Asbru Web Content Management System 9.2.7 - Multiple Vulnerabilities

Asbru Web Content Management System 9.2.7 - Multiple Vulnerabilities Asbru Web Content Management System v9.2.7 Multiple Vulnerabilities Vendor: Asbru Ltd. Product web page: http://www.asbrusoft.com Affected version: 9.2.7 Summary: Ready to use, full-featured, database-driven web content...

Asbru Web Content Management System 9.2.7 - Multiple Vulnerabilities

Asbru Web Content Management System v9.2.7 Multiple Vulnerabilities Vendor: Asbru Ltd. Product web page: http://www.asbrusoft.com Affected version: 9.2.7 Summary: Ready to use, full-featured, database-driven web content management system CMS with integrated community, databases, e-commerce and...

Asbru Web Content Management System v9.2.7 Multiple Vulnerabilities

Summary Ready to use, full-featured, database-driven web content management system CMS with integrated community, databases, e-commerce and statistics modules for creating, publishing and managing rich and user-friendly Internet, Extranet and Intranet websites. Description Asbru WCM suffers from...

TRS WCM parseXMLFile()函数 XXE漏洞

No description provided by source...

TRS WCM common/pre.as 参数_url文件包含漏洞

No description provided by source...

TRS WCM越权直接创建任意用户（无需审核）

简要描述： 任意创建用户，无需审核，直接登录。 详细说明： 1、首先我们确定一个不存在或者密码错误的用户名： 2、通过webservice调用创建用户的方法，创建一个用户： =============================== 在乌云找了找， WooYun: TRS系统任意文件下载漏洞 中只发现一个存在该方法的案例 http://wcm.xxz.gov.cn:8080/wcm/ 湘西州政府站群 漏洞证明： 成功登录新创建的用户：...

TRS系统任意文件下载漏洞

简要描述： 详细说明： 此系统多为大型政府新闻发布站点（新闻源），如一旦被某些（博彩集团）控制，估计后果危害不是一般大。。。 http://123.131.133.150:8080/wcm/ 临沂日报报业集团 http://61.153.63.94/wcm 云和县政府所有发布站点 http://www.cflac.org.cn/wcm 中国文联 http://wcm.xxz.gov.cn:8080/wcm/ 湘西州政府站群 http://www.jscnt.gov.cn/wcm/ 江苏省文化厅 http://www.sccnt.gov.cn 四川省文化厅...

TRS认证漏洞可登陆后台操作任意站群

简要描述： 详细说明： TRS WCM 后台绕过控制站群系统 通过该漏洞，可直接登录后台操作任意站群。。。 此系统多为大型政府新闻发布站点（新闻源），如一旦被某些（博彩集团）控制，估计后果危害不是一般大。。。 http://123.131.133.150:8080/wcm/ 临沂日报报业集团 http://61.153.63.94/wcm 云和县政府所有发布站点 http://www.cflac.org.cn/wcm 中国文联 http://wcm.xxz.gov.cn:8080/wcm/ 湘西州政府站群 http://www.jscnt.gov.cn/wcm/ 江苏省文化厅...

TRS WCM后台SQL注入一枚

简要描述： 详细说明： 测试版本：WCM6.5，问题出在后台“新建栏目分发” 直接看图： select WCMDocument.DocId from WCMCHNLDOC,WCMDocument where WCMDocument.DocId=WCMChnlDoc.DocId and WCMChnlDoc.CHNLID=? AND 注入点 AND WCMChnlDoc.DOCSTATUS0 and WCMChnlDoc.Modal0 and WCMChnlDoc.DocChannel0 order by WCMChnlDoc.DOCORDERPRI desc,...

CentOS Update for kernel CESA-2014:0328 centos6

Check for the Version of kernel OpenVAS Vulnerability Test CentOS Update for kernel CESA-2014:0328 centos6 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under th...

RedHat Update for kernel RHSA-2014:0328-01

Check for the Version of kernel OpenVAS Vulnerability Test RedHat Update for kernel RHSA-2014:0328-01 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Cross site scripting

Cross-site scripting XSS vulnerability in the WCM Web Content Manager UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF11 allows remote attackers to inject arbitrary web script or HTML via unspecified...

CVE-2014-0828

Cross-site scripting XSS vulnerability in the WCM Web Content Manager UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF11 allows remote attackers to inject arbitrary web script or HTML via unspecified...

IBM WebSphere Portal跨站脚本漏洞

CVE ID:CVE-2014-0901 IBM WebSphere Portal提供了一个组合应用程序或业务mashup框架，并且提供了一种高级工具来构造灵活的，基于SOA的解决方案。 由于某些关于WCM UI的输入在返回用户前没有正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 IBM WebSphere Portal 6.x IBM WebSphere Portal 7.x IBM WebSphere Portal 8.x IBM WebSphere Portal 8.0.0.1 CF11版本以修复此漏洞，建议用户下载使用：...

IBM WebSphere Portal Improper Access Control Checks (PI07185)

The version of IBM WebSphere Portal on the remote host is affected by a remote information disclosure vulnerability in the WCM Path Traversal component. An attacker can bypass access control checks and search for items of which the user should not have access. %NASLMINLEVEL 70300 C Tenable Networ...

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2014:0328 Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scorin...

IBM WebSphere Portal 'wcm.path.traversal.security'安全绕过漏洞

Bugtraq ID:65955 CVE ID:CVE-2013-6730 IBM WebSphere Portal提供了一个组合应用程序或业务mashup框架，并且提供了一种高级工具来构造灵活的，基于SOA的解决方案。 当启用了Web Content Manager WCM路径遍历"wcm.path.traversal.security"设置时应用程序不正确限制对搜索结果的访问，允许攻击者利用漏洞绕过限制获取受限内容信息。 0 IBM WebSphere Portal 6.x IBM WebSphere Portal 6.x IBM WebSphere Portal 7.x IBM...

CVE-2013-6735

IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository JCR information via a modified Web...

CVE-2013-6316

IBM WebSphere Portal 7.0.0.x before 7.0.0.2 CF26 and 8.0.0.x before 8.0.0.1 CF09 does not properly handle content-selection changes during Taxonomy component rendering, which allows remote attackers to obtain sensitive property information in opportunistic circumstances by leveraging an error in ...

CVE-2013-6723

IBM WebSphere Portal 8.0.0.1 before CF09 does not properly handle references in compute="always" Web Content Manager WCM navigator components, which allows remote attackers to obtain sensitive component information via unspecified vectors...