CVE-2015-2940

Cross-site request forgery CSRF vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors...

Design/Logic Flaw

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."...

CVE-2015-2940

Cross-site request forgery CSRF vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors...

CVE-2015-2935

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."...

CVE-2015-2940

Cross-site request forgery CSRF vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors...

CVE-2015-2940

Cross-site request forgery CSRF vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors...

CVE-2015-2935

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."...

CVE-2015-2940

CVE-2015-2940 is a CSRF flaw in the MediaWiki CheckUser extension that can allow a remote attacker to hijack a user’s session and retrieve sensitive information. The connected advisories corroborate this as part of multiple vulnerabilities affecting MediaWiki, with remediation guidance to upgrade...

doyocms parallel rights issue of disclosure orders-vulnerability warning-the black bar safety net

Order override view vulnerability The problem code is in source/member. php at function myorder if$this-syArgs'oid'||$this-syArgs'orderid',1!=" if$this-syArgs'oid'$r=array'id'=$this-syArgs'oid';else$r=array'orderid'=$this-syArgs'orderid',1; $this-order=syDB'order'-find$r;...

mediawiki: multiple issues

CVE-2015-2931 cross-side scripting It was discovered that MIME types were not properly restricted, allowing a way to circumvent the SVG MIME blacklist for embedded resources. This allowed an attacker to embed JavaScript in a SVG file. - CVE-2015-2932 cross-side scripting The SVG filter to prevent...

Hackers Selling Uber Credentials on Underground Market

The alternative taxi service Uber denies insinuations that its systems were breached following reports claiming that underground forums are offering Uber user-credentials for as little as $1. First reported by Vice Magazine’s Motherboard spinoff, the information for sale also includes names, the...

Hilton Hotel The Official Website of the CSRF vulnerability-vulnerability warning-the black bar safety net

! A world-class hotel chains--Hilton Hotel The Official Website of the aeration CSRF（cross-site request forgery）vulnerabilities, while the CSRF vulnerabilities in the most security researchers eyes not on the“high-risk”, but this vulnerability can be not small. Change the password can be obtained...

Flash patch is released for four years, a vulnerability is still a vulnerability-vulnerability warning-the black bar safety net

Early in the 2 0 1 1 year Adobe Flash will released a security vulnerability patch still fails to work, today an attacker can still exploit the vulnerability to attack, Alexa rank of the top ten popular websites in the three are affected by the vulnerability. Vulnerability description LinkedIn...

[SECURITY] [DSA 3176-1] request-tracker4 security update

Exploit Title: HelpDezk 1.0.1 Multiple Vulnerabilities Google Dork: "intext: helpdezk-community-1.0.1" Date: 26-2-2015 Exploit Author: Dennis Veninga Vendor Homepage: http://www.helpdezk.org/ Vendor contacted: 26-2-2015 Version: 1.0.1 Tested on: Firefox 36 & Chrome 38 / W8.1-x64 HelpDezk - Versio...

HelpDezk 1.0.1 Multiple Vulnerabilities

Exploit Title: HelpDezk 1.0.1 Multiple Vulnerabilities Google Dork: "intext: helpdezk-community-1.0.1" Date: 26-2-2015 Exploit Author: Dennis Veninga Vendor Homepage: http://www.helpdezk.org/ Vendor contacted: 26-2-2015 Version: 1.0.1 Tested on: Firefox 36 & Chrome 38 / W8.1-x64 HelpDezk - Versio...

Sina micro-activities there is fishing exploits user information for fear of disclosure-vulnerability warning-the black bar safety net

Through the vulnerability enables the system to automatically send the information to tell you have winning increasing confidence in! ! This is sent after the event within 3 minutes the recruitment of the user ! In ten minutes I'll gather up 3 0 0 name of the user information! Liar proof: 1 2 nex...

KingCms最新版（k9）查看、修改所有用户所有信息

简要描述： KingCms最新版（k9）查看、修改所有用户所有信息 详细说明： 朋友的公司想购买kingcms的授权，让我帮忙看下。发现kingcms很长一段时间没更新了，憋了一段时间放出了最新版的k9，官网下下来学习一下。 在wooyun上看到了几个漏洞，如： WooYun: kingcms最新版sql注入漏洞 这里越权涉及到两个方面。 0x00：先来看看如果查看所有会员信息。 问题文件在/api/conn.php $get=$GET; ifempty$get'jsoncallback' exit'非法提交!'; $jsoncallback=$GET'jsoncallback';...

XDcms订餐网站系统单店版注入(demo测试)

简要描述： rt 详细说明： 黑盒demo测试 首先注册一个用户，然后修改用户资料 http://dd.xdcms.cn/index.php?m=member&f=edit 修改完成之后，下单点餐。 然后报错了。二次注入 由于demo有安全狗，就没用深入测试了。 漏洞证明：...

HelpDezk 1.0.1 Shell Upload / Code Execution / Disclosure Vulnerabilities

HelpDezk version 1.0.1 suffers from remote shell upload, code execution, and information disclosure vulnerabilities. Exploit Title: HelpDezk 1.0.1 Multiple Vulnerabilities Google Dork: "intext: helpdezk-community-1.0.1" Date: 26-2-2015 Exploit Author: Dennis Veninga Vendor Homepage:...