4951 matches found
[SECURITY] Fedora 19 Update: wget-1.16-3.fc19
GNU Wget is a file retrieval utility which can use either the HTTP or FTP protocols. Wget features include the ability to work in the background while you are logged out, recursive retrieval of directories, file name wildcard matching, remote file timestamp storage and comparison, use of Rest wit...
OracleVM 3.3 : wget (OVMSA-2014-0036)
The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2014-4877 wget: FTP symlink arbitrary filesystem access 1156133 - Fix the parsing of weblink when doing recursive retrieving 960137 - Fix errors found by static analysis of source code 873216 ...
WSS最新版某处SQL注入直接获取数据四
简要描述： WSS最新版多处SQL注入直接获取数据四，访客即可注入拿数据 详细说明： WSS最新正式版1.3.2，某处SQL注入直接获取数据，访客权限即可注入拿数据 首先介绍下WSS的用户角色： 管理员MMrank=5 项目经理MMrank=4 普通用户MMrank=3 访客MMrank=2 只读MMrank=1 在WSS系统里面部分文件和功能判断了MMrank值，即权限问题 也有部分文件和功能没有权限判断和限制，前面的两个漏洞都是没有权限限制的 这里我们要讲的漏洞是MMrank大于等于2的用户就能注入，访客即可 文件logedit.php ?php $restrictGoTo =...
[SECURITY] Fedora 20 Update: wget-1.16-3.fc20
GNU Wget is a file retrieval utility which can use either the HTTP or FTP protocols. Wget features include the ability to work in the background while you are logged out, recursive retrieval of directories, file name wildcard matching, remote file timestamp storage and comparison, use of Rest wit...
WSS最新版多处SQL注入直接获取数据三（官方demo演示及快速定位漏洞技巧）
简要描述： WSS最新版多处SQL注入直接获取数据三，官方demo演示，这里存在多处，对同一问题进行总结 详细说明： WSS最新版1.3.2，这里存在多处，并对此同一问题进行总结，以及快速查找同一问题全部漏洞 这里的漏洞没有任何权限限制，任何用户都能进行注入 漏洞分析： WooYun: WSS最新版某处SQL注入直接获取数据二（两处） WSS最新版某处SQL注入直接获取数据二（两处） 这个漏洞之前已经降到了漏洞的过程 因为全局过滤函数设计缺陷导致sql注入 if !functionexists"GetSQLValueString" function...
用友NC-IUFO报表系统部分安全问题（影响多个大客户）
简要描述： 用友NC-IUFO报表系统存在用户信息泄漏，存在暴力破解的风险，另登录的验证码形同虚设，弱口令，登录之后利用系统功能获取webshell； 详细说明： 我们这里以wooyun厂商的忽略大王，中粮集团的报表平台为例； link： http://iufo.cofco.com/service/iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.login.LoginAction 1. 用户信息泄漏 link：...
CentOS Update for mod_auth_mellon CESA-2014:1803 centos6
Check the version of modauthmellon SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882076";...
Mandriva Linux Security Advisory : wget (MDVSA-2014:212)
Updated wget package fixes security vulnerability : Wget was susceptible to a symlink attack which could create arbitrary files, directories or symbolic links and set their permissions when retrieving a directory recursively through FTP CVE-2014-4877. The default settings in wget have been change...
The Samsung“find mobile phone Find My Mobile”function the presence of 0Day vulnerabilities-vulnerability warning-the black bar safety net
! The U.S. National Institute of standards and Technology（NIST）to the majority of users warned: Samsung mobile phone“to retrieve mobile phone Find my mobile”function the presence of 0Day vulnerabilities. About the Find My Mobile The Samsung company after modification, to get back phone the Find m...
MGASA-2014-0431 Updated wget packages fix CVE-2014-4877
Updated wget package fixes security vulnerability: Wget was susceptible to a symlink attack which could create arbitrary files, directories or symbolic links and set their permissions when retrieving a directory recursively through FTP CVE-2014-4877. The default settings in wget have been changed...
CVE-2 0 1 4-3 5 6 6 SSLv3 POODLE principle of analysis-vulnerability warning-the black bar safety net
0x00 background POODLE attack against SSLv3, CBC mode encryption algorithm, a padding oracle attack. This attack mode and before the BEAST attacks much like, can allow an attacker to obtain the SSL communication part of the information of the plaintext, such as coockie with. And the BEAST is...
[SECURITY] Fedora 19 Update: check-mk-1.2.4p5-2.fc19
check-mk is a general purpose Nagios-plugin for retrieving data. It adopts a new approach for collecting data from operating systems and network compone nts. It obsoletes NRPE, checkbyssh, NSClient, and checksnmp and it has many benefits, the most important are a significant reduction of CPU usag...
MGASA-2014-0409 Updated python-requests packages fix security vulnerabilities
Updated python-requests packages fix security vulnerability: Python-requests was found to have a vulnerability, where the attacker can retrieve the passwords from /.netrc file through redirect requests, if the user has their passwords stored in the /.netrc file CVE-2014-1829. It was discovered th...
BMC Track-It! - Multiple Vulnerabilities
BMC Track-It! - Multiple Vulnerabilities Multiple critical vulnerabilities in BMC Track-It! Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= The application exposes several .NET remoting...
[SECURITY] [DSA 3048-1] apt security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3048-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 08, 2014 http://www.debian.org/security/faq -...
DSA-3048-1 apt - security update
Bulletin has no description...
BMC / Numara Track-It! Domain Administrator and SQL Server User Password Disclosure
This module exploits an unauthenticated configuration retrieval .NET remoting service in Numara / BMC Track-It! v9 to v11.X, which can be abused to retrieve the Domain Administrator and the SQL server user credentials. This module has been tested successfully on versions 11.3.0.355, 10.0.51.135,...
[SECURITY] Fedora 21 Update: check-mk-1.2.4p5-2.fc21
check-mk is a general purpose Nagios-plugin for retrieving data. It adopts a new approach for collecting data from operating systems and network compone nts. It obsoletes NRPE, checkbyssh, NSClient, and checksnmp and it has many benefits, the most important are a significant reduction of CPU usag...
[SECURITY] Fedora 20 Update: check-mk-1.2.4p5-1.fc20
check-mk is a general purpose Nagios-plugin for retrieving data. It adopts a new approach for collecting data from operating systems and network compone nts. It obsoletes NRPE, checkbyssh, NSClient, and checksnmp and it has many benefits, the most important are a significant reduction of CPU usag...