HTTP Commander AJS 3.1.9 Exception Cross Site Scripting

Document Title: =============== HTTP Commander AJS v3.1.9 - Client Side Exception Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1329 Release Date: ============= 2014-10-02 Vulnerability Laboratory ID VL-ID:...

HTTP Commander v3.1.9 - CS Exception Vulnerability

Document Title: =============== HTTP Commander v3.1.9 - CS Exception Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1329 Release Date: ============= 2014-10-01 Vulnerability Laboratory ID VL-ID: ==================================== 1329...

live800在线沟通平台客户端存储型XSS可攻击客服

简要描述： 帮朋友测试项目时无意间发现的。 详细说明： 我没有做过大量统计和测试，但根据我这几个月零零散散的测试我认为仍然存有大量的桌面应用，web应用和浏览器插件存有一摸一样的问题。 所以，这个XSS的输入点还是文件名。 漏洞证明： 首先我们构造这样的文件名： .jpg 随后通过http://x55.me/800.htm向客服发送文件，如下图： 现在切换到客服的应用界面，看发生了什么？...

Syslog LogAnalyzer 3.6.5 - Stored XSS Exploit

Exploit for multiple platform in category web applications Vulnerability title: Syslog LogAnalyzer 3.6.5 Stored XSS Author: Dolev Farhi Contact: dolevf at yahoo dot com @dolevff Application: LogAnalyzer 3.6.5 Date: 8.2.2014 Relevant CVEs: CVE-2014-6070 Vulnerable version: alert"xss", and sending ...

JQuery 1.4.2 Cross Site Scripting Vulnerability

JQuery version 1.4.2 suffers from a create object option in runtime client-side cross site scripting vulnerability. XSS Reflected JQuery 1.4.2 - Create object option in runtime client-side From: Mauro Risonho de Paula Assumpção Date: 02.09.2014 13:21:20 -0300 VSLA Security Advisory...

JQuery 1.4.2 Cross Site Scripting

XSS Reflected JQuery 1.4.2 - Create object option in runtime client-side From: Mauro Risonho de Paula Assumpção Date: 02.09.2014 13:21:20 -0300 VSLA Security Advisory FIRE-XSS-Reflected-Jquery 1.4.2 2014-001: XSS Reflected JQuery 1.4.2 LEVEL: MEDIUM In our tests authorized by the customer, we can...

Fedora 20 : subversion-1.8.10-1.fc20 (2014-9636)

This update includes the latest stable release of Apache Subversion, version 1.8.10. Client-side bugfixes: - guard against md5 hash collisions when finding cached credentials - raserf: properly match wildcards in SSL certs. - raserf: ignore the CommonName in SSL certs where there are Subject Alt...

Delphi and C++ Builder VCL library Buffer Overflow

1. Advisory Information Title: Delphi and C++ Builder VCL library Buffer Overflow Advisory ID: CORE-2014-0004 Advisory URL:http://www.coresecurity.com/core-labs/advisories/delphi-and-c-builder-vcl-library-buffer-overflow Date published: 2014-08-20 Date of last update: 2014-08-20 Vendors contacted...

用友人力资源管理软件SQL注入漏洞（无需登录，影响所有版本）

简要描述： 详细说明： 用友软件： 涉及客户非常多。都是大型国企、银行、能源、金融重要单位。 举例如下： 大连银行 http://zpyc.bankofdl.com 顺德农商行 http://career.sdebank.com 中国海洋石油总公司 http://zhaopin.cnooc.com.cn 北京市建筑设计研究院 www.biad.com.cn:88/ 民生银行 http://ehr.creditcard.cmbc.com.cn 中国中铁 http://61.232.6.108/ ....等等单位 直接谷歌搜 inurl:hrss/login.jsp inurl:hrss/r...

程氏舞曲CMS最新版v3.5存储型XSS

简要描述： 绕过过滤再来一发。。 详细说明： 问题页面：发表文章 news.php : $news'cscontent'=$this-CsdjSkins-uhtml$this-input-post'cscontent'; //内容 过滤代码： function uhtml$str $farr = array "/\s+/", //过滤多余的空白 "/?/isU", //过滤 ona-zA-Z+\s=^/isU", //过滤javascrīpt的on事件 ; $tarr = array " ", " ", "\1\2", ; $str = pregreplace...

Barracuda Networks Spam&Virus Firewall v6.0.2 (600 & Vx) - Client Side Cross Site Vulnerability

Document Title: =============== Barracuda Networks Spam&Virus Firewall v6.0.2 600 & Vx - Client Side Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=890 Barracuda Networks Security ID BNSEC: BNSEC-1176...

Zenoss Monitoring System 4.2.5-2108 Cross Site Scripting

Exploit Title: Stored XSS vulnerability in Zenoss core open source monitoring system Date: 12/05/2014 Exploit author: Dolev Farhi dolevatopenflare.org Vendor homepage: http://zenoss.com Software Link: http://www.zenoss.com Version: Core 4.2.5-2108 64bit Tested on: Kali Linux Vendor alerted:...

Barracuda Spam&Virus FW #39 - CS Cross Site Vulnerability

Document Title: =============== Barracuda Spam&Virus FW 39 - CS Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1118 Barracuda Networks Security ID BNSEC: BNSEC-1052 https://www.barracuda.com/support/knowledgebase/501600000013lYI...

Zenoss Monitoring System 4.2.5-2108 64bit - Stored XSS

No description provided by source. Exploit Title: Stored XSS vulnerability in Zenoss core open source monitoring system Date: 12/05/2014 Exploit author: Dolev Farhi dolevatopenflare.org Vendor homepage: http://zenoss.com Software Link: http://www.zenoss.com Version: Core 4.2.5-2108 64bit Tested o...

Zenoss Monitoring System 4.2.5-2108 64bit - Stored XSS Vulnerability

Cross-site scripting XSS vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web script or HTML via the title of a device. Exploit Title: Stored XSS vulnerability in Zenoss core open source monitoring system Date: 12/05/2014 Exploit author: Dolev Farhi dolevatopenflare.org...

Barracuda Spam&Virus FW #39 - CS Cross Site Vulnerability

Document Title: =============== Barracuda Spam&Virus FW 39 - CS Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1118 Barracuda Networks Security ID BNSEC: BNSEC-1052 https://www.barracuda.com/support/knowledgebase/501600000013lYI...

Zenoss Monitoring System 4.2.5-2108 (x64) - Persistent Cross-Site Scripting

Exploit Title: Stored XSS vulnerability in Zenoss core open source monitoring system Date: 12/05/2014 Exploit author: Dolev Farhi dolevatopenflare.org Vendor homepage: http://zenoss.com Software Link: http://www.zenoss.com Version: Core 4.2.5-2108 64bit Tested on: Kali Linux Vendor alerted:...

Barracuda Networks Spam And Virus Firewall 6.0.2 XSS

Document Title: =============== Barracuda Networks Spam&Virus Firewall v6.0.2 600 & Vx - Client Side Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=890 Barracuda Networks Security ID BNSEC: BNSEC-1176...

Yahoo! Mail Cross Site Scripting

Document Title: =============== Yahoo! Bug Bounty 30 YM - Application-Side Mail Encoding File Attachment Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1137 Release Date: ============= 2014-07-08 Vulnerability Laboratory ID VL-ID:...

Yahoo! Bug Bounty #30 YM - Persistent Mail Vulnerability

Document Title: =============== Yahoo! Bug Bounty 30 YM - Persistent Mail Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1137 Release Date: ============= 2014-07-08 Vulnerability Laboratory ID VL-ID: ==================================== 11...