CSCMS在app/controllers/api/count.php中存在sql注入

No description provided by source...

YouYaX_V5.47 YouYa.php param 参数 SQL 注入

问题出现在ORG/YouYa.php文件中。 第356行： public function find$table, $ext = "string", $param //在 param 中寻找与给定的正则表达式 pattern 所匹配的子串 if pregmatchall"/=/", $param, $tmp $sql = "select from " . $table . " where " . $param; //echo 'x'.$sql; else $param = "id=$param"; $sql = "select from " . $table . " where "...

大汉 jcms m_5_7/replace/export.jsp 任意文件下载漏洞

No description provided by source...

CVE-2016-0852

CVE-2016-0852 affects Advantech WebAccess (pre-8.1). The vulnerability, described in ICS-CERT and CVE records, allows remote attackers to bypass an administrative requirement and gain access to files/folders via unspecified vectors. Affected versions include WebAccess 8.0 and earlier. Impact desc...

Commentator <= 2.5.2 - Reflected Cross-Site Scripting (XSS)

The commentator WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-admin/admin-ajax.php?action=commentatorsocialsignin&provider=facebook"...

Amanda 3.3.1 Local Root Privilege Escalation

AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup solution that allows the IT administrator to set up a single master backup server to back up multiple hosts over network to tape drives/changers or disks or optical media. Amanda uses native utilities and formats e.g. dump...

Emerson ROCLINK™ 800 弱口令

参考链接: http://www.documentation.emersonprocess.com/groups/public/documents/instructionmanuals/d301159x012.pdf...

Netcomm Wireless 弱口令

固件型号： 3G21WB 详情参考： http://media.netcomm.com.au/public/assets/pdffile/0003/68403/WSG-3G21WB.pdf 内容截图： /log/in?un=admin&pw=admin&rd=%2Fuir%2Find.htm&rd2=%2Fuir%2Fbsclogin.htm&Nrd=1 其他固件 ： 同样有说明文档，此处就不枚举了。...

Yokogawa YFGW410 gateway

No description provided by source...

Tecomat Foxtrot 弱口令

参考 http://dsec.ru/ipm-research-center/notification-of-vulnerabilities/tecomatplcparolipoumolchaniyu/...

Digi DC-ME-01T-S 弱口令

参考链接: http://www.digi.com/support/forum/13553/digi-connect-me-default-password...

Stulz GmbH Stulz WIB 8000 弱口令

该WEB接口存在3个无需用户名的默认密码且具有不同程度的控制权限。 1. ganymed -- 最高控制权限，管理员权限 2. kallisto -- 中级控制权限， 具有读写权限，仅有信息和操作级别的权限。 3. europa -- 低级别权限，只有读权限，仅有信息和操作级别的权限。 弱口令： ganymed – highest authorization, administrator kallisto – medium authorization, read and write, only levels “Info” and “Operate” europa – lowest...

Amanda 3.3.1 - Local Privilege Escalation

Amanda 3.3.1 - Local Privilege Escalation / AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup solution that allows the IT administrator to set up a single master backup server to back up multiple hosts over network to tape drives/changers or disks or optical media. Amanda...

B&B ELECTRONICS LR77 v2 Libratum/LR77 v2 弱口令

参考链接: http://www.induowireless.com/wp-content/uploads/2014/12/lr77-v2-libratum-manual.pdf, http://data.kommago.nl/files/pdf/conel-lr77v2-handleiding.pdf...

Emerson DeltaV™ Digital Automation System 弱口令

参考链接: http://www.chem.mtu.edu/chemeng/current/newcourses/CM4120/2009/Getting%20Started.pdf...

TAC AB TAC Xenta 500/700/911/913, TAC Xenta511, TAC Xenta527 弱口令

参考 http://www.xref.be/dpdf/tacxenta911xenta511manueluk.pdf...

ENTES EMG-10, EMG-02 , EMG-12 弱口令

参考链接: http://www.entes.com.tr/dosyalar/EMGSeriesEN-ver22.pdf...

Fortinet FortiGate 4.x 5.0.7 - SSH Backdoor Access

Fortinet FortiGate 4.x 5.0.7 - SSH Backdoor Access !/usr/bin/env python SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7 Usage: ./fgtsshbackdoor.py import socket import select import sys import paramiko from paramiko.py3compat import u import base64 import hashlib import termios import tty d...

53KF XSS打客服

简要描述： RT 详细说明： http://www22.53kf.com 在截图的时候截断 修改图片地址为XSS地址 即可打客服 漏洞证明：...

PostgreSQL CREATE LANGUAGE Execution

Some installations of Postgres 8 and 9 are configured to allow loading external scripting languages. Most commonly this is Perl and Python. When enabled, command execution is possible on the host. To execute system commands, loading the "untrusted" version of the language is necessary. This...