某通用型电子采购平台存在任意文件上传漏洞GETSHELL

简要描述： 详细说明： 1.看看前人提交的漏洞： WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） ,说的是注入漏洞，后来仔细研究发现存在一个编辑器存在任意文件上传可导致批量Getshell，影响危害极大。 厂商： http://www.ng.com/ 北京网达信联科技发展有限公司 关键字（构造的不是很好）： 2.Getshell漏洞。 /ftb.imy.aspx 可以直接上传asp文件 漏洞证明： 【声明以下案例仅供CNCERT、CNVD复现测，其它人不得利用或使用其恶意破坏，否则后果自负！】 3.案例测试：...

[Onapsis Security Advisories] Multiple Hard-coded Usernames in SAP Components

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisories:Multiple Hard-coded Usernames CWE-798 have been found and patched in a variety of SAP components. Summaries of the advisories with links to full versions follow: 1. ONAPSIS-2014-011-SAP Project System Structures and...

China Bans Microsoft Windows 8 for Government Computers

While US government is always prohibiting the purchase of Huawei products due to suspected backdoors from the Chinese government, China also keep itself totally apart from the US productions. China is a bit famous for using its own operating systems, smartphone application services and lots more,...

Former NSA Director Addresses Crypto Standard Subversion

During the last 11 months of mounting leaks and revelations about the government’s surveillance operations and the lengths it will go to gain intelligence on foreign threats, perhaps the most disturbing revelation was the intentional subversion of widely used cryptographic standards. It’s also be...

Security feature bypass

Unspecified vulnerability in the PeopleSoft Enterprise SCM Services Procurement component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security...

CVE-2014-0425

CVE-2014-0425 concerns Oracle PeopleSoft 9.2 SCM Services Procurement. The provided documents do not reveal concrete technical details about the vulnerability’s root cause, affected component specifics beyond the general SCM Services Procurement scope, or explicit exploit/mitigation data. NVD des...

CVE-2014-0425

Unspecified vulnerability in the PeopleSoft Enterprise SCM Services Procurement component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security...

Threat Outbreak Alert: Fake Army Weapons Procurement Email Messages on June 7, 2013

Medium Alert ID: 29606 First Published: 2013 June 10 12:31 GMT Version: 1 Summary Cisco Security detected significant activity related to spam email messages that claim to contain information about Army weapons procurement. The text in the email message attempts to convince the recipient to open ...

Apple Supplier Foxconn's Servers Hacked, Exposing Vendor Usernames and Passwords

Apple Supplier Foxconn's Servers Hacked, Exposing Vendor Usernames and Passwords Apple supplier Foxconn has reportedly been hacked, exposing the usernames and passwords of the company's clients and employees. Hacker group SwaggSec just released a dump of Foxconn internal information, including a...

Pentagon Discloses Massive Data Theft, Lays Out New Security Strategy

A targeted attack on a defense contractor in March of this year resulted in the theft of 24,000 files by an unknown attacker, according to Defense Department officials. The attack, which officials say was the work of a foreign government, would represent one of the more serious known attacks on t...