Apache Struts 2 'action:' Parameter Prefix Security Constraint Bypass

The remote web application appears to use Struts 2, a web framework used for creating Java web applications. The version of Struts 2 in use is affected by a security constraint bypass vulnerability due to a flaw in the action mapping mechanism. Under certain unspecified conditions, an attacker...

Apache Struts 远程代码执行漏洞(CVE-2013-4316)

BUGTRAQ ID: 62587 CVECAN ID: CVE-2013-4316 Struts2 是第二代基于Model-View-Controller MVC模型的java企业级web应用框架。 Apache Struts 2.3.15.2之前版本的“Dynamic Method Invocation”机制是默认开启的，仅提醒用户如果可能的情况下关闭此机制，这样就存在远程代码执行漏洞，远程攻击者可利用此漏洞在受影响应用上下文中执行任意代码。 0 Apache Group Struts 2.3.15.2 厂商补丁： Apache Group ------------ Apache...

HP LoadRunner WriteFileString Directory Traversal - ver 2 (CVE-2013-4798)

A directory traversal and file overwrite vulnerability exists in HP LoadRunner. The vulnerability is due to insufficient input sanitization, which permits directory traversal in theWriteFileString method. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to visi...

AspxCommerce 2.0 - Arbitrary File Upload

Exploit Title: AspxCommerce v2.0 - Arbitrary File Upload Vulnerability Exploit Author: SANTHO Vendor Homepage: http://www.aspxcommerce.com/ Version: Version 2.0 and below Introduction: AspxCommerce is a complete e-Commerce solution for setting up a fully functional online store in minutes. It's...

AspxCommerce 2.0 - Arbitrary File Upload

AspxCommerce 2.0 - Arbitrary File Upload Exploit Title: AspxCommerce v2.0 - Arbitrary File Upload Vulnerability Exploit Author: SANTHO Vendor Homepage: http://www.aspxcommerce.com/ Version: Version 2.0 and below Introduction: AspxCommerce is a complete e-Commerce solution for setting up a fully...

getRedirect in JiraWebActionSupport redirects to unsafe URLs by default

In jira-components/jira-api/src/main/java/com/atlassian/jira/web/action/JiraWebActionSupport.java the following code is found: code:java / Redirects to the value of @code getReturnUrl, falling back to @code defaultUrl if the @code returnUrl is not set. This method clears the @code returnUrl. If...

SupeSite 7.5 background upload webshell-vulnerability warning-the black bar safety net

Get the webshell method without any technical content. the. There are many online similar. But, this see online also not, their just at once get a webshell in the process of discovery, so it sends to, Of course, related many examples. For example, the following two. Example 1: the Wordpress...

cfme: CFME 2.0 multiple zip file upload path traversal vulnerabilities

Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. dot dot in the filename parameter to the 1 log, 2 upload, or 3 linuxpkgs method...

Vulnerability allowed hacker to Delete any Facebook Photo; Rewarded with $12,500 for reporting bug

Indian Security Enthusiast 'Arul Kumar' recently reported an interesting Facebook vulnerability that allowed him to delete any Facebook image within a minute. Facebook Bug Bounty program rewarded him with $12,500 USD for helping the Facebook Security team to patch this critical loophole in their...

Buffer overflow

Buffer overflow in the Authenticate method in the INCREDISPOOLERLib.Pop ActiveX control in ImSpoolU.dll in IncrediMail 2.0 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a long string in the first argument...

CVE-2013-5578

Buffer overflow in the ToDot method in the WINGRAPHVIZLib.NEATO ActiveX control in WinGraphviz.dll in StarUML allows remote attackers to execute arbitrary code via a long argument...

CVE-2010-5289

Buffer overflow in the Authenticate method of the INCREDISPOOLERLib.Pop ActiveX control (ImSpoolU.dll) in IncrediMail 2.0 is the issue. The vulnerability arises from a long string in the first argument, triggering a crash (DoS) and potentially unspecified impact. Affected component: ImSpoolU.dll,...

DB quote_identifier(), possible injection

The method "quoteidentifier" which is used in the DB class to make sure identifiers are quoted can be vulnerable for injection if uncleaned GET variables are passed to it, due to the way pregreplace has been used with the "/e" modifier. All released versions are affected. This has been addressed ...

DEBIAN-CVE-2013-2172

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization...

CVE-2013-2172

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization...

UBUNTU-CVE-2013-2172

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization...

CVE-2013-3319

The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128...

Path traversal

Absolute path traversal vulnerability in the 3D Graph ActiveX control in cw3dgrph.ocx in National Instruments LabWindows/CVI 2012 SP1 and earlier, LabVIEW 2012 SP1 and earlier, and other products allows remote attackers to create and execute arbitrary files via a full pathname in an argument to t...

CVE-2013-5024

An ActiveX control in NationalInstruments.Help2.dll in National Instruments NI .NET Class Library Help, as used in Measurement Studio 2013 and earlier and other products, allows remote attackers to obtain sensitive information about the existence of registry keys via crafted 1 key-open or 2...

SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure

source: https://www.securityfocus.com/bid/61578/info SilverStripe is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. SilverStripe 3.0.3 is vulnerable; other versions may also be affected...