889 matches found
Discuz! 7.x csrf+存储xss(富文本)脱裤(2处)和后台sql(root getshell)(附带exploit)
简要描述： Discuz! 7.x csrf xss富文本脱裤和后台sqlroot getshell,这回个真的给你们发一个实实在在的xss,美包包！！！，求加精！ 详细说明： 今天审核了一下dz 7系列的内容，发现富文本一处代码，可绕过进行xss 首先我们看一下这个富文本绕过，直接看代码： diszuscode.func.php:305-317: function parseaudio$url, $width = 400, $autostart = 0 $ext = strtolowersubstrstrrchr$url, '.', 1, 5; switch$ext case 'mp3...
ThinkSAAS 2.2 存储型XSS
简要描述： 挖最后一个。。。然后干活去了。。。这个绕过和之前几个都不一样，各浏览器通用、无触发条件、可盗取cookie并getshell、绕过全局防过滤函数，非重复漏洞。 详细说明： 既然挖thinksaas，那么就看看他的富文本XSS究竟过滤好了没。 可惜还是让我失望了。不过也不是厂商的错，毕竟这东西确实很难做的完美。我会在漏洞修复处给一个很好解决方案。 先看原理吧。 function cleanJs$text $text = trim $text ; //$text = stripslashes $text ; // 完全过滤注释 $text = @pregreplace '//',...
Microsoft Word RTF pFragments Stack Buffer Overflow (File Format)
No description provided by source. $Id: ms10087rtfpfragmentsbof.rb 11875 2011-03-04 08:39:48Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...
Microsoft Windows XP/95/98/2000/NT 4 Riched20.dll Attribute Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6874/info The riched20.dll is vulnerable to a buffer overflow that results in the application calling the library to fail. By creating a Rich Text Format RTF file with more than 65536 bytes of data in an attribute, the...
Multiple Web Wiz Products Remote Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/27419/info Web Wiz Forums, NewsPad, and Rich Text Editor are prone to a remote information-disclosure vulnerability because they fail to properly sanitize user-supplied input. An attacker can exploit this issue to retriev...
ThinkSAAS 2.2-beta 存储型XSS
简要描述： 富文本过滤不严格导致可植入恶意脚本盗取用户cookies 详细说明： 对比了一下 WooYun: Thinksaas存储型XSS ，发现确实更新了。我就无耻的来了。 下面是对富文本过滤的代码片段： function cleanJs$text $text = trim $text ; //$text = stripslashes $text ; // 完全过滤注释 $text = pregreplace '//', '', $text ; // 完全过滤动æ€ä»£ç $text = pregreplace '//', '',...
[oss-security] Mumble 1.2.6: Mumble-SA-2014-005 and Mumble-SA-2014-006
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi oss-security, The Mumble team has just released Mumble 1.2.6, which contains fixes for the two following vulnerabilities: Mumble-SA-2014-005 http://mumble.info/security/Mumble-SA-2014-005.txt - SVG images with local file references could trigger...
DEBIAN-CVE-2010-5109
Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service crash via a crafted TNEF file, which triggers a buffer overflow...
Advance Notification Service for the April 2014 Security Bulletin Release
Today we provide advance notification for the release of four bulletins, two rated Critical and two rated Important in severity. These updates address issues in Microsoft Windows, Office and Internet Explorer. The update provided through MS14-017 fully addresses the Microsoft Word issue first...
Microsoft Word RTF Drawing Primitives Remote Code Execution (MS08-072) - Ver2 (CVE-2008-4028)
Rich Text Format RTF provides a format for text and graphics interchange that can be used with different operating systems. OLE is the technology that applications use to create and edit compound documents. By using OLE technology, an application can provide embedding and linking support. A remot...
Microsoft Word RTF Control Word Handling Integer Overflow (MS08-072) - Ver2 (CVE-2008-4025)
Rich Text Format RTF provides a format for text and graphics interchange that can be used with different operating systems. OLE is the technology that applications use to create and edit compound documents. By using OLE technology, an application can provide embedding and linking support. A remot...
destoon最新版某敏感功能xss指哪打哪
简要描述： 之前提交过，官方说补了 http://www.wooyun.org/bugs/wooyun-2014-053573 于是我看看修补以后的效果。 详细说明： 这是最新版的过滤富文本xss的函数： 已经解决了之前的问题。用expressi0n替换了expression。看似似乎没问题了。 其实还有各种问题。IE还有一个容错特性，那就是expression，其中加斜杠\，在IE6789上是可以触发的（当然我没测试更高版本）。所以，利用这个特性，可以绕过dsafe函数的过滤。 这时候，我们测试： 照弹无误：...
ThinkSNS存储型XSS一枚
简要描述： 存储型XSS 详细说明： thinksns在微吧的应用中，允许用户发表帖子，而帖子是富文本。 所以，不可避免地涉及到富文本中xss的过滤。而问题就出来过滤的地方。 thinksns使用如下函数过滤传入的参数 function h$text, $type = 'html' // 无标签格式 $texttags = ''; //只保留链接 $linktags = ''; //只保留图片 $imagetags = ''; //只存在字体样式 $fonttags = ''; //标题摘要基本格式 $basetags = $fonttags.' '; //兼容Form格式...
Microsoft Releases Security Advisory 2953095
Today we released Security Advisory 2953095 to notify customers of a vulnerability in Microsoft Word. At this time, we are aware of limited, targeted attacks directed at Microsoft Word 2010. An attacker could cause remote code execution if someone was convinced to open a specially crafted Rich Te...
PT-2014-1206 · Microsoft · Sharepoint Server +6
Name of the Vulnerable Software and Affected Versions: Microsoft Word versions 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT Word Viewer Office Compatibility Pack version SP3 Office for Mac version 2011 Word Automation Services on SharePoint Server versions 2010 SP1 and SP2 and 2013...
Microsoft Word RTF Object Parsing Remote Code Execution (MS08-072) - Ver2 (CVE-2008-4027)
Microsoft Word is a popular word processing software. A remote code execution vulnerability has been identified in Microsoft Word. The vulnerability is due to a memory calculation error in Microsoft Word that fails to properly handle specially crafted control words in Rich Text Format .rtf files....
Thinksaas存储型XSS
简要描述： 点击触发，因为多处调用的同一个函数所以多处存在问题 之前还交过一个它的sql注入一个越权。。求审核……审核……核 详细说明： Thinksaas是一款轻量级开源社区系统，界面我很喜欢。官网在http://www.thinksaas.cn/。 因为是一个类似论坛的社区，所以前台难免会有富文本编辑器，而处理不好富文本的话就容易产生XSS。自从看了M老师的文章，我对XSS也有了进一步的认识，所以才能找到Thinksaas过滤不严的XSS。 我们先看它使用的哪个函数对XSS进行的过滤，\thinksaas\tsFunction.php中： / 过滤脚本代码 @param unknow...
Debian DSA-2841-1 : movabletype-opensource - XSS
A cross-site scripting vulnerability was discovered in the rich text editor of the Movable Type blogging engine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-2841. The text itself is...
Debian Security Advisory DSA 2841-1 (movabletype-opensource - cross-site scripting)
A cross-site scripting vulnerability was discovered in the rich text editor of the Movable Type blogging engine. OpenVAS Vulnerability Test $Id: deb2841.nasl 6715 2017-07-13 09:57:40Z teissa $ Auto-generated from advisory DSA 2841-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks...
CVE-2014-0977
Cross-site scripting XSS vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...