Lucene search
+L
SeebugMost viewed

56796 matches found

seebug.org
seebug.org
added 2009/12/14 12:00 a.m.81 views

JBoss企业应用平台多个安全漏洞

BUGTRAQ ID: 37276 CVE ID: CVE-2009-1380,CVE-2009-2405,CVE-2009-3554 JBoss企业应用平台(EAP)是J2EE应用的中间件平台。 JBoss的实现上存在多个安全漏洞,包括多个跨站脚本问题和一个本地信息泄露问题,远程攻击者可能利用此漏洞来窃取信息。 RedHat JBoss EAP 厂商补丁: RedHat ------ 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.jboss.org/...

4.3CVSS6.3AI score0.0253EPSS
SaveExploits1
seebug.org
seebug.org
added 2009/08/25 12:00 a.m.81 views

ITechBids 8.0 (itechd.php productid) Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print " \n"; print " VIVA ISLAME VIVA ISLAME \n"; print " VIVA ISLAME VIVA ISLAME \n"; print " \n"; print " ITechBids v8.0 Blind SQL Injection Exploit \n"; print " \n"; print " itechd.php productid...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2009/05/15 12:00 a.m.81 views

Easy Scripts Answer and Question Script Multiple Vulnerabilities

No description provided by source. || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ /'\ \ /\ \ \ \ /'\ \ | | \ \ /\ /\ \ \ \ /...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2009/04/30 12:00 a.m.81 views

DBD::Pg 'pg_getline()'和'getline()'堆缓冲区溢出漏洞

BUGTRAQ ID: 34755 CVE ID:CVE-2009-0663 DBD::Pg是一款用于PostgreSQL数据库访问的DBI驱动模块。 DBD::Pg存在基于堆的缓冲区溢出,远程攻击者可以利用漏洞执行任意代码。 使用pggetline和getline函数可从数据库中读取行信息的应用程序可通过触发堆溢出而执行任意代码。 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux...

7.5CVSS0.4AI score0.04347EPSS
SaveExploits1
seebug.org
seebug.org
added 2008/09/28 12:00 a.m.81 views

帝国ECMS V5 /e/member/list/index.php注入漏洞

帝国ECMS /e/member/list/index.php文件: if$sear $keyboard=RepPostVar2$GET'keyboard'; if$keyboard $add.=$where.$userusername." like '%$keyboard%'"; $search.="&sear=1&keyboard=$keyboard"; 判断sear参数是否存在,然后直接去keyboard的参数,然后再判断keyboard值是否为空,如果不为 空就直接把keyboard带入查询产生注射漏洞. 帝国ECMS V5 暂无...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2008/09/17 12:00 a.m.81 views

趋势科技OfficeScan cgiRecvFile.exe栈溢出漏洞

BUGTRAQ ID: 31139 CVECAN ID: CVE-2008-2437 OfficeScan是一种针对整个网段的分布式杀毒软件。 OfficeScan的cgiRecvFile.exe中存在栈溢出漏洞,如果远程攻击者在提交的HTTP请求中包含了超长的ComputerName参数的话,就可以触发这个溢出,导致执行任意指令。必须还要控制TempFileName、NewFileSize和Verify参数才能利用这个漏洞。 Trend Micro OfficeScan 7.3 patch 4 build 1362 Trend Micro -----------...

10CVSS6.4AI score0.06673EPSS
SaveExploits5
seebug.org
seebug.org
added 2008/03/07 12:00 a.m.81 views

Ruby 1.8.6 (Webrick Httpd 1.3.1) Directory Traversal Vulnerability

No description provided by source. ------------------------------------------------------------------------------------ Digital Security Research Group DSecRG Advisory DSECRG-08-018...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2007/09/14 12:00 a.m.81 views

Joomla Component joomlaradio v5 Remote File Inclusion Vulnerability

No description provided by source. Joomla Radio v5 Component RFI Bug in : administrator/components/comjoomlaradiov5/admin.joomlaradiov5.php Variable : $mosConfiglivesite Download : http://www.joomlaos.de/option,comremository/Itemid,41/func,fileinfo/id,2661.html Dork: inurl:"comjoomlaradiov5"...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2007/03/10 12:00 a.m.82 views

Grayscale Blog 0.8.0 (Security Bypass/SQL/XSS) Multiple Remote Vulns

No description provided by source. Security Advisory - Multiple Vulnerabilities in Grayscale Blog 0.8.0 Date : 2007-02-24 Product : Grayscale Blog Version : 0.8.0 - Prior version maybe also be affected Vendor : http://sourceforge.net/projects/gsblogger/ - http://www.karlcore.com/programming/blog/...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2007/02/07 12:00 a.m.81 views

Samba延迟CIFS文件打开拒绝服务漏洞

Samba是一套实现SMB(Server Messages Block)协议、跨平台进行文件共享和打印共享服务的程序。 Samba的延迟文件打开机制的实现上存在漏洞,远程攻击者可能利用此漏洞对服务器执行拒绝服务攻击。 Samba的文件服务守护程序smbd支持延迟文件打开调用。在某些环境下重新命名文件时可能没有从延迟的打开队列删除请求,这样smbd就会陷入试图处理打开请求服务的死循环。如果已认证用户打开了多个CIFS会话的话,每个会话都会生成新的smbd进程,每个连接都会陷入死循环,这样就会导致在服务器上耗尽内存和CPU资源。 Samba 3.0.6 - 3.0.23d 厂商补丁:...

6.8CVSS0.1AI score0.0459EPSS
SaveExploits1
seebug.org
seebug.org
added 2007/01/30 12:00 a.m.81 views

Linux-PAM pam_unix.so绕过认证漏洞

可插拔认证模块(PAM)是用于认证用户的机制,使用在多种Linux版本上。 Linux-PAM的modules/pamunix/support.c文件中unixverifypassword函数在验证用户口令时存在漏洞,远程攻击者可能利用此漏洞获取非授权访问。 如果口令文件中的哈希为“!!”或类似的话,用户就可以以任意口令登录。 Linux-PAM Linux-PAM 0.99.7.0 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2006/12/16 12:00 a.m.81 views

Premod Shadow Functions_Portal.PHP远程文件包含漏洞

Premod Shadow是一款基于PHP的WEB应用程序。 Premod Shadow不正确过滤用户提交的URI数据,远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'FunctionsPortal.PHP'脚本对用户提交的'phpbbrootpath'参数缺少过滤,提交恶意的远程服务器作为包含对象,可导致以WEB进程权限执行任意PHP代码。 Premod Shadow Premod Shadow 2.7.1 http://premod-shadow.info/...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2006/12/08 12:00 a.m.81 views

Microsoft Windows Print Spooler GetPrinterData拒绝服务漏洞

Microsoft Windows 2000是一款流行的操作系统。 Microsoft Windows spoolss GetPrinterData存在设计错误,远程攻击者可以利用漏洞进行拒绝服务攻击。 问题存在于GetPrinterData函数中,由于存在内存分配错误,可导致系统崩溃,造成拒绝服务攻击。 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000...

7AI score
SaveExploits0
seebug.org
seebug.org
added 2006/11/29 12:00 a.m.81 views

Sisfo Kampus文件包含及目录遍历漏洞

Sisfo Kampus是一款系统信息管理系统。 Sisfo Kampus在处理用户请求时存在输入验证漏洞,远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 Sisfo Kampus的index.php和print.php脚本没有过滤slnt参数的输入,允许攻击者通过包含本地或外部资源的任意文件导致执行任意代码。 index.php中漏洞代码如下: -------------------------Line 27----------------------------- ?php if $exec=='main.php' &&...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2006/09/16 12:00 a.m.81 views

Mambo com_registration_detailed <= 4.1 Remote File Include

No description provided by source. Mambo comregistrationdetailed = 4.1 Remote File Inclusion Download Source : http://mamboxchange.com/projects/regdetailed/ Dork = allinur:comextendedregistration Found By: k1tk4t - k1tk4td0th4ck4tgmaild0tcom Location: Indonesia file ; registrationdetailed.inc.php...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2006/08/17 12:00 a.m.81 views

Oracle SYS.DBMS_METADATA_UTIL软件包SQL注入漏洞

Oracle Database是一款商业性质大型数据库系统。 Oracle SYS.DBMSMETADATAUTIL软件包的LONG2VARCHAR、LONG2VCMAX、LONG2VCNT和LONG2CLOB函数中存在4个SQL注入漏洞。成功利用这些漏洞的远程攻击者可以完全入侵受影响的数据库系统。 Oracle 10g Release 1 Oracle ------ Oracle已经为此发布了一个安全公告(cpujan2006)以及相应补丁: cpujan2006:Oracle Critical Patch Update - January 2006...

