112 matches found
IBOS Enterprise Collaboration Management Software WeiboController.php page actionFollowing function has SQL injection vulnerability
IBOS Enterprise Collaboration Management Software is a PHP-based collaborative office management system. A SQL injection vulnerability exists in the WeiboController.php page of IBOS Enterprise Collaboration Management Software. An attacker is allowed to exploit the vulnerability to obtain sensiti...
The Struts S2-045 vulnerability heat analysis-vulnerability warning-the black bar safety net
Author: janesknow Chong Yu 404 laboratory Date: 2017-03-15 Background description Struts2 official to GMT 2017 3 December 6, 10pm published Struts2 there is a remote code execution vulnerability vulnerability number S2-045, CVE number: CVE-2017-5638, and rated as high-risk vulnerabilities. Becaus...
QrlJacker - QrlJacking Exploitation Framework
A python framework which goal is to exploit QrlJacking attack vector easily Installation Requirements Python 2.7.x Requests Pillow Selenium configparser Installation on Windows After downloading the framework cd QrlJacking-Framework pip install -r requirements.txt python QRLJacker.py Installation...
weibo.com XSS vulnerability
Vulnerable URL: http://www.weibo.com/signup/signup.php?lang=zh-hk&"-alert/OPENBUGBOUNTY//////=qiyewei Details: Description| Value ---|--- Patched:| Yes, at 07.02.2017 Latest check for patch:| 07.02.2017 10:33 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20 VI...
api.weibo.com XSS vulnerability
Vulnerable URL: https://api.weibo.com/oauth2/authorize?clientid=2077566580uri=http://www.medcn.cn/jiankangjsp/weibocallback.jsptype=code=&f3u;auth=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 12.12.2016 Latest check for patch:| 12.12.2016 05:...
ThinkSNS V2.8 apps\wap\Lib\Action\IndexAction.class.php 任意文件上传漏洞
漏洞信息： ThinkSNS开源微博系统,是智士的开源社交平台。采用PHP+MySQL技术平台,微博+应用的产品模式,同时拥有iphone、android客户端、wap、3G版界面。 ThinkSNS V2.8 存在任意文件上传漏洞，可以导致上传shell,并导致服务区沦陷。 漏洞分析： 微博上传图片时只在前端进行验证, 服务器端没有进行安全过滤。 问题在apps\wap\Lib\Action\IndexAction.class.php中263行： if!empty$FILES'pic''name' // 自动发一条图片微博 $data'pic' = $FILES'pic';...
CVE-2014-6805
The weibo aka magic.weibo application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Information disclosure
The weibo aka magic.weibo application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-6805
The weibo aka magic.weibo application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-6805
The CVE-2014-6805 entry concerns the Android Weibo (magic.weibo) app version 1.2, which does not verify X.509 certificates when establishing SSL connections. This behavior allows man-in-the-middle attackers to spoof HTTPS servers and obtain sensitive information via a crafted certificate. Per ava...
CVE-2014-6805: Undefined Security Weakness
The weibo aka magic.weibo application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
PT-2014-7483
Name of the Vulnerable Software and Affected Versions weibo aka magic.weibo application version 1.2 for Android Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificat...
Using QQ panel login authentication is not strictly+Arp sniffing to login within the network of the other QQ space,Weibo, etc free password-vulnerability warning-the black bar safety net
This can be said that there is no technical content,just saying an idea,first simple demo. 1. Open burp set up the browser proxy and then under the QQ panel, QQ space fast landing you can see the burp intercept,is the intercept of this segment of the RUL ! 2. Put this URL copy the following down ...
OAuth authentication memory vulnerability caution a user identity hijacking-vulnerability warning-the black bar safety net
With OpenSSL, like OAuthOpen Authorizationas a widely used open-source third-party login authentication Protocol, this year also broke a security vulnerability. In the third session of the know the security Forum, from Sina Weibo of the blue di snowball shows Sina as early as year 3 months...
Sina Weibo Usage Detection
Binary data 8170.prm...
ThinkSNS某功能平行权限4
简要描述： 看到厂商迟迟不确认，所以再来一发，难不成厂商已经放假了？如果是开年求收留！ 详细说明： 问题发生在 wap模块 apps/wap/Lib/Action/IndexAction.class.php 和 apps/w3g/Lib/Action/IndexAction.class.php 行665 public function doDelete $weiboid = intval$GET'weiboid'; if $weiboid urlencode$GET'key','page'=$GET'page'; $data'id' = $weiboid; $detail =...
easytalkCSRF可蠕虫发微博
简要描述： easytalk是一个，优秀的开源微博CMS 详细说明： easytalkCSRF可蠕虫发微博 可用于各个方面，例如广告传销，一发不可收拾 漏洞证明： 抓包得： POST /?m=space&a=sendmsg HTTP/1.1 Host: t.nextsns.com Connection: Keep-Alive Content-Length: 51 Accept: / User-Agent: Mozilla/4.0 compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727...
Tencent Weibo CSRF brush fan of vulnerability-3-vulnerability warning-the black bar safety net
Cloud Wang says Tencent is the GDP from manufacturing. Detailed description: Was accidentally found, well, LOOK! 1）registered a clean account, visit the following POC example; the the the document. se55i0n. submit; 2 See run the POC effect; ! 3 refresh Twitter success your own clouds official...