382 matches found
Pan micro-OA system webservice-xml/login/login. wsdl. php blind
No description provided by source...
万户OA xfire xml实体注入漏洞
xfire xml实体注入 webservice使用了xfire框架，存在xxe漏洞 jmx-console 存在默认口令: admin/ezoffice，网上搜一下基本没改。...
万户OA webservice SQL 注入漏洞
0x3 SQL注射 webservice服务需要一个通信密码，但官方自己留了一个万能密码：auth.key.whir2012 有了这个key，webservice都能使用。可以进行添加、删除用户等操作。 webservice很多地方没有使用参数查询还是拼接sql，存在SQL注射：...
泛微oa /webservice/upload.php /webservice/upload/upload.php 等多处任意文件上传
任意文件上传共四处，属于同一个漏洞 文件位置 /webservice/upload.php /webservice/upload/upload.php /webservice-json/upload/upload.php /webservice-xml/upload/upload.php 四处都有如下代码 没有对文件有任何验证，无须登陆 文件上传之后的位置是： $path = $ATTACHPATH.$attachmentID; $fileName = $path."/".$FILES'file''name'; moveuploadedfile $FILES'file''tmpname'...
GPS satellite positioning platform vulnerability disaster, the user location information in an emergency-vulnerability warning-the black bar safety net
Recently, the press exposure a lot of plays through the GPS positioning device trace abduction. By on the market on some of the GPS positioning device research, found that these GPS positioning system background using a common set of procedures, its Cloud Platform on the presence of multiple...
Webservice-DIC yoyaku_v41 OS Command Injection Vulnerability
Webservice-DIC yoyakuv41 is a conference room reservation management software from Webservice-DIC. Webservice-DIC yoyakuv41 fails to properly filter user-submitted input, allowing remote attackers to exploit the vulnerability by submitting a special request to execute arbitrary operating system...
Webservice-DIC yoyaku_v41 Input Validation Vulnerability
Webservice-DIC yoyakuv41 is a conference room reservation management software from Webservice-DIC. Webservice-DIC yoyakuv41 fails to properly filter user-submitted input, allowing remote attackers to exploit the vulnerability by submitting a special request to create arbitrary files...
CVE-2015-2979
Webservice-DIC yoyakuv41 allows remote attackers to execute arbitrary OS commands via unspecified vectors...
CVE-2015-2978
Webservice-DIC yoyakuv41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."...
Code injection
Webservice-DIC yoyakuv41 allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via unspecified vectors...
CVE-2015-2977
Webservice-DIC yoyakuv41 allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via unspecified vectors...
Authentication flaw
Webservice-DIC yoyakuv41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."...
CVE-2015-2978
The CVE-2015-2978 case describes Webservice-DIC yoyaku_v41 as vulnerable to an authentication bypass (CWE-592), enabling remote attackers to bypass login and complete a conference-room reservation (described as an “unintentional reservation”). Affected product: yoyaku_v41. Root cause: inadequate ...
CVE-2015-2978
Webservice-DIC yoyakuv41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."...
CVE-2015-2977
Webservice-DIC yoyaku_v41 (conference room reservation software) is affected by CVE-2015-2977. The vulnerability stems from insufficient input validation (CWE-20), enabling remote attackers to create arbitrary files, which may lead to arbitrary code execution on the server. Public sources in the ...
CVE-2015-2979
CVE-2015-2979 affects Webservice-DIC yoyaku_v41 (conference room reservation software). Concrete details from connected sources show an OS command injection (CWE-78) vulnerability that allows remote execution of arbitrary OS commands on the web server. Root cause described as improper input handl...
yoyaku_v41 vulnerable to authentication bypass
Overview yoyakuv41 provided by Webservice-DIC is a software to manage conference room reservations. yoyakuv41 contains an authentication bypass vulnerability CWE-592. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...
JVN#52248864: yoyaku_v41 vulnerable to authentication bypass
yoyakuv41 provided by Webservice-DIC is a software to manage conference room reservations. yoyakuv41 contains an authentication bypass vulnerability CWE-592. Impact A remote attacker could bypass yoyakuv41's authentication, and make an unintentional reservation. Solution Do not use yoyakuv41...
JVN#17522792: yoyaku_v41 vulnerable to OS command injection
yoyakuv41 provided by Webservice-DIC is a software to manage conference room reservations. yoyakuv41 contains an OS command injection vulnerability CWE-78. Impact An arbitrary OS command may be executed with the privileges of the web server on the server where yoyakuv41 is running. Solution Do no...
