PHPB2B网站管理系统SQL注入漏洞(无视防注入)

简要描述： RT 详细说明： 注入链接：/virtual-office/job.php 注入参数：job 漏洞代码：（第52行开始） if !empty$POST'job' && $POST'save' $vals = $POST'job'; pbsubmitcheck'job'; // 验证post提交的token,可直接使用get访问job.php后在网页源码中搜索formhash获取 $nowjobamount = $job-findCountnull, "created".$todaystart." AND memberid=".$thememberid; if...

Bypass Demonstrated for Microsoft Use-After-Free Mitigation in IE

For a long time, Microsoft’s monthly Patch Tuesday security bulletins have periodically addressed use-after free vulnerabilities, the latest class of memory corruption bugs that have already found their way into a number of targeted attacks. Microsoft has implemented mitigations to address memory...

CONPOT ICS SCADA Honeypot

CONPOT ICS SCADA Honeypot Conpot is a low interactive server side Industrial Control Systems honeypot designed to be easy to deploy, modify and extend. By providing a range of common industrial control protocols we created the basics to build your own system, capable to emulate complex...

DEBIAN-CVE-2014-8414

ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service channel hang and memory consumption by causing transitions to be delayed, which triggers a state change from...

CuuMall 最新版本sql注入一枚

简要描述： CuuMall 最新版本sql注入一枚 详细说明： 感觉 CuuMall 的官网文件是不是被人改动了 还是本身就是个bug，不多说了 直接看代码 DetailsAction.class.php282-313 public function addpru $coo = new Cookie ; if $coo-isset c "GUESTCOOK" ."mall-m-name" $this-assign "waitSceond", 3 ; $this-assign "jumpUrl", "APP/Home/login" ; $this-error "请登录后收藏商品" ; ex...

TinyShop sql注入#3（ 可无限充值）

简要描述： rt 详细说明： 我们看到 /protected/controllers/ucenter.php public function infosave $name = Filter::sqlReq::args"name"; $id = $this-user'id'; $this-model-table"user"-dataarray"name"=$name-where"id=$id"-update; $this-model-table"customer"-where"userid=$id"-update; $obj = $this-model-table"user as...

Maligno - Penetration Testing Tool that Serves Metasploit Payloads

Maligno is an open source penetration testing tool that serves Metasploit payloads. It generates shellcode with msfvenom and transmits it over HTTP or HTTPS. The shellcode is encrypted with AES and encoded with Base64 prior to transmission. Changelog: Metasploit multi-host support, socks4a server...

CVE-2013-2916

Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to spoof the address bar via vectors involving a response with a 204 aka No Content status code, in conjunction with a delay in notifying the user of an attempted spoof...

[SECURITY] Fedora 18 Update: ktimer-4.10.4-1.fc18

KTimer is a little tool to execute programs after some time...

Not getting hardware sensor alerts in a timely manner

Challenge You do not receive information about specific alerts regarding host hardware sensors quick enough for your environment, both in the Veeam ONE Monitor GUI and e-mails. For example, a host goes offline and you do not get any alerts for 20 minutes. Or there is another delayed alerting...

CVE-2012-3482

Fetchmail 5.0.8 through 6.3.21, when using NTLM authentication in debug mode, allows remote NTLM servers to 1 cause a denial of service crash and delayed delivery of inbound mail via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder, or 2 obtain sensitive informati...

CVE-2012-3482

Fetchmail 5.0.8 through 6.3.21, when using NTLM authentication in debug mode, allows remote NTLM servers to 1 cause a denial of service crash and delayed delivery of inbound mail via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder, or 2 obtain sensitive informati...

CentOS 5 : kernel (CESA-2012:1323)

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

XSS and IL vulnerabilities in IBM Lotus Domino

Hello 3APA3A! I want to warn you about Cross-Site Scripting and Information Leakage vulnerabilities in IBM Lotus Domino. At 15th of August IBM released the advisory concerning these Cross-Site Scripting vulnerabilities. CVE ID: CVE-2012-3302. ------------------------- Affected products:...

CVE-2011-5117

Sophos SafeGuard Enterprise Device Encryption 5.x through 5.50.8.13, Sophos SafeGuard Easy Device Encryption Client 5.50.x, and Sophos Disk Encryption 5.50.x have a delay before removal of 1 out-of-date credentials and 2 invalid credentials, which allows physically proximate attackers to defeat t...

Fedora 16 : cyrus-imapd-2.4.12-1.fc16 (2011-13832)

security fix : - fixes incomplete authentication checks in nntpd Secunia SA46093 - other fixed bugs : - delayed delete can fail because of invalid names - cyradm cannot wildcard delete ACLs from a mailbox - Wrong ENABLE result doubled names - mbpath output changed from 2.3 to 2.4 for remote...

Fedora 15 : cyrus-imapd-2.4.12-1.fc15 (2011-13860)

security fix : - fixes incomplete authentication checks in nntpd Secunia SA46093 - other fixed bugs : - delayed delete can fail because of invalid names - cyradm cannot wildcard delete ACLs from a mailbox - Wrong ENABLE result doubled names - mbpath output changed from 2.3 to 2.4 for remote...

Wireshark packet-dect.c Stack Buffer Overflow

This module exploits a stack buffer overflow in Wireshark use exploit/windows/misc/wireshark/packetdect msf undefinedpacketdect show actions ...actions... msf undefinedpacketdect set ACTION msf undefinedpacketdect show options ...show and set options... msf undefinedpacketdect run This module...

OpenText FirstClass Client 11.005 - Code Execution

Exploit Title: OpenText FirstClass Client Delayed Code Executiion Date: Discovered 11/16/2010, Contacted OpenText 2/1/11 and 2/7/11, Released 4/11/2011 Author: Kyle Ossinger www.k0ss.net Email: [email protected] Software Link:...

Microsoft warns against hacked Windows Phone 7 updates !

Microsoft is sorry, quite sorry indeed, that so many Windows Phone 7 owners have yet to receive the NoDo update for their handset. In a weekly written update today, the Windows Phone 7 team expressed sympathy to owners frustrated over the lag in receiving the update: "You want the latest technolo...