Potential SQL Injection

Overview Affected versions of sequelize are vulnerable to SQL Injection when user input is passed into findOne or into a statement such as where: "user input". Recommendation Update to version 3.0.0 or later. Version 3.0.0 will introduce a number of breaking changes. Thankfully, the project autho...

PHP 7.0.0 - Format String

PHP 7.0.0 - Format String Overview -------------------------------------------- A fun little format string vulnerability exists in PHP 7.0.0 due to how non-existent class names are handled. From my limited research I believe this issue is likely exploitable for full code execution see test script...

CakePHP 3.1.4, 3.0.15, 2.7.6 and 2.6.12 released

CakePHP 3.1.4, 3.0.15, 2.7.6 and 2.6.12 released The CakePHP core team is happy to announce the immediate availability of CakePHP 3.1.4, 3.0.15, 2.7.6, and 2.6.12. These releases contain security fixes. 3.1.4 and 2.7.6 also contain bugfixes. Security Fixes These releases contain fixes for a Remot...

[CORE-2015-0013] - FortiClient Antivirus Multiple Vulnerabilities

Advisory Information Title: FortiClient Antivirus Multiple Vulnerabilities Advisory ID: CORE-2015-0013 Advisory URL: http://www.coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities Date published: 2015-09-01 Date of last update: 2015-09-01 Vendors contacted: Fortinet...

PT-2015-7112

Name of the Vulnerable Software and Affected Versions refbase versions prior to 0.9.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the where parameter to "rss.php" or the sqlQuery parameter to "search.php". Recommendations For versions...

VBox Satellite Express 2.3.17.3 - Arbitrary Write

KL-001-2015-005 : VBox Satellite Express Arbitrary Write Privilege Escalation Title: VBox Satellite Express Arbitrary Write Privilege Escalation Advisory ID: KL-001-2015-005 Publication Date: 2015.09.16 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2015-005.txt 1...

VBox Satellite Express Arbitrary Write Privilege Escalation

Vulnerability Details Affected Vendor: VBox Communications Affected Product: Satellite Express Protocol Affected Version: 2.3.17.3 Platform: Microsoft Windows XP SP3, Microsoft Windows 7 x86 CWE Classification: CWE-123: Write-what-where condition Impact: Arbitrary Code Execution Attack vector:...

SiS Windows VGA Display Manager Multiple Privilege Escalation

Vulnerability Details Affected Vendor: Silicon Integrated Systems Corporation Affected Product: Windows VGA Display Manager Affected Version: 6.14.10.3930 Platform: Microsoft Windows 7 x86, Microsoft Windows XP SP3 CWE Classification: CWE-123: Write-what-where condition Impact: Arbitrary Code...

SiS Windows VGA Display Manager 6.14.10.3930 - Write-What-Where PoC

Exploit for windows platform in category dos / poc Title: SiS Windows VGA Display Manager Multiple Privilege Escalation Publication Date: 2015.09.01 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2015-003.txt 1. Vulnerability Details Affected Vendor: Silicon Integrated...

XGI Windows VGA Display Manager 6.14.10.1090 - Arbitrary Write PoC

Exploit for windows platform in category dos / poc Title: XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2015-004.txt 1. Vulnerability Details Affected Vendor: Silicon Integrated Systems Corporation...

XGI Windows VGA Display Manager 6.14.10.1090 - Arbitrary Write (PoC)

XGI Windows VGA Display Manager 6.14.10.1090 - Arbitrary Write PoC KL-001-2015-004 : XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation Title: XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation Advisory ID: KL-001-2015-004 Publication Date: 2015.09.01 Publicati...

MallMold 2.5 app/action/newsletterAction.php SQL注入漏洞

/app/action/newsletterAction.phppublic function statistics //create a image header'Content-type:image/gif'; echo base64decode'R0lGODlhAQABAIAAAAAAAAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw=='; $sn = trim$GET'sn'; $email = trim$GET'ue'; $this-model'newsletter'-statistics$sn, $email;...

KingCms最新版（k9）注入1枚

简要描述： KingCms最新版（k9）注入1枚 详细说明： 朋友的公司想购买kingcms的授权，让我帮忙看下。发现kingcms很长一段时间没更新了，憋了一段时间放出了最新版的k92014-12-13更新，官网下下来学习一下。 在wooyun上看到了几个漏洞，如： WooYun: kingcms最新版sql注入漏洞 注入点：POST /apps/jianli/index.php HTTP/1.1 注入参数：where 问题文件在/apps/jianli/index.php function create $u=new user;$u-authrole'jianli'; $db=new...

K7 Total Security Privilege Escalation Vulnerability (Feb 2015) - Windows

K7 Total Security is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2015-3616

Name of the Vulnerable Software and Affected Versions ClanSphere version 2011.4 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the where parameter in a list action to "index.php". Recommendations For ClanSphere version 2011.4, consider...

CVE-2014-100010: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ClanSphere 2011.4 allows remote attackers to inject arbitrary web script or HTML via the where parameter in a list action to index.php...

KPPW最新版SQL注入漏洞四(同一问题引发多处注入及越权含分析）

简要描述： KPPW最新版SQL注入漏洞四同一问题引发多处注入及越权） 详细说明： KPPW最新版SQL注入漏洞四同一问题引发多处注入及越权） 文件/control/user/accountreport.php $objReportT = keketableclass::getinstance'witkeyreport'; if isset $action switch $action case 'mulitDel' : if $ckb $objTaskT-del 'taskid', $ckb ; kekezu::showmsg '删除成功', $strUrl, NULL, NULL,...

大米CMS注入后台可以getshelll

简要描述： 大米CMS注入，后台可以getshelll 详细说明： 一注入 1.挖洞前奏 Damicms搭建在本地以后，对cms\dami\Core\Lib\Think\Db\Db.class.php进行修改，将sq语句vardump处理。 然后就进行黑盒测试。搜索点，以及admin登入点输入单引号就会给过滤了。。。 看到有注册功能，发现登入点居然没有过滤单引号。。。 这运气比较好了 2.漏洞原理 于是苦逼看代码，发现thinkphp 看不懂 - - 去学习了一下回来了。。。。 发现登入点在: dami\Web\Lib\Action\MemberAction.class.php 这控制器...

CVE-2012-5701: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 searchstring or 2 where parameter in a contacts action, 3 deptid parameter in a departments action, 4 projectid parameter in a project action, or...

CVE-2014-7334

The Where Dallas aka com.magzter.wheredallas application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...