759 matches found
Fedora 21 : php-5.6.13-1.fc21 (2015-14976)
03 Sep 2015, PHP 5.6.13 Core: Fixed bug 69900 Too long timeout on pipes. Anatol Fixed bug 69487 SAPI may truncate POST data. cmb Fixed bug 70198 Checking liveness does not work as expected. Shafreeck Sea, Anatol Belski Fixed bug 70172 Use After Free Vulnerability in unserialize. Stas Fixed bug...
FineCms 免费版任意文件上传漏洞
路径：dayrui/libraries/Chart/ofcuploadimage.php $defaultpath = '../tmp-upload-images/'; if !fileexists$defaultpath mkdir$defaultpath, 0777, true; $destination = $defaultpath . basename $GET 'name' ; echo 'Saving your image to: '. $destination; $jfh = fopen$destination, 'w' or die"can't open file";...
A dissertation submitted to the system common SQL vulnerability
Brief description: Detailed description: A dissertation submitted to the system common SQL vulnerabilities. Case: http://...: 8001//paper/forget1. jsp ...: 8001//paper/forget1. jsp http://...: 8080//paper/forget1. jsp ...: 8001//paper/forget1. jsp http://...: 8001/paper/forget1. jsp Vulnerability...
File Inclusion Vulnerability in Zblog
Zblog is based on the Asp platform Blog blog weblog program. Zblog has a file inclusion vulnerability. zbinstall/index.php does not escape POST, and an attacker can truncate the .php that follows...
Wordpress Really Simple Guest Post <= 1.0.6 - File Include Vulnerability
Exploit for php platform in category web applications Exploit Title: Wordpress Really Simple Guest Post File Include Google Dork: inurl:"really-simple-guest-post" intitle:"index of" Date: 04/06/2015 Exploit Author: Kuroi'SH Software Link: https://wordpress.org/plugins/really-simple-guest-post/...
WordPress Really Simple Guest Post Plugin <= 1.0.6 - File Include
Because of this vulnerability, an attacker can come directly into the URL /wp-content/plugins/really-simple-guest-post/simple-guest-post-submit.php and send a post data. Solution Update the plugin...
WordPress Plugin Really Simple Guest Post 1.0.6 - Local File Inclusion
Exploit Title: Wordpress Really Simple Guest Post File Include Google Dork: inurl:"really-simple-guest-post" intitle:"index of" Date: 04/06/2015 Exploit Author: Kuroi'SH Software Link: https://wordpress.org/plugins/really-simple-guest-post/ Version: =1.0.6 Tested on: Linux The vulnerable file is...
WordPress GigPress 2.3.8 SQL Injection Vulnerability
WordPress GigPress plugin version 2.3.8 suffers from a remote SQL injection vulnerability. Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+...
My Calendar <= 2.3.29 - Arbitrary File Override & Reflected XSS
The file override vulnerability allows an admin to override any file on the web server, ignoring settings such as DISALLOWFILEEDIT. PoC Arbitrary File Override ----------------------- POST http://localhost/wordpress/wp-admin/admin.php?page=my-calendar-styles Post Data: wpnonceavalidnonce...
WordPress TheCartPress Plugin 1.3.9 /checkout/CheckoutEditor.class.php 本地文件包含漏洞
checkout/CheckoutEditor.class.phpfunction adminaction if empty $POST return; if isset $REQUEST'tcpsavefields' $partialpath = $REQUEST'tcpboxpath'; $classname = $REQUEST'tcpboxname'; $initialpath = dirname dirname TCPADMINFOLDER . '/'; requireonce $initialpath . $partialpath ; $box = new $classnam...
vBulletin 4.x.x 'visitormessage.php' Remote Code Injection Vulnerability
Exploit Title: vBulletin 4.x.x 'visitormessage.php' Remote Code Injection Vulnerability + Discovered By: Dariush Nasirpour Net.Edit0r + My Homepage: black-hg.org / nasirpour.info + Date: 2015 27 February + Vendor Homepage: vBulletin.com + Tested on: vBulletin 4.2.2 + Greeting : Ali Razmjoo -...
WooThemes WooFramework 4.5.1 Cross Site Scripting
------------------------------------------------------------------------------ WooThemes WooFramework 4.5.1 Authenicated Cross Site Scripting XSS ------------------------------------------------------------------------------ - Vulnerability Description:...
HostingTakip 3.0 Cross Site Scripting
HostingTakip v3.0 - Stored XSS Vulnerability My + Discovered by: KnocKout Contact : [email protected] HomePage : http://h4x0resec.blogspot.com Love to UnDeRTaKeR & BARCOD3 & Septemb0x & ZoRLu milw00rm.com Software info |Web App. : HostingTakip |Affected Version : v3.0 |Software :...
WordPress Plugin Download Manager 2.7.4 - Remote Code Execution
!/usr/bin/python Exploit Name: Wordpress Download Manager 2.7.0-2.7.4 Remote Command Execution Vulnerability discovered by SUCURI TEAM http://blog.sucuri.net/2014/12/security-advisory-high-severity-wordpress-download-manager.html Exploit written by Claudio Viviani 2014-12-03: Discovered...
WordPress Download Manager 2.7.4 Remote Command Execution
!/usr/bin/python Exploit Name: Wordpress Download Manager 2.7.0-2.7.4 Remote Command Execution Vulnerability discovered by SUCURI TEAM http://blog.sucuri.net/2014/12/security-advisory-high-severity-wordpress-download-manager.html Exploit written by Claudio Viviani 2014-12-03: Discovered...
WordPress 4.0 - Denial of Service
WordPress 4.0 - Denial of Service $argv2, 'pwd' = strrepeat"A",1000000, 'redirectto' = $argv1 . "/wp-admin/", 'reauth' = 1, 'testcookie' = '1', 'wp-submit' = "Log%20In"; $cookieFiles = "cookie.txt"; curlsetoptarray$ch, array CURLOPTHEADER = 1, CURLOPTUSERAGENT = "Mozilla/5.0 Windows; U; Windows N...
WordPress Core 4.0 - Denial of Service
$argv2, 'pwd' = strrepeat"A",1000000, 'redirectto' = $argv1 . "/wp-admin/", 'reauth' = 1, 'testcookie' = '1', 'wp-submit' = "Log%20In"; $cookieFiles = "cookie.txt"; curlsetoptarray$ch, array CURLOPTHEADER = 1, CURLOPTUSERAGENT = "Mozilla/5.0 Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6...
WordPress 4.0 Denial Of Service
$argv2, 'pwd' = strrepeat"A",1000000, 'redirectto' = $argv1 . "/wp-admin/", 'reauth' = 1, 'testcookie' = '1', 'wp-submit' = "Log%20In"; $cookieFiles = "cookie.txt"; curlsetoptarray$ch, array CURLOPTHEADER = 1, CURLOPTUSERAGENT = "Mozilla/5.0 Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6...
DEBIAN-CVE-2014-3707
The curleasyduphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPTCOPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information...
CVE-2014-3707
The curleasyduphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPTCOPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information...