某在线培训系统通用SQL注入漏洞

简要描述： 详细说明： 某在线培训系统通用SQL注入漏洞。 http://.../WebOrg/TCHlist.aspx?typeid=9 http://.../WebOrg/TCHlist.aspx?typeid=9 http://.../WebOrg/TCHlist.aspx?typeid=9 http://.../WebOrg/TCHlist.aspx?typeid=9 http://.../WebOrg/TCHlist.aspx?typeid=9 http://.../WebOrg/TCHlist.aspx?typeid=9 漏洞证明：...

Online Training Management System Generalized Arbitrary File Download Vulnerability of Beijing Jianfeng Hexun Technology Co.

Peak Hutchinson's Online Training Management System is a software system that provides full-process management of training activities for learning organizations. There is a generic arbitrary file download vulnerability in the online training management system of Beijing Summit Hexun Technology Co...

SQL Injection Vulnerability in Teacher Training Platform of Zibo Kuanzheng Digital Network Technology Co.

Teacher training platform is a teaching system developed by Zibo Kuanzheng Digital Network Technology Co. A SQL injection vulnerability exists in the Teacher Training Platform of Zibo Kuanzheng Digital Network Technology Co. Ltd, which allows attackers to exploit this vulnerability to obtain...

某在线培训系统SQL盲注漏洞

简要描述： rt 详细说明： 官网站：http://.../Login.aspx 在注册用户，检测用户名是否存在 处存在POST注入！ 附：...:8000/ 一例 数据包如下： POST /CscAjax/ajax.aspx HTTP/1.1 Host: ... Proxy-Connection: keep-alive Content-Length: 63 Accept: text/html, / Origin: http://... X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 Windows NT 6.1; WOW...

Cisco WebEx Training Center Cross-Site Scripting Vulnerability

Cisco WebEx Training Center is an online training solution from Cisco. A cross-site scripting vulnerability in Cisco WebEx Training Center allows remote attackers to inject arbitrary web script or HTML via an unspecified value...

Phishing Your Employees: Clever way to Promote Cyber Awareness

Employees are the weakest link when it comes to enterprise security, and unfortunately hackers realized this years ago. All an attacker needs to use some social engineering tactics against employees of companies and organizations they want to target. A massive 91% of successful data breaches at...

Web Security Dojo

Web Security Dojo is a preconfigured, stand-alone training environment for Web Application Security. Virtualbox and VMware versions are available for download. Dojo is an open source project intended to be used as a training environment, and shouldn’t be used as a pen-testing platform due to the...

[SECURITY] Fedora 20 Update: armacycles-ad-0.2.8.3.3-1.fc20

In this game you ride a lightcycle; that is a sort of motorbike that cannot be stopped and leaves a wall behind it. The main goal of the game is to make your opponents' lightcycles crash into a wall while avoiding the same fate. The focus of the game lies on the multiplayer mode, but it provides...

[SECURITY] Fedora 21 Update: armacycles-ad-0.2.8.3.3-1.fc21

In this game you ride a lightcycle; that is a sort of motorbike that cannot be stopped and leaves a wall behind it. The main goal of the game is to make your opponents' lightcycles crash into a wall while avoiding the same fate. The focus of the game lies on the multiplayer mode, but it provides...

Python for Security Professionals: Free IT Security Training

Python is an excellent programming language that has rapidly become popular among Hackers, Reverse engineers, software testers, Forensic analyst and Penetration testers. Python is a simple object-oriented and minimalistic language that is easy to learn for novice programmers as well as experience...

Web Security Dojo - Training Environment for Web Application Security Penetration Testing

A free open-source self-contained training environment for Web Application Security penetration testing. Tools + Targets = Dojo What? Various web application security testing tools and vulnerable web applications were added to a clean install of Ubuntu v10.04.2, which is patched with the...

U.S. and Japan to Cooperate on Cybersecurity, Information Sharing

The United States and Japan have agreed to cooperate more closely on cybersecurity and information sharing initiatives as a way to help both countries defend against future threats and attacks. The new initiative will include a variety of components, most notably cooperation during serious...

PCI Compliance Simplified: Get Trained and Avoid Security Breaches

Target’s data breach is a chilling example: After the widely publicized hack, 12% of loyal shoppers no longer shop at that retailer, and 36% shop at the retailer less frequently. For those who continue to shop, 79% are more likely to use cash instead of credit cards. According to DeMeo, Vice...

eFront 3.6.15 - Multiple Vulnerabilities

Exploit for php platform in category web applications eFront 3.6.15 Multiple SQL Injection Vulnerabilities + Author: Filippo Roncari | Luca De Fulgentis + Target: eFront + Version: 3.6.15 and probably lower + Vendor: www.efrontlearning.net + Accessibility: Remote + Severity: High + CVE: + Full...

Why You Should Enroll In Cyber Security Awareness Training

When it comes to cyber security, even big organizations lack the basic knowledge of how to protect company’s data from the outside. Everyday businesses are facing the threat of phishing, ransomware, data breaches and malware attacks that not only results in millions of dollars losses, but also...

Government Report Critical of FAA Security Controls

The Federal Aviation Administration has been put on notice that its information security controls are not up to par and that a risk-based program must be implemented from the ground up in order to assure the safety of its networks and passengers in the sky. A scathing Government Accounting Office...

Schneider Electric OFS Buffer Overflow Vulnerability

OVERVIEW Schneider Electric has reported to NCCIC/ICS-CERT a Stack Buffer Overflow vulnerability supplied with the Schneider Electric OPC Factory Server OSF. Independent researcher known as 0x7A240E67 submitted the vulnerability to ZDI, who provided coordination with the vendor and ICS-CERT...

骑士CMS某新功能SQL注入

简要描述： 骑士CMS某新功能SQL注入 详细说明： http://demo.74cms.com/ 培训中心SQL注入。所以先注册一个培训中心的账号，然后去发不新课程， 课程名用：cname'/, 其他的随便填写。 然后使用用户的身份登录其申请课程： 随便填写： 提交即返回错误： 我们把其他说明改为： /,3,1, 200, concatuser,0x0a,version , 1, 1413525884 然后提交即成功。 这个时候用培训中心的账号，查看课程申请：...

SAP Afaria 7 XcListener - Missing authorization check

Application: SAP Afaria 7.0.6001.5 Vendor URL: http://www.sap.com Bugs: Missing authorization check Reported: 09.12.2014 Vendor response: 10.12.2014 Date of Public Advisory: 15.03.2015 Reference: SAP Security Note 2134905 Authors: Vahagn Vardanyan ERPScan Vulnerability information Class: DoS...

Audacity <= 1.2 (.gro File) Universal BOF Exploit (egg hunter)

No description provided by source. !/usr/bin/env python Audacity = 1.2 .gro universal buffer overflow exploit Author: mrme Download: http://audacity.sourceforge.net/download/ Tested on Wind0ws XP sp3 & Vist@ Greetz fly to Muts and the offensive-security team also to my wonderful partner Vanessa F...