迅雷权限提升漏洞

迅雷下载东西的时候，会调用我们安装迅雷后一个htm文件，去激活htm文件里的一些代码， 把我们所下载东西添加到列表当中。 所对应的htm文件有2处： C:\Program Files\Thunder Network\Thunder\Program\geturl.htm C:\Program Files\Thunder Network\Thunder\Program\getAllurl.htm 如果我们想把我们想要的代码添加进去执行了？ 我们简单写个代码试试，代码如下： Set vbs=CreateObject"Wscript.Shell" vbs.run "cmd /c net user...

迅雷极速版权限提升漏洞

迅雷下载东西的时候，会调用我们安装迅雷后一个htm文件，去激活htm文件里的一些代码， 把我们所下载东西添加到列表当中。 所对应的htm文件有2处： C:\Program Files\Thunder Network\Thunder\Program\geturl.htm C:\Program Files\Thunder Network\Thunder\Program\getAllurl.htm 如果我们想把我们想要的代码添加进去执行了？ 我们简单写个代码试试，代码如下： Set vbs=CreateObject"Wscript.Shell" vbs.run "cmd /c net user...

CVE-2015-5323

Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user...

CVE-2015-5323

Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user...

CVE-2015-5323

Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user...

CVE-2015-8227

The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message...

Design/Logic Flaw

The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message...

CVE-2015-8227

The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message...

WordPress Social Share Button Plugin <= 2.1 - Stored Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can store HTML or JS code. Solution Update the plugin...

WordPress Websimon Tables Plugin <= 1.3.4 - Reflected Cross Site Scripting

Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Update the plugin...

WordPress SEO Rank Reporter Plugin <= 2.2.2 - Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can inject html or JS code. Vulnerable parameters are "keyworditem" and "entryurl". Solution Update the plugin...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary 1 commands via the cmd paramet...

CVE-2015-7984

Multiple cross-site request forgery CSRF vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary 1 commands via the cmd paramet...

CVE-2015-7984

CVE-2015-7984 cites CSRF vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 that allow remote attackers to hijack administrator authentication to perform requests executing arbitrary commands, SQL queries, or PHP code (via cmd, ...

CVE-2015-7984

Multiple cross-site request forgery CSRF vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary 1 commands via the cmd paramet...

CVE-2015-5999

Multiple cross-site request forgery CSRF vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2.06.B09BETA allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin password, 2 change the network policy, or 3 possibly have...

CVE-2015-8233

The MAYO Drupal theme (7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6) is affected by an XSS vulnerability. Root cause: insufficient sanitization in theme settings that remote administrators with the Administer themes permission can exploit to inject arbitrary script/HTML. Impact: potential fo...

Adobe Releases Security Updates for ColdFusion, LiveCycle Data Services, and Adobe Premiere Clip

Adobe has released security updates to address multiple vulnerabilities in ColdFusion, LiveCycle Data Services, and Adobe Premiere Clip. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to revi...

Unable to log in to PVS console, error: The domain/user does not have access to the Farm

When a domain user tries to log in to the PVS console, gets error: "The domain/user does not have access to the Farm." The environment may or may not have multiple PVS sites and/or multiple domains. The domain user has been added to the "Farm Administrators" under the Security tab on the Farm...

Google Releases Security Updates for Chrome and Chrome OS

Google has released security updates to address vulnerabilities in Chrome and Chrome OS. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system. Updates available include: Chrome 46.0.2490.86 for Windows, Mac and Linux Chrome 46.0.2490.82 fo...