WordPress SP Client Document Manager 2.4.1 SQL Injection

Vulnerability title: Multiple SQL Injection in SP Client Document Manager plugin Plugin: SP Client Document Manager Vendor: http://smartypantsplugins.com Product: https://wordpress.org/plugins/sp-client-document-manager/ Affected version: version 2.4.1 and previous version Fixed version: N/A Goog...

WordPress SP Client Document Manager 2.4.1 SQL Injection Vulnerability

WordPress SP Client Document Manager plugin version 2.4.1 suffers from multiple remote SQL injection vulnerabilities. Vulnerability title: Multiple SQL Injection in SP Client Document Manager plugin Plugin: SP Client Document Manager Vendor: http://smartypantsplugins.com Product:...

用友NC-IUFO报表系统部分安全问题（影响多个大客户）

简要描述： 用友NC-IUFO报表系统存在用户信息泄漏，存在暴力破解的风险，另登录的验证码形同虚设，弱口令，登录之后利用系统功能获取webshell； 详细说明： 我们这里以wooyun厂商的忽略大王，中粮集团的报表平台为例； link： http://iufo.cofco.com/service/iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.login.LoginAction 1. 用户信息泄漏 link：...

http-avaya-ipoffice-users NSE Script

Attempts to enumerate users in Avaya IP Office systems 7.x. Avaya IP Office systems allow unauthenticated access to the URI '/system/user/scnuserlist' which returns a XML file containing user information such as display name, full name and extension number. Tested on Avaya IP Office 7.027. Script...

76M Households, 7M Businesses Impacted in JPMorgan Chase Breach

A securities filing on Thursday revealed that up to 76 million households and seven million small businesses, far more than initially thought, were implicated in the cyber attack that hit JPMorgan Chase over the summer, making it one of the largest data breaches in U.S. history. The New York-base...

Cicada-known Enterprise Portal system v2. 5 sql injection to admin-vulnerability warning-the black bar safety net

The problem is when the user modifies the information of the place /system/module/user/control.php public function edit$account = " if!$ account or RUNMODE == 'front' $account = $this-app-user-account; if$this-app-user-account == 'guest' $this-locateinlink'login'; if! empty$POST...

Security Advisory-Screen Capture Vulnerability on Huawei Ascend P6 Mobile Phones

Apps on Huawei Ascend P6 mobile phones can capture screens without the root permission. As a result, user information can be leaked by malware on Ascend P6 mobile phones. Vulnerability ID： HWPSIRT-2014-0893. This Vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID:...

APPLE-SA-2014-09-17-2 Apple TV 7

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-09-17-2 Apple TV 7 Apple TV 7 is now available and addresses the following: Apple TV Available for: Apple TV 3rd generation and later Impact: An attacker can obtain WiFi credentials Description: An attacker could have impersonated a WiFi...

Dropbox Reports 80 Percent of Subpoenas Contain Gag Request

Most U.S. government subpoenas for data on Dropbox users are accompanied with a request not to inform the user in question. Dropbox legal counsel Bart Volkmer said those gag orders are repelled unless there is a valid court order. The revelation accompanied the release of the cloud storage...

用友某通用学习管理系统设计不当致用户信息泄漏(可批量)

简要描述： 已经有大牛呵呵过了，至于是谁..自己猜去 详细说明： WooYun: 某通用型在线学习管理系统存在任意文件上传及任意文件下载漏洞 , WooYun: 某通用型在线学习管理系统存在任意文件上传漏洞（另一种奇葩姿势） 用友的e-Learning，wefgod大牛提交过，这里摘取一下他之前提供的弱口令： 首先需要一个低权限账号登录（反正没有验证码，设定好简单密码，按数字直接丢去暴了都没有问题） 给出几个默认或简单密码的： http://58.214.233.113:8800/lmsv5/ 00041013/123456 00041014/123456...

CVE-2014-3300

The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 10 does not properly implement access control, which allows remote attackers to modify user information via a crafted URL, aka Bug ID CSCum77041...

Improper access control

The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 10 does not properly implement access control, which allows remote attackers to modify user information via a crafted URL, aka Bug ID CSCum77041...

CVE-2014-3300

CVE-2014-3300 affects Cisco Unified Communications Domain Manager (CDM) BVSMWeb portal in Unified CDM Application Software prior to 10, where insufficient access control allows remote attackers to modify BVSMWeb user information via a crafted URL. Related materials show Metasploit/Viproy modules ...

CVE-2014-3300

The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 10 does not properly implement access control, which allows remote attackers to modify user information via a crafted URL, aka Bug ID CSCum77041...

LDAP injection - ownCloud

Due to not properly sanitizing the LDAP queries an attacker is able to: Gain information about existing LDAP users Modify the login query, e.g. with a wildcard Affected Software ownCloud Server 6.0.2 CVE-2014-2047 ownCloud Server 5.0.15 CVE-2014-2049 Action Taken All LDAP queries have been review...

Server: LDAP injection

Due to not properly sanitizing the LDAP queries an attacker is able to: Gain information about existing LDAP users Modify the login query, e.g. with a wildcard For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Simple Chat 1.x User Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7168/info Simple Chat! does not restrict access to sensitive information by default. An attacker could use this information to launch attacks against other users. http://www.example.com/chat/data/usr...

SIPS 0.2.2 User Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7134/info It has been reported that authentication is not required to view user account information. As a result, an unauthorized remote attacker may be able to view potentially sensitive information. This may aid in...

Mobius <= 1.4.4.1 (browse.php id) Remote SQL Injection Vulnerability

No description provided by source. :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP YmmMMMM MMM YM Discovered by dun \ dunatstrcpy.pl Mobius = 1.4.4.1 Remote SQL Injection Vulnerability Script: Mobius Web Publishing Software Script sit...

PHP-Fusion Database Backup Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10974/info It is reported that PHP-Fusion is susceptible to a database backup information disclosure vulnerability. An anonymous remote attacker may be able to download a complete database backup from the server...