Cross site scripting

Cross-site scripting XSS vulnerability in Sterling Order Management 8.5 before HF113, Sterling Selling and Fulfillment Foundation 9.0.0 before FP92, and Sterling Field Sales SFS 9.0 before HF7 in IBM Sterling Selling and Fulfillment Suite allows remote attackers to inject arbitrary web script or...

CVE-2015-1911

CVE-2015-1911 is an XSS vulnerability in IBM Sterling Selling and Fulfillment Suite components: Sterling Order Management 8.5 (before HF113), Sterling Selling and Fulfillment Foundation 9.0.0 (before FP92), and Sterling Field Sales 9.0 (before HF7). The IBM bulletin (IBM Security Bulletin) attrib...

CVE-2015-1911

Cross-site scripting XSS vulnerability in Sterling Order Management 8.5 before HF113, Sterling Selling and Fulfillment Foundation 9.0.0 before FP92, and Sterling Field Sales SFS 9.0 before HF7 in IBM Sterling Selling and Fulfillment Suite allows remote attackers to inject arbitrary web script or...

Threat Outbreak Alert RuleID15407: Email Messages Distributing Malicious Software on May 20, 2015

Medium Alert ID: 38933 First Published: 2015 May 20 18:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15407 may contain the following files: Name | Size...

74CMS一逻辑漏洞导致两处二次注入

简要描述： 74CMS一逻辑漏洞导致两处二次注入 详细说明： 1.首先还是注册一个企业用户，在注册的过程中用burp抓包，修改里面的username字段 username=1′,1,1001,1,user,1,1,1,1,1,1,1 — a 2.74cms本来是不允许注册带有特殊字符的用户名的，但是使用这样的方法可以绕过过滤，我们来看一下数据库。 3.我们再来看哪里对该用户进行了二次数据库操作。找了很久，看到了对很多操作都提供了日志记录的功能。writememberslog函数 function...

Threat Outbreak Alert RuleID15285: Email Messages Distributing Malicious Software on May 14, 2015

Medium Alert ID: 38870 First Published: 2015 May 15 12:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15285 may contain the following files: Name | Size...

WordPress Plugin TheCartPress Incorrect Access Control Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An incorrect access control vulnerability exists in the WordPress plugin TheCartPress. An unauthenticated remote attacker...

IBM Sterling Order Management Cross-Site Scripting Vulnerability (CNVD-2015-02756)

IBM Sterling Order Management is a suite of order management software that orchestrates the cross-channel sales and order fulfillment process across a dynamic business network of customers, suppliers and partners. A cross-site scripting vulnerability exists in IBM Sterling Order Management for...

Threat Intelligence Sharing Still Seen as a Challenge

SAN FRANCISCO–The discussion about information sharing has been going on in the security community since before there was a security community, but the tone and shape of the conversation have changed recently thanks to an executive order from the Obama administration and the relentless drumbeat o...

某网上商城系统任意订单取消

简要描述： 某网上商城系统任意订单取消 详细说明： 1、先提交一个订单之后点击取消抓包 2、打开抓到的url 提示ok 3、来看看我们的订单是不是取消了 成功取消了 4、下面我换一个号来提交3个订单订单号分别是258 259 260 前面的200多个订单都可以取消测试嘛就自己来 img src="https://images.seebug.org/upload/201504/1513494371e28e5e44b60cc2fdc49c059d575ec4.png" alt="6.png" wi...

doyocms parallel rights issue of disclosure orders-vulnerability warning-the black bar safety net

Order override view vulnerability The problem code is in source/member. php at function myorder if$this-syArgs'oid'||$this-syArgs'orderid',1!=" if$this-syArgs'oid'$r=array'id'=$this-syArgs'oid';else$r=array'orderid'=$this-syArgs'orderid',1; $this-order=syDB'order'-find$r;...

pgbouncer -- remote denial of service

PgBouncer reports: Fix remote crash - invalid packet order causes lookup of NULL pointer. Not exploitable, just DoS...

White House Executive Order Declares Cyber National Emergency

U.S. President Barack Obama last week issued an Executive Order declaring a national emergency and deputizing the Treasury Secretary and Attorney General to apply sanctions and other consequences for international actors deemed to have engaged in “cyber-enabled activities” detrimental to U.S...

Threat Outbreak Alert RuleID14423: Email Messages Distributing Malicious Software on April 1, 2015

Medium Alert ID: 38159 First Published: 2015 April 1 13:07 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14423 may contain the following files: Name | Siz...

Satellite-Based Monitoring Constitutes a Fourth Amendment Search

The Supreme Court has weighed in on a series of lower court decisions, issuing a summary opinion that satellite-based monitoring is in fact a Fourth Amendment search. What remains to be decided is whether GPS-based tracking constitutes an unreasonable search and is thus a violation of the Fourth...

Threat Outbreak Alert RuleID14274: Email Messages Distributing Malicious Software on March 26, 2015

Medium Alert ID: 38065 First Published: 2015 March 26 15:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14274 may contain the following files: Name | Si...

Debian DLA-176-1 : mono security update

Three issues with Mono's TLS stack are addressed. CVE-2015-2318 Mono's implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. 'SKIP-TLS' CVE-2015-2319 Mono's implementation of SSL/TLS also contained...

FreeBSD : libuv -- incorrect revocation order while relinquishing privileges (996bce94-d23d-11e4-9463-9cb654ea3e1c)

Nodejs releases reports : CVE-2015-0278 This may potentially allow an attacker to gain elevated privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques...

Threat Outbreak Alert RuleID14170: Email Messages Distributing Malicious Software on March 23, 2015

Medium Alert ID: 37993 First Published: 2015 March 23 15:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14170 may contain the following files: Name | Si...

YXcms1.2.7 刷账户预存款余额

简要描述： YXcms1.2.7 刷账户预存款余额 详细说明： 问题存在于protested/apps/member/controller/shopcarController.php 只判断了数目不能为负，但没有判断价格不能为负。 访问链接http://127.0.0.1/YXcmsApp1.2.7/index.php?r=member/shopcar/caradd post: 'code' = int 1 'name' = int 1 'price' = float -100 'num' = int 1 就向购物车里塞了一个负数价格的商品。 生成订单然后支付，就可以刷余额了。...