105 matches found
CVE-2015-3752: Exposure of Sensitive Information to an Unauthorized Actor
The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive...
PT-2015-1872
Name of the Vulnerable Software and Affected Versions Apple Safari versions before 6.2.8 Apple Safari versions 7.x before 7.1.8 Apple Safari versions 8.x before 8.0.8 iOS versions before 8.4.1 Description The issue is related to the Content Security Policy implementation in WebKit, which does not...
cmseasy csrf通过一个xss最后getshell
简要描述： 为什么我们要选择get类型的呢，因为get类型存储到数据库的时候触发时候管理员是察觉不到的，可以通过图片等进行操作，然后我们存储一个xss后门，这样一来，我们就可以加载一个远端的js，那么就各种无视token和referer了 详细说明： 开始我们先分析一段源代码： celive/admin/system.php:line:128-142: if$do == 'add' and $username != '' $password = addslashes$REQUEST'password'; $password = md5$password; $realname =...
