Ghost glibc Vulnerability Patching and Exploits

There are some silver linings in the wake of yesterday’s disclosure of the Ghost vulnerability in the Gnu C library, glibc, which affects all Linux systems and seemed to harken yet another Internet-wide vulnerability. First, the 15-year-old bug isn’t the showstopper that the Shellshock...

Apple MAC OS X Yosemite Information Disclosure Vulnerability (CNVD-2015-00761)

Apple MAC OS X Yosemite is the latest operating system developed by Apple. Apple MAC OS X Yosemite Spotlight fails to check the status of Mail's "Load remote content in messages" setting, which can result in the sender of an email being able to determine the recipient's IP address information...

Exim GHOST (glibc gethostbyname) Buffer Overflow

This module remotely exploits CVE-2015-0235, aka GHOST, a heap-based buffer overflow in the GNU C Library's gethostbyname functions on x86 and x8664 GNU/Linux systems that run the Exim mail server. Module Options msf use exploit/linux/smtp/exim/gethostbynamebof msf undefinedgethostbynamebof show...

U-Mail邮件系统任意用户登录漏洞

简要描述： 不多说了，这邮件系统问题简直太多，真揪心 详细说明： 漏洞文件 /fast/option/module/opassword.php代码 if ACTION == "question" $url = "/webmail/fast/option/index.php?module=view&action=password"; $where = "UserID='".$userid."'"; $data = array "question" = gss $POST'question' , "answer" = gss $POST'answer' ; $result =...

Qualys Security Advisory - glibc gethostbyname Buffer Overflow

Qualys Security Advisory CVE-2015-0235 GHOST: glibc gethostbyname buffer overflow -- Contents ---------------------------------------------------------------- 1 - Summary 2 - Analysis 3 - Mitigating factors 4 - Case studies 5 - Exploitation 6 - Acknowledgments -- 1 - Summary...

U-Mail邮件系统一处接口漏洞（可sql注入，任意用户登陆，获取管理员密码）

简要描述： 用户量这么多的邮件系统，分分钟钟就被getshell是件很令人头疼的事情。 详细说明： 1.邮件系统介绍 1）官方下载地址：http://www.comingchina.com/html/downloads/ 2）版本：最新版V9.8.57 3）测试环境：Windows Server 2003+IIS6.0+官方默认软件 4）使用案例：http://www.comingchina.com/html/case/ OR Google "Powered by U-Mail" 漏洞代码 附600多url下载 链接: http://pan.baidu.com/s/1nQRzo 密码:...

U-Mail邮件系统二次注入（不鸡肋，可直接获取管理员密码）

简要描述： U-Mail别哭。另外wooyun-2010-093049更新了无需登录且可批量getshell的exp，随便测试了下，批量轻轻松松get几百个shell，很严重，望管理速审核 : 详细说明： 漏洞文件 /client/oabshare/module/operates.php 代码 if ACTION == "save-to-pab" includeonce LIBPATH."PAB.php" ; $PAB = PAB::getinstance ; $maillistid = gss $GET'maillist' ; $maillistid = intval...

Grinder - System to Automate the Fuzzing of Web Browsers

Grinder is a system to automate the fuzzing of web browsers and the management of a large number of crashes. Grinder Nodes provide an automated way to fuzz a browser, and generate useful crash information such as call stacks with symbol information as well as logging information which can be used...

eYou邮件系统邮件正文存储型XSS（HTML5特性并需点击）

简要描述： eyou邮件系统邮箱多为政府和学校使用，经测试存在xss。 详细说明： 由于eyou版本号不同，下面测试代码的效果也有细微区别，但是存在漏洞原因相同。 测试代码： 发送后打开，效果如图： 某党政机关邮箱： 某院校邮箱： 漏洞证明： 由于eyou版本号不同，下面测试代码的效果也有细微区别，但是存在漏洞原因相同。 测试代码： 发送后打开，效果如图： 某党政机关邮箱：...

[SECURITY] Fedora 21 Update: thunderbird-31.4.0-1.fc21

Mozilla Thunderbird is a standalone mail and newsgroup client...

Debian Security Advisory DSA 3132-1 (icedove - security update)

Multiple security issues have been found in Icedove, Debian OpenVAS Vulnerability Test $Id: deb3132.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3132-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone Networks GmbH...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20150113)

Two flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2014-8634, CVE-2014-8639 It was found that the Beacon interface...

OS X Spotlight vulnerability will reveal the IP address and other system details-vulnerability warning-the black bar safety net

! OS X mail users using the OS X Spotlight search function, it will display in the search results message. Spotlight ignores mail the application to the remote content of the prohibited load, and the remote mail file as the search process is loaded. When Spotlight finished loading can track The...

From one upload to Maxthon within the network-vulnerability warning-the black bar safety net

From one upload to Maxthon within the network The first is to find a sub-domain name of the upload custom. maxthon. cn In the upload icon when only verifies the content-type is not on file after the judgment ! 1532ed2be1f9d7260dd9085f527ba9e0. png Simple modification packages to get to the shell ...

Heroku API Mail Encoding

Document Title: =============== Heroku API Bug Bounty 1 - Persistent Invitation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1300 Video: http://www.vulnerability-lab.com/getcontent.php?id=1335 BugCrowd ID:...

Marketo Cloud - Persistent Mail Encoding Vulnerability

Document Title: =============== Marketo Cloud - Persistent Mail Encoding Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1321 Release Date: ============= 2015-01-13 Vulnerability Laboratory ID VL-ID: ==================================== 132...

condor: mailx invocation enables code execution as condor user

The HTCondor scheduler can optionally notify a user of completed jobs by sending an email. Due to the way the daemon sent the email message, authenticated users able to submit jobs could execute arbitrary code with the privileges of the condor user...

Wireshark SMTP parser 'packet-smtp.c' remote denial of service vulnerability

Wireshark is an open source network protocol analysis tool. A remote denial of service vulnerability exists in Wireshark SMTP Dissector 'packet-smtp.c', which can be exploited by an attacker to crash the affected application and deny service to legitimate users...

USN-2455-1 bsd-mailx vulnerability

It was discovered that bsd-mailx contained a feature that allowed syntactically valid email addresses to be treated as shell commands. A remote attacker could possibly use this issue with a valid email address to execute arbitrary commands. This functionality has now been disabled by default, and...

Updated webmin packages fix security vulnerabilities

Updated webmin package fixes security vulnerability: The webmin package has been updated to version 1.730 to fix possible security issues that could be caused by malicious symlinks when reading mail. The updated version also has various bug fixes, translation updates, and functionality...