1202 matches found
PT-2013-79: Relative path traversal in SIMATIC WinCC Open Architecture
The specialists of the Positive Research center have detected a Relative path traversal vulnerability in SIMATIC WinCC Open Architecture. The SIMATIC WinCC OA integrated Web server at Port 4999/TCP might allow attackers to traverse through the server’s file system based on the application’s Windo...
HDWiki Xss+CSRF GetShell 0day
简要描述： 啊,这个不知道有没有奖金. Xss + CSRF = Getshell 详细说明： 主要两处问题： 一、前台创建词条时插入内容只是editor的js对敏感code做了客户端过滤，传入服务器后服务器端过滤不够严格，构成Xss。 二、后台对文件编辑时没有限制相对路径的使用，文件可以直接使用相对路径编辑在列表里可以看到默认是绝对路径的，并且在编辑文件位置没有进行验证，构成CSRF。 漏洞证明： 具体利用Getshell： 普通用户前台创建词条： 发布，截包修改： 这里插入的是一个写好的JS，编辑install/index.php内容为一句话木马。 内容如下： function aj...
perl Module::Signature privilege escalation
Relative path is used to execute external application...
Airlive IP Cameras - Multiple Vulnerabilities
Exploit for hardware platform in category web applications 1.Advisory Information Title: Airlive Multiple Vulnerabilities Date Published: 12/06/2013 Date of last updated: 12/06/2013 2.Vulnerability Description Multiple vulnerabilities have been found in this devices: -CVE-2013-3540. Cross Site...
Airlive CSRF / Traversal / Disclosure / Denial Of Service
=========================================================================== AIRLIVE ==================================================================== =========================================================================== 1.Advisory Information Title: Airlive Multiple Vulnerabilities Date...
Directory traversal
Directory traversal vulnerability in EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x before 5.2SP1 allows remote authenticated users to upload files, and consequently execute arbitrary code, via a relative path...
Readily remember arbitrary file upload flaws and fixes-vulnerability warning-the black bar safety net
Heard readily lend good make, registration number ready to buy a membership first try Pass avatar when the first-mover can now select all of the files, selected a qq. exe, point to upload, the bottom right corner traffic moving, Tip: incorrect format, open firebug, and then upload the returned fi...
CentOS Update for xmlsec1 CESA-2011:0486 centos5 x86_64
Check for the Version of xmlsec1 OpenVAS Vulnerability Test CentOS Update for xmlsec1 CESA-2011:0486 centos5 x8664 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...
[CVE-2012-1089] Apache Wicket serving of hidden files vulnerability
Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Wicket 1.4.x and 1.5.x Description: It is possible to view the content of any file of a web application by using an Url to a Wicket resource which resolves to a 'null' package. With such a Url the attacker can...
CentOS Update for elinks CESA-2009:1471 centos4 i386
The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...
CentOS Update for xmlsec1 CESA-2011:0486 centos4 i386
Check for the Version of xmlsec1 OpenVAS Vulnerability Test CentOS Update for xmlsec1 CESA-2011:0486 centos4 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...
Nagios XI privilege escalation
resetconfigperms.sh executable via suid root wrapper call external application by relative path...
Unsafe library loading vulnerabilities — Mozilla
Mozilla developer Ehsan Akhgari reported that a function used to load external libraries on Windows platforms was using a relative path to a DLL-loading application and was thus vulnerable to binary planting if an attacker was able to place an executable of the same name in the current working...
Qt Creator code execution
Dynamic libraries are loaded with relative path...
brltty: insecure relative RPATH
Untrusted search path vulnerability in libbrlttybba.so in brltty 3.7.2 allows local users to gain privileges via a crafted library, related to an incorrect RPATH setting...
CentOS 5 : mysql (CESA-2010:0109)
Updated mysql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL serve...
QQmail Multiple Xss Vulnerabilities-vulnerability warning-the black bar safety net
QQmail Multiple Xss Vulnerabilities Author: www.80vul.com 1. firefox2 css xss vulnerabilities styleBODY-moz-binding:url"http://www.80vul.coom/test.xmlxss"/style test.xml: ? xml version="1.0"?& gt; bindings xmlns="" binding id="xss" implementation constructor! CDATAalert'XSS'/constructor...
devalcms-lfi.txt
===================================================== Devalcms 1.4a Local File Inclusion Vulnerability ===================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...
Bugzilla -- Directory Traversal in importxml.pl
A Bugzilla Security Advisory reports: When importing bugs using importxml.pl, the --attachpath option can be specified, pointing to the directory where attachments to import are stored. If the XML file being read by importxml.pl contains a malicious ../relativepath/to/localfile node, the script...