Z-Blog的php版官方blog存在sql注入（仅仅官方）

简要描述： 操蛋捏 详细说明： 注入地址http://app.rainbowsoft.org/?zba=220 呵呵，好久没法洞了， 漏洞证明：...

Z-Blog旗下DBS主机漏洞可获得客户域名账号密码

简要描述： Z-Blog旗下DBS主机漏洞存在严重的注入漏洞。客户得到所有的域名账号、密码。 详细说明： 1、用的华众的系统，直接看图，查询代码是这样写的。 2、嘎嘎，注册个会员【te】搞定。决定是超另类的注入。登陆后，点击域名管理： 查询语句就变成了 ufatstr like '%,te,%' 漏洞证明：...

CVE-2013-5385

The OSPF implementation in IBM i 6.1 and 7.1, in z/OS on zSeries servers, and in Networking Operating System aka NOS, formerly BLADE Operating System does not properly validate Link State Advertisement LSA type 1 packets before performing operations on the LSA database, which allows remote...

Design/Logic Flaw

The OSPF implementation in IBM i 6.1 and 7.1, in z/OS on zSeries servers, and in Networking Operating System aka NOS, formerly BLADE Operating System does not properly validate Link State Advertisement LSA type 1 packets before performing operations on the LSA database, which allows remote...

CVE-2013-5385

The OSPF implementation in IBM i 6.1 and 7.1, in z/OS on zSeries servers, and in Networking Operating System aka NOS, formerly BLADE Operating System does not properly validate Link State Advertisement LSA type 1 packets before performing operations on the LSA database, which allows remote...

Z-Blog php Edition front regular SQL blind injection vulnerability-vulnerability warning-the black bar safety net

Brief description: The second...also a bit puzzled want to ask your developer Detailed description: The problem /zbsystem/function/csystemcommon.php function GetVars$name,$type='REQUEST' if $type=='ENV' $array=&$ENV; if $type=='GET' $array=&$GET; if $type=='POST' $array=&$POST; if $type=='COOKIE'...

Z-Blog is a PHP version of the three low-permission to admin POST injection-vulnerability warning-the black bar safety net

Brief description: Register a reviewer account will be able to note to the administrator Detailed description: Wood have found you accept the POST variables of the function in which 所以 认为 问题 出 在 /zbsystem/function/lib/dbsql.php public function ParseWhere$where global $zbp; $sqlw=null; if!...

Scientific Linux Security Update : busybox on SL6.x i386/x86_64 (20131121)

It was found that the mdev BusyBox utility could create certain directories within /dev with world-writable permissions. A local unprivileged user could use this flaw to manipulate portions of the /dev directory tree. CVE-2013-1813 This update also fixes the following bugs : - Previously, due to ...

mod_nss security update

1.0.8-19 - Resolves: CVE-2013-4566 - Bugzilla Bug 1030265 - modnss: incorrect handling of NSSVerifyClient in directory context rhel-6.5.z...

Low: Red Hat Security Advisory: busybox security and bug fix update

Updated busybox packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

IBM Tivoli NetView for z/OS Privilege Escalation

The remote host appears to have IBM Tivoli NetView installed that is affected by a privilege escalation vulnerability. A Unix System Services authenticated attacker may be able to gain the privileges of the NetView application. Note that Nessus has not tested for the issues, but instead has relie...

Z-Blog的PHP版前台存储型XSS漏洞一

简要描述： 看到你们内测的消息我就屁颠屁颠地跑过来了，花了两个通宵看代码发现几处漏洞.. 这里先绕过了你们XSS过滤脚本.. 详细说明： 问题出在 /zbsystem/function/csystemcommon.php function TransferHTML$source,$para ifstrpos$para, 'nohtml'!==false $source=pregreplace"//si","",$source; ifstrpos$para, 'noscript'!==false $source=pregreplace"/.?/si","",$source;...

Z-Blog PHP版之三低权限管理员POST注入

简要描述： 注册个评论者账号就能注到管理员 详细说明： 木有找到你们接受POST变量的函数在哪，所以认为问题出在/zbsystem/function/lib/dbsql.php public function ParseWhere$where global $zbp; $sqlw=null; if!empty$where $sqlw .= ' WHERE '; $comma = ''; foreach$where as $k = $w $eq=$w0; if$eq=='='|$eq==''|$eq=='LIKE'|$eq==''|$eq=='!=' $x = string$w1; $y ...

Z-Blog的php版前台正则SQL盲注漏洞

简要描述： 第二发...另外有点疑惑想问下你们的开发 详细说明： 问题出在 /zbsystem/function/csystemcommon.php function GetVars$name,$type='REQUEST' if $type=='ENV' $array=&$ENV; if $type=='GET' $array=&$GET; if $type=='POST' $array=&$POST; if $type=='COOKIE' $array=&$COOKIE; if $type=='REQUEST' $array=&$REQUEST; if $type=='SERVER'...

Privacy Advocates File Complaint Over Jay-Z's 'MCHG' App,

Privacy advocates called out rapper/entrepreneur Jay-Z this week, filing a complaint with the Federal Trade Commission over an app he released earlier this month that many critics feel goes overboard in the amount of the information it requests from users. Citing “deceptive business practices,”...

Oracle Linux 5 / 6 : dbus (ELSA-2011-1132)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1132 advisory. - Merge changes from RHEL-6 branch: Drop default patch fuzz Merge CVE-2010-4352.patch from RHEL-60-Z - Apply patches for CVE-2011-2200 Tenable has extracted...

Oracle Linux 5 : kernel (ELSA-2012-1061-1)

From Red Hat Security Advisory 2012:1061 : Updated kernel packages that fix one security issue and multiple bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVS...

Oracle Linux 5 : Important: / kernel (ELSA-2007-0993)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0993 advisory. - CVE-2007-4571 ALSA memory disclosure flaw - Tick divider bugs on x8664 - CVE-2007-5494 openOATOMICLOOKUP leaks dentry - PATCH jbd: wait for already...

Oracle Linux 4 : kernel (ELSA-2008-0167)

From Red Hat Security Advisory 2008:0167 : Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The kernel packages contain t...

Passwords, Email, Usernames Accessed in Ubisoft Hack

The video game publishing company Ubisoft is urging its users to create new passwords after announcing late last week on a support forum that attackers exploited a vulnerability in one of the company’s websites to gain unauthorized access to some of their online systems. The attackers compromised...