Analyzer (NTA) < 4.1 Multiple SQLi Vulnerabilities

SolarWinds Netflow Traffic Analyzer NTA is prone to multiple SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

Symantec Encryption Management Server < 3.2.0 MP6 - Remote Command Injection

Vantage Point Security Advisory 2014-007 ======================================== Title: Symantec Encryption Management Server - Remote Command Injection ID: VP-2014-007 Vendor: Symantec Affected Product: Symantec Encryption Gateway Affected Versions: 3.2.0 MP6 Product Website:...

Multiple SQL Injection Vulnerabilities in Absolut Engine

Absolut Engine is a press release system. Absolut Engine has multiple SQL injection vulnerabilities. Due to the program failing to adequately filter user-supplied input. An attacker could exploit the vulnerabilities to compromise the application and access or modify data...

phpyun v3.2 (20141226) 两处注入。

简要描述： 最近更新日期（2014-12-26） 又更新了, 麻烦别再给5rank了 20走起可好。 一处是新的 一处算是绕过补丁了。 之前还有一两个没打补丁哦 加快速度把。 详细说明： 第一处 新发现的在兑换奖品的时候 在model/redeem.class.php中 function dhaction $this-publicaction; if!$this-uid && !$this-username $this-obj-ACTlayermsg"您还没有登录，请先登录！",8,$SERVER'HTTPREFERER'; if$POST'submit'...

Hdwiki (20141205) 存在7处SQL注入漏洞（含之前处理不当安全的漏洞）

简要描述： 看到更新了, 有几个老洞还没修复 也随便放到这里面来说了。 详细说明： 0x01 在control/comment.php 中 function doreport $usernames=array; $id=intval$this-post'id' ? $this-post'id' : 0; $report=trimhtmlspecialcharsWIKICHARSET==GBK?string::hiconv$this-post'report':$this-post'report'; ifempty$id||empty$report $this-message-1,'',2;...

CVE-2012-0811

Multiple SQL injection vulnerabilities in Postfix Admin aka postfixadmin before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via 1 the pw parameter to the pacrypt function, when mysqlencrypt is configured, or 2 unspecified vectors that are used in backup files generate...

Debian: Security Advisory (DSA-3030-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WeBid <= 1.1.1 Multiple XSS and LDAP Injection Vulnerabilities

WeBid is prone to multiple cross-site scripting XSS and LDAP injection vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

74cms (20140709) 9枚注入打个包

简要描述： 不好好修改漏洞代码 而是修改过滤函数 虽然你们这过滤函数我绕不过。 但是过滤的还不是很完善, 还能出数据。 还是在修改过滤函数的同时好好修改下产生漏洞的代码把。 详细说明： 看过滤函数 function removexss$string $string = pregreplace'/\x00-\x08\x0B\x0C\x0E-\x1F\x7F+/S', '', $string; $parm1 = Array'javascript', 'union','vbscript', 'expression', 'applet', 'xml', 'blink', 'link',...

Heaven Soft CMS 4.7 - SQL Injection Vulnerability

No description provided by source. x Tybe: SQL Injection Vulnerabilities x Vendor: http://www.newyorkindoorcricket.com/ x Script Name: Heaven Soft, CMS Version: 4.7 x author: PrinceofHacking x Team: Ashiyane Digital Security Team x Mail : PrincedotH4ck@gmaildotcom D0rk:photogalleryshow.php?id...

Scripts Genie Domain Trader (catalog.php, id param) - SQL Injection Vulnerability

No description provided by source. / / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // Domain Trader Script, MySQL Injection Vulnerabilities Software Page:...

Quantum Art QP7.Enterprise news_and_events_new.asp p_news_id Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/16022/info QP7.Enterprise is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful...

PDJK-support Suite 1.1 - Multiple SQL Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/15598/info PDJK-support Suite is prone to multiple SQL injection vulnerabilities. These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic o...