SS-2016-011: ChangePasswordForm does not check Member::canLogIn()

More info at https://www.silverstripe.org/download/security-releases/ss-2016-011/...

精讯cms sql注入 和 任意刷钱和积分漏洞

简要描述： 精讯cms sql注入 和 任意刷钱和积分漏洞 详细说明： public function reg if $this - obj - isLogin $go = $this - referer && !strstr$this - referer, 'login'?$this - referer:Url :: getUrl'member'; $this - showMsgL'ALREADYISMEMBER', $go; if $this - isSubmit if $this - obj - reg $this - obj - login$POST'info''username...

WordPress Ultimate Member Plugin <= 1.0.78 - Multiple Vulnerabilities

Because of multiple vulnerabilities in this plugin, attackers can delete any file or upload arbitrary files. Solution Update the plugin...

Ultimate Member <= 1.0.78 - Multiple Vulnerabilities

Ultimate Member Plugin version 1.0.78 has several security vulnerabilities that allow unauthenticated users to delete and upload files, which can ultimately lead to remote code execution...

QiboCMS v7 /member/comment.php SQL注入漏洞

No description provided by source...

Foxit Products GIF Conversion - 'DataSubBlock' Memory Corruption

Application: Foxit Products GIF Conversion Memory Corruption Vulnerabilities DataSubBlock Platforms: Windows Versions: The vulnerability is confirmed in version Foxit Reader 7.x. Other versions may also be affected. Secunia: SA63346 PRL: 2015-02 Author: Francis Provencher Protek Research Lab’s...

SDCMS 最新门户版 V3.0 储存型xss一枚 可盲打后台

简要描述： 严谨的说 是编辑器xss储存型漏洞 详细说明： 虚拟主机搭建测试： 需要条件： 开启会员注册默认开启 开启投稿功能（默认开启） 下载地址： http://www.sdcms.cn/product/portal.html 默认 开启会员注册 无需审核 原本想在demo上测试的 但是他开启审核了 ---------------------------------------- 注册个会员 找到在线投稿 选择文章模型 远程上传地址处 插入： " 提交 img...

嘉缘人才系统sql注入#3

简要描述： 求20rank 详细说明： 首先看到frcms\member\requireslist.php if$do=="savedata" if$POST'id'=="" $POST'sid'=intval$Memberid; $POST'member'=getcookie'userlogin'; $POST'school'=getcookie'username'; ifempty$POST'title' showmsg'标题不能为空！','-1';exit; $POST'adddate'=date'Y-m-d H:i:s';...

HackerOne: Auto Approval of Invitation to join Team as a Team member

Hi Hackerone, I have found a vulnerability wherein once a Team manager of any team sends out an Invitation to another Hackerone user to join his team, the invited team member gets auto accepted into the team to which he is being invited to join. The choice of "Accept" or "Reject" invitation which...

[SECURITY] [DLA 160-1] sudo security update

Package : sudo Version : 1.7.4p4-2.squeeze.5 CVE ID : CVE-2014-0106 CVE-2014-9680 Debian Bug : 772707 This update fixes the CVEs described below. CVE-2014-0106 Todd C. Miller reported that if the envreset option is disabled in the sudoers file, the envdelete option is not correctly applied to...

HackerOne: Team member invitations to sandboxed teams are not invalidated consistently

hello today i found a Bug about Auth in Send invitation to member to join the team ,, so if Now The Victim Send invition to Another Victim Account to join the team as a Manager,, the link of the invitation is will Be Valid For Many Many Many time to Accept the invtiation from Another Accounts in ...

openldap -- two remote denial of service vulnerabilities

Ryan Tandy reports: With the deref overlay enabled, ldapsearch with '-E deref=member:' causes slapd to crash. Bill MacAllister discovered that certain queries cause slapd to crash while freeing operation controls. This is a 2.4.40 regression. Earlier releases are not affected...

NAFCU Dismisses Data Encryption Rule Idea

Even after suffering a data breach, the organization in charge of overseeing the needs of credit unions has cast off the idea of implementing a rule mandating the use of encryption for data transfers. Despite the breach, the National Association of Federal Credit Unions, or NAFCU, is insisting th...

X (Formerly Twitter): fabric.io - app member can make himself an admin

Let say, Alice is a member of TestApp. - Log into fabric.io as Alice and navigate to settings. - Click on Apps and choose TestApp. - Click on team members link and notice that Alice role is Member. Clicking on team members link sends a similar request as shown below. GET...

DayuCMS 1.525 /member/include/tag.class.php SQL注入漏洞

/member/include/member.class.phpfunction exists$field, $value return $this-db-fetchone"SELECT id FROM $this-table WHERE $this-table.$field='$value' LIMIT 0, 1"; 传入的$field和$value未经过过滤直接带入SQL语句中。 /member/include/msg.class.php function send$msgs global $userid,$username,$member;...

大米CMS最新版SQL盲注5绕过防御

简要描述： 大米CMS最新版4.7，SQL盲注 详细说明： 大米CMS最新版4.7，SQL盲注，绕过防御 文件/Web/Lib/Action/PublicAction.class.php： //在线充值或在线订单处理 function shouquan $appath = intvalC'APTYPE'==1?'apjishi':'apdanbao'; requireonce"./Trade/$appath/alipay.config.php"; requireonce"./Trade/$appath/lib/alipaynotify.class.php"; //计算得出通知验证结果...

HackerOne: Reflected File Download

Info: Reflected File Download is a new web attack vector. It allows an attacker to craft a malicious file and present it to a victim, but there is no file present at the server. It was recently published at the BlackHat Eupore 2014 by Oren Hafif. Link to his presentation is given at the end...

CVE-2014-9004

Cross-site scripting XSS vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a memberprofile action to index.php...

PHPB2B注入#2(绕过过滤)

简要描述： PHPB2B某处注入1。绕过过滤。 官方最新版本. https://github.com/ulinke/phpb2b/archive/master.zip 漏洞文件。 详细说明： POST /virtual-office/personal.php Content-Disposition: form-data; name="memberfieldfirstname" Content-Disposition: form-data; name="memberfieldlastname"...

WordPress Users Ultra 1.3.37 SQL Injection

Title : Wordpress Users Ultra Plugin - SQL injection Vulnerability Risk : High+/Critical Author : XroGuE Google Dork : inurl: wp-content/plugins/users-ultra/ Plugin Version : 1.3.37 Plugin Name : users ultra Plugin Download Link : https://downloads.wordpress.org/plugin/users-ultra.zip Vendor Home...