MDM the mobile terminal management system of the SAP Afaria stored XSS vulnerability using process-vulnerability warning-the black bar safety net

Here, will demo on SAP Afaria, a world-renowned MDM mobile terminal management software for the vulnerability analysis,while the analysis of the network how could an attacker exploit the vulnerability to attack. The black bar safety net Wikipedia: what is MDM? In short, MDM is to help...

Deserialization Code Execution

Overview Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer. Proof of Concept const yaml = require'js-yaml'; const x = test: !!js/function function f console.log1; ; yaml.loadx; Recommendation Update js-yaml to version 2.0.5 or later, and...

Reflected Cross-Site Scripting (XSS) in SourceBans

High-Tech Bridge Security Research Lab discovered vulnerability in SourceBans, which can be exploited to perform Cross-Site Scripting XSS attacks against web application users. The vulnerability exists due to insufficient filtration of input-data passed via the "advSearch" HTTP GET parameter to...

AnyMacro邮件系统存储XSS漏洞2(可盲打其它用户)

简要描述： 第一弹被忽略了，目测是厂商一直没关注wooyun，导致过期自动忽略的。 可以考虑直接转交给CNCERT处理 http://www.wooyun.org/bugs/wooyun-2010-0136531 详细说明： 据说乌云已经把它列入到通用型奖励厂商当中了。 0x01 背景 AnyMacro（安宁）成立于1999年，是国内领先的统一消息/移动门户/PushMail产品与应用解决方案提供商。主要客户涵盖国家部委、大型企业以及部分海外客户，客户分布于政府、军工、金融、电信、能源、教育等行业。...

WordPress Contact Form Generator <= 2.0.1 - Multiple CSRF Vulnerabilities

Exploit for php platform in category web applications Live Demos. It is packed with a Template Creator Wizard to create fantastic forms in a matter of seconds without coding. copy of ´contactformgenerator.php´ file =================== TECHNICAL DETAILS =================== A CSRF issue was found i...

CVE-2015-2807

The CVE-2015-2807 issue affects the WordPress Navis DocumentCloud plugin, specifically versions before 0.1.1. The vulnerability resides in the js/window.php file where the wpbase parameter is used, enabling a reflected cross-site scripting (XSS) attack. An attacker can inject arbitrary script/HTM...

WordPress sourceAFRICA 0.1.3 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sourceafrica/ Date: 2015-08-29 Tested On : Elementary Os - Firefox Software Link...

CVE-2 0 1 5-4 4 8 3: Use the feed Protocol to bypass the Firefox Mixed Content Blocker-bug warning-the black bar safety net

In Firefox 4 0. fixes a bug number for CVE-2 0 1 5-4 4 8 3 BUG. Usually Firefox can prevent the following Mixed Content mixed content: the https://mkpocapp.appspot.com/bug1148732/victim In short: the https site has a portion of the content is via the http transmission, such as resource files, etc...

WordPress sourceAFRICA 0.1.3 Cross Site Scripting

Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sourceafrica/ Date: 2015-08-29 Tested On : Elementary Os - Firefox Software Link :...

WordPress Role Scoper Plugin <= 1.3.64 - Cross Site Scripting

Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Upgrade the plugin...

Google Chrome < 44.0.2403.157 Bypass Anti-XSS filter Vulnerability

影响版本：Google Chrome〈 44.0.2403.157 已知Google Chrome具有XSS防护机制，防止执行XSS中的的JS代码。下面有一段PHP代码：?php // Echo the value of parameter one echo "This is text1:".$GET'text1'."brbr"; // Echo the value of parameter two echo "This is text2:".$GET'text2'."brbr"; ?...

WordPress Post Video Players Plugin <= 1.136 - XSS

Because of this vulnerability, authenticated users like editors can store HTML or JS code. Solution Update the plugin...

WordPress Social Locker Plugin <= 4.2.0 - Reflected Cross Site Scripting

Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Update the plugin...

WordPress Multicons Plugin <= 2.1 - Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can store HTML or JS code in plugin configuration values. Solution Update the plugin...

WordPress Crontrol Plugin <= 1.2.3 - Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can store HTML and JS code. Vulnerable parameters: "idhookname", "idsig", "idnextrun", "idargscode". Solution Update the plugin...

WordPress YITH Maintenance Mode Plugin <= 1.1.4 - Cross-Site Scripting

Because of this vulnerability, authenticated administrators can store HTML and JS code. Solution Update the plugin...

WordPress Social Bookmarking Light Plugin <= 1.7.9 - Cross Site Scripting

Because of this vulnerability, authenticated administrators can store HTML or JS code. Solution Update the plugin...

WordPress Category Order and Taxonomy Terms Order Plugin <= 1.4.4 - XSS

Because of this vulnerability, authenticated administrators can inject HTML and JS code. Solution Update the plugin...

WordPress Email Encoder Bundle Plugin <= 1.4.1 - Cross Site Scripting

Because of this vulnerability, unauthenticated users can inject HTML or JS code. Solution Update the plugin...

Python Network Recon Framework: ivre

IVRE Instrument de veille sur les réseaux extérieurs or DRUNK Dynamic Recon of UNKnown networks is a network recon framework, including two modules for passive recon one p0f -based and one Bro -based and one module for active recon mostly Nmap -based, with a bit of ZMap . External programs /...