Accept Answer URL should be idempotent and accept PUT or POST requests only

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-46610. panel Answers currently users a single URL to both accept and un-accept answers: noformat $baseurl/acceptanswer/$answerid...

Accept Answer URL should be idempotent and accept PUT or POST requests only

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-46610. panel Answers currently users a single URL to both accept and un-accept answers: noformat $baseurl/acceptanswer/$answeri...

Geeklog Calendar Plugin Cross Site Scripting Vulnerability

Geeklog is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-Site Scripting (XSS) in Ilch CMS

High-Tech Bridge Security Research Lab discovered vulnerability in Ilch CMS, which can be exploited to perform Cross-Site Scripting XSS attacks against users and administrators of vulnerable application. 1 Cross-Site Scripting XSS in Ilch CMS: CVE-2014-1944 The vulnerability exists due to...

phpBB 3.0.8 - Remote Denial of Service

phpBB 3.0.8 - Remote Denial of Service source: https://www.securityfocus.com/bid/65481/info phpBB is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Phpbb Forum Denial of Service...

Phire CMS 1.1.2 - Multiple XSS Vulnerabilities

Latest Phire CMS suffers on multiple cross site scripting vulnerabilities because of poor variables filtration. Title: Phire CMS 1.1.2 - Multiple XSS Vendor: phirecms.org - en.wikipedia.org/wiki/PhireCMS Version: 1.1.2 Latest ATM Demo: demo.phirecms.org Date: 01.25.2014 Contact:...

Easy POS System SQL注入漏洞

No description provided by source. 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You might use ‘sqlmap -l’ to load it though. PoC: POST /login.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux i686; rv:22.0...

godontologico 5 SQL注入漏洞

No description provided by source. 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests as indicated on the output. You might use sqlmap -l to load it though. Admin hashes under Table ‘funcionarios' on column ‘senha'. PoC: POST /gco/wallpapers/indexajax.php HTTP/1.1...

Easy POS System SQL Injection

Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You...

Easy POS System - 'login.php' SQL Injection

Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You...

Synology DiskStation Manager arbitrary file modification

Overview Synology DiskStation Manager versions 4.3-3776-3 and below contain a vulnerability that allows a remote unauthenticated user to append arbitrary data to an arbitrary file under root privileges. Description CWE-284: Improper Access Control - CVE-2013-6955Synology DiskStation Manager...

FileMaster SY-IT 3.1 iOS - Multiple Web Vulnerabilities

FileMaster SY-IT 3.1 iOS - Multiple Web Vulnerabilities Document Title: =============== FileMaster SY-IT v3.1 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1170 Release Date: ============= 2013-12-16 Vulnerability...

BoastMachine - 'blog' SQL Injection

source: https://www.securityfocus.com/bid/64278/info BoastMachine is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

Enorth Webpublisher CMS SQL Injection Vulnerability

Enorth Webpublisher CMS suffers from a remote SQL injection vulnerability. Title: ==== CVE-2013-6985SQL Injection Vulnerability In Enorth Webpublisher CMS Vendor: ====== http://products.enorth.com.cn/bfnrglxt/index.shtml Severity: ======= Important Versions Affected: ============== All versions...

程氏舞曲CMS又一储存型xss

简要描述： xss 详细说明： 官网修补的不太彻底啊。。 同样是修改 资料处。 火狐 修改下 post包提交 CSName=aaaaaa&CSEmail=a%40qq.com&CSNichen=aaaaaa&CSSex=0&CSCity=%C1%C9%C4%FE%CA%A1&CSQQ=111111111&CSQianm= 出来了。。 后台还是可以 写入任意文件。。。 构造 xss worm如下 isindex type=image src=1...

Directory traversal

Directory traversal vulnerability in the web-management interface in the server in Cisco Wide Area Application Services WAAS Mobile before 3.5.5 allows remote attackers to upload and execute arbitrary files via a crafted POST request, aka Bug ID CSCuh69773...

CVE-2013-5554

Directory traversal vulnerability in the web-management interface in the server in Cisco Wide Area Application Services WAAS Mobile before 3.5.5 allows remote attackers to upload and execute arbitrary files via a crafted POST request, aka Bug ID CSCuh69773...

CVE-2013-5554

Directory traversal vulnerability in the web-management interface in the server in Cisco Wide Area Application Services WAAS Mobile before 3.5.5 allows remote attackers to upload and execute arbitrary files via a crafted POST request, aka Bug ID CSCuh69773...

Stop User Enumeration 1.2.4 - POST Request Protection Bypass

The Stop User Enumeration WordPress plugin was affected by a POST Request Protection Bypass security vulnerability...

Cheng's dance CMSPHP3. 0 stored xss getshell-a vulnerability warning-the black bar safety net

This cms before 9 0 someone made a getshell,when is background verification file problem The official website has been patched, so again, source Because the backend login will also need the authentication code so the injection didn't see. There xss Vulnerability file user/member/skinedit.php trtd...