1942 matches found
Cross site scripting
Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public 1 read or 2 execute access via a move action, aka ZEN-15386...
CVE-2014-6256: Undefined Security Weakness
Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public 1 read or 2 execute access via a move action, aka ZEN-15386...
Security fix for the ALT Linux 7 package krb5 version 1.13-alt1
Oct. 31, 2014 Alexey Shabalin 1.13-alt1 - 1.13 - fixed CVE-2014-5351 - move header from /usr/include/krb5 to /usr/include - drop kdcrotate service - update krb5.conf: + add logging example + add realms example + add domainrealm example + define defaultccachename as KEYRING:persistent:%uid...
Security fix for the ALT Linux 8 package krb5 version 1.13-alt1
Oct. 31, 2014 Alexey Shabalin 1.13-alt1 - 1.13 - fixed CVE-2014-5351 - move header from /usr/include/krb5 to /usr/include - drop kdcrotate service - update krb5.conf: + add logging example + add realms example + add domainrealm example + define defaultccachename as KEYRING:persistent:%uid...
thinksaas2.2beta 越权修改置顶删除任意小组帖子
简要描述： 已经被很多前辈找过很多了。但是越权这种类型没有统一一次性的防御方案。只能在每个操作的点进行权限验证，一旦出现遗漏就会存在问题。ps:thinksaas厂商比较友好开放，所以来凑个热闹。 详细说明： 这次出问题的点在groupapp的topicmove.php 没有进行权限验证，所以用户可以将任意帖子移动到任意小组当中。这样子看起来危害不是很大，不过后来想到可以将任意帖子移动到自己建立的小组中进行编辑，删除，置顶，加精等操作，之后再移动回以前的小组，从而实现了对任意帖子的任意操作。在任意小组发表置顶贴之类的操作。相当于具有了所有小组管理员的一个权限。 这里采用test12...
Fedora 19 : perl-Plack-1.0031-1.fc19 (2014-9544)
---------------------------------------------------------------------- ---------- ChangeLog : - Fri Aug 8 2014 Ralf Corsepius - 1.0031-1 - Upstream update. - Thu Jan 16 2014 Ralf Corsepius - 1.0030-3 - Move misplaced %exclude-line from base-package to -Test. - Wed Jan 15 2014 Ralf Corsepius -...
MultiMonitorTool v1.63 - Multiple Monitors on Windows
MultiMonitorTool is a small tool that allows you to do some actions related to working with multiple monitors. With MultiMonitorTool, you can disable/enable monitors, set the primary monitor, save and load the configuration of all monitors, and move windows from one monitor to another. You can do...
Microsoft IIS WebDAV Write Access Code Execution
No description provided by source. $Id: iiswebdavuploadasp.rb 10397 2010-09-20 15:59:46Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms...
Move Networks Quantum Streaming Player - SEH Overwrite Exploit
No description provided by source. !-- Move Networks Quantum Streaming Player SEH Overwrite Exploit Vulnerability discovered by Parvez Anwar, CVE-2007-4722 Exploit written by e.b. Shellcode is limited to around 400 bytes Tested on Windows XP SP2fully patched English, IE6 Thanks to h.d.m. and the...
Move Media Player 1.0 Quantum Streaming ActiveX Control Multiple Buffer Overflow Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/25529/info Move Media Player is prone to multiple remote buffer-overflow vulnerabilities because the application fails to properly bounds-check user-supplied data before copying it into insufficiently sized memory buffers...
Linux Kernel 2.6.x - Ext4 'move extents' ioctl Local Privilege Escalation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/37277/info Linux kernel is prone to a local privilege-escalation vulnerability because the software fails to verify access permissions. Exploits may allow attackers to execute arbitrary code with kernel-level privileges a...
US Navy's Nuclear Reactor System Administrator Arrested on Hacking Charges
The United States charged two men for their involvement in a conspiracy to hack into the computer systems of dozens of government and commercial organizations, including the U.S. Navy and National Geospatial-Intelligence Agency NGA, according to the U.S. Attorney's Office in Tulsa. On Monday, the...
CVE-2014-1841
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. dot dot in the src parameter...
CVE-2014-1841: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. dot dot in the src parameter...
PT-2014-4325
Name of the Vulnerable Software and Affected Versions Titan FTP Server versions prior to 10.40 build 1829 Description The issue allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. dot dot in the src parameter. This is a result of a directory traversal...
BP Group Documents 1.2.1 XSS / CSRF / File Move
Details below. We intended to publish these earlier, but they slipped through the net. The most recent version is 1.5, and all these were reported fixed in 1.2.2. First one: https://security.dxw.com/advisories/stored-xss-vulnerability-in-bp-group-documents-1-2-1/ Details ================ Software...
WordPress BP Group Documents多个漏洞
WordPress是一款内容管理系统。 WordPress BP Group Documents“显示名称”和“描述”字段存在存储型跨站脚本漏洞，跨站请求伪造和文件移动漏洞。 0 BP Group Documents 1.2.1 厂商补丁： WordPress ----- WordPress 1.2.2版本以修复此漏洞，建议用户下载使用： http://wordpress.org/plugins/bp-group-documents/ Stored XSS ================ Go to the upload form, select a document to uploa...
Apache mod_dav_svn DoS
Assertion failure on COPY, DELETE and MOVE commands processing...
DEBIAN-CVE-2013-4131
The moddavsvn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service assertion failure or out-of-bounds read via a certain 1 COPY, 2 DELETE, or 3 MOVE request against a revision root...
UBUNTU-CVE-2013-4131
The moddavsvn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service assertion failure or out-of-bounds read via a certain 1 COPY, 2 DELETE, or 3 MOVE request against a revision root...