ManageEngine Shell Upload / Directory Traversal Vulnerabilities

ManageEngine products Service Desk Plus, Asset Explorer, Support Center, and IT360 suffer from file upload and directory traversal vulnerabilities. This is part 11 of the ManageOwnage series. For previous parts, see 1. This time we have two remote code execution via file upload and directory...

[SECURITY] Fedora 21 Update: mingw-dbus-1.8.12-1.fc21

D-BUS is a system for sending messages between applications. It is used both for the system wide message bus service, and as a per-user-login-session messaging facility...

[SECURITY] Fedora 20 Update: dbus-1.6.28-1.fc20

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

某高校通用内容管理系统后台任意用户登录+getshell

简要描述： 本来我是发现了该系统后台注入和万能密码登录的问题的，搜索了下没找到相关内容，以为没人提交过。等我整理好了，又发现了 http://www.wooyun.org/bugs/wooyun-2010-055845。 挺郁闷的啊....既然这样，那咱就换种方法吧。条条大路通后台啊 详细说明： 南京南软科技为研究生院开发的管理系统 http://www.southsoft.com.cn/Case.asp?id=941 该系统登陆后每次cookie都是一样的，通过简单的伪造cookie就可以绕过后台登陆。...

BiWEB最新门户版XFF注入一枚

简要描述： BiWEB最新门户版XFF注入一枚 详细说明： 在wooyun上看到了有人把biweb的shell拿到了： WooYun: BIWEB门户版Getwebshell漏洞 ，也有人提了其他漏洞，我也来找找它的漏洞吧。去官网下BiWEB门户版最新的5.8.3来看看。 看看用户登录处是怎么处理的。BiWEB首先对GET和POST进行了过滤，/config/filtrate.inc.php 这里就先不说这种过滤的脑残之处了。 继续往下看，判断用户是否可以正常登录的文件/user/login.php。 无关代码 if!empty$POST if...

US-CERT Warns of Dyre Banking Trojan

The Department of Homeland Security formally sounded the alarm Monday on Dyre, the banking Trojan that’s been spotted siphoning banking credentials from both large enterprises and major financial institutions as of late. The warning came in the form of an alert from the United States Computer...

Stash email settings fields can be inadvertently be populated by browser with user login details - security issue

The email and username password in the email server settings screen has the same names as the username and password fields when logging in. This has the unintentional side affect of being pre-populated by your browser if you have left the mail server credentials blank and your browser has saved...

Duplicate Post 2.5 - duplicate-post-admin.php User Login Cookie Value SQL Injection

The Yoast Duplicate Post WordPress plugin was affected by a duplicate-post-admin.php User Login Cookie Value SQL Injection security vulnerability...

CVE-2014-3549

Cross-site scripting XSS vulnerability in the getdescription function in lib/classes/event/userloginfailed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attem...

Cross site scripting

Cross-site scripting XSS vulnerability in the getdescription function in lib/classes/event/userloginfailed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attem...

CVE-2014-3549

Cross-site scripting XSS vulnerability in the getdescription function in lib/classes/event/userloginfailed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attem...

Magic Photo Storage Website user/login.php _config[site_path] Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/21965/info Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the...

NetcPlus SmartServer3 3.75 Weak Encryption Vulnerability

No description provided by source. / source: http://www.securityfocus.com/bid/1962/info SmartServer3 is an email server designed for small networks. A design error exists in SmartServer3 which enables an authenticated user to view other users login information and possibly gain access to password...

Wordpress Automatic Plugin 2.0.3 - SQL Injection

No description provided by source. Title: ====== Wordpress Automatic Plugin v2.0.3 SQL Injection Date: ===== 2012-06-15 Website: =========== http://codecanyon.net/item/wordpress-automatic-plugin/1904470 Introduction: ============= Wordpress automatic plugin posts quality targeted articles, Amazon...

eZ Publish < 3.9.5/3.10.1/4.0.1 (token) Privilege Escalation Exploit

No description provided by source. ?php / eZ Publish privilege escalation and weak activation token for new user exploit by s4avrd0w [email protected] Versions affected = 3.5.6 eZ Publish privilege escalation resolved in 3.9.5, 3.10.1, 4.0.1 More info:...

osDate 2.1.9 - Remote File Inclusion Vulnerabilities

No description provided by source. ======================================================================================== o osDate Remote File Inclusion Vulnerabilities Software : osDate dating and matchmaking script version 2.1.9 mostly affected Vendor : http://www.tufat.com/ Download :...

RazorCMS <= 1.2.1 STABLE File Upload Vulnerability

No description provided by source. Exploit Title: RazorCMS = 1.2.1 STABLE File Upload Vulnerability Google Dork: ? Date: 2012-02-26 Author: i2secHyo jun Oh Software Link: http://www.razorcms.co.uk/archive/core/razorCMScorev121STABLE.zip Version: RazorCMS 1.2.1 Tested on: Windows XP Upload a file...

iPhone4 FTP Server 1.0 - Empty CWD-RETR Remote Crash

No description provided by source. Exploit Title: iPhone4 FTP Server V1.0 - Empty CWD-RETR Remote Crash Date: 2011-05-30 Author: offsetIntruder Software Link: http://itunes.apple.com/us/app/ftp-server/id356055128?mt=8 Version: 1.0 Tested on: iPhone4 IOS 4.3.2 CVE: N/A import socket import sys...

Wordpress Event Registration Plugin 5.32 SQL Injection Vulnerability

No description provided by source. Wordpress Event Registration SQL injection Author: k3m4n9i Homepage: http://alko.web.id/ Date: 13 November, 2010 Software Information + Vendor : http://edgetechweb.com/ + Software Link: http://wordpress.org/extend/plugins/event-registration/ + Version: 5.32 or...

Cmseasy SQL注射漏洞 2

简要描述： 注入..无限制 详细说明： frontclass.php 对 username 做了限制 但是 忘了\转义符 ifpregmatch'/'|"/', $POST'username' || pregmatch'/'|"/', $GET'username' || pregmatch'/'|"/', $COOKIE'loginusername' exit'非法参数'; 先看注册 useract.php 289 行: function registeraction iffront::post'submit' if!config::get'regon'...