某图书系统通用注入一枚

简要描述： 影响网站数量较大，建议转国家应急 详细说明： http://www.infosea.com.cn/yonghu.html 北京清大新洋科技有限公司 注入文件：/opac/dzxxxs.jsp?dztm=00007&index=3 案例： http://61.187.55.41:8090/opac/dzxxxs.jsp?dztm=00007&index=3 http://58.30.20.36:8089/opac/dzxxxs.jsp?dztm=00007&index=3...

Design/Logic Flaw

Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging t...

Lenovo System Update < 5.06.0034 Multiple Vulnerabilities

The version of Lenovo System Update installed on the remote host is prior to 5.06.0034. It is, therefore, affected by the following vulnerabilities : - A flaw exists in SUService.exe System Update service due to generating security tokens for a named pipe in a predictable manner. A local attacker...

Lenovo System Update Correct Checksum Bypass Vulnerability

Lenovo System Update is a system upgrade tool for Lenovo. Lenovo System Update fails to properly validate the Lenovo System Update CA certificate chain, allowing remote attackers who can conduct man-in-the-middle attacks to bypass signature validation, replace Lenovo applications, and execute...

NetNanny uses a shared private key and root CA

Overview NetNanny uses a shared private key and root Certificate Authority CA, making systems broadly vulnerable to HTTPS spoofing. Description NetNanny installs a Man-in-the-Middle MITM proxy as well as a new trusted root CA certificate. The certificate used by NetNanny is shared among all...

Design/Logic Flaw

Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain nam...

CVE-2015-3008

Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain nam...

UBUNTU-CVE-2015-3008

Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain nam...

CVE-2015-3008

Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain nam...

[SECURITY] [DSA 3203-1] tor security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3203-1 [email protected] http://www.debian.org/security/ Sebastien Delafond March 22, 2015 http://www.debian.org/security/faq -...

Google Drops Trust in Chinese CA CNNIC

UPDATE–Google has taken the unusual step of completely removing trust from Chrome for the Chinese certificate authority CNNIC in the wake of an incident in which certificates issued by the CA were misused. Mozilla followed suit on Thursday, also removing CNNIC from its trust store. Google officia...

Mandriva Linux Security Advisory : samba4 (MDVSA-2015:083)

Multiple vulnerabilities has been discovered and corrected in samba4 : Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller AD DC is configured, allows remote authenticated users to set the LDB userAccountControl UFSERVERTRUSTACCOUNT...

Debian DLA-178-1 : tor security update

Several issues have been discovered and fixed in Tor, a connection-based low-latency anonymous communication system. o Jowr discovered that very high DNS query load on a relay could trigger an assertion error. o A relay could crash with an assertion error if a buffer of exactly the wrong layout w...

Tech Companies, Privacy Advocates Call for NSA Reform

A group of technology companies, non-profits and privacy and human rights organizations have sent a letter to President Barack Obama, the director of national intelligence and a wide range of Congressional leaders, calling for an end to the bulk collection of phone metadata under Section 215 of t...

ManageEngine Desktop Central statusUpdate Arbitrary File Upload RCE (intrusive check)

The version of ManageEngine Desktop Central running on the remote host is affected by a remote code execution vulnerability due to a failure by the statusUpdate script to properly sanitize user-supplied input to the 'fileName' parameter when performing an 'LFU' action to statusUpdate. A remote,...

Debian DSA-3203-1 : tor - security update

Several denial-of-service issues have been discovered in Tor, a connection-based low-latency anonymous communication system. - Jowr discovered that very high DNS query load on a relay could trigger an assertion error. - A relay could crash with an assertion error if a buffer of exactly the wrong...

CA Tied to Chinese Registrar Issued Unauthorized Google Certificates

Google security engineers, investigating fraudulent certificates issued for several of the company’s domains, discovered that a Chinese certificate authority was using an intermediate CA, MCS Holdings, that issued the unauthorized Google certificates, and could have issued certificates for...

PT-2015-4018 · Gnu +4 · Gnutls +4

Name of the Vulnerable Software and Affected Versions: GnuTLS versions prior to 2.9.10 Description: The issue allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is either not yet valid or no longer valid, due to the failure to verify the activati...

[SECURITY] [DLA 178-1] tor security update

Package : tor Version : 0.2.4.26-1deb6u1 Several issues have been discovered and fixed in Tor, a connection-based low-latency anonymous communication system. o Jowr discovered that very high DNS query load on a relay could trigger an assertion error. o A relay could crash with an assertion error ...

[SECURITY] [DSA 3203-1] tor security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3203-1 [email protected] http://www.debian.org/security/ Sebastien Delafond March 22, 2015 http://www.debian.org/security/faq -...