ecshop最新版本存储XSS至后台

简要描述： 存储XSS 直接打后台。对电商网站比较容易中 详细说明： 问题出现在用户充值页面，充值如果没有付款成功的话，后台查看充值记录位置调用的是act=check，此页面已经过滤 但是如果充值了并且完成付款，后台查看充值记录位置 变成act=edit 此页面没有过滤，所以导致问题发生。 user.php 1424行 / 变量初始化 / $surplus = array 'userid' = $userid, 'recid' = !empty$POST'recid' ? intval$POST'recid' : 0, 'processtype' =...

Disabled user are still able to request for password reset email.

h3. Step to Reproduce: Disable a user test in Crowd administration console make sure that there is no duplicate user Request password reset for the disabled user test h3. Expected result No mail will be sent to disabled account. h3. Observerd Result. The disabled user still receive the password...

TweetDeck Taken Down in Wake of XSS Attacks

TweetDeck services have been disabled for the time being as Twitter tries to get a handle on a cross-site scripting vulnerability that caused mountains of consternation on the social networking platform this morning. We've temporarily taken TweetDeck services down to assess today's earlier securi...

Files Desk Pro 1.4 Local File Inclusion

Document Title: =============== Files Desk Pro v1.4 iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1266 Release Date: ============= 2014-05-16 Vulnerability Laboratory ID VL-ID: ====================================...

Artiva Agency Single Sign-On (SSO) feature vulnerability

Overview Artiva Agency Single Sign-On SSO feature checks only the local Windows login name which could allow an attacker to impersonate another Artiva Agency user. Description Artiva Agency Single Sign-On SSO feature when configured with the domain name option allows the currently logged on Windo...

IRCCloud: User Account Creation CSRF

Any One Account Can be created and display home screen Please Fix this...

Katello (RedHat Satellite) - users/update_roles Missing Authorisation (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Katello Red Hat Satellite users/updateroles Missing Authorization', 'Description' = %q This module exploits a missing authorization...

74cms某功能注入漏洞（有条件）

简要描述： 略鸡肋,分享出来。 详细说明： 最新版v3.4，更新时间20140310 文件/plus/weixin.php responseMsg函数，使用 $postStr = $GLOBALS"HTTPRAWPOSTDATA"; 获得了post数据。所以，可以无视GPC。 获得的数据是XML格式，我们一会发送数据包即可。 继续看该函数： if !empty$postStr $postObj = simplexmlloadstring$postStr, 'SimpleXMLElement', LIBXMLNOCDATA; $fromUsername =...

CVE-2013-1851

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the usermigrate application is enabled, allows remote authenticated users to import arbitrary files to the user's account via unspecified vectors...

EUVD-2014-0355

The Security Account Manager Remote SAMR protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly determine the user-lockout state, which makes it easier for...

Blue Coat ProxySG Local User Modification Race Condition

The remote Blue Coat ProxySG device's SGOS self-reported version is prior to 6.5.4.0. It is, therefore, potentially affected by a race condition issue during the time before the new changes take effect after a local user account modification due to configuration caching. User account modification...

IBM BPMS 8.0.0.1 Privilege Escalation / Disclosure

IBM BPMS version 8.0.0.1 suffers from account reconfiguration, privilege escalation, and information disclosure vulnerabilities. Exploit Title: IBM BPMS BPM User account reconfiguration/Privilege Escalation/Information Disclosure Date: 31.01.14 Exploit Author: 0in Software link:...

IBM BPMS 8.0.0.1 Privilege Escalation / Disclosure

Exploit Title: IBM BPMS BPM User account reconfiguration/Privilege Escalation/Information Disclosure Date: 31.01.14 Exploit Author: 0in Software link: http://www-03.ibm.com/software/products/en/business-process-manager-family/ Version: 8.0.0.1 newest versions can also be vulnerable Vulnerability...

IBM Business Process Manager - User Account Reconfiguration

IBM Business Process Manager - User Account Reconfiguration Exploit Title: IBM BMPS BPM User account reconfiguration/Privilege Escalation/Information Disclosure Date: 31.01.14 Exploit Author: 0in Software link: http://www-03.ibm.com/software/products/en/business-process-manager-family/ Version:...

IBM Business Process Manager - User Account Reconfiguration

Exploit Title: IBM BMPS BPM User account reconfiguration/Privilege Escalation/Information Disclosure Date: 31.01.14 Exploit Author: 0in Software link: http://www-03.ibm.com/software/products/en/business-process-manager-family/ Version: 8.0.1.1 newest versions can also be vulnerable Vulnerability...

MGASA-2014-0031 Updated drupal package fixes security vulnerabilities

Christian Mainka and Vladislav Mladenov reported a vulnerability in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts CVE-2014-1475. Matt Vance and Damien Tournoud reported an access bypass vulnerability in the...

Phabricator: Improperly implemented password recovery link functionality

I took a look at live install of Phabricator https://secure.phabricator.com/ and noticed, that the user gets automatically logged in after clicking the password recovery link this link is sent to the user's mail. This authentication takes place before the user is asked to enter a new password...

Plone CMS Credential Disclosure

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Plone CMS Vendor: Plone Foundation http://plone.org IDs: CSNC-2013-013, CVE-2013-4200 Subject: URL Redirection Vulnerability Risk: High Effect: Remotely exploitable Author: Cyrill Bannwart Date: 20/05/2013...

HackerOne: Switching the user to the attacker's account

Two requests are needed to make it happen. Request1 log out the user: Request2 log in the user to the attacker's account: Please let me know if more detailed description is needed. Regards, Dawid Czagan...

SA-CORE-2014-001 - Drupal core - Multiple vulnerabilities

Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7. Impersonation OpenID module - Drupal 6 and 7 - Highly critical A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack...