XDcms订餐网站系统单店版注入(demo测试)

简要描述： rt 详细说明： 黑盒demo测试 首先注册一个用户，然后修改用户资料 http://dd.xdcms.cn/index.php?m=member&f=edit 修改完成之后，下单点餐。 然后报错了。二次注入 由于demo有安全狗，就没用深入测试了。 漏洞证明：...

Failed to connect to vCenter server during Restore

During a restore you receive the error message: “Failed to connect to vCenter server”...

CVE-2015-1632

The CVE-2015-1632 issue is a Cross-site scripting vulnerability in Outlook Web App (OWA) errorfe.aspx of Microsoft Exchange Server 2013 SP1 and Cumulative Update 7, exploitable via the msgParam parameter in an authError action. The root cause is improper sanitization of error messages in OWA, ena...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

CVE-2015-2198

Multiple cross-site scripting XSS vulnerabilities in editprefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the 1 homepageurl, 2 picurl, or 3 avatarurl parameter, which are not properly handled in an error message...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in editprefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the 1 homepageurl, 2 picurl, or 3 avatarurl parameter, which are not properly handled in an error message...

USN-2499-1 postgresql-8.4, postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities

Stephen Frost discovered that PostgreSQL incorrectly displayed certain values in error messages. An authenticated user could gain access to seeing certain values, contrary to expected permissions. CVE-2014-8161 Andres Freund, Peter Geoghegan and Noah Misch discovered that PostgreSQL incorrectly...

UBUNTU-CVE-2014-8161

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message...

PT-2015-4021

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 9.0.19 PostgreSQL versions 9.1.x prior to 9.1.15 PostgreSQL versions 9.2.x prior to 9.2.10 PostgreSQL versions 9.3.x prior to 9.3.6 PostgreSQL versions 9.4.x prior to 9.4.1 Description The issue allows remote...

CVE-2014-9649

Cross-site scripting XSS vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message...

CVE-2014-9649

Cross-site scripting XSS vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message...

Cross site scripting

Cross-site scripting XSS vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message...

CVE-2014-9649

CVE-2014-9649 is a cross-site scripting (XSS) vulnerability in the RabbitMQ management plugin. The issue occurs in the /api/ path handling during error messages, allowing a remote attacker to inject arbitrary web script or HTML. Affected are RabbitMQ versions from 2.1.0 up to 3.4.x before 3.4.1. ...

PT-2015-4325 · Pivotal +1 · Rabbitmq

Name of the Vulnerable Software and Affected Versions: RabbitMQ versions 2.1.0 through 3.4.x Description: A cross-site scripting XSS issue exists due to improper handling of the path info to "api/" in an error message, allowing remote attackers to inject arbitrary web script or HTML...

DEBIAN-CVE-2014-8625

Multiple format string vulnerabilities in the parseerrormsg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via format string specifiers in the 1 package or 2 architecture name...

Design/Logic Flaw

Maian Uploader 4.0 allows remote attackers to obtain sensitive information via a request without the height parameter to loadflv.js.php, which reveals the installation path in an error message...

CVE-2014-10005

CVE-2014-10005 affects Maian Uploader 4.0. The issue arises when requesting load_flv.js.php without the required height parameter, which may cause an error message that reveals the installation path. This is a potential information disclosure in the affected component (load_flv.js.php). The docum...

Information disclosure

templates/default/index.php in Redaxscript 0.3.2 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message...

CVE-2011-5314: Exposure of Sensitive Information to an Unauthorized Actor

templates/default/index.php in Redaxscript 0.3.2 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message...

Information disclosure

The 1 templatewrap/templatefoot.php, 2 cmsjs/plugin.js.php, and 3 cmsincludes/cmspluginapilink.inc.php scripts in Tribal Tribiq CMS before 5.2.7c allow remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message...