6.9AI score
SaveExploits0
seebug.org
seebug.org
added 2021/04/08 12:00 a.m.80 views

天清入侵防御系统 弱口令漏洞

...

0.3AI score
SaveExploits0
seebug.org
seebug.org
added 2018/06/26 12:00 a.m.80 views

Emerson Liebert IntelliSlot Web Card family delivers enhanced communications and control to Liebert UPS,AC Power and Thermal Management systems Unauthorized access

Emerson Liebert IntelliSlot Web Card family delivers enhanced communications and control to Liebert UPS,AC Power and Thermal Management systems Unauthorized access。Lots of them No authentication required and The Management configuration uses the default password. Liebert:Liebert devices in ZoomEy...

2AI score
SaveExploits0
seebug.org
seebug.org
added 2017/12/26 12:00 a.m.80 views

Tplink Bridge Authenticated RCE

Vulnerability: Command Injection in bridge.lua ------------------------------------------ Exploitation: Can remote command execution on the root shell. ------------------------------------------ Vendor of Product: Tp-Link router ------------------------------------------ Affected Products and...

8.2AI score
SaveExploits0
seebug.org
seebug.org
added 2017/12/15 12:00 a.m.80 views

Linksys WVBR0 25 Command Injection(CVE-2017-17411)

In this guest blog, Trend Micro DVLabs researcher Ricky Lawshae discusses the recently disclosed CVE-2017-17411. He discovered and reported this bug through the ZDI program. Earlier this year, I learned that AT&T was starting to move customers away from its U-Verse service in favor of its DirecTV...

10CVSS10AI score0.87929EPSS
SaveExploits9
seebug.org
seebug.org
added 2017/12/11 12:00 a.m.80 views

APPCMS comment.php文件SQL注入

AppCMS 官网:http://www.appcms.cc/ 审计版本:2.0.101 下载连接:http://www.appcms.cc/download/appcms2.0.101.zip AppCMS comment.php SQL Injection 0x00 前言 一开始是在cnvd()上看到有人提交这个漏洞没有详情,去官网下载源码本地审计没有审计出来;一次偶然的机会看到@Thinking分享的文章,才知道服务器端获取的“HTTPCLIENTIP”值是http头中“CLIENT-IP”字段的值是可伪造的!看到这个就恍然大悟了 0x01 分析...

7.6AI score
SaveExploits0
seebug.org
seebug.org
added 2017/10/17 12:00 a.m.80 views

Apple Image I/O EXR Color Component Remote Code Execution Vulnerability(CVE-2016-4629)

SUMMARY An exploitable heap based buffer overflow exists in the handling of EXR images on OS X. A crafted EXR document can lead to a heap based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved EXR file delivered by other means when opened in any...

10CVSS9.7AI score0.07418EPSS
SaveExploits2
seebug.org
seebug.org
added 2017/10/17 12:00 a.m.80 views

Microsoft Windows Kernel Local Information Disclosure Vulnerability(CVE-2017-11784)

One kernel memory disclosure in the exception handling code has already been discovered and reported as issue 1177 . It was fixed in the June Patch Tuesday as CVE-2017-8482. However, it seems there is another bug in this code area, this time a pool as opposed to stack memory leak. We've had some...

2.1CVSS5.8AI score0.03713EPSS
SaveExploits5
seebug.org
seebug.org
added 2017/10/16 12:00 a.m.80 views

Windows KEPT remote code execution vulnerability analysis(CVE-2017-11779)

根据 Microsoft 安全通告,多个版本 Windows 中的 DNSAPI.dll 在处理 DNS response 时可导致 SYSTEM 权限 RCE。 以 DNS Client API DLL 10.0.15063.0 与 10.0.15063.674 为例,补丁对比, 可知漏洞存在于 DNSAPI.dll 中的 Nsec3RecordRead 函数,那么可以确定问题就是出在解析 DNS response 的 NSEC3 Resource record,为了构造 PoC,先得了解这个 "NSEC3" 的背景。首先,DNS 协议数据结构如下图所示, 例如,当访问...

9.3CVSS8.2AI score0.33338EPSS
SaveExploits1
seebug.org
seebug.org
added 2017/10/11 12:00 a.m.80 views

HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability(CVE-2016-4332)

Description HDF5 is a file format that is maintained by a non-profit organization, The HDF Group. HDF5 is designed to be used for storage and organization of large amounts of scientific data and is used to exchange data structures between applications in industries such as the GIS industry via...

6.9CVSS8.6AI score0.00812EPSS
SaveExploits2
seebug.org
seebug.org
added 2016/05/24 12:00 a.m.80 views

phpwind9.x 通讯秘钥安全漏洞

来源链接:phpwind 利用哈希长度扩展攻击进行getshell 一哥新发的漏洞,还是蛮屌的: http://www.wooyun.org/bugs/wooyun-2016-0210850。分析补丁( http://www.phpwind.net/read/3709549 )加上一些风闻,我得知利用的是哈希长度扩展攻击。之前CTF中经常出境的MD5 Length Extension Attack,终于在实战中露了一次面。 0x01 漏洞点分析 phpwind逻辑太冗杂了,一看就是java程序员开发的。...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2016/05/11 12:00 a.m.80 views

D-Link DAR-8000/DAR-7000系列上网行为审计网关 任意文件上传

No description provided by source...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2016/01/22 12:00 a.m.80 views

shopnc o2o版 index.php?act=payment&op=notify SQL注入漏洞

No description provided by source...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2016/01/18 12:00 a.m.80 views

AnyMacro G7 版本存储型XSS

简要描述: RT 详细说明: 邮件系统的网盘功能-文件中心-上传文件-共享文件功能存在存储型XSS漏洞 首先,上传一个文件,修改文件名为alertdocument.cookie.php 接着共享该文件,点击该链接即可触发该漏洞 漏洞证明: 邮件系统的网盘功能-文件中心-上传文件-共享文件功能存在存储型XSS漏洞 首先,上传一个文件,修改文件名为alertdocument.cookie.php 接着共享该文件,点击该链接即可触发该漏洞...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2015/05/19 12:00 a.m.80 views

致远协同OA 3.5 /seeyon/fileUpload.do 文件上传漏洞

No description provided by source...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2015/02/11 12:00 a.m.80 views

mcms最新版SQL注入三枚打包(可出任意数据)

简要描述: mcms最新版SQL注入三枚打包(可出任意数据) 详细说明: 在wooyun上看到掌易科技终于不再忽略漏洞了,我也来凑凑热闹吧。去下了mcms的最新版(v3.1.0.enterprise),来研究研究。 注入一枚:POST /app/message/?m=savemessage post中有本个参数,虽然都经过了xss和sql的过滤,但是过滤的并不完全,我们看看是如何注入的。 看看代码/app/message/index.php function msavemessage global $dbm,$C,$V; $POST=H::sqlxss$POST;...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2015/01/28 12:00 a.m.80 views

74CMS 3.4 /plus/weixin.php 任意文件下载漏洞

No description provided by source...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2014/11/12 12:00 a.m.80 views

DouPHP v1.1 /kindeditor/php/file_manager_json.php 备份文件发现漏洞

No description provided by source...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2014/09/18 12:00 a.m.80 views

KesionCMS X1 /KS_Data/KesionCMSX1.mdb 数据库发现漏洞

默认的数据库文件在KSData目录下的 KesionCMSX1.mdb,攻击者可以直接下载。漏洞利用过程访问地址http://127.0.0.1/KSData/KesionCMSX1.mdb !/usr/bin/env python coding=utf-8 test: import urllib2 from comm import cmdline from comm import generic pocinfo = 'VulId' : '1503', webvul的ID号 'Name' : 'KesionCMS X1 /KSData/KesionCMSX1.mdb 数据库发现漏洞...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2014/07/01 12:00 a.m.80 views

WMAPM 3.1 Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8995/info wmapm has been reported prone to a local privilege escalation vulnerability. The vulnerability has been conjectured to result from a lack of relative path usage while the vulnerable dock app is invoking a third...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2014/07/01 12:00 a.m.80 views

Wordpress TimThumb 2.8.13 WebShot - Remote Code Execution (0-day)

No description provided by source...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2014/07/01 12:00 a.m.80 views

WordPress 2.3.1 Unauthorized Post Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/26885/info WordPress is prone to a vulnerability that lets unauthorized users read draft posts before they have been published. This issue affects WordPress 2.3.1; other versions may also be affected. NOTE: This BID is...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2014/07/01 12:00 a.m.80 views

wordpress <= 3.3.1 - Multiple Vulnerabilities

No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2012-002: Multiple Vulnerabilities in WordPress https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt Published: 1/24/12 Version: 1.0 Vendor: WordPress http://wordpress.org/ Product: WordPress Version...

