OpenJDK: incorrect code permission checks in RMIConnectionImpl (JMX, 8075853)

An information leak flaw was found in the JMX component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions...

PHPCMS \phpcms\modules\member\index.php user login SQL injection vulnerability analysis-vulnerability warning-the black bar safety net

catalog 1. Vulnerability description 2. Vulnerability trigger conditions 3. Vulnerability scope 4. Vulnerability code analysis 5. Defense method 6. Offensive and defensive thinking 1. Vulnerability description 2. Vulnerability trigger conditions 0x1: POC http://localhost/phpcmsv9/index. php?...

Panasonic Security API SDK MulticastAddr Stack Buffer Overflow (CVE-2015-4648)

A buffer overflow vulnerability exists in Panasonic Security API SDK, Ipropsapi.ipropsapiCtrl.1 ActiveX Control component. The vulnerability is due to a lack of boundary checks on a parameter passed to the MulticastAddr method. A remote attacker can exploit this vulnerability by enticing the vict...

Zaption: Using GET method for account login with CSRF token leaking to external sites Via Referer.

HI At the time of login, the values are present in URL along with the CSRF token. Also this URL is leaking to external sites in HTTP REFRERER. Here are some of those sites: dxzc9stvaxhhy.cloudfront.net bam.nr-data.net ssl.google-analytics.com usage.trackjs.com api.mixpanel.com...

Stack overflow

Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments, aka ZDI-CAN-2699...

CVE-2015-0795

Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments, aka ZDI-CAN-2699...

CVE-2015-0795

CVE-2015-0795 affects NetIQ Security Solutions for ISeries. The NetIQExecObject.NetIQExec.1 ActiveX Control’s SafeShellExecute method in NetIQExec.dll contains a stack-based buffer overflow when processing long parameters, enabling remote code execution in affected installations of version 8.1. T...

Squid CONNECT Method Peer Response Processing Security Control Bypass Vulnerability

Squid cache or Squid for short is a popular free software GNU General Public License proxy server and web caching server. Squid cache fails to properly handle CONNECT method peer-to-peer replies, allowing remote attackers to access backend proxies by exploiting security controls that bypass the...

OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI...

OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI...

OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI...

FoxyCart Filter Bypass

Document Title: =============== FoxyCart Bug Bounty 1 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1451 098bdc9b309783df65044c5abb690dafdd4bcd436c380ae68c924fe37e14b4e0 Release Date: ============= 2015-07-15...

UBUNTU-CVE-2015-4733

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI...

OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI...

GET to the vulnerability-vulnerability warning-the black bar safety net

This article is mainly about the current on the Internet get method is non-standard use of some of the security vulnerabilities. Which focuses on speaking the get request in the account login system is abuse of the scene and attacks. 0x01 Get method defined In between the client and server for...

Pivotx Cross-Site Scripting Vulnerability

Pivotx is an open source blog content management system Blog CMS. The system supports built-in comment review, spam protection and template replacement. A cross-site scripting vulnerability exists in the 'form' method in the modules/formclass.php script in versions prior to Pivotx 2.3.11. A remot...

WebGate Multiple Products WESPSerialPortCtrl Buffer Overflow (CVE-2015-2097)

A buffer overflow vulnerability exists in WebGate Multiple Products. The vulnerability is due to insufficient input validation of the length of the parameters passed to the Connect method of WESPSerialPort.WESPSerialPortCtrl.1. A remote attacker could exploit this vulnerability by enticing a user...

CVE-2015-4647

Multiple stack-based buffer overflows in Ipropsapi in Panasonic Security API PS-API ActiveX SDK before 8.10.18 allow remote attackers to execute arbitrary code via a long string in the 1 FilePassword property or to the 2 GetStringInfo method...

CVE-2015-4647

Multiple stack-based buffer overflows in Ipropsapi in Panasonic Security API PS-API ActiveX SDK before 8.10.18 allow remote attackers to execute arbitrary code via a long string in the 1 FilePassword property or to the 2 GetStringInfo method...

CVE-2015-4648

Stack-based buffer overflow in the Ipropsapi.ipropsapiCtrl.1 ActiveX control in ipropsapivideo in Panasonic Security API PS-API ActiveX SDK before 8.10.18 allows remote attackers to execute arbitrary code via a long string to the MulticastAddr method...