CVE-2011-4613

The X.Org X wrapper xserver-wrapper.c in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, which allows local users to bypass intended access restrictions by associating stdin with a file that is misinterpreted as the console TTY...

Design/Logic Flaw

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2013-5881...

Syrian Electronic Army's own website got hacked by Turkish hacker

Oops.. Hackers got Hacked! The Syrian Electronic Army, who has hacked hundreds of High Profile targets in 2013-14, today they got hacked by a Turkish hacker. Turkguvenligi, a Turkish hacker told The Hacker News that he hacked and defaced the official website of the hacking group SEA sea.sy and...

CVE-2013-7232

SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service...

Sql injection

SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service...

CVE-2013-7232

SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service...

Cross site scripting

Cross-site scripting XSS vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the ACM web server...

Code injection

The server in Brocade Network Advisor before 12.1.0, as used in EMC Connectrix Manager Converged Network Edition CMCNE, HP B-series SAN Network Advisor, and possibly other products, allows remote attackers to execute arbitrary code by using a servlet to upload an executable file...

CVE-2013-6410

nbd-server in Network Block Device nbd before 3.5 does not properly check IP addresses, which might allow remote attackers to bypass intended access restrictions via an IP address that has a partial match in the authfile configuration file...

Code injection

The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service CPU consumption via unspecified vectors...

(新)程氏舞曲CMS 三步GETSHELL（实例演示+源码详析）

简要描述： SQL绕过双重保险再注射+无需解MD5后台认证绕过（同时绕过了安装时写在config文件里的验证码）+后台GETSHELL 无论从技术难度还是危害讨论，均已到达最高RANK了吧 实例演示的站点为官方主页链接过去的 www.26yy.com GETSHELL由于对服务器文件有影响，只在本机127.0.0.1演示 详细源码分析，漏洞证明截图各见下文相应区域 详细说明： 第一步： 分析： 本CMS使用自定义CSRequest过滤所有GET和POST 比如： $id=CSRequest"id"; function CSRequest$pistrName...

Drupal 7.x < 7.24 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 7.x prior to 7.24. It is, therefore, potentially affected by multiple vulnerabilities : - An error exists related to the HTML form API and validation callbacks as used by third-party modules that could allow an attacker to bypass the...

CVE-2013-4485

389 Directory Server 1.2.11.15 aka Red Hat Directory Server before 8.2.11-14 allows remote authenticated users to cause a denial of service crash via multiple @ characters in a GER attribute list in a search request...

CVE-2013-5786

Unspecified vulnerability in Oracle MySQL Server 5.6.12 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2013-5793...

Western Digital Arkeia Appliance 10.0.10 - Multiple Vulnerabilities

Exploit for php platform in category web applications Arkeia Appliance v10.0.10 is prone to 2 security vulnerabilties: 1 Unauthenticated firmware upload There are no restrictions when a POST request is send to http:///scripts/upload.php thus allowing any unauthenticated client to upload any data ...

Monkey HTTPD Header Parsing Denial of Service (CVE-2013-3843)

A denial of service vulnerability has been reported in Monkey HTTPD Server...

Path traversal

Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence BI 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the Report Author privilege, a different vulnerability than CVE-2013-2988...

mooSocial 1.3 - Multiple Vulnerabilities

Exploit Title: mooSocial 1.3 - Multiple Vulnerabilites Official site: http://www.moosocial.com Risk Level: High Exploit Author: Esac Homepage author : www.iss4m.ma Last Checked: 22/08/2013 +----------+ | OVERVIEW | +----------+ mooSocial is a social networking script built on top of CakePHP 2...

MiniWeb (Build 300) Arbitrary File Upload

This module exploits a vulnerability in MiniWeb HTTP server build 300. The software contains a file upload vulnerability that allows an unauthenticated remote attacker to write arbitrary files to the file system. Code execution can be achieved by first uploading the payload to the remote machine ...

CVE-2013-2219

The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute...