C4B XPhone UC Web 4.1.890S R1 XSS Vulnerability

No description provided by source...

Discuz UC_Server 本地文件包含漏洞（有条件限制）

简要描述： 怀着忐忑的心情提交了这个漏洞，依旧相信wooyun是一个良好的平台 赌上了作为一个白帽子的节操，不要在让他碎一地 详细说明： 条件一： 需要UC管理员权限。 条件二： 前台可上传带有PHP代码的可控文件。 漏洞函数onping在文件ucserver\control\admin\app.php function onping $ip = getgpc'ip'; $url = getgpc'url'; $appid = intvalgetgpc'appid'; $app = $ENV'app'-getappbyappid$appid; $status = '';...

PHPEMS (在线考试系统) 设计缺陷 Getshell一枚(官网已shell)

简要描述： 号称是最好用的开源php考试系统? 果断来看看。 已拿下官网。 详细说明： PHPEMS整合了uc。 在api/config.inc.php中 define'UCCONNECT', 'mysql'; define'UCDBHOST', 'localhost'; define'UCDBUSER', 'root'; define'UCDBPW', 'root'; define'UCDBNAME', 'ucenter16'; define'UCDBCHARSET', 'utf8'; define'UCDBTABLEPRE', 'ucenter16.uc';...

OpenSSL null pointer dereference do_ssl3_write-vulnerability warning-the black bar safety net

Our UC – KEEL tool found dossl3write a null pointer dereference error in ssl/s3pkt. c for the reminder to hang SSLMODERELEASEBUFFERS flag. This bug affect the latest 1. 0. 1 branch. dossl3write in the code to detect whether the buffer is NULL 6 4 4 if wb-buf == NULL6 4 5 if ! ssl3setupwritebuffer...

kingcms the latest version sql injection vulnerability-vulnerability warning-the black bar safety net

Brief description: kingcms injection vulnerability Detailed description: api/uc.php UCKEY not initialized cause injection ? php define'UCCLIENTVERSION', '1.5.0'; //note UCenter version identifier define'UCCLIENTRELEASE', '2 0 0 9 0 5 0 2'; define'APIDELETEUSER', 1; //note the user to delete the A...

[Bluebox-ng] UC/VoIP Security Tool

Bluebox-ng is a next generation UC/VoIP security tool. It has been written in CoffeeScript using Node.js powers. This project is "our 2 cents" to help to improve information security practices in VoIP/UC environments. GitHub repo : https://github.com/jesusprubio/bluebox-ng IRCFreenode :...

CVE-2012-4970

Cross-site scripting XSS vulnerability in the web management interface on Polycom HDX Video End Points with UC APL software before 2.7.1.1J, and commercial software before 3.0.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4970

Cross-site scripting XSS vulnerability in the web management interface on Polycom HDX Video End Points with UC APL software before 2.7.1.1J, and commercial software before 3.0.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PHPDrive privilege elevation vulnerability and the Fix-vulnerability warning-the black bar safety net

PHPDrive is set to run in the PHP environment file management system, can be applied to a network disk, enterprise document management, schools, team management, software, file, CMS, etc. includes/user.lib.php Row 8 7 function getip ifisset$SERVER"HTTPXFORWARDEDFOR"&&$SERVER"HTTPXFORWARDEDFOR" $i...

CVE-2012-1655

Unspecified vulnerability in the UC PayDutchGroup / WeDeal payment module 6.x-1.0 for Drupal allows remote authenticated users to obtain account credentials via unknown attack vectors...

CVE-2012-1655

CVE-2012-1655 affects the UC PayDutchGroup / WeDeal payment module (Drupal 6.x-1.0). The Drupal SA confirms information leakage: a malicious user who has an account and can checkout can login to the PayDutchGroup site as the store owner and obtain/manage the store owner’s credentials via scenario...

CVE-2012-1655

Unspecified vulnerability in the UC PayDutchGroup / WeDeal payment module 6.x-1.0 for Drupal allows remote authenticated users to obtain account credentials via unknown attack vectors...

CVE-2012-3060

CVE-2012-3060 affects Cisco Unity Connection (UC) versions 8.6, 9.0, and 9.5. The vulnerability allows remote attackers to cause a denial of service by sending malformed UDP packets, leading to CPU consumption. The underlying cause is malformed UDP handling in UC that triggers high CPU usage. Pub...

CVE-2012-3096

Cisco Unity Connection (UC) versions 7.1, 8.0, and 8.5 are affected by CVE-2012-3096. The advisory states that remote authenticated users can trigger a denial of service (resource consumption and administration outage) through extended use of the product, identified as Bug ID CSCtd79132. The avai...

CVE-2012-4259

Cross-site scripting XSS vulnerability in the contacts in 1 XPhone UC Web and the 2 web frontend for XPhone Virtual Directory in C4B XPhone Unified Communications UC 2011 Web 4.1.890S R1 allows remote attackers to inject arbitrary web script or HTML via the company name. NOTE: some of these detai...

Cross site scripting

Cross-site scripting XSS vulnerability in the contacts in 1 XPhone UC Web and the 2 web frontend for XPhone Virtual Directory in C4B XPhone Unified Communications UC 2011 Web 4.1.890S R1 allows remote attackers to inject arbitrary web script or HTML via the company name. NOTE: some of these detai...

CVE-2012-4259

CVE-2012-4259 affects C4B XPhone Unified Communications UC, specifically the XPhone UC Web/ web frontend for XPhone Virtual Directory (2011 Web 4.1.890S R1). The vulnerability is a cross-site scripting (XSS) issue allowing remote attackers to inject arbitrary script via the company name in the Co...

CVE-2012-4259

Cross-site scripting XSS vulnerability in the contacts in 1 XPhone UC Web and the 2 web frontend for XPhone Virtual Directory in C4B XPhone Unified Communications UC 2011 Web 4.1.890S R1 allows remote attackers to inject arbitrary web script or HTML via the company name. NOTE: some of these detai...

C4B XPhone UC Web 4.1.890S R1 - Cross Site Vulnerability

Title: ====== C4B XPhone UC Web 4.1.890S R1 - Cross Site Vulnerability Date: ===== 2012-04-24 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=484 VL-ID: ===== 484 Introduction: ============= XPhone Unified Communications 2011 ist die leistungsstarkste Telefonie- und...

C4B XPhone UC Web 4.1.890S R1 - Cross Site Vulnerability

Title: ====== C4B XPhone UC Web 4.1.890S R1 - Cross Site Vulnerability Date: ===== 2012-04-24 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=484 VL-ID: ===== 484 Introduction: ============= XPhone Unified Communications 2011 ist die leistungsstarkste Telefonie- und...