Maccms V8 Sql Injection #1（有gpc限制）

简要描述： 现在 V8版本 基本全部文件都有zend加密了。 而且还有360safe3.php保护 刚开始以为没搞头的，结果有个妹子发来微信。 妹子：在干嘛？ 我：挖洞 妹子：一个人挖？ 我：对啊！ 妹子：我过去陪你一起挖吧！ 我马上关机。擦，想跟老子抢乌云币？果断一个人作死开挖 详细说明： 是cookie注入，有gpc限制，4处注入点 重现下发现过程 1. inc/common/function.php 直接获取cookie，未过滤 function getCookie$key if!isset$COOKIE$key return ''; else return $COOKIE$key...

CVE-2013-3984

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

HackerOne: Issue with remember_user_token

When a user logs out, cookie named rememberusertoken is invalidated on the user side. When the user log in again with functionality 'remember me for a week', he gets the same value of rememberusertoken as previously. Moreover, when there is only cookie named rememberusertoken in request, the user...

Coinbase: Cookie missing the HttpOnly flag

Hello coinbase, Iam saikiran.Iam a security researcher.while i was going through your site i found that your website does not have HTTPOnly flag for the cookies.it is not a vulnerability but it is a new improvement and improves the security of your site. If your not aware of HTTPOnly flag here is...

Monoprice.com Cart Enumeration

As similarly stated at http://nmap.org/mailman/listinfo/fulldisclosure I would appreciate if Monoprice.com better secures its ecommerce site by fixing the following flaw rather than hiding it. With no cookies, visiting http://www.monoprice.com/Cart yields an empty cart with no cart id . Adding an...

Kemana Directory 1.5.6 Password Hash Disclosure Vulnerability

Kemana contains a flaw that is due to the 'kemanaadminpasswd' cookie storing user password SHA1 hashes. This may allow a remote MitM attacker to more easily gain access to password information. Version 1.5.6 is affected. Kemana Directory 1.5.6 kemanaadminpasswd Cookie User Password Hash Disclosur...

PHPYUN设计缺陷可认证任意手机

简要描述： PHPYUN设计缺陷可认证任意手机 详细说明： 上代码 model/ajax.class.php 行609 $moblie=$POSTstr0; $randstr=rand100000,999999; setcookie"mobliecode",$randstr,time+120, "/"; 神马情况 码直接放到cookie里面。。 这个程序员才不省心哦！明显就是掩耳盗铃的节奏啊！！ 漏洞证明： 同上...

Et-Chat 3.07 Privilege Escalation / Shell Upload

Exploit Title: Et-chat 3.07 user id Parameter Remote code execution Exploit Author: MR.XpR Script Download : http://et-chat.ir/up/etchatv307.zip Risk : Normal Platforms : PHP Tested on: 7 , KAli , Vista Date : 2013 -====================- How does : This error occurs due to keep cookies Exploit :...

Opera < 12.15 Multiple Vulnerabilities

Binary data 6753.prm...

Mobile app dig fiscal website, the cookie encryption algorithm is weak can be forged-vulnerability warning-the black bar safety net

Brief description: The installation of a dug Choi, because want to sync the data, so the first test of a fan, but the cookie was found on this issue. By some means can forge other people's cookies to log in, you can access financial information, login to Forum, etc., if the forgery of the...

Exclusive : Hacking Hotmail and Outlook accounts using Cookie reuse vulnerability

This Friday I was working with my co-security researcher "Christy Philip Mathew" in +The Hacker News Lab for testing the Cookie Handling Vulnerabilities in the most famous email services i.e Hotmail and Outlook. Well, both are merged now and part of the same parent company - Microsoft, the softwa...

PBBoard 2.1.4 SQL Injection

Title: PBBoard v2.1.4 multiple SQLi Vulnerabilities Version: 2.1.4 Author/Found by: loneferret Software Site: http://www.pbboard.com/PBBoardv2.1.4.zip Other vulnerabilities: http://www.exploit-db.com/exploits/18937/ Date found: May 29th 2012 Tested on: Ubuntu Server 8.04 / PHP Version...

httpd: NULL pointer dereference crash in mod_log_config

The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %C format string, which allows remote attackers to cause a denial of service daemon crash via a cookie that lacks both a nam...

CVE-2012-1837

The 1 webreports, 2 post/create-role, and 3 post/update-role programs in IBM Tivoli Endpoint Manager TEM before 8.2 do not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to thi...

Sql injection

Eval injection vulnerability in zp-core/zp-extensions/viewersizeimage.php in ZENphoto 1.4.2, when the viewersizeimage plugin is enabled, allows remote attackers to execute arbitrary PHP code via the viewersizeimagesaved cookie...

CVE-2012-0021

The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %C format string, which allows remote attackers to cause a denial of service daemon crash via a cookie that lacks both a nam...

Directory traversal

Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related to Output.pm...

Apple Safari Secure Cookie Security Bypass Vulnerability (Windows)

The host is installed with Apple Safari web browser and is prone to security bypass vulnerability. OpenVAS Vulnerability Test $Id: gbapplesafaricookiesecbypassvulnwin.nasl 7006 2017-08-25 11:51:20Z teissa $ Apple Safari Secure Cookie Security Bypass Vulnerability Windows Authors: Sooraj KS...

CVE-2008-7298

The Android browser in Android cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security HSTS...

CVE-2008-7296

Apple Safari cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security HSTS includeSubDomains...