3219 matches found
Haraj Script Stored XSS and File Upload Vulnerability
You Can Upload file And make come Xss code ! at Once ,, in famous arabic scripth php Haraj script . ============================= 1: first enter to site of our target , and signup in the target site . 2: go to HTTP://TARGET.COM/home/add/ or HTTP://TARGET.COM/homeadd.html or or...
Microsoft ASP.NET PKCS Padding Information Disclosure (MS10-070; CVE-2010-3332)
An information disclosure vulnerability has been reported in ASP.NET. This vulnerability is caused by ASP.NET providing web clients details in error messages when decrypting certain ciphertext. Successful exploitation of this vulnerability could allow the attacker to read and tamper with data. If...
anwsion问答系统存在任意文件上传重大漏洞
简要描述： 上传只做了js验证貌似 详细说明： 本人只在topic话题下上传了，貌似头像上传那里也存在该问题（没测试） 点击话题图像，就可以编辑上传图像了。 使用火狐的TAMPER DATA插件，并打开开始截获。 选择一个2bb.jpg（内涵php一句话的正常图片即可 该文件目录内还有一个2bb.php（留作备用 在tamaper data内修改数据，把2bb.JPG改成2bb.php即可 就可以看到上传上去的php图片小马了，但是这个是经过处理的 只要把url后面的100X100参数或者50x50参数去除，就可以得到一个没有经过处理的PHP小马了。 漏洞证明： 官方已经拿到shell了...
extension): MITM due to improper validation of AX attribute signatures
message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...
Security advisory: SQL Injection in LedgerSMB 1.2.24 and lower
Hi all; The LedgerSMB development team has found an SQL injection issue in LedgerSMB 1.2.24. Because this issue stems from our common SQL-Ledger heritage, it affects all versions of LedgerSMB and has been confirmed in SQL-Ledger 2.8.33. We contacted Dieter when we initially discovered this and no...
Microsoft Security Bulletin MS10-086 - Moderate Vulnerability in Windows Shared Cluster Disks Could Allow Tampering (2294255)
Microsoft Security Bulletin MS10-086 - Moderate Vulnerability in Windows Shared Cluster Disks Could Allow Tampering 2294255 Published: October 12, 2010 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in Windows Server 2008 R2 whe...
MS10-086: Vulnerability in Windows Shared Cluster Disks Could Allow Tampering (2294255)
The remote Windows 2008 R2 host has a data tampering vulnerability. When the host is used as a shared failover cluster, the Failover Cluster Manager uses insecure default permissions when adding disks to a cluster. This allows unauthorized read, write, and delete access to the administrative shar...
Microsoft Releases Security Bulletin MS10-070
Microsoft has released Microsoft Security Bulletin MS10-070 to address a vulnerability affecting ASP.NET. Exploitation of this vulnerability may allow an attacker to obtain sensitive information or tamper with data. US-CERT encourages users and administrators to review Microsoft Security Bulletin...
Microsoft Releases Security Advisory 2416728
Microsoft has released a security advisory to alert users of a vulnerability affecting ASP.NET. Exploitation of this vulnerability may allow an attacker to obtain sensitive information or tamper with data. US-CERT encourages administrators to review Microsoft security advisory 2416728 and apply a...
Multiple HTTP Error Responses (CVE-2010-3332)
ASP.NET is a collection of technologies within the.NET Framework that enable developers to build Web applications and XML Web Services. A remote attacker may exploit this issue to read data, such as the View State, which was encrypted by the server. This vulnerability is caused by ASP.NET providi...
Internet Navigware Server Information Disclosure Vulnerability
Overview Internet Navigware Server is vulnerable to information disclosure or data tampering. Impact A remote attacker could disclose or alter information. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropriate action...
PHP-Nuke 8.0 - News Module Cross-Site Scripting HTML Code Injection
PHP-Nuke 8.0 - News Module Cross-Site Scripting HTML Code Injection Software Link: http://www.phpnuke.org/modules.php?name=Downloads&dop=viewdownload&cid=1 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= note : This bug found by tampering passed data . coders don't sanitize and che...
PHP-Nuke <= 8.0 XSS & HTML Code Injection in News Module
Exploit for unknown platform in category web applications ======================================================== PHP-Nuke alert/XSS/.source 2. Html code injection : -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 0day.today 2018-03-19...
PHP-Nuke <= 8.0 XSS & HTML Code Injection in News Module
No description provided by source. Software Link: http://www.phpnuke.org/modules.php?name=Downloads&dop=viewdownload&cid=1 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= note : This bug found by tampering passed data . coders don't sanitize and check user entry point for news rate...
PHP-Nuke 8.0 - News Module Cross-Site Scripting / HTML Code Injection
Software Link: http://www.phpnuke.org/modules.php?name=Downloads&dop=viewdownload&cid=1 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= note : This bug found by tampering passed data . coders don't sanitize and check user entry point for news rate...
Mozilla Thunderbird < 2.0.0.22 Multiple Vulnerabilities
The installed version of Thunderbird is earlier than 2.0.0.22. Such versions are potentially affected by the following security issues : - Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code provided JavaScript is enabled in mail. MFSA 2009-14 - Whe...
Further understanding of USB Key security vulnerabilities-vulnerability warning-the black bar safety net
1, as long as the digital certificate and private key stored in the computer medium, or may be read into memory, and then are unsafe. For example, China merchants Bank, the hard disk version of the digital certificate is unsafe. Because of its private key and the digital certificate has been Troj...
ms-access-97-passwords.txt
Date: Thu, 4 Feb 1999 04:15:13 -0700 From: "Donald Moore MindRape" To: [email protected] Subject: Microsoft Access 97 Stores Database Password as Plaintext ====================================================================== Title: Microsoft Access 97 Stores Database Password as Plaintext...
Security Update for Exchange 2000 Server (KB894689)
A security issue has been identified that could affect your Exchange 2000 Server system in the following way: 1. Tampering with Data 2. Denial of Service...