MySQL 5 Command Line Client HTML Special Characters HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/31486/info MySQL is prone to an HTML-injection vulnerability because the application's command-line client fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied...

WebMaster ConferenceRoom 1.8 Developer Edition DoS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2178/info WebMaster ConferenceRoom Developer Edition is a chat package which enables a large community of users to chat together. ConferenceRoom has a wide range of capabilities and a user friendly channel moderation...

MyAlbum <= 3.02 (language.inc.php) Remote File Inclusion Vulnerability

No description provided by source. ============================================================================================== MyAlbum = 3.02 langsdir Remote File Inclusion Vulnerability =============================================================================================== Critical...

Critical: Red Hat Security Advisory: rubygem-openshift-origin-node security update

An updated rubygem-openshift-origin-node package that fixes one security issue and several bugs is now available for Red Hat OpenShift Enterprise 2.1.1. The Red Hat Security Response Team has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base...

openSUSE Security Update : cups (openSUSE-SU-2010:1018-1)

This updates fix several bugs, but only the security fixes are listed here : - CVE-2010-2941: CVSS v2 Base Score: 3.3 AV:A/AC:L/Au:N/C:N/I:N/A:P: CWE-399 Special IPP requests allow to crashcupsd remotely. - CVE-2010-0542: CVSS v2 Base Score: 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P: CWE-264 A NULL pointer...

openSUSE Security Update : strongswan (openSUSE-SU-2013:1333-1)

This update of strongswan fixed a denial-of-service vulnerability, that could be triggered by special XAuth usernames and EAP identities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

Security Advisory-Multiple Heap Overflow Vulnerabilities in Huawei Campus Series Switches

Some Huawei Campus series switches have three heap overflow vulnerabilities. When receiving some special malformed packets, such devices access heap memory that is beyond the valid range and cause unexpected restart of the devices. If an attacker keeps sending such malformed packets, the devices...

74CMS 二次注入 #3 (多处)

简要描述： No check out。 6月份了 不知道是自己倒数的多少个洞了。 2014年6月2日 16:06:55 最后写一个 写了就去上晚自习了。 时间原因 怕迟到 可以注入的地方很多 我就贴两个出来就算了。 demo成功。 详细说明： 总所周知 74cms在/user/userreg.php注册的时候 用户名： 只能包含中英文、数字和下划线 不允许注册特殊字符 但是在plus/ajaxuser.php中 也能注册。 在这里就没过滤特殊字符了。 elseif $act=='doreg' $captcha=getcache'captcha'; if...

DEBIAN-CVE-2012-5391

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid...

Acrylic WiFi Free - Real-time WLAN information and network analysis

Acrylic WiFi enables identificating WiFi access points , obtaining information of the security mechanisms and obtaining generic WiFi passwords thanks to a plugins system. Access points : WLAN network information SSID and BSSID and clients connected to the network. Signal level : Signal quality...

Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:083)

Updated mediawiki packages fix security vulnerabilities : Login CSRF issue in MediaWiki before 1.22.5 in Special:ChangePassword, whereby a user can be logged into an attackers account without being aware of it, allowing the attacker to track the user's activity CVE-2014-2665. XSS vulnerability in...

NIST SP 800-52 Revision 1 Recommends TLS 1.2 by Jan. 1, 2015

U.S. federal government agencies are being told they should move to TLS 1.2 by the beginning of 2015. The National Institute for Standards and Technology, NIST, recently released NIST Special Publication 800-52 Revision 1, which includes the final public comments made since SP 800-52 was withdraw...

NRPE 2.15 - Remote Command Execution

NRPE 2.15 - Remote Command Execution ============================================= - Release date: 17.04.2014 - Discovered by: Dawid Golunski - Severity: High ============================================= I. VULNERABILITY ------------------------- NRPE - Nagios Remote Plugin Executor = 2.15 Remot...

[SECURITY] Fedora 20 Update: ImageMagick-6.8.6.3-4.fc20

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

Praim Ino SoC I9000 Series瘦客户端&quot;browsed&quot;命令注入漏洞

Praim Ino SoC I9000 Series Thin Clients是一款瘦客户端产品。 Praim Ino SoC I9000 Series Thin Clients相关"browsed"应用没有正确过滤用户提交的输入，允许攻击者向UDP 1680端口发送特制报文，可注入和执行任意shell命令。 0 Praim Ino SoC I9000 Series Thin Clients 目前没有详细解决方案： http://www.praim.com/en/products/solution-thin-client/ino-soc-series1319idp/...

Hacking Maytag: Coin-Operated Laudromat Machines

Most Maytag commercial washers and dryers out there use a common controller platform. It dates back to the 80s and is still produced. So almost all Maytag with digital control panel is exploitable in this way. The identifying features are green vacuum florescent display with a four-digit numerica...

sp mode mail vulnerability where Java methods may be executed

Overview sp mode mail provided by NTT DOCOMO contains an issue in the processing Deco-mail emoticon POP, which may lead to the execution of arbitrary Java methods that can be executed with the privileges of sp mode mail. Hironori Tokuta reported this vulnerability to IPA. JPCERT/CC coordinated wi...

Discuz! X3.1 刷积分漏洞

简要描述： X3.1 利用特殊主题进行刷分 详细说明： 首先论坛需开启悬赏贴，如不开启，则无任何的影响。 具体步骤： 1，使用主号发布悬赏贴，其他号进行回帖。 2，主号打开2个窗口，1个窗口为采纳最佳答案的帖子，另1个窗口打开帖子的编辑。 然后，先采纳答案，然后把编辑的窗口，保存。 此处会发现帖子会变成未采纳，还可以继续采纳，但是主号的金币并没有在扣除。 漏洞证明：...

Senior PHP application vulnerability auditing techniques-vulnerability warning-the black bar safety net

Senior PHP application vulnerability auditing techniques Foreword Traditional code auditing techniques PHP version and application code audit Other factors and application code audit The expansion of our dictionary The variable itself is the key Variable coverage Traverse initialize variables...

Application there is a file include vulnerability Unix systems-vulnerability warning-the black bar safety net

Found time: Vulnerability type: a file that contains Belongs the establishment of the station program: other Belongs to the server type: General Belongs to the programming language: other Description: The target Unix system, the application may exist in the file containing the vulnerability. 1. T...