PT-2015-1192

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 43.0.2357.65 Description The issue is related to errors in the HTMLConstructionSite.cpp file in the DOM implementation in Blink, used in Google Chrome. It allows remote attackers to bypass the Same Origin Policy...

PT-2015-4129

Name of the Vulnerable Software and Affected Versions IBM Rational ClearQuest versions 7.1.x through 7.1.2.17 IBM Rational ClearQuest versions 8.0.0.x through 8.0.0.14 IBM Rational ClearQuest versions 8.0.1.x through 8.0.1.7 Description A cross-site request forgery CSRF issue allows remote...

Agilent Technologies Feature Extraction AnnotationX.AnnList.1 ActiveX Control Arbitrary Code Execution Vulnerability

Agilent Technologies Feature Extraction is a set of feature extraction software for automatically reading and processing image files from multiple original chips from Agilent Technologies. A security vulnerability exists in Agilent Technologies Feature Extraction's AnnotationX.AnnList.1 ActiveX...

CVE-2015-2092

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

CVE-2015-2092: Improper Restriction of Operations within the Bounds of a Memory Buffer

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

嘉缘人才系统sql注入#3

简要描述： 求20rank 详细说明： 首先看到frcms\member\requireslist.php if$do=="savedata" if$POST'id'=="" $POST'sid'=intval$Memberid; $POST'member'=getcookie'userlogin'; $POST'school'=getcookie'username'; ifempty$POST'title' showmsg'标题不能为空！','-1';exit; $POST'adddate'=date'Y-m-d H:i:s';...

(0Day) Agilent Technologies Feature Extraction ActiveX Control Index Out-Of-Bounds Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Agilent Technologies Feature Extraction. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

PT-2015-5599

Name of the Vulnerable Software and Affected Versions Agilent Technologies Feature Extraction affected versions not specified Description The issue allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the INSERT page in Cisco Prime Infrastructure PI allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868...

CVE-2014-2152

Cisco Prime Infrastructure (PI) contains a Cross-Site Request Forgery (CSRF) vulnerability on the INSERT page that could allow an unauthenticated/remote attacker to hijack the authentication of an authenticated PI user and perform actions on behalf of that user. Root cause is insufficient CSRF pr...

PT-2015-3701

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities in INSERT pages. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML vi...

PT-2015-3700

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure PI affected versions not specified Description A cross-site request forgery CSRF issue in the INSERT page allows remote attackers to hijack the authentication of arbitrary users. Recommendations At the moment, there ...

CVE-2014-2152: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the INSERT page in Cisco Prime Infrastructure PI allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868...

CVE-2014-2153: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in INSERT pages in Cisco Prime Infrastructure allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun21869...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter in a search request, 2 username in a login request, which is not properly handled when logging the event, or 3 page titl...

CVE-2015-1373

Multiple cross-site scripting XSS vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter in a search request, 2 username in a login request, which is not properly handled when logging the event, or 3 page titl...

PT-2015-3632

Name of the Vulnerable Software and Affected Versions Savsoft Quiz affected versions not specified Description A cross-site request forgery CSRF issue exists in the index.php/user data/insert user endpoint, allowing remote attackers to hijack administrator authentication for requests that create...

PHPAPP注入第九枚（insert无视过滤）

简要描述： PHPAPP注入第九枚（insert无视过滤） 详细说明： 在wooyun上看到了有人提了PHPAPP的漏洞： http://wooyun.org/bugs/wooyun-2010-055604，然后去官网看了看，前几天刚有更新，就在官网下了PHPAPP最新的v2.6来看看2014-12-11更新的。 PSOT注入点：wwww.xxx.com/member.php?action=1&app=43&cid=2&rid=-1, 存在漏洞的文件在/phpapp/apps/refund/memberphpapp.php...

74cms最新版 二次注入

简要描述： 详细说明： 74cms 20141128最新版 漏洞文件:/wap/plus/wapajax.php 610-654行： elseif $act == 'invitedadd' $smarty-cache = false; $resume=resumeone$POST"resumeid"; $jobs=jobsone$POST"jobsid"; if$SESSION'utype'!=1 exit"企业会员请登录后邀请面试"; if checkinterview$POST"resumeid",$POST"jobsid",$SESSION'uid' exit"repeat";...

Supesite 前台注入 #2 (Insert)

简要描述： Insert 无视GPC 装supesite会有ucenter 如果在一个裤的话 可以尝试把uckey注入出来 然后…… 详细说明： 来看看全局文件 if!getmagicquotesgpc $GET = saddslashes$GET; $POST = saddslashes$POST; $COOKIE = saddslashes$COOKIE; 判断gpc 是否开启 如果没有开启 就对get post cookie 转义 这里没有对files转义。 在batch.upload.php中 elseif !empty$POST //如果POST不为空 //编辑标题...