OpenSSL Security Bypass Vulnerability

OpenSSL is an open source implementation of SSL used to enable strong encryption of network communications and is now widely used in a variety of web applications. A security bypass vulnerability exists in OpenSSL that could be exploited by an attacker to perform unauthorized operations...

RabbitMQ 'rabbit_mgmt_util.erl' Security Bypass Vulnerability

RabbitMQ is a messaging agent that is typically used to integrate applications or different components of an application through messaging. A security bypass vulnerability exists in RabbitMQ 'rabbitmgmtutil.erl', which can be exploited by an attacker to bypass certain security restrictions and...

ManageEngine Desktop Central Remote Security Bypass Vulnerability

Manageengine desktop central is a complete windows client management software that enables remote management of desktop and mobile computers with its remote software installation and configuration options. A remote security bypass vulnerability exists in ManageEngine Desktop Central, which can be...

KPPW最新版SQL注入漏洞八(全局问题导致12处注入及越权操作)

简要描述： KPPW最新版SQL注入漏洞八，从一处问题找出罪魁祸首，全局文件问题导致12处注入及越权操作 详细说明： KPPW最新版SQL注入漏洞八，从一处问题找出罪魁祸首，全局文件问题导致12处注入及越权操作 文件/control/pubgoods.php sysconfig'indexseodesc'; $id = intval$id; $step = strvaltrim$step; ...... $strUrl = "index.php?do=pubgoods&id=".$id; $SESSION'spread' = 'index.php?do=pubgoods'; requir...

YXCMS1.2.6版本1处任意文件删除+6处越权操作

简要描述： YXCMS1.2.6版本1处任意文件删除+6处越权操作 详细说明： 经过简单的审计发现YXcms一处任意文件删除漏洞（不是wooyun上已经提交过的）和多处越权操作（只举出一例作为证明） 1. 任意文件删除漏洞 出这个漏洞的代码位于/protected/apps/member/controller/newsController.php的 delcover函数中： public function delcover //文件保存目录 $id=in$POST'id'; $pic=in$POST'pic'; $data'picture'= $this-nopic;...

Invision Power Board (IP.Board) 3.x - Cross-Site Request Forgery Token Hjiacking

Invision Power Board IP.Board 3.x - Cross-Site Request Forgery Token Hjiacking Title: IP Board 3.x CSRF - Token hjiacking Date: 03.09.14 Version: = 3.4.6 Vendor: invisionpower.com Author: Piotr S. Video-PoC: https://www.youtube.com/watch?v=G5P21TA4DjY 1 Introduction Latest and propabbly previous...

YiDacms 最新版重置任意用户账户二及其他越权操作

简要描述： YiDacms 最新版重置任意用户账户，及其他越权操作 详细说明： 易达CMS 企业建站系统 当前最新版本是：YidaCms X3.2（20140718）版 之前发过一次重置任意用户密码的漏洞，但是只能修改成固定的密码，要是修改成任意密码的话，比较麻烦，需要md5明文密码后取10位作为信息密码，较麻烦。 这里我们直接输入任意明文密码，即可修改 来看看源代码： 文件/Yidacms/user/user.asp if request"yidacms"="password" Then set rs=server.createobject"adodb.recordset" useri...

PHPBB2 Page_Header.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6888/info A SQL injection vulnerability has been reported in phpBB2. phpBB2, in some cases, does not sufficiently sanitize user-supplied input which is used when constructing SQL queries. As a result, attackers may supply...

CVE-2014-0123

The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict 1 view and 2 edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to...

Easy to think ESPCMS Cookie injection-vulnerability warning-the black bar safety net

Easy to think ESPCMS enterprise website management system based on LAMP development to build enterprise website management system. Easy to think ESPCMS enterprise website management system V5. 6 There is a Cookie injection vulnerability, an attacker may use this vulnerability to destroy the...

MyBB 1.x 多个安全漏洞

BUGTRAQ ID: 50816 MyBB是一款流行的Web论坛程序。 MyBB在实现上存在跨站脚本执行、跨站请求伪造和其他多个安全漏洞，攻击者可利用这些漏洞在受影响站点用户浏览器中执行任意脚本，窃取cookie验证凭证，泄露或修改敏感信息或这些非法操作。 1）好友列表中的未解析头像中存在错误； 2）通过用户名传递的输入在返回给用户之前没有正确过滤，导致在受影响站点的用户浏览器中执行任意HTML和脚本代码； 3）应用允许用户通过HTTP请求执行某些操作，但不验证这些请求。可在用户浏览特制的网页时更改语言设置。 MyBB 1.x 厂商补丁： MyBB ----...

Ruby on Rails安全限制绕过和SQL注入漏洞

BUGTRAQ ID: 46292 CVE ID: CVE-2011-0448,CVE-2011-0449 Ruby on Rails简称RoR 或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails在实现上存在安全限制绕过和SQL注入漏洞，攻击者可利用安全限制绕过漏洞绕过某些安全限制和执行未授权操作，利用SQL注入漏洞修改SQL请求，完全控制受影响软件，检索信息或修改数据。 Ruby on Rails Ruby on Rails 3.x 厂商补丁： Ruby on Rails -------------...

Objectivity/DB Lack of Authentication Remote Exploit

!/usr/bin/python obj.py Objectivity/DB Lack of Authentication Remote Exploit Jeremy Brown 0xjbrown41-gmail-com Jan 2011 "Objectivity, Inc. is a leader in distributed, scalable database technology. Our patented data management engine and persistent object store is the enabling technology powering...

Objectivity/DB - Lack of Authentication

!/usr/bin/python obj.py Objectivity/DB Lack of Authentication Remote Exploit Jeremy Brown 0xjbrown41-gmail-com Jan 2011 "Objectivity, Inc. is a leader in distributed, scalable database technology. Our patented data management engine and persistent object store is the enabling technology powering...

RapidWareX 2.0.1 Cross Site Request Forgery

...

Code injection

vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete 1 attachments, 2 reports, 3 filters, 4 views, and 5 tickets; insert 6 attachments, 7 reports, 8 filters, 9 views, and 10 tickets; and edit 11 reports, 12 filters, 13 views, and 14 tickets via...

OpenJDK JMX allows illegal operations with local monitoring (6332953)

Unspecified vulnerability in the Java Management Extensions JMX management agent in Sun Java Runtime Environment JRE in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform unauthorized operations" via...

OpenJDK JMX allows illegal operations with local monitoring (6332953)

Unspecified vulnerability in the Java Management Extensions JMX management agent in Sun Java Runtime Environment JRE in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform unauthorized operations" via...

OpenJDK JMX allows illegal operations with local monitoring (6332953)

Unspecified vulnerability in the Java Management Extensions JMX management agent in Sun Java Runtime Environment JRE in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform unauthorized operations" via...

OpenJDK JMX allows illegal operations with local monitoring (6332953)

Unspecified vulnerability in the Java Management Extensions JMX management agent in Sun Java Runtime Environment JRE in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform unauthorized operations" via...