api.weibo.com XSS vulnerability

Vulnerable URL: https://api.weibo.com/oauth2/authorize?clientid=2077566580uri=http://www.medcn.cn/jiankangjsp/weibocallback.jsptype=code=&f3u;auth=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 12.12.2016 Latest check for patch:| 12.12.2016 05:...

ThinkSNS V2.8 apps\wap\Lib\Action\IndexAction.class.php 任意文件上传漏洞

漏洞信息： ThinkSNS开源微博系统,是智士的开源社交平台。采用PHP+MySQL技术平台,微博+应用的产品模式,同时拥有iphone、android客户端、wap、3G版界面。 ThinkSNS V2.8 存在任意文件上传漏洞，可以导致上传shell,并导致服务区沦陷。 漏洞分析： 微博上传图片时只在前端进行验证, 服务器端没有进行安全过滤。 问题在apps\wap\Lib\Action\IndexAction.class.php中263行： if!empty$FILES'pic''name' // 自动发一条图片微博 $data'pic' = $FILES'pic';...

CVE-2014-6805

The weibo aka magic.weibo application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The weibo aka magic.weibo application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6805

The weibo aka magic.weibo application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6805

The CVE-2014-6805 entry concerns the Android Weibo (magic.weibo) app version 1.2, which does not verify X.509 certificates when establishing SSL connections. This behavior allows man-in-the-middle attackers to spoof HTTPS servers and obtain sensitive information via a crafted certificate. Per ava...

Using QQ panel login authentication is not strictly+Arp sniffing to login within the network of the other QQ space,Weibo, etc free password-vulnerability warning-the black bar safety net

This can be said that there is no technical content,just saying an idea,first simple demo. 1. Open burp set up the browser proxy and then under the QQ panel, QQ space fast landing you can see the burp intercept,is the intercept of this segment of the RUL ! 2. Put this URL copy the following down ...

OAuth authentication memory vulnerability caution a user identity hijacking-vulnerability warning-the black bar safety net

With OpenSSL, like OAuthOpen Authorizationas a widely used open-source third-party login authentication Protocol, this year also broke a security vulnerability. In the third session of the know the security Forum, from Sina Weibo of the blue di snowball shows Sina as early as year 3 months...

Sina Weibo Usage Detection

Binary data 8170.prm...

ThinkSNS某功能平行权限4

简要描述： 看到厂商迟迟不确认，所以再来一发，难不成厂商已经放假了？如果是开年求收留！ 详细说明： 问题发生在 wap模块 apps/wap/Lib/Action/IndexAction.class.php 和 apps/w3g/Lib/Action/IndexAction.class.php 行665 public function doDelete $weiboid = intval$GET'weiboid'; if $weiboid urlencode$GET'key','page'=$GET'page'; $data'id' = $weiboid; $detail =...

easytalkCSRF可蠕虫发微博

简要描述： easytalk是一个，优秀的开源微博CMS 详细说明： easytalkCSRF可蠕虫发微博 可用于各个方面，例如广告传销，一发不可收拾 漏洞证明： 抓包得： POST /?m=space&a=sendmsg HTTP/1.1 Host: t.nextsns.com Connection: Keep-Alive Content-Length: 51 Accept: / User-Agent: Mozilla/4.0 compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727...

Tencent Weibo CSRF brush fan of vulnerability-3-vulnerability warning-the black bar safety net

Cloud Wang says Tencent is the GDP from manufacturing. Detailed description: Was accidentally found, well, LOOK! 1）registered a clean account, visit the following POC example; the the the document. se55i0n. submit; 2 See run the POC effect; ! 3 refresh Twitter success your own clouds official...

Thinksns最新版微博存储型xss

简要描述： 详细说明： 首页视频处未过滤，在视频链接后加入代码即可执行 漏洞证明： POC: 在视频链接中填入 http://v.youku.com/vshow/idXNTM2OTY3NjQw.html"alert/xss/ 至于能做什么，xsser.me之类，大家都懂的。...

ThinkSNS V3任意删除评论 微博 转发漏洞

简要描述： 今天注册的v3测试下功能 发现v3问题很多 主要是在没有验证权限，只是单纯的在js上进行验证，下面是测试截图。 详细说明： 删除前： 删除中 修改uid和微博id 删除后： 漏洞证明：...

Study Finds China Censorship Of Social Media Is Real, Pervasive

A study by researchers at Carnegie Mellon University has concluded that Chinese social media sites are deleting messages with content that might be construed as controversial by the Communist Party – the first conclusive evidence that state censorship extends to social media sites like Sina Weibo...

CVE-2012-1389

Unspecified vulnerability in the Di Long Weibo com.icekirin.weibos application 1.9.9 for Android has unknown impact and attack vectors...

Design/Logic Flaw

Unspecified vulnerability in the Di Long Weibo com.icekirin.weibos application 1.9.9 for Android has unknown impact and attack vectors...

CVE-2012-1389

Unspecified vulnerability in the Di Long Weibo com.icekirin.weibos application 1.9.9 for Android has unknown impact and attack vectors...

CVE-2012-1389

Technical details about CVE-2012-1389 are not publicly available in the provided documents. Monitor for updates from official sources; no confirmed affected products, impact, vectors, or remediation are disclosed here.

CVE-2012-1389

Unspecified vulnerability in the Di Long Weibo com.icekirin.weibos application 1.9.9 for Android has unknown impact and attack vectors...