HP WebInspect 10.4 - XML External Entity Injection

Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits vulnerability. 1.1. Website that steals files using OO...

CVE-2015-2783

ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service buffer over-read and application crash via a crafted length value in conjunction with crafted serialized data ...

Seagate Central 2014.0410.0026-F - Remote Facebook Access Token

!/usr/bin/python seagatecentralfacebook.py Seagate Central Remote Facebook Access Token Exploit Jeremy Brown jbrown3264/gmail May 2015 -Synopsis- Seagate Central stores linked Facebook account access tokens in /etc/archiveaccounts.ser and this exploit takes advantage of two bugs: 1 Passwordless...

Updated moodle packages fix security vulnerabilities

Updated moodle package fixes security vulnerabilities: In Moodle before 2.6.11, leaving gradebook feedback is a trusted action and such capabilities in other modules already have an XSS mask, 'mod/quiz:grade' was missing this flag CVE-2015-3174. In Moodle before 2.6.11, some error messages displa...

CVE-2015-3340

Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a 1 XENDOMCTLgettscinfo or 2 XENSYSCTLgetdomaininfolist request...

mcms最新版SQL注入一枚（可出任意数据）

简要描述： mcms最新版SQL注入一枚（可出任意数据） 详细说明： 掌易科技的程序员反应相当快啊，确认漏洞当天就修复以后出新版本了，前面在wooyun提的几个漏洞新版的mcms做了相应的处理，发布了新版v3.1.3.enterprise，再来研究研究。 注入一枚：POST /app/public/flink.php?m=insertlogo&ajax=1 post中有个参数fimg存在注入。 function minsertlogo global $dbm; $POST'fid' = isset$POST'fid' ? intval$POST'fid' : 0; $POST'fimg'...

mcms最新版SQL注入（可出任意数据）

简要描述： mcms最新版SQL注入（可出任意数据） 详细说明： 掌易科技的程序员反应相当快啊，确认漏洞当天就修复以后出新版本了，前面在wooyun提的几个漏洞新版的mcms做了相应的处理，发布了新版v3.1.3.enterprise，再来研究研究。 注入一枚：POST /app/public/adv.php?m=saveall...

BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File RetrievalDeletion

BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File RetrievalDeletion Vulnerability title: Arbitrary File Retrieval + Deletion In New Atlanta BlueDragon CFChart Servlet CVE: CVE-2014-5370 Vendor: New Atlanta Product: BlueDragon CFChart Servlet Affected version: 7.1.1.17759 Fixed version:...

BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File Retrieval/Deletion

Vulnerability title: Arbitrary File Retrieval + Deletion In New Atlanta BlueDragon CFChart Servlet CVE: CVE-2014-5370 Vendor: New Atlanta Product: BlueDragon CFChart Servlet Affected version: 7.1.1.17759 Fixed version: 7.1.1.18527 Reported by: Mike Westmacott Details: The CFChart servlet of...

mcms最新版SQL注入漏洞（可出任意数据）

简要描述： mcms最新版SQL注入漏洞（可出任意数据） 详细说明： 掌易科技的程序员反应相当快啊，确认漏洞当天就修复以后出新版本了，前面在wooyun提的几个漏洞新版的mcms做了相应的处理，发布了新版v3.1.3.enterprise，再来研究研究。 注入一枚： GET /app/public/gov.shop.order.php?m=view&orderid=1（注意public文件夹是安装系统时取的名字）其中orderid没有过滤，直接进行sql执行。 function mview global $dbm,$result,$V,$C,$orderid;...

mcms最新版SQL注入二枚打包（可出任意数据）

简要描述： mcms最新版SQL注入二枚打包（可出任意数据） 详细说明： 掌易科技的程序员反应相当快啊，确认漏洞当天就修复以后出新版本了，前面在wooyun提的几个漏洞新版的mcms做了相应的处理，发布了新版v3.1.3.enterprise，再来研究研究。 注入一枚：/app/public/code.php?codeid=6977&txt=test&value=test（注意public文件夹是安装系统时取的名字）post中有两个参数，都存在过滤不严的问题。 Txt和value都存在注入问题，这里我们以txt为例来证明问题的存在。我们看看是如何注入的。...

BlueDragon CFChart Servlet 7.1.1.17759 Directory Traversal

Vulnerability title: Arbitrary File Retrieval + Deletion In New Atlanta BlueDragon CFChart Servlet CVE: CVE-2014-5370 Vendor: New Atlanta Product: BlueDragon CFChart Servlet Affected version: 7.1.1.17759 Fixed version: 7.1.1.18527 Reported by: Mike Westmacott Details: The CFChart servlet of...

dashboard: log file arbitrary file retrieval

It was found that the local log-viewing function of the redhat-access-plugin for OpenStack Dashboard horizon did not sanitize user input. An authenticated user could use this flaw to read an arbitrary file with the permissions of the web server...

Shopify: Force 500 Internal Server Error on any shop (for one user)

There is very strange behavior. If user open urls like below: - https://whashp.myshopify.com/?previewthemeid=11288717 - or https://lmfshp.myshopify.com/?previewthemeid=11290937 He got redirect to shop https://whashp.myshopify.com/ and 500 Internal Server Error response, and reload does not help i...

mcms最新版SQL注入8枚打包（可出任意数据）

简要描述： mcms最新版SQL注入8枚打包（可出任意数据） 详细说明： 前段时间在wooyun提交了几个mcms的漏洞，以前mcms的版本是v3.1.1.enterprise， WooYun: mcms最新版SQL注入三枚打包（可出任意数据） ，现在都升级到v3.1.3.enterprise了，还是来研究一下mcmsv3.1.3.enterprise吧。 注入一枚：POST...

Mandriva Linux Security Advisory : python-requests (MDVSA-2015:133)

Updated python-requests packages fix security vulnerabilities : Python-requests was found to have a vulnerability, where the attacker can retrieve the passwords from /.netrc file through redirect requests, if the user has their passwords stored in the /.netrc file CVE-2014-1829. It was discovered...

Cisco Unified Call Manager Arbitrary File Retrieval Vulnerability

A vulnerability in Cisco Unified Call Manager Cisco Unified CM could allow an authenticated, remote attacker to retrieve arbitrary files. The vulnerability is due to improper security restrictions by the affected application while handling requests for resources. An authenticated, remote attacker...

Design/Logic Flaw

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml...

KLA10522 Multiple vulnerabilities in Citrix CC

Multiple serious vulnerabilities have been found in Citrix Controle Center. Malicious users can exploit these vulnerabilities to execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. Improper access restrictions can be exploited remotely via an...

That's so fetch!

There's been some confusion around the new fetch API recently. Let's clear things up. The first thing you'll notice about fetch is it's a massive improvement on XMLHttpRequest in terms of API design. Here's how to get some JSON using XHR: var xhr = new XMLHttpRequest; xhr.open'GET', url;...