68 matches found
CVE-2020-15134 Missing TLS certificate verification in Faye
Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes. Faye uses em-http-request and faye-websocket in the Ruby version of its client. Those libraries both use the EM::Connectionstarttls method in EventMachine to implement the TLS handshake whenever a wss: URL i...
Missing TLS certificate verification
Faye uses em-http-request6 and faye-websocket10 in the Ruby version of its client. Those libraries both use the EM::Connectionstarttls1 method in EventMachine2 to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not implement certificate verification by...
GHSA-3Q49-H8F9-9FR9 Missing TLS certificate verification
Faye uses em-http-request6 and faye-websocket10 in the Ruby version of its client. Those libraries both use the EM::Connectionstarttls1 method in EventMachine2 to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not implement certificate verification by...
Missing TLS certificate verification in faye-websocket
The Faye::WebSocket::Client class uses the EM::Connectionstarttls1 method in EventMachine2 to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not implement certificate verification by default, meaning that it does not check that the server presents a...
Information disclosure
Evoko Home devices 1.31 through 1.37 allow remote attackers to obtain sensitive information such as usernames and password hashes via a WebSocket request, as demonstrated by the sockjs/224/uf1psgff/websocket URI at a wss:// URL...
SQL Injection Vulnerability in WSS Project Management System Version 1.3.2 de***.php
WSS Project Management System is a browser-based collaborative office platform that integrates "Project Management", "Task Management", "Work Hour Management", "Work Log Management" and "Work Log Management". management" as one of the collaborative office platform. A SQL injection vulnerability...
Information Disclosure Vulnerability in WSS Project Management System Version 1.3.2
WSS Project Management System is a browser-based collaborative office platform that integrates "Project Management", "Task Management", "Work Hour Management", "Work Log Management" and "Work Log Management". management" as one of the collaborative office platform. An information disclosure...
CVE-2016-5137
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy CSP implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs,...
chromium-browser: various fixes from internal audits
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy CSP implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easie...
CVE-2016-1617
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy CSP implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easie...
CVE-2016-1617
Removed by vendor...
WSS is the latest version of any user of the password reset（official demo demo-the vulnerability warning-the black bar safety net
WSS latest version of the design flaws lead to arbitrary user password reset, including the administrator 文件 usereditpassword.php code area ? php $editFormAction = $SERVER'PHPSELF'; if isset$SERVER'QUERYSTRING' $editFormAction .= "?" . htmlentities$SERVER'QUERYSTRING'; $password = "-1"; if...
wss项目管理系统XSS
简要描述： wss项目管理系统XSS 详细说明： 漏洞证明：...
WSS最新版某处SQL注入直接获取数据二（两处）
简要描述： WSS最新版某处SQL注入直接获取数据二（两处） 详细说明： WSS最新版1.3.2 文件defaultuser.php ?php $urlproject = $SERVER"QUERYSTRING" ; $currenturl = currentexplode"&sort",$urlproject; $currentPage = $SERVER"PHPSELF"; $maxRowsRecordset1 = getitem 'maxrowsuser' ; $pageNumRecordset1 = 0; if isset$GET'pageNumRecordset1'...
WSS最新版某处SQL注入直接获取数据四
简要描述： WSS最新版多处SQL注入直接获取数据四，访客即可注入拿数据 详细说明： WSS最新正式版1.3.2，某处SQL注入直接获取数据，访客权限即可注入拿数据 首先介绍下WSS的用户角色： 管理员MMrank=5 项目经理MMrank=4 普通用户MMrank=3 访客MMrank=2 只读MMrank=1 在WSS系统里面部分文件和功能判断了MMrank值，即权限问题 也有部分文件和功能没有权限判断和限制，前面的两个漏洞都是没有权限限制的 这里我们要讲的漏洞是MMrank大于等于2的用户就能注入，访客即可 文件logedit.php ?php $restrictGoTo =...
WSS最新版某处SQL注入直接获取数据
简要描述： WSS最新版某处SQL注入直接获取数据 详细说明： WSS最新版1.3.2 在任务执行人修改处存在SQL注入 defaulttaskedituser.php文件： http://localhost/WSS1.3.2cn/wss/defaulttaskedituser.php csatouser=123' union select 1 from select count,concatfloorrand02,select concat0x23,tkuserlogin,0x23,tkuserpass from tkuser limit 0,1a from...
WSS最新版任意用户密码重置（官方demo演示）
简要描述： WSS最新版设计缺陷导致任意用户密码重置，包括管理员，官方demo演示 详细说明： WSS最新版设计缺陷导致任意用户密码重置，包括管理员 文件usereditpassword.php 保存成功 如果UID不正确会返回错误，没权限，但是不影响密码重置 这里测试用户的UID=7 重置之后，admin用户登录： img src="https://images.seebug.org/upload/201411/21230710e7a8dd96f6edc8d36d5b9f2c0b2ad747...
WSS项目管理系统越权修改信息密码
简要描述： 再也不用担心老大给任务了 详细说明： 公司一直用的是wss 1.3.2 无聊中想去看看这个有没有洞 明天要上班，大晚上的也不想去分析代码了，就用黑盒去试了一试 在用户这个地方，每个用户都有一个recordID 用自己公司的wss来做示范，当然是用基友的账号了，老大的可不敢动 先问一下基友的密码是多少 然后去修改自己的资料 抓包，将自己的ID改成基友的ID，他的ID是11，我的是14 改成六个2之后提示修改正确，然后去登陆看看 登陆成功！ 然后我去告诉他之后，唉。 img s...
WSS最新版多处SQL注入直接获取数据三（官方demo演示及快速定位漏洞技巧）
简要描述： WSS最新版多处SQL注入直接获取数据三，官方demo演示，这里存在多处，对同一问题进行总结 详细说明： WSS最新版1.3.2，这里存在多处，并对此同一问题进行总结，以及快速查找同一问题全部漏洞 这里的漏洞没有任何权限限制，任何用户都能进行注入 漏洞分析： WooYun: WSS最新版某处SQL注入直接获取数据二（两处） WSS最新版某处SQL注入直接获取数据二（两处） 这个漏洞之前已经降到了漏洞的过程 因为全局过滤函数设计缺陷导致sql注入 if !functionexists"GetSQLValueString" function...