CakePHP Framework 3.2.4 - IP Spoofing

Exploit for php platform in category web applications ============================================= - Release date: 12.05.2016 - Discovered by: Dawid Golunski - Severity: Medium ============================================= I. VULNERABILITY ------------------------- CakePHP Framework = 3.2.4 IP...

CakePHP Framework 3.2.4 - IP Spoofing

CakePHP Framework 3.2.4 - IP Spoofing ============================================= - Release date: 12.05.2016 - Discovered by: Dawid Golunski - Severity: Medium ============================================= I. VULNERABILITY ------------------------- CakePHP Framework = 3.2.4 IP Spoofing...

CakePHP Framework 3.2.4 - IP Spoofing

============================================= - Release date: 12.05.2016 - Discovered by: Dawid Golunski - Severity: Medium ============================================= I. VULNERABILITY ------------------------- CakePHP Framework = 3.2.4 IP Spoofing Vulnerability 3.1.11 2.8.1 2.7.10 2.6.12 II...

CakePHP Framework 3.2.4 IP Spoofing

http://legalhackers.com/advisories/CakePHP-IP-Spoofing-Vulnerability.txt ============================================= - Release date: 12.05.2016 - Discovered by: Dawid Golunski - Severity: Medium ============================================= I. VULNERABILITY ------------------------- CakePHP...

TaoCMS v2.5Beta5 ip可伪造导致储存型Xss

No description provided by source...

Gallery 2 2.0.2 - Multiple Vulnerabilities

Gallery 2 2.0.2 - Multiple Vulnerabilities Gallery 2 Multiple Vulnerabilities Vendor: Bharat Mediratta Product: Gallery 2 Version: = 2.0.2 Website: http://gallery.menalto.com/ BID: 16940 CVE: CVE-2006-1127 CVE-2006-1128 OSVDB: 23596 23597 SECUNIA: 19104 PACKETSTORM: 44358 Description: Gallery2, t...

Gallery 2 < 2.0.2 - Multiple Vulnerabilities

Gallery 2 Multiple Vulnerabilities Vendor: Bharat Mediratta Product: Gallery 2 Version: = 2.0.2 Website: http://gallery.menalto.com/ BID: 16940 CVE: CVE-2006-1127 CVE-2006-1128 OSVDB: 23596 23597 SECUNIA: 19104 PACKETSTORM: 44358 Description: Gallery2, the open source web based photo album...

Hide My WP <= 4.51.1 - Stored Cross-Site Scripting (XSS)

An attacker can make a fake attack attempt, with a JavaScripting payload, which will be logged by the plugin, resulting in XSS. The attacker also can spoof their IP address in the logs by setting the X-FORWARDED-FOR header. PoC curl --referer '...

WDCP一处小地方不严谨引发的一系列安全隐患

简要描述： 求打雷求打雷 貌似WDCP的用户好多呀，然后某宝上面用wdcp做控制面板开空间的也好多... WDCP一处小地方不严谨，引发成功登录和登录失败的IP均可以被伪造、“登录锁定”这个功能被绕过、登录记录前台无法查看、奇怪的生物混进来以及各种xss 详细说明： 本漏洞是基于 WooYun: WDCP后台的登录IP可被伪造 的再深入挖掘 系统信息 系统名称：WDlinux Control Panel 简称wdCP WD订阅 当前版本: wdcpv2.5.1120140926 最新 wdcpv2.5.1120140926 更新日志 操作系统：Linux 2.6.18-308.el5...

WDCP后台的登录IP可被伪造

简要描述： 据说可以让名字或ID,永久驻留wdcp的手册里 详细说明： 本漏洞台词方法灵感等部分or均来自 ksc 前辈某个漏洞的描述 （=感觉我厚脸皮呀=） 我不知道要不要这样说明一下噢，如果不需要的话，管理大大删掉这三段呗 获取用户ip的时候 使用了信息 X-Forwarded-For 假如仅仅是提示用户的地方使用的此信息，则问题不是很严重 若其他地方有基于ip地址做安全校验的地方就修改下代码吧 首先，在一些改X-Forwarded-For的插件里面，改自己想要的IP，比如9.9.9.9 然后登录 漏洞证明：...

itBit Exchange: Notification Emails: IP + Content-Spoofing

Hello there, As far as every successfull login attemp ends with e-mail to user with information about time of login, User-Agent and IP address. There is possibility to log in using modified X-Forwarded-For header with other IP address, so user can be faked that someone with different IP looged to...

