Cubic CMS多个安全漏洞

Cubic CMS是一款内容管理系统。 由于/login.usuario没有正确过滤传递的'login'和'pass' POST参数的用户输入，允许远程攻击者注入或操纵SQL查询。 0 Cubic CMS 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.cubicfactory.com/ I. BACKGROUND ------------------------- "CUBIC CMS" is a non-free content management system for websites and portals o...

Cubic CMS - Multiple Vulnerabilities

Cubic CMS - Multiple Vulnerabilities I. BACKGROUND ------------------------- "CUBIC CMS" is a non-free content management system for websites and portals of any size, powerful, adaptable to any graphic design that allows users administration 100% professional but simple at the same time that...

YXcmsApp某处xss导致getshell

简要描述： xss到后台导致getshell一条龙服务不过略鸡肋。 详细说明： YXCMS是一款面向企业的内容管理系统，采用三级缓存，MVC架构以BSD协议开源。 注册了用户以后来到用户管理页面，点击信息发布 - 增加咨询，发现是一个富文本编辑器，kindeditor。不管是什么编辑器，既然给了一个用户这么大的权限，这种情况下很容易出现xss。 随便输入点什么东西，抓包，修改content字段内容，写你的xss代码，什么都行。 好了。管理员在后台就能看到我提交的文章： 然后编辑的话就能触发xss：...

Debian DSA-2834-1 : typo3-src - several vulnerabilities

Several vulnerabilities were discovered in TYPO3, a content management system. This update addresses cross-site scripting, information disclosure, mass assignment, open redirection and insecure unserialize vulnerabilities and corresponds to TYPO3-CORE-SA-2013-004. %NASLMINLEVEL 70300 C Tenable...

[SECURITY] [DSA 2834-1] typo3-src security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2834-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso January 01, 2014 http://www.debian.org/security/faq -...

DSA-2834-1 typo3-src - several

Bulletin has no description...

Debian: Security Advisory (DSA-2834-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for drupal6 FEDORA-2013-22507

Check for the Version of drupal6 OpenVAS Vulnerability Test Fedora Update for drupal6 FEDORA-2013-22507 Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

TYPO3内容编辑向导多个跨站脚本漏洞

TYPO3是一款基于PHP4/PHP5+MYsql的内容管理系统。 TYPO3内容编辑向导存在未明安全漏洞，允许通过验证的远程攻击者利用漏洞反序列化任意对象，删除任意文件。 0 TYPO3 4.5.0 TYPO3 4.5.31 TYPO3 4.7.0 TYPO3 4.7.16 TYPO3 6.0.0 TYPO3 6.0.11 TYPO3 6.1.0 TYPO3 6.1.6 TYPO3 6.2 厂商补丁： TYPO3 ----- TYPO3 4.5.32, 4.7.17, 6.0.12, 6.1.7已经修复该漏洞，请到厂商的主页下载： http://typo3.org/...

TYPO3 Form Content Element授权绕过信息泄露漏洞

TYPO3是一款基于PHP4/PHP5+MYsql的内容管理系统。 TYPO3 Form Content Element存在一个安全漏洞，允许远程通过验证的攻击者生成任意签名HMAC，访问受限资源，获取敏感信息。 0 TYPO3 4.5.0 TYPO3 4.5.31 TYPO3 4.7.0 TYPO3 4.7.16 TYPO3 6.0.0 TYPO3 6.0.11 TYPO3 6.1.0 TYPO3 6.1.6 TYPO3 6.2 厂商补丁： TYPO3 ----- TYPO3 4.5.32, 4.7.17, 6.0.12, 6.1.7已经修复该漏洞，请到厂商的主页下载：...

TYPO3内容编辑向导反序列化对象任意文件删除漏洞

TYPO3是一款基于PHP4/PHP5+MYsql的内容管理系统。 TYPO3内容编辑向导存在未明安全漏洞，允许通过验证的远程攻击者利用漏洞反序列化任意对象，删除任意文件。 0 TYPO3 4.5.0 TYPO3 4.5.31 TYPO3 4.7.0 TYPO3 4.7.16 TYPO3 6.0.0 TYPO3 6.0.11 TYPO3 6.1.0 TYPO3 6.1.6 TYPO3 6.2 厂商补丁： TYPO3 ----- TYPO3 4.5.32, 4.7.17, 6.0.12, 6.1.7已经修复该漏洞，请到厂商的主页下载： http://typo3.org/...

TYPO3后端用户管理反射型跨站脚本漏洞

TYPO3是一款基于PHP4/PHP5+MYsql的内容管理系统。 TYPO3后端用户管理Backend User Administration存在反射型跨站脚本漏洞，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，当恶意数据被查看时可获取敏感信息或者劫持用户会话。 0 TYPO3 6.0.0 TYPO3 6.0.11 TYPO3 6.1.0 TYPO3 6.1.6 TYPO3 6.2 厂商补丁： TYPO3 ----- TYPO3 4.5.32, 4.7.17, 6.0.12, 6.1.7已经修复该漏洞，请到厂商的主页下载： http://typo3.org/...

[SECURITY] Fedora 20 Update: drupal6-6.29-1.fc20

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 20 Update: drupal7-7.24-1.fc20

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 19 Update: drupal6-6.29-1.fc19

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

Netin(Knight)content management system vulnerability-vulnerability warning-the black bar safety net

A very cold content management system, for the first time. Background path: netin/Login. asp Default user: admin/netin The default password is:0 0 0 0 0 0/netin2009 Default database:db$snetinb\db$snetin. mdb The default administrator table: BsUser Injection point: http://0day5.com/shownews.asp?id...

Fedora Update for drupal7 FEDORA-2013-21844

Check for the Version of drupal7 OpenVAS Vulnerability Test Fedora Update for drupal7 FEDORA-2013-21844 Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

VBulletin Content Management System Administrator Injection Remote Code Execution

A remote code execution vulnerability has been reported in VBulletin Content Management System. A remote attacker may exploit this issue by sending specially crafted POST message to the target server. Exploitation of this vulnerability may result in remote code execution...

DEBIAN-CVE-2013-4555

Cross-site request forgery CSRF vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors...

JVN#75720314: Tiki Wiki CMS Groupware vulnerable to SQL injection

Tiki Wiki CMS Groupware Tiki is a content management system CMS. Tiki contains a SQL injection vulnerability. Impact An arbitrary SQL command may be executed in the database the product is referencing. Solution Apply an Update Apply the appropriate update for the version of the software being use...