大汉网络JCMS又一上传漏洞可被Getshell（需登陆）

简要描述： 详细说明： 问题出在jcms/setup/oprupload.jsp中 该功能为导入一个更新包... CommonUploadFile upload = null; ifrequest.getMethod.toUpperCase.equals"POST" JcmsUpdaterecordBLF blf = new JcmsUpdaterecordBLF"1"; JcmsUpdateRecordEntity entity = new JcmsUpdateRecordEntity; //解压路径 String strFilePath = strSysPath +...

LOL, Jar File Malware Just Goes Viral Through Facebook Messages

If you came across any suspicious Facebook message with ‘LOL’ text or a fake Image file send by any of your Facebook friend, avoid clicking it. A Trojan horse is currently circulating in wild through the Facebook social network that could steal your Facebook account data and Credentials. Security...

CVE-2013-5660

Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file...

CVE-2013-5660

Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file...

CVE-2013-5660

WinArchiver 3.2 (PowerSoftware) is affected by a SEH-based buffer overflow in crafted ZIP handling, allowing remote code execution. Affected component: the WinArchiver ZIP processing path; root cause: SEH-based overflow leading to arbitrary code execution. Impact: remote attacker could execute co...

CVE-2013-5660

Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file...

Threat Outbreak Alert: Fake Court Hearing Attendance Request Email Messages on August 7, 2015

Medium Alert ID: 33910 First Published: 2014 April 23 20:34 GMT Last Updated: 2015 August 11 14:30 GMT Version: 2 Summary Cisco Security has detected significant activity related to Portuguese language spam email messages that claim to contain a court hearing attendance notice for the recipient...

CVE-2013-7338

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a file size value larger than the size of the zip file to the 1 ZipExtFile.read, 2 ZipExtFile.readn, 3 ZipExtFile.readlines, 4 ZipFile.extract, or 5 ZipFile.extractall function...

CVE-2013-7338

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a file size value larger than the size of the zip file to the 1 ZipExtFile.read, 2 ZipExtFile.readn, 3 ZipExtFile.readlines, 4 ZipFile.extract, or 5 ZipFile.extractall function...

CVE-2013-7338

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a file size value larger than the size of the zip file to the 1 ZipExtFile.read, 2 ZipExtFile.readn, 3 ZipExtFile.readlines, 4 ZipFile.extract, or 5 ZipFile.extractall function...

CVE-2013-7338

CVE-2013-7338 affects Python 3.3.x before 3.3.4 RC1. The vulnerability lies in the Zip handling APIs (ZipExtFile.read/readlines, ZipFile.extract/extractall, etc.), where a file size value larger than the actual zip can trigger an infinite loop and CPU denial of service. Impact is DoS; no exploita...

PSF-2014-3 zipfile DoS using invalid file size

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a file size value larger than the size of the zip file to the 1 ZipExtFile.read, 2 ZipExtFile.readn, 3 ZipExtFile.readlines, 4 ZipFile.extract, or 5 ZipFile.extractall function...

CVE-2013-7338

Removed by vendor...

Threat Outbreak Alert: Fake Delivery Rescheduling Notice Email Messages on April 10, 2014

Medium Alert ID: 33744 First Published: 2014 April 10 14:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a delivery rescheduling notice from UPS for the recipient. The text in the email message attempts to convince th...

WinRAR Filename Spoofing Exploit

This Metasploit module abuses a filename spoofing vulnerability in WinRAR. The vulnerability exists when opening ZIP files. The file names showed in WinRAR when opening a ZIP file come from the central directory, but the file names used to extract and open contents come from the Local File Header...

Threat Outbreak Alert: Email Messages with Malicious Attachments on March 31, 2014

Medium Alert ID: 33580 First Published: 2014 March 31 17:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that contain an attachment for the recipient. The email message attempts to convince the recipient to open the attachment for details...

Threat Outbreak Alert: Email Messages with Malicious Links on March 11, 2014

Medium Alert ID: 33266 First Published: 2014 March 11 16:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to Italian-language spam email messages that claim to contain a malicious link for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Bill Payment Notification Email Messages on April 22, 2014

Medium Alert ID: 33025 First Published: 2014 February 25 20:37 GMT Last Updated: 2014 April 24 13:31 GMT Version: 2 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain bill payment notification for the recipient. The text i...

Bandizip 3.09 Crash Proof Of Concept

!/usr/bin/env ruby Exploit Title: Bandizip 3.09 .zip Crash POC Date: February 6th 2014 Author: Osanda Malith Jayathissa E-Mail: osandajayathissagmail.com Version: 3.09 32bit and 64bit Below versions might be affected Vendor Homepage: http://www.bandisoft.com/ Tested on: Windows XP 32-bit SP2 en,...

Directory traversal

Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. dot dot sequences in a zip file...