2215 matches found
Z-BLOG Blind-XXE Arbitrary File Read Vulnerability
Z-Blog is developed by RainbowSoft Studio a Blog program based on the Asp platform . Z-Blog has an arbitrary file read vulnerability. /zbsystem/xml-rpc/index.php directly call simpleloadstring parsing XML, resulting in XML entity injection, an attacker can read system files using the vulnerabilit...
Z-blog at the front Desk without signing in contains a vulnerability a gold-bug warning-the black bar safety net
http://www.zblogcn.com/zblogphp/ download The problem occurs in zbinstall/index. php I also notice a bit after the installation is complete is to write what's prompt The results of the installation Create the database! zblog Connect to the database and create a data table! Create and insert data...
Z-BLOG Blind-XXE result in arbitrary file read vulnerability warning-the black bar safety net
Download the latest version of Z-Blog: http://bbs.zblogcn.com/thread-88670-1-1.html /zbsystem/xml-rpc/index.php 6 4 1 row: $zbp-Load; AddFilterPlugin'FilterPluginZbpShowError','RespondError'; $xmlstring = filegetcontents 'php://input' ; //Logs$xmlstring; $xml = simplexmlloadstring$xmlstring; The...
Home Automation Protocol Z-Way Vulnerable to Remote Attacks
A researcher is warning users of the extensible Z-Way controller project that a weakness built into the software could inherently expose it to attacks. Z-Way is the controller and abstraction layer of software that handles Z-Wave, a standard for wireless communication between devices in smart...
Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the accessibility of protected information
The multiple vulnerabilities in the kernel-headers-2.4-s390 operating system package of Debian GNU/Linux may lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...
RHEL 5 : kernel (RHSA-2015:0783)
The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0783 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. It was found that the Linux kernel's Infiniband...
phpdisk Z-core网赚版子程序过滤不严，导致可删除文件.
简要描述： phpdisk Z-core网赚版下载子程序sub过滤不严，导致可删除任意文件. 详细说明： 我们先来看子程序中phpdiskdelprocess.php这个文件相关代码。 parsestrpdencode$str,'DECODE'; 这里直接把传进来的值，解析到变量中了。但是被加密了，看似不可利用，其实不然。我们再来看dl.php。这个是最后下载页。 parsestrpdencodebase64decoderawurldecode$str,'DECODE';...
CentOS 6 : busybox (CESA-2013:1732)
Updated busybox packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Z-Vote 1.1 - SQL Injection
The z-vote WordPress plugin was affected by a SQL Injection security vulnerability...
Live For Speed 2 Version Z .Mpr - Local buffer Overflow Exploit
No description provided by source. / Live For Speed 2 Version Z .Mpr Local buffer Overflow Exploit !! X version .mpr header specifications can be found at http://www.lfs.net/?page=MPR Version :Patch Z and all previous versions. Vendor :http://www.lfs.net/ Release date: July 14th 2009 Patch for th...
deV!L`z Clanportal Gamebase Addon SQL Injection Vulnerability
No description provided by source...
Z-Vote 1.1 Wordpress Plugin SQL Injection Vulnerability
No description provided by source. Source: http://packetstormsecurity.org/files/view/98671/zvote-sql.txt Vulnerability ID: HTB22839 Reference: http://www.htbridge.ch/advisory/sqlinjectioninzvotewordpressplugin.html Product: Z-Vote wordpress plugin Vendor: 140hours...
IBM Lotus Domino iCalendar Email Address Stack Buffer Overflow Vulnerability
漏洞起因 栈溢出导致的远程代码执行 影响系统 Lotus Domino Server Versions 8.0 and 8.5 on AIX, AIX 64bit, Linux, Linux iSeries, Linux, zSeries, Solaris, Windows, Windows 64bit, z/OS 危害 远程攻击者可以利用漏洞在服务器上执行任意代码。 攻击所需条件 攻击者构造包含特殊参数的邮件。 漏洞信息 未经身份验证的远程代码执行漏洞是由于代码在识别处理和转换 iCalendar...
WordPress A to Z Category Listing plugin <= 1.3 - SQL Injection Vulnerability
No description provided by source. Exploit Title: WordPress A to Z Category Listing plugin = 1.3 SQL Injection Vulnerability Date: 2011-09-09 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/a-to-z-category-listing.zip Version: 1....
Ollydbg <= 1.10 Format String Bug
No description provided by source. // Exploit opens a new cmd.exe.Tested on win2ken+sp4en+ollydbg v1.09d // Open exploit with ollydebug and run the exploit from ollydebugF9 key. // Coded by Ahmet Cihana.k.a. hurby // Thanx to r3db4r0n, Murat Erdo??ana.k.a. Stormwr, Onur Cihana.k.a.eurnie and...
CVE-2014-3042
IBM CICS Transaction Server 3.1, 3.2, 4.1, 4.2, and 5.1 on z/OS does not properly implement CEMT transactions, which allows remote authenticated users to cause a denial of service storage overlay by using a 3270 emulator to send an invalid 3270 data stream...
WordPress Simple Popup Images Plugin - XSS
Because of this vulnerability in popup.php, the attackers can inject arbitrary web script or HTML via the "z" parameter. Solution Update the plugin...
CVE-2011-4192
kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwioemtitle of .profile."...
CVE-2011-3180
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown...
