Discuz附件下载权限绕过

简要描述： 绕过附件下载权限只是漏洞的一个应用，还可以免费下载附件，其他的应用还没发掘.. 详细说明： 在下载附件的时候，附件所设置的“阅读权限”可以被绕过。 Discuz的附件下载地址是类似 forum.php?mod=attachment&aid=Nzg4fDQwNGQzYjMxfDEzODk2OTM4Mzh8MzEyNTR8MjY3Mw%3D%3D 这样的地址，其中的aid参数是一串base64，解码后是： 788|404d3b31|1389693838|31254|2673 这串aid在source/module/forum/forumattachment.php 中被这样解析...

Threat Outbreak Alert: Fake Bonus Attachment Email Messages on January 13, 2014

Medium Alert ID: 32410 First Published: 2014 January 14 18:43 GMT Version: 1 Summary Cisco Security has detected significant activity related to Italian-language spam email messages that claim to contain a bonus attachment for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake New Payment Attachment Email Messages on January 13, 2014

Medium Alert ID: 32411 First Published: 2014 January 14 17:48 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain new payment details attachment for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Order Details Email Messages on January 13, 2014

Medium Alert ID: 32420 First Published: 2014 January 14 17:44 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain product order information for the recipient. The text in the email message attempts to convince the recipient ...

Threat Outbreak Alert: Fake Location Change Notification Email Messages on January 13, 2014

Medium Alert ID: 32422 First Published: 2014 January 14 16:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a location change notice for the recipient. The text in the email message attempts to convince the recipient t...

Threat Outbreak Alert: Fake Transaction Details Notification Email Messages on January 13, 2014

Medium Alert ID: 32424 First Published: 2014 January 14 16:10 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain transaction details for the recipient. The text in the email message attempts to convince the recipient to ope...

Threat Outbreak Alert: Fake Order Details Notification Email Messages on January 13, 2014

Medium Alert ID: 32425 First Published: 2014 January 14 15:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain order details for the recipient. The text in the email message attempts to convince the recipient to open the...

Threat Outbreak Alert: Fake Court Appearance Request Email Messages on January 22, 2014

Medium Alert ID: 32426 First Published: 2014 January 14 15:46 GMT Last Updated: 2014 January 24 12:42 GMT Version: 5 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a court appearance notice for the recipient. The text in the email...

Threat Outbreak Alert: Fake Certificate Update Information Email Messages on January 13, 2014

Medium Alert ID: 32427 First Published: 2014 January 14 15:44 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain certificate update information attachment for the recipient. The text in the email message attempts to convinc...

Threat Outbreak Alert: Fake Fax Message Delivery Email Messages on January 14, 2014

Medium Alert ID: 32429 First Published: 2014 January 14 15:44 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a fax message delivery notification for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Financial Documents Email Messages on January 14, 2014

Medium Alert ID: 32428 First Published: 2014 January 14 15:42 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain financial documents for the recipient. The text in the email message attempts to convince the recipient to ope...

Threat Outbreak Alert: Fake Official Documents Notification Email Messages on January 13, 2014

Medium Alert ID: 32418 First Published: 2014 January 14 15:40 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain official documents for the recipient. The text in the email message attempts to convince the recipient to open...

Threat Outbreak Alert: Fake Bank Documents Email Messages on January 13, 2014

Medium Alert ID: 32417 First Published: 2014 January 14 15:38 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain bank documents for the recipient. The text in the email message attempts to convince the recipient to open the...

Threat Outbreak Alert: Fake Invoice Notification Email Messages on January 13, 2014

Medium Alert ID: 32416 First Published: 2014 January 14 15:37 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an invoice notification for the recipient. The text in the email message attempts to convince the recipient to...

Threat Outbreak Alert: Fake Photo Notification Email Messages on January 13, 2014

Medium Alert ID: 32415 First Published: 2014 January 14 15:36 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claim to contain photographs for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Transaction Notification Email Messages on January 13, 2014

Medium Alert ID: 32414 First Published: 2014 January 14 15:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain transaction details for the recipient. The text in the email message attempts to convince the recipient to ope...

Threat Outbreak Alert: Fake FMS Notification Attachment Email Messages on January 13, 2014

Medium Alert ID: 32413 First Published: 2014 January 14 15:33 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a Department of the Treasury Financial Management Service FMS notification for the recipient. The text in the...

Threat Outbreak Alert: Malicious Attachment Email Messages on January 13, 2014

Medium Alert ID: 32412 First Published: 2014 January 14 15:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an attachment for the recipient. The text in the email message attempts to convince the recipient to open the...

Whitelist or blacklist for inline attachment display

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-32204. panel Currently, there are three Attachment Download Security Policy: Default Insecure Secure !sample.png! It would be...

Whitelist or blacklist for inline attachment display

Currently, there are three Attachment Download Security Policy: Default Insecure Secure !sample.png! It would be helpful if there is an extra option which allow the administrator to control the type of attachment which can be displayed inline...