XDcms订餐网站系统单店版注入(demo测试)

简要描述： rt 详细说明： 黑盒demo测试 首先注册一个用户，然后修改用户资料 http://dd.xdcms.cn/index.php?m=member&f=edit 修改完成之后，下单点餐。 然后报错了。二次注入 由于demo有安全狗，就没用深入测试了。 漏洞证明：...

Threat Outbreak Alert RuleID14045: Email Messages Distributing Malicious Software on March 16, 2015

Medium Alert ID: 37886 First Published: 2015 March 16 20:57 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14045 may contain the following files: Name | Si...

libuv -- incorrect revocation order while relinquishing privileges

Nodejs releases reports: CVE-2015-0278 This may potentially allow an attacker to gain elevated privileges...

phpems多处水平权限漏洞可进行订单操作

简要描述： phpems多处水平权限漏洞可进行订单操作 详细说明： 3.网站多处存在平行权限漏洞 存在漏洞的代码位置在/app/user/center.php的payfor函数中 public function payfor $subaction = $this-ev-url3; $orderstatus = array1='待付款',2='已完成',99='已撤单'; $this-tpl-assign'orderstatus',$orderstatus; switch$subaction case 'remove': $oid = $this-ev-get'ordersn'; $ord...

SQL Injection Vulnerability in Hotel Online Direct Marketing Platform of Guangzhou Askway Information Technology Co.

Ltd. is a set of hotel online direct marketing technology and operation service system, focusing on building their own online direct marketing platform and system for hotels, providing consulting, advisory, training and other services to help hotels to improve the operation and revenue capacity...

Vulnerabilities in the Online Direct Marketing Platform of Guangzhou Askway Information Technology Co.

Ltd. is a set of hotel online direct marketing technology and operation service system, focusing on building their own online direct marketing platform and system for hotels, providing consulting, advisory, training and other services to help hotels to improve the operation and revenue capacity...

Threat Outbreak Alert RuleID13581: Email Messages Distributing Malicious Software on February 16, 2015

Medium Alert ID: 37481 First Published: 2015 February 16 15:48 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13581 and RuleID13581KVR may contain the...

Obama's Executive Order urges Companies to Share CyberSecurity Threat Data

President Barack Obama signed an executive order on Friday that encourages and promotes sharing of information on cybersecurity threats within the private sector and between the private sector companies and the government agencies as well. AREAS TO IMPROVE During his speech at the White House...

Many well-known hotel chains, high-end brand hotels there are serious security vulnerabilities, massive open room information stored in the disclosure risk-vulnerability warning-the black bar safety net

Well-known Inn orange, Jinjiang Inn, the super eight, pudding; high-end hotel the MARRIOTT Hotel Group, MARRIOTT, Ritz Carlton, Starwood group, Sheraton, Le Meridien, W Hotels, Intercontinental Hotel Group, Holiday Inn, etc there is a serious security breach, the tenant Open House information at ...

Threat Outbreak Alert RuleID13507: Email Messages Distributing Malicious Software on February 11, 2015

Medium Alert ID: 37436 First Published: 2015 February 11 20:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13507 may contain the following files: Name |...

FancyFon Software FAMOC SQL Injection Vulnerability

FancyFon Software FAMOC is a mobile device lifecycle management solution from FancyFon Software Ireland. The solution enables centralized remote management of smartphones using various operating systems over the Internet. A SQL injection vulnerability exists in FancyFon Software FAMOC versions...

Threat Outbreak Alert RuleID13472: Email Messages Distributing Malicious Software on February 9, 2015

Medium Alert ID: 37396 First Published: 2015 February 9 15:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13472 may contain the following files: Name |...

Threat Outbreak Alert RuleID13465: Email Messages Distributing Malicious Software on February 9, 2015

Medium Alert ID: 37393 First Published: 2015 February 9 15:52 GMT Last Updated: 2015 February 10 14:33 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13465...

Sql injection

Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow 1 remote attackers to execute arbitrary SQL commands via the device ID REST parameter PATHINFO to /ajax.php or 2 remote authenticated users to execute arbitrary SQL commands via the order parameter to index.php...

Joyent Node.js Sequelize SQL Injection Vulnerability

Joyent Node.js is the United States Joyent company's set of web applications built on Google V8 JavaScript engine on top of the platform. Sequelize is one of the database ORM object-relational mapping tool. A SQL injection vulnerability exists in Joyent Node.js Sequelize. A remote attacker can...

CVE-2015-1369

SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter...

Threat Outbreak Alert RuleID13134: Email Messages Distributing Malicious Software on July 6, 2015

Medium Alert ID: 37030 First Published: 2015 January 16 17:07 GMT Last Updated: 2015 July 7 13:09 GMT Version: 7 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13134 and...

用友某订单系统POST Oracle注入(疑似通用)

简要描述： 涉及订单就不深入了，但是危害自己知道，如果黑客进去了，就不好办了，故rank为高 详细说明： 有两个问题站点：http://ufbg-ss02.yonyou.com/Login/login.aspx?ReturnUrl=%2flogin.aspx http://desktop.yonyou.com/Login/login.aspx?ReturnUrl=%2flogin.aspx 按照页面上的英文来说，应该是订单系统，涉及订单就不深入了，但是危害自己知道，如果黑客进去了，就不好办了 列出了Oracle用户密码 db： CTXSYS HR MDSYS ODM ODMMTR OE...

North Korea Sanctions Handed Out in Sony Hack

President Obama today signed an Executive Order authorizing sanctions against North Korea for its alleged involvement in the Sony hack. The FBI on Dec. 19 formally blamed the hack on the North Korean government; the attack destroyed workstations and resulted in the loss of employee personal and...

CmsEasy最新版5.5 存储型XSS导致GetShell

简要描述： n处XSS，我不信都插完打不到cookie，get不了shell -.- 详细说明： 第一处（只代码审计第一处，后面几处类似。都是没有过滤）： function loginfalse cookie::set'loginfalse',int cookie::get'loginfalse'+1,time+3600; event::log'loginfalse','失败 user='.front::post'username'; front::flashlang'登陆失败！'."".lang'backuppage'."";...