5896 matches found
CVE-2013-2756
Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform formerly Citrix CloudStack 3.0.x before 3.0.6 Patch C allows remote attackers to bypass the console proxy authentication by leveraging knowledge of the source code...
CVE-2 0 1 3-4 5 4 7 Nginx parsing vulnerability in-depth use and analysis-vulnerability warning-the black bar safety net
0x00 background Nginx historically there have been many times parsing vulnerability, such as 80sec found parsing vulnerability, as well as the extension directly after add%0 0 truncation lead to code execution resolves vulnerabilities. But in 2 0 1 3 year-end, nginx again broke Vulnerability, CVE...
bug vulnerability handling mechanism system-bugtracker-bug warning-the black bar safety net
For the company configured a Bug tracking system, 找到BugTracker.NET,read a bit, the translation of which is configuration. After a research experience then put up to share. A friend in need can be the following URL to download http://sourceforge.net/project/showfiles.php?groupid=66812 BugTracker...
FreeBSD Security Advisory FreeBSD-SA-14:09.openssl [REVISED]
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:09.openssl Security Advisory The FreeBSD Project Topic: OpenSSL use-after-free vulnerability Category: contrib Module: openssl Announced: 2014-04-30 Affects:...
Fedora 19 : syncevolution-1.4.1-1.fc19 (2014-5236)
Update to 1.4.1 stable release CVE-2014-1639 syncevolution: insecure temporary file usage in installcheck-local.sh It was found 1 that the installcheck-local.sh script of the syncevolution package creates temporary files in an insecure way. A local attacker could use these flaws to perform a...
New NIST AppVet Aims to Streamline Application Security
Apple and Google put developers’ apps through a relatively vigorous screening process before they make their way into their respective app stores. Now developers who produce apps intended for use on internal networks at government agencies can get a vetting process of their own. The National...
CVE-2014-2719
AdvancedSystemContent.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code...
Code injection
AdvancedSystemContent.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code...
CVE-2014-2719: Exposure of Sensitive Information to an Unauthorized Actor
AdvancedSystemContent.asp in the ASUS RT series routers with firmware before 3.0.0.4.374.5517, when an administrator session is active, allows remote authenticated users to obtain the administrator user name and password by reading the source code...
Yahoo!: readble .htaccess + Source Code Disclosure (+ .SVN repository)
Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...
Concrete CMS: FULL PATH DISCLOSUR
Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page source, require the attacker to have the full path to the file they wis...
IRCCloud: Login CSRF
Hi sir, There is no mitigation of XCSRF in your login form. Kindly check the source code of login: Login Forgotten your password? kindly let me know if you needed more information. Clifford...
MS-DOS: Bug in Source Code Files(v1.1)
Hello, While i was Going through object Files of v1.1 and Opened MS-dos Applications everything was going fine, Then i opened 'CHKDSK' Then suddenly the interface Crashed and It After That it Gave Such a Feedback to my Windows That All the DOS Related Applications are incompatible And are not a...
[SECURITY] Fedora 20 Update: python-astroid-1.0.1-2.fc20
The aim of this module is to provide a common base representation of python source code for projects such as pychecker, pyreverse, pylint, and others. It extends the class defined in the compiler.ast python module with some additional methods and attributes...
EspCMS最新版可伪造任意帐户登陆（简单利用代码）
简要描述： EspCMS最新版可伪造任意帐户登陆（源码分析） 测试版本espcmsutf85.8.14.03.03b 详细说明： EspCMS中用户cookie生成算法中重要的就是dbpscode 貌似前面有大牛提交过多次，厂商都只是略作修改，并没有最终搞定问题 这里来说一下，可以通过注册普通帐号，通过帐号+cookie破解得到dbpscode 首先是cookie加密算法，/public/classfunction.php，144-170行 function eccode$string, $operation = 'DECODE', $key =...
vtiger CRM 5.4.0 get_tickets_list SQLi
SQL Injection vulnerability in vtiger CRM getticketslist SOAP method in /soap/customerportal.php Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...
DedeCMS latest through the kill injection(buy_action.php)vulnerability analysis-vulnerability warning-the black bar safety net
0x00 Preface Two days ago, dark clouds white hat submitted two DedeCMS through killing injection vulnerabilities, much noise uproar, 2, No. 5, weaving dreams official release of the patch, so you download the latest code back to do a comparison, here is a simple analysis under the one injection...
Oracle Demantra 12.2.1 - Arbitrary File Disclosure
Exploit for windows platform in category web applications Details: The Team discovered a Local File Include LFI vulnerability. A file inclusion vulnerability occurs when a file from the target system is injected into a page on the attacked server page. The vulnerable page is: /demantra/GraphServl...
Oracle Demantra 12.2.1 - Arbitrary File Disclosure
Oracle Demantra 12.2.1 - Arbitrary File Disclosure Details: The Team discovered a Local File Include LFI vulnerability. A file inclusion vulnerability occurs when a file from the target system is injected into a page on the attacked server page. The vulnerable page is: /demantra/GraphServlet...