cmseasy 管理员身份 后台缓存配置文件，没有过滤一个字符导致getshell(3)

简要描述： cmseasy 管理员身份 后台缓存配置文件，没有过滤一个字符导致getshell3 哥就是要找完所有后台shell，让你们后台无处可找，呵呵.......... 详细说明： 直接看代码: unionadmin.php:lines:123-138: if front::post'submit' &&$this-manage-vaild $this-manage-filter$this-Exc; $this-manage-addbefore$this; $this-manage-savebefore; $path = ROOT.'/config/union.php';...

Google Chrome < 37.0.2062.94 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 37.0.2062.94. It is, therefore, affected by the following vulnerabilities : - Blink contains a use-after-free vulnerability in its SVG implementation. By using a specially crafted web page, a remote attacker can cause...

Directory traversal

kcleanup.cpp in KDirStat 2.7.0 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a " double quote character in the directory name, a different vulnerability than CVE-2014-2528...

Updated bugzilla packages fix a CSRF vulnerability

Updated bugzilla packages fix security vulnerabilities: Adobe does not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery CSRF attacks against Bugzilla's JSONP endpoint, possibly obtaining sensitive bug information, via a crafted OBJECT...

Minimising font downloads

Optimising fonts is pretty difficult for larger sites. There's an easy solution, although only some browsers support it. Translations Français Fonts can be big Really big. They can be anywhere from 70k to many megabytes compressed of course, because why wouldn't you?. You want bold? Well, you jus...

PT-2014-5783 · Oracle +6 · Mysql Server +6

Name of the Vulnerable Software and Affected Versions: Oracle MySQL Server versions 5.5.38 and earlier Oracle MySQL Server versions 5.6.19 and earlier Description: The issue affects the availability of the system, allowing remote authenticated users to exploit it via vectors related to...

CVE-2014-1558

Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service X.509 certificate parsing outage via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1559...

CVE-2014-1559

Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service X.509 certificate parsing outage via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1558...

CVE-2014-1560

Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service X.509 certificate parsing outage via a crafted certificate that does not use ASCII character encoding in a required context...

CVE-2014-1560

CVE-2014-1560 affects Mozilla Firefox before 31.0 and Thunderbird before 31.0. The issue is in parsing X.509 certificates: a crafted certificate that does not use ASCII character encoding in a required context can trigger a denial of service. The vulnerability is triggered during certificate pars...

CVE-2014-1560

Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service X.509 certificate parsing outage via a crafted certificate that does not use ASCII character encoding in a required context...

CVE-2014-1558

Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service X.509 certificate parsing outage via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1559...

CVE-2014-1560

Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service X.509 certificate parsing outage via a crafted certificate that does not use ASCII character encoding in a required context...

Certificate parsing broken by non-standard character encoding — Mozilla

Mozilla security researcher Christian Holler discovered several issues while fuzzing the parsing of SSL certificates. Two of these issues were a result of using characters that are not UTF-8 in certificates when various functions expected all strings to be UTF-8 format. The third issue was a resu...

CVE-2012-2682

Cumin aka MRG Management Console, as used in Red Hat Enterprise MRG 2.5, allows attackers with certain database privileges to cause a denial of service inaccessible page via a non-ASCII character in the name of a link...

CVE-2012-2682

Cumin aka MRG Management Console, as used in Red Hat Enterprise MRG 2.5, allows attackers with certain database privileges to cause a denial of service inaccessible page via a non-ASCII character in the name of a link...

Upload the file of trap II pure alphanumeric. swf is a vulnerability?- Vulnerability warning-the black bar safety net

0x00 background In a previous uploaded file trap , the author mentioned for flash cross-domain data hijacking,sometimes does not need us to upload a file. Because we can simply use the JSONP interface,the flash content is assigned to the callback to be used. Just like in the comments@Sogili...

BEA Systems WebLogic Server and Express 7.0 Null Character DoS

No description provided by source. source: http://www.securityfocus.com/bid/4646/info BEA Systems WebLogic Server is an enterprise level web and wireless application server for Microsoft Windows and most Unix and Linux distributions. BEA WebLogic Express provides a platform for serving dynamic da...

Netgear FM114P Wireless Firewall File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6807/info Netgear FM114P Wireless Firewalls allow directory traversal using escaped character sequences. It is possible for an unauthenticated user to retrieve the firewall's configuration file by escaping from the...

Yahoo! Messenger 7.0/7.5 jscript.dll Non-Ascii Character DoS

No description provided by source. source: http://www.securityfocus.com/bid/18622/info Yahoo! Messenger is prone to a denial-of-service vulnerability. Successful exploitation will cause the application to crash, effectively denying service. This issue affects version 7.5.0.814; other versions may...