Oracle Linux 6 / 7 : freetype (ELSA-2015-0696)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0696 advisory. - Fixes CVE-2014-9657 - Check minimum size of recordsize. - Fixes CVE-2014-9658 - Use correct value for minimum table length test. - Fixes...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

mcms最新版任意表的任意字段注入+添加管理员+任意数据删除

简要描述： mcms最新版任意表的任意字段注入+添加管理员+任意数据删除 详细说明： 前两天在wooyun提了两个漏洞，一天就确认修复了，而且出了新版本，那我就去官网下个最新（v3.1.1.enterprise）的来看看学习学习吧。 问题一：任意表的任意字段注入 注入一枚：POST /app/user/info.php?m=save&ajax=1 POST中有个参数modelname，这个参数是用来与数据表前缀（TBPRE）拼接需要操作的数据表的表名的，在获得modelname时并没有过滤，因此，在数据表名可就可以进行注入了，当然，可以利用任意表的任意字段来进行注入。...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Ilch CMS allows remote attackers to hijack the authentication of administrators for requests that add a value to a profile field via a profilefields request to admin.php...

PXE Boot Exploit Server

This module provides a PXE server, running a DHCP and TFTP server. The default configuration loads a linux kernel and initrd into memory that reads the hard drive; placing a payload to install metsvc, disable the firewall, and add a new user metasploit on any Windows partition seen, and add a uid...

CVE-2014-9331

Cross-site request forgery CSRF vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATEID/1417736606982/roleMgmt.do...

KPPW最新版本(Csrf删除任意帐号/添加管理员)

简要描述： 求高Rank 么么哒 详细说明： http://localhost/KPPW/index.php?do=user&view=message&op=send http://localhost/KPPW/index.php?do=pubtask&id=1&step=step2 收件人填目标用户名 标题随便 内容没有转义 不过过滤了敏感标签和 onerror onload等事件。 先来看第一个删除任意帐号 http://localhost/KPPW/admin/index.php?do=user&view=list&op=del&edituid=5529 GET提交此URL...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Stark CRM 1.0 allow remote attackers to hijack the authentication of administrators for requests that add 1 an administrator via a crafted request to the admin page, 2 an agent via a crafted request to the agent page, 3 a sub-agent via a...

CVE-2014-8073

Cross-site request forgery CSRF vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrators for requests that add a new user via a Save User action to admin/users/user.form...

openSUSE Security Update : bash (openSUSE-SU-2014:1310-1) (Shellshock)

Replace patches bash-4.2-heredoc-eof-delim.patch and bash-4.2-parse-exportfunc.patch with the official upstream patch levels bash42-052 and bash42-053 - Replace patch bash-4.2-CVE-2014-7187.patch with upstream patch level bash42-051 - Add patches bash-4.2-heredoc-eof-delim.patch for bsc898812,...

RBS Change Complet Open Source 3.6.8 - CSRF Vulnerability

No description provided by source. Exploit Title: RBS Change Complet Open Source CSRF Google Dork: intext:"une réalisation rbs" Date: 10/01/2014 Exploit Author: KrustyHack Vendor Homepage: http://www.rbschange.fr/ Software Link:...

Live800在线客服XSS+CSRF可直接添加管理员

简要描述： M 锅在测试 XSS 的时候，我乱入了然后我也发现了点问题来提交了！ 详细说明： 先直接上 payload:...

CVE-2014-5555

The Counting & Addition Kids Games aka air.com.tribalnova.ilearnwith.ipad.PokoAddEn application 1.8.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5552

The Numbers & Addition! Math games aka air.com.tribalnova.ilearnwith.ipad.App2En application 1.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5555

The CVE-2014-5555 issue affects the Android app Counting & Addition Kids Games (package air.com.tribalnova.ilearnwith.ipad.PokoAddEn) version 1.8.1. Root cause: the app does not verify X.509 certificates for TLS connections, allowing MITM attackers to spoof SSL servers and access sensitive inform...

UMI.CMS 2.9 - CSRF Vulnerability

No description provided by source. 添加一个管理员用户：csrfuser|||password document.main.submit;...

FreePBX 2.5.2 Zap Channel Addition Description Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/37482/info FreePBX is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content...

2Wire Routers - Cross-Site Request Forgery Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/27246/info Multiple 2Wire routers are prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to execute arbitrary actions on an affected device. Set a password NUEVOPASS:...

@lex Guestbook <= 4.0.2 - Remote Command Execution Exploit

No description provided by source. !/usr/bin/php ?php // | | header @lex Guestbook = 4.0.2 Remote Command Execution Exploit | header ======================================================== | status Retrieving the administrator password | sploit AdminUsername::root | sploit AdminPassword::toor |...

Pet Grooming Management System <= 2.0 Arbitrary Add-Admin Exploit

No description provided by source. !/usr/bin/perl use strict; use LWP::UserAgent; print -+- Pet Grooming Management System = 2.0 Arbitrary Add-Admin Exploit -+-\n; print -+- Discovered && Coded By: t0pP8uZz - Discovered On: 15 MAY 2008 -+-\n; print -+- Script Download:...