ruvar OA系统 plan_template_preview.aspx 参数template_id SQL注入漏洞

0x01 框架介绍 ruvar OA采用基于IE浏览器的 B/S 结构，以人员管理、考勤管理、薪资管理、招聘管理、培训管理、合同管理、社保福利、绩效考核、报表中心为核心功能模块，是企业领导、HR经理和员工全员参与的，可多层次管理的集团版eHR系统。 官方主页：http://www.ruvar.com/ 0x02 漏洞细节 /WorkPlan/plantemplatepreview.aspx?templateid 处存在SQL注入漏洞。 案例：...

motherless.com Open Redirect vulnerability

Vulnerable URL: http://motherless.com/index/top?url=https://xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.10.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 1292 Google Pagerank| 3 VIP website status:| Yes...

ergoarena.pl XSS vulnerability

Vulnerable URL: http://ergoarena.pl/?s=%22%3E%3Csvg%20onload=alert%28/XSSPSOED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 576234 Google Pagerank| 5 VIP website status:| ...

Raspberry Pi 3 — New $35 MicroComputer with Built-in Wi-Fi and Bluetooth

While celebrating its computer's fourth birthday, the Raspberry Pi Foundation has launched a brand new Raspberry Pi today. Great news for all Micro-computing fans – A new, powerful Raspberry Pi 3 Model B in town. Months after introducing just $5 Raspberry Pi Zero, Raspberry Pi Foundation has...

kqzyfj.com Open Redirect vulnerability

Vulnerable URL: https://www.kqzyfj.com/click-7629304-11751890-1446214466000?sid=1603617912.1456659189=http://xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 17:42 GMT Vulnerability type:| Open Redirect Vulnerability status:|...

foroactivo.com XSS vulnerability

Vulnerable URL: http://www.foroactivo.com/crear-un-foro/crear-un-foro-gratis/punbb Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 17:42 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 15987 Google Pagerank| 5...

shoppbs.org XSS vulnerability

Vulnerable URL: http://www.shoppbs.org/search/noResults.jsp?kw=%27%2Balert%28/XSSPOSED/%29%2B%27 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 24980 Google Pagerank| 0 VIP website...

local.google.co.in Open Redirect vulnerability

Vulnerable URL: http://local.google.co.in/search?btnI==http://www.xssposed.org Details: Description| Value ---|--- Patched:| Yes, at 03.09.2016 Latest check for patch:| 03.09.2016 20:53 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

groupon.co.id Open Redirect vulnerability

Vulnerable URL: http://groupon.co.id/redirect.php?u=https://www.xssposed.org Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 16394 Google Pagerank| 6 VIP website status:| Yes Check groupon.co.id SSL...

stormbringer.at XSS vulnerability

Vulnerable URL: http://www.stormbringer.at/search.html Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 605841 Google Pagerank| 4 VIP website status:| No Check stormbringer.at SSL...

firstsamara.ru Open Redirect vulnerability

Vulnerable URL: http://firstsamara.ru/wp-b/www/delivery/ck.php?oaparams=2bannerid=2zoneid=2cb=0aceef34a3oadest=https://xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed...

premium-dance.com Open Redirect vulnerability

Vulnerable URL: http://premium-dance.com/ads2/www/delivery/ck.php?oaparams=2bannerid=33zoneid=5cb=61e9909c4aoadest=https://xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 17:30 GMT Vulnerability type:| Open Redirect Vulnerability...

caravans.net Open Redirect vulnerability

Vulnerable URL: http://www.caravans.net/adserver/www/delivery/ck.php?oaparams=2bannerid=303zoneid=182cb=088428212eoadest=https://xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly...

zackinpublications.com Open Redirect vulnerability

Vulnerable URL: http://zackinpublications.com/adserver/www/delivery/ck.php?oaparams=2bannerid=505zoneid=57cb=05209eb701oadest=https://xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 20:47 GMT Vulnerability type:| Open Redirect...

apps.library.und.edu XSS vulnerability

Vulnerable URL: https://apps.library.und.edu/archon/?p=collections/findingaid=39%22%3E%3Cimg%20src=x%20onerror=prompt%28%27XSSPOSED%27%29%3E==3637 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

thefinancialexpress-bd.com XSS vulnerability

Vulnerable URL: http://www.thefinancialexpress-bd.com/search/?q=%22%2F%3E%3CscRiPT%3Ealert%28%22XSSPOSED%22%29%3B%3C%2FscriPT%3E=print Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 20:47 GMT Vulnerability type:| XSS Vulnerability status:|...

toledoblade.com XSS vulnerability

Vulnerable URL: http://www.toledoblade.com/Police-Fire/2012/1?start=%22%3E%3Csvg/onload=alert%28%27XSSPOSED%27%29%3E121?start=1 Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 17:26 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

CVE-2016-2275

The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code...

Improper access control

The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code...

CVE-2016-2275

CVE-2016-2275 affects Advantech/B+B SmartWorx VESP211-EU (firmware 1.7.2) and VESP211-232 (firmware 1.5.1 and 1.7.2). The web interface relies on client-side authentication, permitting remote attackers to perform administrative actions by modifying JavaScript. Exposure is via network-accessible w...