CVE-2016-0680

CVE-2016-0680 affects Oracle PeopleSoft Products 9.1 and 9.2, specifically the Services Procurement subcomponent of the PeopleSoft Enterprise SCM suite. A security vulnerability exists that can be exploited by a remote authenticated user to read, update, insert, or delete data, thereby compromisi...

procurement.ecmwf.int XSS vulnerability

Vulnerable URL: https://procurement.ecmwf.int/ecmwf/supplier.nsf/frmopportunity?openFormid=CONTRACT-A7GL-BHMIDMid=OPP-HIS-A7LK-77OXX3id=id=ORG-9UGG-2MWUEV=supplierhome" Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 21:54 GMT Vulnerability...

一采通电子采购系统任意文件上传

No description provided by source...

Threat Outbreak Alert RuleID21314: Email Messages Distributing Malicious Software on February 24, 2016

Medium Alert ID: 43730 First Published: 2016 February 24 15:17 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID21314 may contain the following files: Name |...

1caitong 电子采购系统 InviteFee_Edit.asp SQL注入漏洞

No description provided by source...

Threat Outbreak Alert RuleID20329: Email Messages Distributing Malicious Software on January 5, 2016

Medium Alert ID: 42892 First Published: 2016 January 5 14:47 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20329 may contain the following files: Name |...

Threat Outbreak Alert RuleID15645: Email Messages Distributing Malicious Software on June 1, 2015

Medium Alert ID: 39152 First Published: 2015 June 2 14:09 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15645 may contain the following files: Name | Size...

SQL Injection Vulnerability in id Parameter of E-procurement System of Yizitong

Yicai Tong has been committed to enterprise procurement informationization and procurement consulting, providing in-depth solutions in the direction of procurement management, group intensive procurement management, lean supply chain, strategic procurement, project supply chain, and industrialize...

SQL Injection Vulnerability in indexNum Parameter of E-procurement System of Yizaitong

Yicai Tong has been committed to enterprise procurement informationization and procurement consulting, providing in-depth solutions in the direction of procurement management, group intensive procurement management, lean supply chain, strategic procurement, project supply chain, and industrialize...

一采通电子采购系统多处SQL注入漏洞#2

简要描述： 一采通电子采购系统多处SQL注入漏洞2 详细说明： google:inurl:companycglist.aspx?ComId= 1 漏洞存在于 /Products/CategoryMSelect.aspx，参数Name 例如 http://eps.umgg.com.cn/Products/CategoryMSelect.aspx?Name=树脂磨盘 2 漏洞存在于 /RAT/Product/HistoryPrice.aspx，参数kw 例如 http://eps.umgg.com.cn/RAT/Product/HistoryPrice.aspx?kw=1 3 漏洞存在于...

某通用型电子采购系统Oracle盲注漏洞

简要描述： 捡漏啊 详细说明： 前人有经验： WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） 厂商： http://www.1caitong.com/ 北京网达信联科技发展有限公司 SQL注入点： /GetPassWord.aspx POST参数txtUserName存在注入 Case: http://eps.umgg.com.cn/GetPassWord.aspx http://ygcg.xuangang.com.cn/GetPassWord.aspx http://222.134.89.6/GetPassWord.aspx...

某通用型电子采购平台可遍历用户和管理员账户密码

简要描述： RT 详细说明： 前人大牛的洞洞 WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） WooYun: 某通用型电子采购平台存在任意文件上传漏洞GETSHELL WooYun: 某通用型电子采购平台从某处目录遍历到任意文件上传GetShell 我也来凑凑热闹 老问题，权限控制问题 漏洞证明： 演示地址为某上市公司 http://cg.jishimedia.com 首先注册账户，登录之后进入密码修改 此时查看源代码即可获取当前用户密码 burpsuite抓包 放入intruder利用0000-9999遍历UserID即可获取所有人员姓名用户和密码，包括管理员 管理后台...

CVE-2014-4313

SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User field...

CVE-2014-4312

Multiple cross-site scripting XSS vulnerabilities in Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the 1 Notes section to Order details; 2 Description section to "Order to consume"; 3 Favorites name section to Favorites; 4...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the 1 Notes section to Order details; 2 Description section to "Order to consume"; 3 Favorites name section to Favorites; 4...

Sql injection

SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User field...

CVE-2014-4312

Multiple cross-site scripting XSS vulnerabilities in Epicor Enterprise 7.4 before FS74SP6HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the 1 Notes section to Order details; 2 Description section to "Order to consume"; 3 Favorites name section to Favorites; 4...

CVE-2014-4313

The CVE-2014-4313 entry describes a SQL injection vulnerability in Epicor Procurement before 7.4 SP2 that allows remote attackers to execute arbitrary SQL commands via the User field. Affected component: Epicor Procurement (before 7.4 SP2). Root cause: improper input handling enabling SQL injecti...

CVE-2014-4313

SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User field...

某通用型电子采购平台SQL注射（涉及大量企业）

简要描述： sql注入，应该没重复吧 详细说明： 之前大牛提交过，其他的还没搜到 WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） google:inurl:custom/CompanyCGList.aspx?ComId= 目测为一采通电子采购平台，所属：北京网达信联科技发展有限公司 百度百科介绍：http://baike.baidu.com/view/5293437.htm?fr=aladdin 涉及大量企业 其中ComId参数存在注入 http://eps.alnan.com.cn/custom/CompanyCGList.aspx?ComId=1...