PHPOK企业建站系统(支付漏洞1元任意买);

简要描述： PHPOK企业建站系统PHPOK4.4.010支付漏洞1元任意买最新版 详细说明： 1.来到产品展示随便选入一件商品进购物车下订单 2.来到之类点确认支付抓包修改金额 3.改成1元然会出现链接点开就好了 只要1元就可以 漏洞证明： 1.来到产品展示随便选入一件商品进购物车下订单 img src="https://images.seebug.org/upload/201511/0919554096547d3a4eb6da54be5276c7ad0c1967.jpg" a...

Threat Outbreak Alert RuleID19554: Email Messages Distributing Malicious Software on November 22, 2015

Medium Alert ID: 42229 First Published: 2015 November 23 14:29 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID19554 may contain the following files: Name |...

WordPress My Link Order Plugin <= 4.3 - Cross Site Scripting (XSS)

Because of this XSS vulnerability, authenticated users can inject HTML or JS code. Vulnerable parameters are "cats" and "hdnCatID". Solution Update the plugin...

grub2 security, bug fix, and enhancement update

2.02-0.29.0.1 - Fix comparison in patch for 18504756 - Remove symlink to grub environment file during uninstall on EFI platforms bug 19231481 - update Oracle Linux certificates Alexey Petrenko - Put 'with' in menuentry instead of 'using' bug 18504756 - Use different titles for UEK and RHCK kernel...

WordPress My Link Order Plugin <= 4.3 - Cross Site Scripting (XSS)

Because of this XSS vulnerability, authenticated users can inject HTML or JS code. Vulnerable parameters are "cats" and "hdnCatID". Solution Update the plugin...

Shopify: An administrator without any permission is able to get order notifications using his APNS Token.

Description ---- An administrator who lacks the 'Settings' permission is not able to add notifications through the UI. But the endpoint shop.myshopify.com/admin/mobiledevices.json does allow the unprivileged user to add his own device. PoC ---- This PoC simply show how to get & re-use the mobile...

WordPress My Category Order Plugin <= 4.3 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Vulnerable parameters: "cats" and "hdnParentID". Solution Upgrade the plugin...

Threat Outbreak Alert RuleID19474: Email Messages Distributing Malicious Software on November 18, 2015

Medium Alert ID: 42159 First Published: 2015 November 18 21:45 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID19474KVR may contain the following files: Nam...

Shopify: deleted staff member can add his amazon marketplace web services account to the store.

Hi , I have found that if a staff member had access to settings for one single time , he can add his amazon marketplace web services account to the store anytime he wants even after he is deleted from the admins which allows him to fulfill orders for the online store using his own inventory store...

ovh.ie XSS vulnerability

Vulnerable URL: https://www.ovh.ie/cgi-bin/newOrder/order.cgi?plan=perso2014'--...

Multiple IBM products are vulnerable

IBM Maximo Asset Management and others are products of IBM Corporation of the U.S.A. IBM Maximo Asset Management for SmartCloud Control Desk SCCD is a suite of comprehensive asset lifecycle and maintenance software for asset and service management solutions SCCD. Maximo Asset Management for Tivol...

CVE-2015-7395

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 FP002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 FP002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for...

CVE-2015-7395

CVE-2015-7395 affects IBM Maximo Asset Management and related IBM products (SmartCloud Control Desk, Tivoli IT Asset Management for IT, Service Request Manager, CRM/DB components). The issue allows a remote authenticated user to bypass work-order change restrictions due to improper access control...

CVE-2015-7395

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 FP002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 FP002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for...

Threat Outbreak Alert RuleID19215: Email Messages Distributing Malicious Software on November 6, 2015

Medium Alert ID: 41962 First Published: 2015 November 6 15:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID19215 may contain the following files: Name |...

site5.com XSS vulnerability

Vulnerable URL: http://www.site5.com/order/vps/ Details: Description| Value ---|--- Patched:| Yes, at 06.11.2016 Latest check for patch:| 06.11.2016 12:17 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 8731 Google Pagerank| 6 VIP website status:| Yes Check...

Threat Outbreak Alert RuleID18929: Email Messages Distributing Malicious Software on March 12, 2016

Medium Alert ID: 41699 First Published: 2015 October 26 13:44 GMT Last Updated: 2016 March 14 12:26 GMT Version: 10 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18929 a...

Threat Outbreak Alert RuleID18849: Email Messages Distributing Malicious Software on October 22, 2015

Medium Alert ID: 41666 First Published: 2015 October 22 16:20 GMT Last Updated: 2015 October 23 12:56 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18849...

Threat Outbreak Alert RuleID18887: Email Messages Distributing Malicious Software on October 22, 2015

Medium Alert ID: 41668 First Published: 2015 October 22 14:32 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18887 may contain the following files: Name |...

UBUNTU-CVE-2015-5283

The sctpinit function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, which allows local users to cause a denial of service panic or memory corruption by creating SCTP sockets before all of the steps have finished...