309 matches found
YXCMS1.2.6版本1处任意文件删除+6处越权操作
简要描述： YXCMS1.2.6版本1处任意文件删除+6处越权操作 详细说明： 经过简单的审计发现YXcms一处任意文件删除漏洞（不是wooyun上已经提交过的）和多处越权操作（只举出一例作为证明） 1. 任意文件删除漏洞 出这个漏洞的代码位于/protected/apps/member/controller/newsController.php的 delcover函数中： public function delcover //文件保存目录 $id=in$POST'id'; $pic=in$POST'pic'; $data'picture'= $this-nopic;...
RHEL 5 : MRG (RHSA-2014:0261)
This is the one-month notification for the retirement of Red Hat Enterprise MRG Version 1 for Red Hat Enterprise Linux 5. This notification applies only to those customers with subscriptions for Red Hat Enterprise MRG Version 1 for Red Hat Enterprise Linux 5. In accordance with the Red Hat...
Iamma Simple Gallery 1.0/2.0 - Arbitrary File Upload Vulnerability
No description provided by source. Found by: X0r Iamma Simple Gallery Arbitrary File Upload Version: 1,2 ? Email: evolutionteam.x0atgmaildotcom Script Download:http://www.matteoiammarrone.com/public/modules.php?name=Downloads&dop=getit&lid=4 Script Download...
Blog System 1.x (note) SQL Injection Vuln
No description provided by source. Script : Blog System Version : 1.x Link : http://netartmedia.net/blogsystem/ Dork : powered by Blog System Table : websiteadminadminusers Columns : id,username,password,type Exploit :...
Active Server Corner ASP Calendar 1.0 Administrative Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11931/info ASP Calendar is reported prone to an unauthorized administrative access vulnerability. An unauthorized remote attacker can access an administrative script and potentially gain administrative access to the...
Unique Ads Banner.PHP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/22164/info Unique Ads is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to...
Winamp 5.572 - whatsnew.txt SEH (meta)
No description provided by source. Title: Winamp 5.572 whatsnew.txt SEH MSF Author: Blake Published: 2010-04-15 Tested on Windows XP SP3 This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for...
Netbutikker <= 4 - Remote SQL Injection Vulnerabilities
No description provided by source. Viva Islam rEm0te SQL Injection Vulnerability netbutik V1 index.php id Script Name : Netbutik Download : www.simpelside.dk Version : version 1 , 2 , 3 ,4 AuTh0r : Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM Email : [email protected] Note This script have 4 version on demo and...
isiAJAX 1 - (praises.php id) Remote SQL Injection Vulnerability
No description provided by source. :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP YmmMMMM MMM YM Discovered by dun \ dunatstrcpy.pl isiAJAX v1 SQL Injection Vulnerability Script: isiAJAX v1 Script site: http://isiajax.sourceforge.net...
PHP-Nuke addon Nuke Mobile Entartainment 1.0 - LFI Vulnerability
No description provided by source. Nuke Mobile Entartainment = modulename Local File Include Vuln Script : Nuke Mobile Entartainment Version : 1 Download : http://www.suonerie-polifoniche-gratis.net/mobilentertainment.zip BorN To K!LL AsbMay's Group ... Vuln. Code : include...
CVE-2014-0222
Integer overflow in the qcowopen function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service crash via a large L2 table in a QCOW version 1 image...
(RHSA-2014:0350) Low: Red Hat Enterprise MRG for Red Hat Enterprise Linux 5 Retirement Notice
In accordance with the Red Hat Enterprise MRG Life Cycle policy, the Red Hat Enterprise MRG product, which includes MRG-Messaging, MRG-Realtime, and MRG-Grid, Version 1 offering for Red Hat Enterprise Linux 5 was retired as of March 31, 2014, and support is no longer provided. Accordingly, Red Ha...
RedHat Update for gnutls RHSA-2014:0247-01
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GnuTLS certificates validation vulnerability
Invalid validation of version 1 ceritficates...
DSA-2866-1 gnutls26 - certificate verification flaw
Bulletin has no description...
Debian Security Advisory DSA 2852-1 (libgadu - heap-based buffer overflow)
Yves Younan and Ryan Pentney discovered that libgadu, a library for accessing the Gadu-Gadu instant messaging service, contained an integer overflow leading to a buffer overflow. Attackers which impersonate the server could crash clients and potentially execute arbitrary code. OpenVAS Vulnerabili...
DSA-2806-1 nbd - privilege escalation
Bulletin has no description...
Integrated CMS - SQL Injection Vulnerability
Exploit for php platform in category web applications ========================================================================================================== /Exploit Title : Integrated CMS Saudi SQL Injection \ /Exploit Author : DSST \ /Vendor Home Page : in2sol.com \ /Tested on: Windows...
Threat Outbreak Alert: Fake Account Money Transfer Notification Email Messages on July 19, 2013
Severity Alert ID: 30147 First Published: 2013 July 22 16:11 GMT Version: 1 Threat Outbreak Threat Outbreak Summary Cisco Security has detected significant activity on July 19, 2013. Revision History Initial ReleaseShow Less Legal Disclaimer THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES...