WordPress GigPress 2.3.8 SQL Injection Vulnerability

WordPress GigPress plugin version 2.3.8 suffers from a remote SQL injection vulnerability. Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+...

Important: Red Hat Security Advisory: java-1.5.0-ibm security update

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Weld: Limited information disclosure via stale thread state

It was discovered that under specific conditions the conversation state information stored in a thread-local variable in JBoss Weld was not sanitized correctly when the conversation ended. This could lead to a race condition that could potentially expose sensitive information from a previous...

Coremail官网SQL注入可读全库

简要描述： coremail官网存在注入，有防护，可绕过。 详细说明： 漏洞地址：http://www.coremail.cn/gjzc2/list117.aspx?lcid=412 漏洞证明： 有防护，直接用sqlmap加个tamper=chardoubleencode.py可以跑出来。 这个是sqlmap用的payload： Place: GET Parameter: lcid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: lcid=412 AND...

WordPress Work The Flow 2.5.2 Shell Upload

Exploit Title : Wordpress Work the flow file upload 2.5.2 Shell Upload Vulnerability Exploit Author : Claudio Viviani Software Link : https://downloads.wordpress.org/plugin/work-the-flow-file-upload.2.5.2.zip Date : 2015-03-14 Tested on : Linux BackBox 4.0 / curl 7.35.0 Description: Work the Flow...

WordPress Plugin Work The Flow File Upload 2.5.2 - Arbitrary File Upload

WordPress Plugin Work The Flow File Upload 2.5.2 - Arbitrary File Upload Exploit Title : Wordpress Work the flow file upload 2.5.2 Shell Upload Vulnerability Exploit Author : Claudio Viviani Software Link : https://downloads.wordpress.org/plugin/work-the-flow-file-upload.2.5.2.zip Date : 2015-03-...

Pragyan CMS SQL Injection Vulnerability

Pragyan CMS is prone to an SQL injection vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Weld: Limited information disclosure via stale thread state

It was discovered that under specific conditions the conversation state information stored in a thread-local variable in JBoss Weld was not sanitized correctly when the conversation ended. This could lead to a race condition that could potentially expose sensitive information from a previous...

DEBIAN-CVE-2015-2754

FreeXL before 1.0.0i allows remote attackers to cause a denial of service stack corruption and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF."...

UBUNTU-CVE-2015-2754

FreeXL before 1.0.0i allows remote attackers to cause a denial of service stack corruption and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF."...

Mandriva Linux Security Advisory : jbigkit (MDVSA-2015:101)

Updated jbigkit packages fix security vulnerability : Florian Weimer found a stack-based buffer overflow flaw in the libjbig library part of jbigkit. A specially crafted image file read by libjbig could be used to cause a program linked to libjbig to crash or, potentially, to execute arbitrary co...

Debian DLA-134-1 : curl security update

Andrey Labunets of Facebook discovered that cURL, an URL transfer library, fails to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl to access a specially crafted URL via an HTTP proxy could use this flaw to do additional requests in...

Debian DLA-19-1 : postgresql-8.4 update

New upstream minor release. Users should upgrade to this version at their next scheduled maintenance window. Noteworthy change : Secure Unix-domain sockets of temporary postmasters started during make check Noah Misch Any local user able to access the socket file could connect as the server's...

代码审计之PHPEMS前台四处注入<官网demo演示>

简要描述： 代码审计之PHPEMS前台四处注入 详细说明： 官网：http://phpems.net 官方演示站：http://phpems.net/2014 分析过程如下图： 漏洞证明： 证明： 需要清空cookie，代码条件 1、http://phpems.net/2014//index.php?exam-api-login GET /2014//index.php?exam-api-login HTTP/1.1 Host: phpems.net User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64; rv:36.0 Gecko/20100101...

Amazon Linux AMI : glibc (ALAS-2015-495)

An out-of-bounds read flaw was found in the way glibc's iconv function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv function with a specially crafted argument could use this flaw to crash that application. CVE-2014-6040 It was found that the file...

phpems前台某4处getshell漏洞

简要描述： phpems前台某4处getshell漏洞 详细说明： 2.phpems前台某4处getshell漏洞 存在漏洞的代码在/app/document/api.php的upload,uploadfile,swupload,swfuploadvideo这四个函数上，因为这四个函数都是处理上传文件的，而且处理方式都一模一样，所以均存在任意文件上传漏洞 首先这四个函数通过注册用户登录，调整URL参数均可以访问到 接下来我以 public function swfuploadvideo $path = 'files/attach/images/content/'.date'Ymd'.'/...

FengCms1.30注入(前台)

简要描述： http://www.fengcms.com/ 最新版本1.30 详细说明： app\model\messageModel.php public function save$array if$SESSION'authnum'!=$array'vcode'||$SESSION'authnum'=="" return array'status' = 'c';exit; unset$array'vcode'; $re=D$this-dname-insert$array; if$re $SESSION'authnum'=""; return array'status' =...

WordPress Survey and Poll Blind SQL Injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

Signal 2.0 — Free iPhone App for Encrypted Calls and Texts

An open source software group, Open Whisper Systems, has announced the release of Signal 2.0 — the second version of its free and open source messaging application for iPhone and iPad users. Signal app is specifically designed to make secure and easy-to-use encrypted voice calling. But that’s wha...

Signal 2.0 Brings Encrypted Messaging to iPhone

The sanctity of Apple iMessage end-to-end encryption has been challenged by white hats who in 2013 reverse engineered the protocol behind it, revealing that Apple controls the key infrastructure and could, in turn, be compelled to turn over messages via government order. CEO Tim Cook denied those...