OracleVM 3.3 : nss (OVMSA-2015-0073)

The remote OracleVM system is missing necessary patches to address critical security updates : nss - Added nss-vendor.patch to change vendor - Additional NULL initialization. - Updated the patch to keep old cipher suite order - Resolves: Bug 1224449 - Rebase to nss-3.19.1 - Resolves: Bug 1224449 ...

Threat Outbreak Alert RuleID15850: Email Messages Distributing Malicious Software on June 10, 2015

Medium Alert ID: 39287 First Published: 2015 June 10 13:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15850 may contain the following files: Name | Siz...

CVE-2015-4024

Algorithmic complexity vulnerability in the multipartbufferheaders function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service CPU consumption via crafted form data that triggers an improper order-of-growth...

SQL injection vulnerability in the id parameter in Ticketmaster ERP web-based ticketing system/Sales/meb_his.aspx?id=.

Ltd. Ticketmaster ERP management system is a special ticket management system for air ticket agents, integrating online booking management, telephone recording screen, corporate travel management, order management in the same industry, membership management, points management, SMS sending, staff...

Cross site scripting

Cross-site scripting XSS vulnerability in Sterling Order Management 8.5 before HF113, Sterling Selling and Fulfillment Foundation 9.0.0 before FP92, and Sterling Field Sales SFS 9.0 before HF7 in IBM Sterling Selling and Fulfillment Suite allows remote attackers to inject arbitrary web script or...

CVE-2015-1911

CVE-2015-1911 is an XSS vulnerability in IBM Sterling Selling and Fulfillment Suite components: Sterling Order Management 8.5 (before HF113), Sterling Selling and Fulfillment Foundation 9.0.0 (before FP92), and Sterling Field Sales 9.0 (before HF7). The IBM bulletin (IBM Security Bulletin) attrib...

CVE-2015-1911

Cross-site scripting XSS vulnerability in Sterling Order Management 8.5 before HF113, Sterling Selling and Fulfillment Foundation 9.0.0 before FP92, and Sterling Field Sales SFS 9.0 before HF7 in IBM Sterling Selling and Fulfillment Suite allows remote attackers to inject arbitrary web script or...

Threat Outbreak Alert RuleID15407: Email Messages Distributing Malicious Software on May 20, 2015

Medium Alert ID: 38933 First Published: 2015 May 20 18:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15407 may contain the following files: Name | Size...

74CMS一逻辑漏洞导致两处二次注入

简要描述： 74CMS一逻辑漏洞导致两处二次注入 详细说明： 1.首先还是注册一个企业用户，在注册的过程中用burp抓包，修改里面的username字段 username=1′,1,1001,1,user,1,1,1,1,1,1,1 — a 2.74cms本来是不允许注册带有特殊字符的用户名的，但是使用这样的方法可以绕过过滤，我们来看一下数据库。 3.我们再来看哪里对该用户进行了二次数据库操作。找了很久，看到了对很多操作都提供了日志记录的功能。writememberslog函数 function...

Threat Outbreak Alert RuleID15285: Email Messages Distributing Malicious Software on May 14, 2015

Medium Alert ID: 38870 First Published: 2015 May 15 12:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15285 may contain the following files: Name | Size...

WordPress Plugin TheCartPress Incorrect Access Control Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An incorrect access control vulnerability exists in the WordPress plugin TheCartPress. An unauthenticated remote attacker...

IBM Sterling Order Management Cross-Site Scripting Vulnerability (CNVD-2015-02756)

IBM Sterling Order Management is a suite of order management software that orchestrates the cross-channel sales and order fulfillment process across a dynamic business network of customers, suppliers and partners. A cross-site scripting vulnerability exists in IBM Sterling Order Management for...

Threat Intelligence Sharing Still Seen as a Challenge

SAN FRANCISCO–The discussion about information sharing has been going on in the security community since before there was a security community, but the tone and shape of the conversation have changed recently thanks to an executive order from the Obama administration and the relentless drumbeat o...

某网上商城系统任意订单取消

简要描述： 某网上商城系统任意订单取消 详细说明： 1、先提交一个订单之后点击取消抓包 2、打开抓到的url 提示ok 3、来看看我们的订单是不是取消了 成功取消了 4、下面我换一个号来提交3个订单订单号分别是258 259 260 前面的200多个订单都可以取消测试嘛就自己来 img src="https://images.seebug.org/upload/201504/1513494371e28e5e44b60cc2fdc49c059d575ec4.png" alt="6.png" wi...

doyocms parallel rights issue of disclosure orders-vulnerability warning-the black bar safety net

Order override view vulnerability The problem code is in source/member. php at function myorder if$this-syArgs'oid'||$this-syArgs'orderid',1!=" if$this-syArgs'oid'$r=array'id'=$this-syArgs'oid';else$r=array'orderid'=$this-syArgs'orderid',1; $this-order=syDB'order'-find$r;...

pgbouncer -- remote denial of service

PgBouncer reports: Fix remote crash - invalid packet order causes lookup of NULL pointer. Not exploitable, just DoS...

White House Executive Order Declares Cyber National Emergency

U.S. President Barack Obama last week issued an Executive Order declaring a national emergency and deputizing the Treasury Secretary and Attorney General to apply sanctions and other consequences for international actors deemed to have engaged in “cyber-enabled activities” detrimental to U.S...

Threat Outbreak Alert RuleID14423: Email Messages Distributing Malicious Software on April 1, 2015

Medium Alert ID: 38159 First Published: 2015 April 1 13:07 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14423 may contain the following files: Name | Siz...

Satellite-Based Monitoring Constitutes a Fourth Amendment Search

The Supreme Court has weighed in on a series of lower court decisions, issuing a summary opinion that satellite-based monitoring is in fact a Fourth Amendment search. What remains to be decided is whether GPS-based tracking constitutes an unreasonable search and is thus a violation of the Fourth...

Threat Outbreak Alert RuleID14274: Email Messages Distributing Malicious Software on March 26, 2015

Medium Alert ID: 38065 First Published: 2015 March 26 15:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14274 may contain the following files: Name | Si...