PT-2015-6024

Name of the Vulnerable Software and Affected Versions Webservice-DIC yoyaku version v41 Description The issue allows remote attackers to create arbitrary files and consequently execute arbitrary code via unspecified vectors. Recommendations For Webservice-DIC yoyaku version v41, at the moment,...

orienteering.ca XSS vulnerability

Vulnerable URL:...

appointment.com XSS vulnerability

Vulnerable URL:...

PT-2015-7951

Уязвимость программной интеграционной платформы SAP NetWeaver существует из-за недостаточного ограничения доступа к сервлету tcmonitoringwebserviceweb. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить сведения о доступности внутренних сетевых служб при помощи...

用友多个系统通用漏洞导致接口信息泄露引发多数据库信息泄露（涉及多个大型厂商）

简要描述： 详细说明： 通过webservice接口泄露,涉及多个系统 一、NC系统 http://123.232.105.202/ http://erp.suning.com.cn/ http://115.238.57.245/ 以苏宁为例。 接口地址:http://erp.suning.com.cn/uapws/service 会发现很多接口,以数据库内网链接泄露为例太多接口了,不一一测试了 得到数据库内网链接为:http://erp.suning.com.cn/uapws/service/nc.itf.ses.inittool.PortalSESInitToolService?ws...

大汉政府信息公开多处SQL注入二(附100个案例)

简要描述： 大汉政府信息公开多处SQL注入二附100个案例 详细说明： 依然webservice漏洞 /xxgk/services/WSYsqgk?wsdl 该WSYsqgk服务的多个方法，多个参数存在严重漏洞，且该漏洞普遍存在，如 wsTest getClientIpAxis wsGetYsqgk 上述方法的多个参数均存在漏洞，这里随便选取一个方法进行测试 首先保存如下内容为wooyun.txt POST /xxgk/services/WSYsqgk?wsdl HTTP/1.1 Accept-Encoding: gzip,deflate Content-Type:...

大汉政府信息公开多处SQL注入(附100个案例)

简要描述： 大汉政府信息公开多处SQL注入附100个案例 详细说明： 同样webservice漏洞，漏洞存在于 /xxgk/services/WSSmsSync?wsdl WSSmsSync服务的多个方法，多个参数存在严重漏洞，且该漏洞普遍存在，如 isBase64 wsSyncGetInfos wsSyncGetInfos setStrAppId setBase64 上述方法的多个参数均存在漏洞，这里随便选取一个方法（wsSyncGetInfos）进行测试 用WSockExpert v0.7抓包，并保存为wooyun.txt POST...

大汉政府信息公开多处SQL注入(附100个案例)

简要描述： 大汉政府信息公开多处SQL注入附100个案例 详细说明： 不同系统，不同文件，真的重复了么? 漏洞证明： webservice漏洞，漏洞存在于 /xxgk/services/WSSynchronize?wsdl WSSynchronize服务的多个方法，多个参数存在严重漏洞，且该漏洞普遍存在，如 wsGetWeb wsGetColumnStyle wsSynchronize wsSynchronizeWithPath 上述方法的多个参数均存在漏洞，这里随便选取一个方法（wsSynchronize）进行测试 用WSockExpert v0.7抓包，并保存为wooyun.txt...

大汉政府信息公开多处SQL注入一(附100个案例)

简要描述： 大汉政府信息公开多处SQL注入一附100个案例 详细说明： 依然是webservice漏洞，漏洞存在于 /xxgk/services/WSSyncxxgk?wsdl 该WSSyncxxgk服务的多个方法，多个参数存在严重漏洞，且该漏洞普遍存在。 wsGetWeb getClientIpAxis wsGetColumn wsGetColumnStyle wsSynchronize wsSynchronizeWithPath wsSync 上述方法的多个参数均存在漏洞，随便选取一个方法进行测试 /xxgk/services/WSSyncxxgk?wsdl wsGetColumn方...

Debian DSA-3124-1 : otrs2 - security update

Thorsten Eckel of Znuny GMBH and Remo Staeuble of InfoGuard discovered a privilege escalation vulnerability in otrs2, the Open Ticket Request System. An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is...

Debian Security Advisory DSA 3120-1 (mantis - security update)

Multiple security issues have been found in the Mantis bug tracking system, which may result in phishing, information disclosure, CAPTCHA bypass, SQL injection, cross-site scripting or the execution of arbitrary PHP code. OpenVAS Vulnerability Test $Id: deb3120.nasl 6609 2017-07-07 12:05:59Z...

大汉jcms多处SQL注入二(附80个案例)

简要描述： 一类很明显，但目前不容易发现的漏洞 详细说明： webservice 漏洞，目前非常多的系统均有该service 恰巧的是，该service的漏洞，是不被人注意的，因而 教容易产生漏洞 /jcms/services/WSReceive?wsdl 下图的多个方法，方法中的多个参数均存在注入 随便选取一个方法进行测试 /jcms/services/WSReceive?wsdl wsGetColumn方法 用WSockExpert v0.7抓包，并保存为wooyun.txt POST /jcms/services/WSReceive?wsdl HTTP/1.1...

PT-2015-4214

Name of the Vulnerable Software and Affected Versions VDG Security SENSE version 2.3.13 Description The issue concerns multiple stack-based buffer overflows in the DIVA web service API, specifically at the "/webservice" endpoint. This allows remote attackers to execute arbitrary code by...

otrs -- Incomplete Access Control

The OTRS project reports: An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is configured and not additionally secured...

CVE-2014-7835

webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting XSS attacks, by specifying the...

CVE-2014-7835

webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting XSS attacks, by specifying the...

CVE-2014-7835

CVE-2014-7835 affects Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3. The webservice/upload.php handler fails to ensure uploaded files are placed in a private/draft area, allowing remote authenticated users to upload JavaScript in the profile-picture area and perform cross-site scripting (XSS)....

CVE-2014-7835

webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting XSS attacks, by specifying the...

CVE-2014-7835

webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting XSS attacks, by specifying the...

CVE-2014-7835: Improper Neutralization of Input During Web Page Generation

webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting XSS attacks, by specifying the...