6698 matches found
ThinkSAAS因过滤不严导致的存储型XSS（两处）
简要描述： 因某函数的过滤不严，导致存在存储型XSS 详细说明： 第一处XSS漏洞： 问题存在于 ： http://localhost/thinksaas/index.php?app=group&ac=create&ts=do 我们看看代码 //执行创建小组 case "do": if$TSAPP'options''iscreate' == 0 || $TSUSER'user''isadmin'==1 ifintval$POST'grpagreement' != 1 tsNotice'不同意社区指导原则是不允许创建小组的！'; $groupname = t$POST'groupname'...
WordPress Photo-Gallery Cross Site Request Forgery Vulnerability
WordPress Photo-Gallery plugin suffers from a cross site request forgery vulnerability. Note that this finding houses site-specific data. + Wordpress Cross Site Request Forgery in Plugin photo-gallery + Date: 07/05/2014 + Risk: HIGH + Author: Felipe Andrian Peixoto + Vendor Homepage:...
WordPress Photo Gallery Plugin <= 1.2.41 - Cross Site Request Forgery
This plugin is prone to a cross site request forgery vulnerability. Solution Update the plugin...
WordPress Photo-Gallery Cross Site Request Forgery
Wordpress Cross Site Request Forgery in Plugin photo-gallery + Date: 07/05/2014 + Risk: HIGH + Author: Felipe Andrian Peixoto + Vendor Homepage: https://wordpress.org/plugins/photo-gallery/ + Contact: [email protected] + Tested on: Windows 7 and Linux + Vulnerable File: UploadHandler.php...
Photo-Gallery <= 1.2.41 - UploadHandler.php File Upload CSRF
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by an UploadHandler.php File Upload CSRF security vulnerability...
Synology DSM4 Blind SQL Injection
Title: Synology DSM Blind SQL Injection Version affected: = 4.3-3827 Vendor: Synology Discovered by: Michael Wisniewski Status: Patched The file "/photo/include/blog/article.php" contains a Blind SQL Injection Vulnerability in the 'value' variable in the URL. The vendor was contacted approximatel...
Flash Photo Gallery <= 0.7 - XSS
Plugin is still affected and has been closed...
Threat Outbreak Alert: Fake Personal Photo Sharing Email Messages on April 16, 2014
Medium Alert ID: 33836 First Published: 2014 April 17 18:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a photo for the recipient. The text in the email message attempts to convince the recipient to open the attachme...
[SECURITY] Fedora 20 Update: ImageMagick-6.8.6.3-4.fc20
ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...
iVault Private P&V 1.1 iOS - Path Traversal Vulnerability
Document Title: =============== iVault Private P&V 1.1 iOS - Path Traversal Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1253 Release Date: ============= 2014-04-08 Vulnerability Laboratory ID VL-ID: ====================================...
Slack: Stored XSS in Slack.com
Steps: Go to your respective URL Mine is https://dezignburg.slack.com/account/photo now Change your photo using Facebook But before that create a Album in your Facebook naming it as " And you will get this error: http://prntscr.com/37eecd If you need a video just tell me...
Private Photo+Video 1.1 Pro iOS - Persistent
Document Title: =============== Private Photo+Video v1.1 Pro iOS - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1249 Release Date: ============= 2014-04-01 Vulnerability Laboratory ID VL-ID: ===================================...
Private Photo+Video v1.1 Pro iOS - Persistent Vulnerability
Document Title: =============== Private Photo+Video v1.1 Pro iOS - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1249 Release Date: ============= 2014-04-01 Vulnerability Laboratory ID VL-ID: ===================================...
My Photo Wifi Share & PS 1.1 iOS - Local Command Injection Vulnerability
Document Title: =============== My Photo Wifi Share & PS 1.1 iOS - Local Command Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1232 Release Date: ============= 2014-03-24 Vulnerability Laboratory ID VL-ID:...
PhotoWIFI Lite 1.0 iOS - Multiple Vulnerabilities
Document Title: =============== PhotoWIFI Lite v1.0 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1239 Release Date: ============= 2014-03-27 Vulnerability Laboratory ID VL-ID: ==================================== 123...
强智综合教务系统后台上传漏洞，可沦陷服务器
简要描述： 后台上传获取webshell 通过搜索获得Oracle数据库管理权限 修改成绩 详细说明： http://www.qzdatasoft.com:8088/qznjw/ewebeditor/admin/ 默认账号密码admin 直接上传webshell 获取root权限 （ewebeditor后台授权漏洞修补 目前无法使用ewebeditor后台进行上传） 搜索 oracle.jdbc.driver.OracleDriver 可以获取Oracle数据库账号密码 通过官方PDF文档知晓 成绩保存在CJ0708 补考保存在CJ0708BK 通过近期对服务器信息收集发现...
Threat Outbreak Alert: Fake Photo Sharing Email Messages on March 18, 2014
Medium Alert ID: 33399 First Published: 2014 March 18 19:19 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a picture for the recipient. The text in the email message attempts to convince the recipient to open the...
Design/Logic Flaw
Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain sensitive photo data by launching the Photos app and looking under a transparent image...
CVE-2014-1281
Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain sensitive photo data by launching the Photos app and looking under a transparent image...
CVE-2014-1281
CVE-2014-1281 affects Apple iOS prior to 7.1, specifically the Photos Backend asset-library cache handling during deletions. The issue allows physically proximate attackers to access sensitive photo data by triggering the Photos app and inspecting a transparent image beneath it. The root cause is...