1760 matches found
PHPWIND2.02 & PHPWIND3.31ce权限提升漏洞
主要的原因是在于Job.php中产生的,但是操作的行为却在很大程度上迷惑了许多人,包括我在测试漏洞的时候都认为是Profile.php中的$Proicon变量引起的. 其实这个变量确实存在问题,而且可以直接导致一些恶意事件的发生.但是利用的两方面,一个是在Php中组合字符串,形成我们要说的漏洞,另外一个则是形成了删除任意文件的漏洞... 首先我们需要看看漏洞形成,在profile.php中的$proicon中,变量没有经过任何处理直接提交,系统中的变量经过了PHP的GPC转义.到了MySQL中一个XSS隐患.这是最重要的...
Symantec Sygate Management Server - 'LOGIN' SQL Injection (Metasploit)
This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...
XSS bugs and SQL injection in sNews
Official page : http://www.solucija.com/home/snews/ XSS in comments : just post some comment with scriptalert'XSS TEST by securitydot.net';/script FIX : put this on 423 line $r = strreplace "","<",$r; $r = strreplace "","&lg",$r; Injection through categories : index.php?category=120or201=2 FIX ...
www.miibeian.gov.cn ICP website record validation vulnerability-vulnerability warning-the black bar safety net
1: login to: 2: registration registration is over the phone does not receive text messages, no verification code） 3: the return home page to 4: input user name, password, CAPTCHA and click Login 5: at this point you enter the“phone code”and“mail code”---- do not enter 6: in the address bar enter“...
From PHP Forum the vulnerability of the endoscope security management-vulnerability warning-the black bar safety net
From: ReJeCt‘s Blog Blue magic Forum is a PHP Forum in the country is widely used. Due to its user registration module in some code defect that can lead to a malicious attacker will be normal users to elevate to administrator. First let's look at an invasion of the examples. The invasion paradigm...
In-game /ignore crash in Soldier of Fortune II 1.03
Luigi Auriemma Application: Soldier of Fortune II http://sof2.ravensoft.com Versions: 1.02x and 1.03 Platforms: Windows, Linux and Mac Bug: bad memory access Exploitation: remote, versus server in-game Date: 29 Jun 2005 Author: unknown, found in the wild and reported to me by two admins Advisory:...
invision203.txt
Invision Power Board v2.0.3 XSS vulnerabilities found more at user signature. when Admin read attacker topics, admin will lost his passhash example...
insecure temporary file creation in kdelibs 3.3.2
The dcopidlng' script in the KDE library package kdelibs-3.3.2/dcop/dcopidlng/dcopidlng creates temporary files in a unsecure manner. This bug has been fixed in 32 minutes ! by Stephan Kulow, the KDE team leader. Here you can found the official patch: http://bugs.kde.org/showbug.cgi?id=97608 Note...
7a69Adv#21 - WinRAR unpack one-folder path disclosure
------------------------------------------------------------------ 7a69ezine Advisories 7a69Adv21 - ------------------------------------------------------------------ http://www.7a69ezine.org 02/02/2005 - ------------------------------------------------------------------ Title: WinRAR unpack...
ACROS Security: Unsanitized Session ID Cookie Allows Modifying Server Response
=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2004-10-14-3 ------------------------------------------------------------------------- ASPR 2004-10-14-3: Unsanitized Session ID Cookie Allows Modifying Serv...
XMicro.backdoor2.txt
Backdoor in the X-Micro WLAN 11b Broadband Router ALL VERSIONS ARE AFFECTED 1.6.0.1 too Previous bugreport's bugtraq id: 10095 FCC ID: RAFXWL-11BRRG Firmware Version: 1.2.2, 1.2.2.3, 1.2.2.4, 1.6.0.0, 1.6.0.1 Remote: yes, easily expoitable Type: administration password, which always works The...
vpopmail CGIapps vpasswd vulnerabilities
Centaura Technologies Security Research Lab Advisory Product Name: vpopmail-CGIApps Systems: Linux/OpenBSD/FreeBSD/NetBSD Severity: High Risk Remote: Yes Category: Insuficient input checking Vendor URL: http://diario.buscadoc.org/index.php?topic=Programas Advisory Author: Ignacio Vazquez Advisory...
Multiple Symantec Firewall Secure Webserver timeout DoS
Advanced IT-Security Advisory 01-10-2002 http://www.ai-sec.dk/ Issue: ====== Multiple Symantec Firewall Secure Webserver timeout DoS Problemdescription: =================== There exists a problem in "Simple, secure webserver 1.1" which is shipped with numerous Symantec firewalls, in which an...
Check Point VPN-1/FireWall-1 4.1 SP2 Blocked Port Bypass Exploit
Exploit for unknown platform in category remote exploits ================================================================ Check Point VPN-1/FireWall-1 4.1 SP2 Blocked Port Bypass Exploit ================================================================ / Summary A vulnerability exists in Check Poi...
Advisory: Office 2000 Scripting
@Stake Inc. L0pht Research Labs www.atstake.com www.L0pht.com Security Advisory Advisory Name: Microsoft Office 2000 UA Control Scripting Release Date: 5-12-2000 Application: Microsoft Office 2000 Platform: Windows 95/98, NT 4.0 and 2000 Severity: Malicious active content can execute regardless o...
Microsoft Office 2000 Advisory
@Stake Inc. L0pht Research Labs www.atstake.com www.L0pht.com Security Advisory Advisory Name: Microsoft Office 2000 UA Control Scripting Release Date: 5-12-2000 Application: Microsoft Office 2000 Platform: Windows 95/98, NT 4.0 and 2000 Severity: Malicious active content can execute regardless o...
Axent Raptor 6.0 - Denial of Service
// source: https://www.securityfocus.com/bid/736/info It is possible to remotely lock Axent Raptor firewalls by sending them packets with malformed IP options fields. According to an advisory posted to bugtraq by the perdue CERIAS labs, setting the SECURITY and TIMESTAMP IP options length to 0 ca...
Update for Windows 8 for x64-based Systems (KB2805966)
Update for Windows 8 for x64-based Systems KB2805966...
ROS-2-1492
2.1492 Multiple vulnerabilities in Moodle CVE-2021-32472 - CVE-2021-32478 1. Vulnerability Description: CVE-2021-32478 A vulnerability exists due to insufficient cleansing of user-provided data at the LTI authorization endpoint. A remote attacker could trick a victim into clicking a specially...
ROS-2-595
2.595 Apache Ant utility vulnerability CVE-2021-36374, CVE-2021-36373 1. Vulnerability Description: CVE-2021-36374 A vulnerability in the Apache Ant utility, is related to the application improperly controlling internal resource consumption when processing ZIP archives. Exploitation of the...