5129 matches found
Draft retrieval in the editor doesn't respect page or space permissions
Drafts are supposed to be per user and private but given a draft id, which should be easy to guess as they are sequential, you can access the contents of any draft, both for new and existing pages by using the following urls:...
Draft retrieval in the editor doesn't respect page or space permissions
Drafts are supposed to be per user and private but given a draft id, which should be easy to guess as they are sequential, you can access the contents of any draft, both for new and existing pages by using the following urls:...
CMSeasy SQL注入漏洞一发（bypass自身与360waf）
简要描述： 也不知道重复没有- -! 详细说明： /lib/default/archiveact.php： function respondaction includeonce ROOT . '/lib/plugins/pay/' . front::$get'code' . '.php'; $payclassname = front::$get'code'; $payobj = new $payclassname; $uri = $SERVER"REQUESTURI"; $uriget = strstr$uri, '?'; $uriget = strreplace'?', '',...
CVE-2014-5241
The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site...
CLI Magic: I Didn’t Know That !
Command Editing Shortcuts Ctrl + a – go to the start of the command line Ctrl + e – go to the end of the command line Ctrl + k – delete from cursor to the end of the command line Ctrl + u – delete from cursor to the start of the command line Ctrl + w – delete from cursor to start of word i.e...
Yokogawa BKBCopyD.exe Client
This module allows an unauthenticated user to interact with the Yokogawa CENTUM CS3000 BKBCopyD.exe service through the PMODE, RETR and STOR operations. Module Options msf use auxiliary/admin/scada/yokogawa/bkbcopydclient msf undefinedbkbcopydclient show actions ...actions... msf...
Netgear WNR1000v3 - Password Recovery Credential Disclosure Vulnerability-vulnerability warning-the black bar safety net
Current source: https://github.com/rapid7/metasploit-framework the Exploit Title: Netgear WNR1000v3 Password Recovery Credential Disclosure Vulnerability Date: 7-5-14 Exploit Author: c1ph04 Version: 1.0 Tested on: Netgear WNR1000v3 Router Version: 'Netgear WNR1000v3 Password Extractor",...
Microsoft Internet Explorer 5.5 File Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2833/info Internet Explorer contains a flaw which could enable a remote web site operator to retrieve a known file from a visiting user's system. If a specially formed script containing GetObject function with the known...
FAQEngine <= 4.16.03 (question.php questionref) SQL Injection Exploit
No description provided by source. !/usr/bin/perl -w FAQEngine = v4.16.03 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code question.php: $sql = select from .$tableprefix.questions where publish=1 and...
TaskDriver <= 1.2 Login Bypass/SQL Injection Exploit
No description provided by source. !/usr/bin/perl -w TaskDriver = 1.2 Login Bypass/SQL Injection Exploit Discovered by: Silentz Payload: Login Bypass & Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code login.php: $sql = SELECT FROM $userstable WHERE username =...
Luca Deri ntop 1.2 a7-9 Unauthorized File Retrieval Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1550/info ntop is a tool that shows the network usage, similar to what the popular top Unix command does. Starting ntop in web mode with the -w parameter starts ntop with it's own built in HTTP server, to allow remote...
XOOPS <= 2.3.3 - Remote File Disclosure Vulnerability (.htaccess)
No description provided by source. ======================================================================== XOOPS = 2.3.3 Remote Arbitrary File Retrieval ======================================================================== Affected Software : XOOPS = 2.3.3 Author : Luca daath De Fulgentis -...
Pheap 1.x/2.0 Edit.PHP Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/22670/info Pheap is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve and edit the contents of arbitrary files...
Scry Gallery Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/17649/info Scry Gallery is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve...
Symantec pcAnywhere 9.0 Weak Encryption Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1093/info Symantec pcAnywhere is shipped by default with a weak encryption scheme that is used to encrypt username and password transmittal. Therefore, usernames and password can be retrieved by anyone sniffing the networ...
Microsoft IIS 4.0/5.0 Malformed Filename Request Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1193/info Requesting a known filename with the extension replaced with .htr preceeded by approximately 230 %20 which is an escaped character that represents a space from Microsoft IIS 4.0/5.0 will cause the server to...
phpXplorer 0.9.33 Action.PHP Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/16292/info phpXplorer is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve...
Community CMS <= 0.4 (/index.php id) Blind SQL Injection Exploit
No description provided by source. --+++==============================================================+++-- --+++====== Community CMS = 0.4 Blind SQL Injection Exploit ======+++-- --+++==============================================================+++-- ?php function query $user, $pos, $chr $query...
SimpleNews <= 1.0.0 FINAL (print.php news_id) SQL Injection Exploit
No description provided by source. !/usr/bin/perl -w SimpleNews = 1.0.0 FINAL SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code print.php: $newsid = $GET'newsid'; $query = SELECT FROM simplenewsarticles WHERE news...
Metainfo Sendmail 2.0/2.5,MetaIP 3.1
No description provided by source. source: http://www.securityfocus.com/bid/110/info MetaInfo www.metainfo.com puts out many NT service products, including MetaIP DHCP/DNS manager and Sendmail Unix port. Both products allow remote administration via Web UIs, and MetaIP uses Java to communicate ba...