CVE-2011-5312

Multiple cross-site scripting XSS vulnerabilities in Gollos 2.8 allow remote attackers to inject arbitrary web script or HTML via the returnurl parameter to 1 register.aspx, 2 publication/info.aspx, or 3 user/add.aspx, or 4 the q parameter to product/list.aspx...

TIPASK问答系统SQL注入二（有多个大型互联网企业案例）

简要描述： 审核真给力，刚提交就通过了 ，赞啊！！！！ 详细说明： 部分案例： 经分析下列文件存在注入 /control/message.php 代码如下 function onremovedialog if$this-post'messageauthor' $authors = $this-post'messageauthor'; $ENV'message'-removebyauthor$authors; $this-message"对话删除成功!", geturlsource; 跟进removebyauthor函数 function removebyauthor$authors...

PT-2014-8682 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs versions 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the q parameter to two API endpoints: "api/v1/repos/search" and...

CVE-2014-3617

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

CVE-2014-3617

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

Design/Logic Flaw

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

CVE-2014-3617

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

CVE-2014-3617

The CVE-2014-3617 issue affects Moodle’s forum: the function forum_print_latest_discussions in mod/forum/lib.php allowed remote authenticated users to bypass the requirement to post an answer and to discover an author’s username by visiting a Q&A forum, without needing the mod/forum:viewqandawith...

MGASA-2014-0379 Updated moodle packages fix security vulnerbilities

Updated moodle packages fix security vulnerabilities: In Moodle before 2.6.5, users who had not yet posted the required answer in a Q&A forum in order to access past posts were able to see the name of the last person who had posted, as other authors are visible in /mod/forum/view.php before the...

Updated moodle packages fix security vulnerbilities

Updated moodle packages fix security vulnerabilities: In Moodle before 2.6.5, users who had not yet posted the required answer in a Q forum in order to access past posts were able to see the name of the last person who had posted, as other authors are visible in /mod/forum/view.php before the...

CVE-2014-5574

The CVE-2014-5574 entry affects the Ask.fm Android app (version 1.2.4) and is caused by the application not verifying X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The connected documents c...

August 2014 Security Bulletin Webcast and Q&A

Today, we published the August 2014 Security Bulletin webcast questions and answers page along with the webcast replay. We answered ten questions on air, with the majority focusing on the update for Internet Explorer. Here is the video replay: We are aware of some issues related to the recent...

php云问答功能处存储型xss

简要描述： 需要主动触发。 详细说明： http://www.hr135.com/ask/index.php 测试地址：http://www.hr135.com/ask/index.php?c=content&id=162 超级链接写入：javascriptalert1 &NewLine是HTML5新增的实体命名编码 firebug之类工具修改链接名称增加欺骗性 成功触发JS 使用追问功能再次添加超级链接：javascriptalertdocument.cookie 成功弹出cookie 漏洞证明：...

July 2014 Security Bulletin Webcast and Q&A

Today we published the July 2014 Security Bulletin webcast questions and answers page along with the webcast replay. We answered eight questions on air, with the majority focusing on the update for Internet Explorer. The transcript also includes a question we did not have time to answer on the ai...

QuadComm Q-Shop 2.5 Failure To Validate Credentials Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8153/info Zone-H has reported that the Q-Shop ASP shopping cart software contains a vulnerability that may allow remote attackers to upload arbitrary files. Once uploaded, the attacker may be able to have the script...

Q-News 2.0 - Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15576/info Q-News is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary remote...

Q-Shop 3.0 - Remote XSS/SQL Injection Vulnerabilities

No description provided by source. 000000 00000 0000 0000 000 00 000000 0000000 0000 000000 00000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00000 0 0 0 0 0 0 0 0 00000 0000 0 0 0 0 00000 0 0 0 0 0 0 0 0 0 0 000 0 0 0 ...

PBLang <= 4.99.17.q Remote File Rewriting / Command Execution

No description provided by source. --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | / \ \ | \ \ | | | \ | |/ \ | | // | || | ||| /| / /\ | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org...

Duyuru Scripti Goster.ASP SQL injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22910/info Duyuru Scripti is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting this vulnerability could permit remot...

q-news 2.0 - Remote Command Execution Exploit

No description provided by source. Author = FireShot , Jacopo Vuga. Mail = fireshotatautisticidotorg Vulnerability = Remote Command Execution Software = q-news 2.0 Download = http://ovh.dl.sourceforge.net/sourceforge/php-box/2.0nologin.zip Greets to = Osirys for his friendship and his tips, Myral...