282 matches found
CVE-2015-5645
ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors...
CVE-2015-5644
The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors...
Code injection
The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors...
Code injection
ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors...
CVE-2015-5645
ICZ MATCHA SNS (MATCHA SNS) before 1.3.7 is vulnerable: remote authenticated users can obtain administrative privileges via unspecified vectors. Affected product: MATCHA SNS from ICZ Corporation, versions 1.3.6 and earlier. Root cause details are not specified in the provided documents; exploitat...
CVE-2015-5644
The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors...
CVE-2015-5645
ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors...
CVE-2015-5644
CVE-2015-5644 affects ICZ MATCHA SNS prior to 1.3.7. The installer fails to correctly configure the database, enabling a code injection path that allows a remote attacker to execute arbitrary PHP code. The vulnerability is tied to installer-time database configuration (CWE-94) and culminates in c...
MATCHA SNS vulnerable to code injection
Overview MATCHA SNS provided by ICZ Corporation is an SNS software. MATCHA SNS contains a code injection CWE-94 vulnerability due to a flaw when configuring the database during installation. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...
JVN#85118545: MATCHA SNS access restriction bypass vulnerability
MATCHA SNS provided by ICZ Corporation is an SNS software. MATCHA SNS contains an access restriction bypass vulnerability. Impact A user without administrative privileges may obtain administrative privileges. Solution Update the Software Update to the latest version according to the information...
JVN#08535069: MATCHA SNS vulnerable to code injection
MATCHA SNS provided by ICZ Corporation is an SNS software. MATCHA SNS contains a code injection CWE-94 vulnerability due to a flaw when configuring the database during installation. Impact An unauthenticated attacker who can execute the installer may execute arbitrary PHP code on the server where...
Samsung Patches Social Media Vulnerability in Millions of Devices
Samsung patched a vulnerability last month in SNS Provider, a popular application that manages other social media apps present in millions of its devices. If exploited the bug could have given attackers the ability to access to any personal information users stored on Facebook, LinkedIn and...
ThinkSNS某处任意上传文件漏洞，获取官方站点控制权
简要描述： ThinkSNS某处任意上传文件漏洞，可导致网站沦陷、用户数据泄露，你说是不是高危？ 详细说明： ThinkSNS群组上传文档处存在任意上传文件漏洞，可导致四个网站沦陷、用户数据泄露，你说是不是高危？ 1.我们打开一个群组上传文档 2.开始抓包，上传一个图片网马比如yy.jpg，然后在包里面改为yy.php 3.于是上传成功 看看文件，额 4.连一连 5.跨一跨 img src="https://images.seebug.org/upload/201301/090...
ThinkSNS某SNS功能极品XSS，通杀WEB和IOS客户端Ⅲ
简要描述： 没啥好说的，继续整改嘛 详细说明： 首先说出出问题的地方： 在主要SNS功能【日志】处有几处没有交代清楚1、超链接网址 2、网络图片网址 3、flash网址。可造成持久跨站。不应该呀不应该！只要浏览该日志就被亲切的跨着 http://t.thinksns.com/app/blog/detail/4206?mid=41632 可以去看看幺 漏洞证明： 首先编辑日志，在网址处写代码 保存发布，可看到效果 结实的XSS...
Thinksns某SNS功能极品XSS，通杀WEB和IOS客户端II
简要描述： 最近流行连载，我也凑个热闹…… 不得不说，同样一个地方，同样的问题，发生了两次，要打程序猿小PP啦 详细说明： 从上次的修改看，是过滤了等特殊字符的过滤 ,但是，问题没有得到解决呀！看图 我可以定义onerror事件，直接利用 照样是发送到首页&并且在点击我的首页时，顺利触发 漏洞证明： 再有 ，我还是不辞劳苦的测试了IOS客户端，效果也是非常明显的 今天没有用xsserme，难道是为xsser节约资源？ -0-...
Thinksns某SNS功能极品XSS，通杀WEB和IOS客户端
简要描述： 某SNS功能极品XSS，测试通过WEB和IOS客户端，我@ 你了哦！ 详细说明： 在一般能够出问题的地方出现了问题，很正常。正题 在个人主页发表图片的时候，存在不严格的地方，导致了一存储跨站： 上传完成，可以看到效果 由于看到了这样一个操作会自动发送一条微博到首页，危害程度就瞬间提升了。 于是有了我在首页的忽悠，可以@好友，可以转发 表示已经@小秘书和某boss，哈哈，没干坏事。 PCWEB cookie： 漏洞证明： 接着我不辞辛苦有试了其IOS客户端，效果也是很明显的，见漏洞证明 IOS cookie...
CVE-2012-1238
Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors...
CVE-2012-1237
Cross-site request forgery CSRF vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack the authentication of arbitrary users...