members.roundandbrown.com XSS vulnerability

Vulnerable URL: http://members.roundandbrown.com/?a=user.login Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 18:36 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 0...

Cms madesimple 1.11.12 - Persistant XSS / Full Path Disclosure Vulnerabilities

Exploit for php platform in category web applications Author : ZwX Date : 09/02/2015 Download : http://www.cmsmadesimple.fr/telecharger-cms Vendor : http://www.cmsmadesimple.fr/ Tested on : Windows 7 +=====================+ Description : +=====================+ Stored Cross Site Scripting...

SalesForce User Login Detection (deprecated)

Binary data 8877.prm...

WordPress User Login Detection

Binary data 8875.prm...

Security Advisory - Buffer Overflow Vulnerability in the FusionAccess

FusionAccess is a kind of virtual desktop applications based on Huawei cloud platform. Through the deployment of Huawei desktop cloud software on the cloud platform, customers can access the cloud desktop by the thin client device or other devices. There is a buffer overflow vulnerability in the...

[SYSS-2015-026] Denial of Service (CWE-730) and Overly Restrictive Account Lockout Mechanism (CWE-645) in Page2Flip Premium App 2.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-026 Product: Page2Flip Vendor: w!ssenswerft GmbH Affected Versions: Premium App 2.5, probably also in Business App and Basic App, and in lower versions Tested Versions: Premium App 2.5 Vulnerability Type: Denial of Service...

kppw最新版任意用户登录

简要描述： 只需要用户名和用户id即可实现任意用户登录 详细说明： 问题出在 lib/inc/kekecoreclass.php function inituser 第981行 elseif $COOKIE 'kekeautologin' $loginInfo = unserialize $COOKIE 'kekeautologin' ; $pwdInfo = explode '|', base64decode $loginInfo 2 ; $uInfo = kekezu::gettabledata '', 'witkeyspace', " username='$pwdInfo2' an...

chelseagreen.com XSS vulnerability

Open Bug Bounty ID: OBB-72144 Description| Value ---|--- Affected Website:| chelseagreen.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

AirLive IP Surveillance Camera there is a command injection vulnerability, a large number of products affected-vulnerability warning-the black bar safety net

A large number of AirLive IP Surveillance Camera is exposed there is a command injection vulnerability, an attacker can use this vulnerability to steal user login credentials and control equipment. The vulnerability principle and scope of impact OvisLink company manufactured a large number of...

Drupal 6.x < 6.36 OpenID Security Bypass

The remote web server is running a version of Drupal that is 6.x prior to 6.36. It is, therefore, potentially affected by a security bypass vulnerability due to a flaw in the OpenID module. A remote attacker can exploit this flaw to log in as other users, including administrators. Note that victi...

The vulnerability of the distributed network access control device of SolarWinds Firewall Security Manager allows a hacker to elevate their privileges and execute arbitrary code within the client session.

The vulnerability of the userlogin.jsp module in the SolarWinds Firewall Security Manager distributed network access control system allows a malicious actor to escalate their privileges and execute arbitrary code within the client session...

Hui Wen libsys library management system, several vulnerability analysis-vulnerability warning-the black bar safety net

libsys is a library management system, pretty much learn to use, for details seewebsite. /zplug/ajaxasynlink. old. php any file containing the you can view the backend admin password, v5. 0 version can getshell） /admin/login. php any user login vulnerability v5. 0 version can getshell） Default...

IdeaCMS built Station system universal vulnerability affects thousands of sites-vulnerability warning-the black bar safety net

IdeaCMS based on the ASP+MSSQL/ACCESS technology development from 2 0 0 8 released in the first version since, every year, we are on a program to do a larger version of the update, so far has released six major versions. IdeaCMS in a simple, efficient, flexible, easy to use, open source, template...

Cross-Site Scripting vulnerability in EMC M&amp;R &#40;Watch4net&#41; Web Portal Report Favorites

------------------------------------------------------------------------ Cross-Site Scripting vulnerability in EMC M&R Watch4net Web Portal Report Favorites ------------------------------------------------------------------------ Han Sahin, November 2014...

phpems某处设计不当可任意用户登陆

简要描述： phpems某处设计不当可任意用户登陆 详细说明： 马上要去实习了，时间越来越珍贵，再发一个cms的吧 1.Phpems存在一个平行权限和垂直权限的奇葩漏洞，利用这个漏洞可以登录任意用户包括管理员。 具体出现漏洞的地方在/app/exam/api.php的login函数中 //通过接口进行登录 public function login //print "start";exit; $sign = $this-ev-get'sign'; $userid = $this-ev-get'userid'; $username = $this-ev-get'username';...

Kingsoft enterprise terminal protection optimization system Web Console without having to log any file deleted-bug warning-the black bar safety net

Kingsoft enterprise terminal protection optimization system Web Console without having to log arbitrary file deletion Arbitrary file deletion: File:/tools/manage/deletetools.php code area children; $i++ if $xml-tool$i-id == $id @unlink"../".$ xml-tool$i-name; if$xml-tool$i-image != "test. png"...

Disabling user in delegated Active Directory doesn't disable them in Confluence until they log in

h3.Steps to Reproduce Create a delegated directory, hooked to Active Directory Login with an AD user, with the "Remember Me" option checked Close the browser completely Disable the user in AD by checking the "Account is disabled" option in User Properties Account Account Options Launch the browse...

Windows Run Command As User

This module will login with the specified username/password and execute the supplied command as a hidden process. Output is not returned by default. Unless targeting a local user either set the DOMAIN, or specify a UPN user format e.g. user@domain. This uses the CreateProcessWithLogonW WinAPI...

LebiShop商城系统最新版任意用户登陆

简要描述： LebiShop商城系统最新版任意用户登陆 详细说明： LebiShop商城系统最新版Powered by LebiShop V3.1.01，存在任意用户登陆 官方demo测试 http://plus.demo.lebi.cn/——可注册普通用户和商家用户 http://demo.lebi.cn/——可注册普通用户 我们使用http://plus.demo.lebi.cn/进行测试 首先我们注册一个普通用户222222，并登陆 注意这里的COOKIE中user的值，id=37，这里是用户222222的用户userid...

TurboMail 前台sql注入漏洞

简要描述： 前台注入存在注入，可查看管理员密码甚至getshell。 详细说明： 0x1 前台注入 turbomail\web\webapps\ROOT\enterprise\noteadd.jsp: ... UserInfo userinfo = ms.userinfo; if userinfo == null XInfo.gotoInfoms,request,response,"info.loginfail",null,0; return; String id = request.getParameter"id";//id参数传入，没有过滤 Note note = null;...