CVE-2015-2978

The CVE-2015-2978 case describes Webservice-DIC yoyaku_v41 as vulnerable to an authentication bypass (CWE-592), enabling remote attackers to bypass login and complete a conference-room reservation (described as an “unintentional reservation”). Affected product: yoyaku_v41. Root cause: inadequate ...

CVE-2015-2978

Webservice-DIC yoyakuv41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."...

CVE-2015-2977

Webservice-DIC yoyaku_v41 (conference room reservation software) is affected by CVE-2015-2977. The vulnerability stems from insufficient input validation (CWE-20), enabling remote attackers to create arbitrary files, which may lead to arbitrary code execution on the server. Public sources in the ...

CVE-2015-2979

CVE-2015-2979 affects Webservice-DIC yoyaku_v41 (conference room reservation software). Concrete details from connected sources show an OS command injection (CWE-78) vulnerability that allows remote execution of arbitrary OS commands on the web server. Root cause described as improper input handl...

yoyaku_v41 vulnerable to authentication bypass

Overview yoyakuv41 provided by Webservice-DIC is a software to manage conference room reservations. yoyakuv41 contains an authentication bypass vulnerability CWE-592. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

JVN#17522792: yoyaku_v41 vulnerable to OS command injection

yoyakuv41 provided by Webservice-DIC is a software to manage conference room reservations. yoyakuv41 contains an OS command injection vulnerability CWE-78. Impact An arbitrary OS command may be executed with the privileges of the web server on the server where yoyakuv41 is running. Solution Do no...

JVN#52248864: yoyaku_v41 vulnerable to authentication bypass

yoyakuv41 provided by Webservice-DIC is a software to manage conference room reservations. yoyakuv41 contains an authentication bypass vulnerability CWE-592. Impact A remote attacker could bypass yoyakuv41's authentication, and make an unintentional reservation. Solution Do not use yoyakuv41...

orienteering.ca XSS vulnerability

Vulnerable URL:...

appointment.com XSS vulnerability

Vulnerable URL:...

用友多个系统通用漏洞导致接口信息泄露引发多数据库信息泄露（涉及多个大型厂商）

简要描述： 详细说明： 通过webservice接口泄露,涉及多个系统 一、NC系统 http://123.232.105.202/ http://erp.suning.com.cn/ http://115.238.57.245/ 以苏宁为例。 接口地址:http://erp.suning.com.cn/uapws/service 会发现很多接口,以数据库内网链接泄露为例太多接口了,不一一测试了 得到数据库内网链接为:http://erp.suning.com.cn/uapws/service/nc.itf.ses.inittool.PortalSESInitToolService?ws...

大汉政府信息公开多处SQL注入二(附100个案例)

简要描述： 大汉政府信息公开多处SQL注入二附100个案例 详细说明： 依然webservice漏洞 /xxgk/services/WSYsqgk?wsdl 该WSYsqgk服务的多个方法，多个参数存在严重漏洞，且该漏洞普遍存在，如 wsTest getClientIpAxis wsGetYsqgk 上述方法的多个参数均存在漏洞，这里随便选取一个方法进行测试 首先保存如下内容为wooyun.txt POST /xxgk/services/WSYsqgk?wsdl HTTP/1.1 Accept-Encoding: gzip,deflate Content-Type:...

大汉政府信息公开多处SQL注入(附100个案例)

简要描述： 大汉政府信息公开多处SQL注入附100个案例 详细说明： 同样webservice漏洞，漏洞存在于 /xxgk/services/WSSmsSync?wsdl WSSmsSync服务的多个方法，多个参数存在严重漏洞，且该漏洞普遍存在，如 isBase64 wsSyncGetInfos wsSyncGetInfos setStrAppId setBase64 上述方法的多个参数均存在漏洞，这里随便选取一个方法（wsSyncGetInfos）进行测试 用WSockExpert v0.7抓包，并保存为wooyun.txt POST...

大汉政府信息公开多处SQL注入(附100个案例)

简要描述： 大汉政府信息公开多处SQL注入附100个案例 详细说明： 不同系统，不同文件，真的重复了么? 漏洞证明： webservice漏洞，漏洞存在于 /xxgk/services/WSSynchronize?wsdl WSSynchronize服务的多个方法，多个参数存在严重漏洞，且该漏洞普遍存在，如 wsGetWeb wsGetColumnStyle wsSynchronize wsSynchronizeWithPath 上述方法的多个参数均存在漏洞，这里随便选取一个方法（wsSynchronize）进行测试 用WSockExpert v0.7抓包，并保存为wooyun.txt...

大汉政府信息公开多处SQL注入一(附100个案例)

简要描述： 大汉政府信息公开多处SQL注入一附100个案例 详细说明： 依然是webservice漏洞，漏洞存在于 /xxgk/services/WSSyncxxgk?wsdl 该WSSyncxxgk服务的多个方法，多个参数存在严重漏洞，且该漏洞普遍存在。 wsGetWeb getClientIpAxis wsGetColumn wsGetColumnStyle wsSynchronize wsSynchronizeWithPath wsSync 上述方法的多个参数均存在漏洞，随便选取一个方法进行测试 /xxgk/services/WSSyncxxgk?wsdl wsGetColumn方...

Debian DSA-3124-1 : otrs2 - security update

Thorsten Eckel of Znuny GMBH and Remo Staeuble of InfoGuard discovered a privilege escalation vulnerability in otrs2, the Open Ticket Request System. An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is...

Debian Security Advisory DSA 3120-1 (mantis - security update)

Multiple security issues have been found in the Mantis bug tracking system, which may result in phishing, information disclosure, CAPTCHA bypass, SQL injection, cross-site scripting or the execution of arbitrary PHP code. OpenVAS Vulnerability Test $Id: deb3120.nasl 6609 2017-07-07 12:05:59Z...

大汉jcms多处SQL注入二(附80个案例)

简要描述： 一类很明显，但目前不容易发现的漏洞 详细说明： webservice 漏洞，目前非常多的系统均有该service 恰巧的是，该service的漏洞，是不被人注意的，因而 教容易产生漏洞 /jcms/services/WSReceive?wsdl 下图的多个方法，方法中的多个参数均存在注入 随便选取一个方法进行测试 /jcms/services/WSReceive?wsdl wsGetColumn方法 用WSockExpert v0.7抓包，并保存为wooyun.txt POST /jcms/services/WSReceive?wsdl HTTP/1.1...

otrs -- Incomplete Access Control

The OTRS project reports: An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is configured and not additionally secured...

CVE-2014-7835

webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting XSS attacks, by specifying the...

CVE-2014-7835

webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting XSS attacks, by specifying the...