Oracle Java SE JRE Multiple Unspecified Vulnerabilities-01 (Oct 2014) - Windows

Oracle Java SE JRE is prone to multiple unspecified vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Java SE JRE Multiple Unspecified Vulnerabilities-01 (Oct 2014) - Linux

Oracle Java SE JRE is prone to multiple unspecified vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Discuz! 多数版本可被暴力破解，包括UCenter

简要描述： Discuz! 多数版本均可被暴力破解，包括UCcenter，我只测试了几个例子，有些深入的工作没有做。若是要写个全自动化的工具，还得多花点心思。 : 详细说明： 很简单的问题，Discuz取不到用户的真实IP，可以被X-Forwarded-For头和Client-IP头绕过，伪造欺骗源IP。导致攻击者可以无限次数发起登录请求。 以锤子手机的论坛为例： Discuz! X3。 找到ID为1的管理员用户是webmaster： http://bbs.smartisan.cn/home.php?mod=space&uid=1 锤子论坛没有验证码，胡乱输入错误5次，提示错误次数过多：...

cmseasy 最新版任意权限getshell

简要描述： 这是一个很长的故事，还请客官慢慢看来。（看在我这么晚还在挖洞写文章的份上，求闪电呀！） 版本：2014-06-05 详细说明： 0x01 首先，从一个后台未授权访问开始讲起。 看到文件/lib/admin/admin.php if !defined'ROOT' exit'Can't Access !'; abstract class admin extends act function construct if ADMINDIR!=config::get'admindir' config::modifyarray'admindir'=ADMINDIR;...

Simple PHP Blog (sphpblog) <= 0.5.1 - Multiple Vulnerabilities

No description provided by source. Title: Simple PHP Blog sphpblog = 0.5.1 Multiple Vulnerabilities Vendor: http://sourceforge.net/projects/sphpblog/ Advisory: http://acid-root.new.fr/?0:15 Author: DarkFig gmdarkfig at gmail dot com Released on: 2007/10/21 Changelog: ---------- L M H T Summary: I...

Palo Alto Networks PAN-OS 5.0.9 Multiple Vulnerabilities

The remote host is running version 5.0.9 of Palo Alto Networks PAN-OS. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists due to an inability to handle IP packets larger than 1480 bytes through an Active/Active VWire setup. An attacker can exploit...

程氏舞曲CMS储存型xss可跨管理员

简要描述： .... 详细说明： 还是那个获取ip的函数，既然可以伪造ip那么坑定可以插入js了。 function GetIP if getenv"HTTPCLIENTIP" && strcasecmpgetenv"HTTPCLIENTIP", "unknown" $ip = getenv"HTTPCLIENTIP"; else if getenv"HTTPXFORWARDEDFOR" && strcasecmpgetenv"HTTPXFORWARDEDFOR", "unknown" $ip = getenv"HTTPXFORWARDEDFOR"; else if...

400 Gbps NTP Amplification DDoS Attack Alarmingly Simple

The largest distributed denial of service attack on public record was reported this week, and with it came many alarming numbers, not only in the volume of traffic generated 400 Gbps at its peak, but in the number of Network Time Protocol servers involved 4,592 on 1,298 networks as well as the...

SDCMS 1. 1sp1 the XSS vulnerability of the mining and use-vulnerability and early warning-the black bar safety net

SDCMS 1. 1sp1XSSthe vulnerability of the mining and use of SDCMS name: era website Information Management System. SDCMS is based on ASP+ACCESS/MSSQL website Information Management System. Permanently free, open source! SDCMS to information as the theme, through text and image title as a starting...