53KF某处一个注入点

简要描述： 某处的一个注入 详细说明： 存在注入的地址: http://www10.53kf.com/zdydbgg2.php?styleid=106098168&companyid=72067196&dbggtype=2 sqlmap identified the following injection points with a total of 0 HTTPs requests: --- Place: GET Parameter: styleid Type: boolean-based blind Title: AND boolean-based blind - WHERE or...

vBulletin vBSSO Single Sign-On 1.4.14 - SQL Injection

vBulletin vBSSO Single Sign-On 1.4.14 - SQL Injection Exploit Title: vBulletin vBSSO Single Sign-On – = 1.4.15 This plugin is vulnerable to SQL injection at the /vbsso/avatar.php file in the fetchUserinfo function. It requires a big UNION ALL SELECT query and commenting out the LIMIT function of...

President Proposes National Breach Notification Standard

Lacking precious detail, President Obama today proposed a national data breach notification standard, legislation that would mandate breached companies notify affected consumers inside of 30 days. The national law would supersede the current collection of state laws that govern notification...

Cart66 Lite <= 1.5.3 - SQL Injection

The QSA named ‘q’ for the ‘promotionProductSearch’ AJAX call is not being sanitized, which allows for MySQL injection utilizing a UNION. The user must be logged in for this to be applicable. The output is JSON encoded, however is a pure representation of the data returned from a MySQL query...

IBM DB2 9.7 < Fix Pack 10 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 9.7 running on the remote host is affected by the following vulnerabilities : - An input-validation error exists related to handling the 'ALTER MODULE' statement that allows buffer overflows. CVE-2014-3094 - An error exists related to handling...

Threat Outbreak Alert RuleID12253: Email Messages Distributing Malicious Software on November 4, 2014

Medium Alert ID: 36321 First Published: 2014 November 5 14:05 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID12253 may contain the following files: Name |...

用友FE协作办公系统SQL注入漏洞(一)

简要描述： 用友FE协作办公系统某处过滤不严，导致SQL注入漏洞 详细说明： 用友FE协作办公系统某处过滤不严，导致SQL注入漏洞，可直接union注入 注入链接：/sys/treeXml.jsp?Si06=1&type=sort 注入参数：Si06 Payload： Si06=1%27+UNION+ALL+SELECT+1,@@version,1,1,1,1,1,1,1,1,1,1,1,1--&type=sort Sqlmap命令： python sqlmap.py -u 'http://xxxx//sys/treeXml.jsp?Si06=1&type=sort' -p Si06...

用友FE协作办公系统SQL注入漏洞

简要描述： RT 详细说明： 用友FE协作办公系统某处过滤不严，导致SQL注入漏洞，可直接union注入 注入链接：/system/config/deptTreeXml.jsp?type=group&SG04=1 注入参数：SG04 Payload：SG04=1'+UNION+ALL+SELECT+1,@@version,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1-- Sqlmap注入：python sqlmap.py -u 'http://xxxx/system/config/deptTreeXml.jsp?type=group&SG04=1...

shop7z注入漏洞#5

简要描述： shop7z注入漏洞5 详细说明： 前台sql注入： http://www.shop7z.com/demo/showfoot.asp?cid=%2527 注入参数：cid 支持Union查询的大洞一枚 漏洞证明： http://www.shop7z.com/demo/showfoot.asp?cid=%2527 支持Union查询的大洞一枚...

[SECURITY] Fedora 20 Update: ctags-5.8-16.fc20

Ctags generates an index or tag file of C language objects found in C source and header files. The index makes it easy for text editors or other utilities to locate the indexed items. Ctags can also generate a cross reference file which lists information about the various objects found in a set o...

CVE-2014-6882

The CVE-2014-6882 entry concerns the Android app for Western Federal Credit Union (version 2.1), which does not verify X.509 certificates when connecting to SSL servers. This creates a risk of man-in-the-middle attacks, potentially allowing a crafted certificate to spoof the server and expose sen...

CVE-2014-6882: Undefined Security Weakness

The Western Federal Credit Union aka com.kerrata.pulse.western application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Gulf Credit Union aka FiMobile.Gulf application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6828

The CVE-2014-6828 entry concerns the Gulf Credit Union Fi_Mobile.Gulf Android app (version 1.1) that does not verify X.509 certificates when establishing SSL connections. This root cause enables man-in-the-middle attackers to spoof TLS servers and obtain sensitive information via a crafted certif...

CVE-2014-5771

The Credit Union of Texas Mobile aka FiMobile.CUOT application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5771

Credit Union of Texas Mobile (Fi_Mobile.CUOT) Android app 1.1 is vulnerable due to lack of X.509 certificate validation in SSL/TLS, allowing MITM attacker to spoof servers and access sensitive data via crafted certificates. Affected: CUOT Android app v1.1. No remediation details provided in the c...

CVE-2014-5771: Undefined Security Weakness

The Credit Union of Texas Mobile aka FiMobile.CUOT application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

IBM DB2 10.5 < Fix Pack 4 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 10.5 running on the remote host is affected by the following vulnerabilities : - An error exists related to JavaScript Object Notation JSON-C handling, string parsing, and the hash function that allows denial of service attacks. CVE-2013-6371 ...

CVE-2014-3095: Improper Input Validation

The SQL engine in IBM DB2 9.5 through FP10, 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service daemon crash via a crafted UNION clause in a subquery of a SELECT statement...

cmseasy csrf导致sql注入绕过union getshell

简要描述： 上一次做了一个csrf+sql注入getshell的 这一次我继续发一个，由于此属于一个get类型的，所以很简单的，管理员根本就不用去点击，就能触发sql并且getshell 详细说明： 首先我们分析一下sql语句： admin/live/header.php:line:16-21 include'../../include/config.inc.php'; includeCEROOT.'/include/admin/check.inc.php'; includeCEROOT.'/include/celive.class.php'; $adminheader = new...