Digital Paradise Mobile Office Middleware Interface Arbitrary XML File Read Vulnerability

Digital Paradise's MKey3G mobile office middleware is an enterprise-oriented application BYOD middleware platform, which has been widely used in energy, finance, government and enterprises. There is an arbitrary XML file reading vulnerability in the interface of Digital Paradise's mobile office...

Digital Paradise Mobile Office Middleware Interface Arbitrary File Write Vulnerability

Digital Paradise's MKey3G mobile office middleware is an enterprise-oriented application BYOD middleware platform, which has been widely used in energy, finance, government and enterprises. There is an arbitrary file writing vulnerability in the interface of Digital Paradise's mobile office...

OpenBravo Hibernate HQL Injection

Title: OpenBravo Hibernate HQL Injection Vulnerability Author: Sam Ng, HPE Software Security Research Team Vendor Patch: 3.0PR15Q3.4 and 3.0PR15Q4.1 Vendor Reference: https://issues.openbravo.com/view.php?id=31577, http://wiki.openbravo.com/wiki/ReleaseNotes/3.0PR15Q3.4,...

python-django: Denial-of-service possibility in logout() view by filling session store

It was found that Django incorrectly handled the session store. A session could be created by anonymously accessing the django.contrib.auth.views.logout view if it was not decorated correctly with django.contrib.auth.decorators.loginrequired. A remote attacker could use this flaw to fill up the...

Django logout function Denial-of-service

Security releases issued: 1.8.4, 1.7.10, 1.4.22CVE: 2015-5963Fix: Update/1.8.4/1.7.10/1.4.22/Add @loginrequiredDjango 官方在八月十八号发布多个版本更新，修复几个安全问题，其中便包括一个由编码不当导致的 DoS 漏洞，测试一些网站均存在此问题。Detaildjango.contrib.auth.views.logout 视图用于开发者实现用户注销退出功能，正常情况下对于 logout 视图应使用官方提供的...

python-django: Denial-of-service possibility in logout() view by filling session store

It was found that Django incorrectly handled the session store. A session could be created by anonymously accessing the django.contrib.auth.views.logout view if it was not decorated correctly with django.contrib.auth.decorators.loginrequired. A remote attacker could use this flaw to fill up the...

Multiple SQL Injection Vulnerabilities in Beijing Jinhe C6 Collaborative Management Platform

Jinhe OA is developed with asp.net and sqlserver technology and is used by many users. There are multiple SQL injection vulnerabilities in the OA system. However, these injections need to log in to the system to be able to use the OA system for sql filtering, but the filtering is not strict enoug...

RhinoSoft Serv-U FTP Server 3/4/5 MDTM Command Time Argument Buffer Overflow Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/9751/info Serv-U FTP Server has been reported prone to a remote stack based buffer overflow vulnerability when handling time zone arguments passed to the MDTM FTP command. The problem exists due to insufficient bounds...

orbis cms 1.0 (afd/adf/asu/sql) Multiple Vulnerabilities

No description provided by source. + Orbis CMS 1.0 AFD/ADF/ASU/SQL Multiple Remote Vulnerabilities + Discovered By SirGod + http://insecurity-ro.org + http://h4cky0u.org + Dork : Powered by Orbis CMS + Download script : http://www.novo-ws.com/orbis-cms/download.shtml + Arbitrary File Download + -...

Multiple Vulnerabilities in Hitachi Tuning Manager and JP1/Performance Management - Manager Web Option

Overview Hitachi Tuning Manager and JP1/Performance Management - Manager Web Option contains cross-site scripting and cross-site request forgery CSRF vulnerabilities. These vulnerabilities can not be exploited, unless logging in these products. Impact A remote attackers could insert to malicious...

Multiple vulnerabilities in Hitachi Tuning Manager and JP1/Performance Management

Overview Hitachi Tuning Manager, JP1/Performance Management - Web Console, and JP1/Performance Management - Manager Web Option contain Cross-site scripting and cross-site request forgery CSRF vulnerabilities. These vulnerabilities can not be exploited, unless logging in these products. Impact A...

Vulnerability in core server (CVE-2009-0922)

It is possible to cause a momentary denial of service when there is a failure to convert a localized error message to the client-specified encoding. A valid login is required to exploit this vulnerability...

Orca 2.0.2 Cross Site Scripting

--------------------------------------------------------------------------\ + Script : Orca-v.2.0.2 + Bug: Xss + By: J-Hacker || Jerusalem Hacker || From : soqor.net + Email : [email protected] + Download : http://www.boonex.com/thankyou.php?p=Orca-v.2.0 + D0rk :Powered by Orca Interactive Forum...

Upload command to Startup folder

Added: 01/20/2009 Background Each user's Startup folder on Windows systems contains programs which run at start-up time. This tool attempts to upload a command connection to a user's Startup folder. If successful, the connection will be established the next time the computer starts. Limitations A...

ace-sql.txt

--==+================================================================================+==-- --==+ Ace Image Hosting Script SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE: N/A DORK: N/A...

netflow-xss.txt

NetFlow Analizer 5 & OpManager 7 multiple XSS vendor url:http://www.adventnet.com/ advisore:http://lostmon.blogspot.com/2007/07/ netflow-analizer-5-opmanager-7-multiple.html vendor notify:yes exploits include:yes NetFlow Analizer and OpManager contains a flaw that allows a remote cross site...

Vulnerability in core server (CVE-2005-0247)

Multiple buffer overflows in the PL/PGSQL parser may allow attackers to execute arbitrary code. A valid login is required to exploit this vulnerability...

Vulnerability in contrib module (CVE-2005-0246)

The intagg contrib module allows attackers to cause a denial of service. A valid login is required to exploit this vulnerability...

PT-2005-1325 · Postgresql +1 · Postgresql +1

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions 8.0.0 and earlier Description: The issue is related to buffer overflows in the gram.y file for PostgreSQL and the PL/PGSQL parser, which may allow attackers to execute arbitrary code. A valid login is required to exploit...

RhinoSoft Serv-U FTPd Server 3/4/5 - 'MDTM' Time Argument Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/9751/info Serv-U FTP Server has been reported prone to a remote stack based buffer overflow vulnerability when handling time zone arguments passed to the MDTM FTP command. The problem exists due to insufficient bounds checking. Ultimately an attacker m...