7.5CVSS6.4AI score0.09551EPSS
SaveExploits10
seebug.org
seebug.org
added 2014/07/01 12:00 a.m.80 views

PNphpBB2 <= 1.2g - (phpbb_root_path) Remote File Include Vulnerability

No description provided by source. Yeah, another ZeroDay Smile Vendor: http://www.pnphpbb.com/ Vulnerable File: includes/functionsadmin.php Vulnerable Code: //The phpbbrootpath isn't initialize includeonce $phpbbrootpath . 'includes/functions.' . $phpEx ; Method To Use:...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2014/07/01 12:00 a.m.80 views

YaPiG 0.92 Remote Server-Side Script Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10891/info A vulnerability is reported to exist in YaPiG that may allow a remote attacker to execute malicious scripts on a vulnerable system. This issue exists due to a lack if sanitization of user-supplied data. It is...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2014/07/01 12:00 a.m.80 views

Oracle <= 9i / 10g (extproc) - Local/Remote Command Execution Exploit

No description provided by source. -- -- $Id: raptororaextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptororaextproc.sql - command exec via oracle extproc -- Copyright c 2006 Marco Ivaldi [email protected] -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g --...

8.5CVSS0.3AI score0.13782EPSS
SaveExploits9
seebug.org
seebug.org
added 2014/06/10 12:00 a.m.80 views

SiteServer 3.6.4 /SiteServer/cms/console_user.aspx SQL注入漏洞

No description provided by source...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2014/05/06 12:00 a.m.80 views

Hanweb JCMS 2010 /down.jsp 任意文件下载漏洞

No description provided by source...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2014/04/25 12:00 a.m.80 views

大汉通版cms上传设计缺陷

简要描述: RT 详细说明: WooYun: 大汉jiep信息交换平台某处越权及sql注入 根据wefgod牛的测试站点进行测试得到的。 http://www.dx.gansu.gov.cn/cms/common/filechoose/filedialog.jsp?webappcode=A61&filetype=1&webapppath=freeform&uploadpath=../../../ 具体%00截图没有绕过上传jsp等脚本文件。 但是如果cms在iis下面可以触发iis解析漏洞,所以还是存在威胁的。 漏洞证明: Content-Disposition: form-data;...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2014/03/26 12:00 a.m.80 views

Check_MK 任意文件删除漏洞(CVE-2014-2332)

BUGTRAQ ID:66396 CVE ID:CVE-2014-2332 CheckMK是一款通用的Nagios/Icinga数据采集插件。 CheckMK 1.2.2p2及其他版本在实现上存在任意文件删除漏洞,成功利用后可使远程攻击者删除受影响应用上下文内的任意文件。 0 mathias-kettner checkmk 1.2.2p2 目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本: http://mathias-kettner.de...

5.5CVSS6.5AI score0.01433EPSS
SaveExploits1
seebug.org
seebug.org
added 2014/03/25 12:00 a.m.80 views

Linux Kernel &quot;rds_ib_laddr_check()&quot;空指针引用漏洞

CVE ID:CVE-2013-7339 Linux Kernel是一款开源的操作系统。 Linux Kernel "rdsibladdrcheck"函数net/rds/ib.c存在一个空指针引用错误,允许本地攻击者利用漏洞使内核崩溃,造成拒绝服务攻击。 0 Linux Kernel 2.6.32.61 用户可参考厂商的GIT库以获得补丁修复此漏洞: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c2349758acf1874e4c2b93fe41d072336f1a31d0...

4.7CVSS0.1AI score0.00476EPSS
SaveExploits2
seebug.org
seebug.org
added 2014/02/26 12:00 a.m.80 views

Apple Mac OS X多个安全漏洞(APPLE-SA-2014-02-25-1)

BUGTRAQ ID: 65777 CVECAN ID: CVE-2014-1254,CVE-2014-1262,CVE-2014-1255,CVE-2014-1256,CVE-2014-1257,CVE-2014-1258,CVE-2014-1261,CVE-2014-1263,CVE-2014-1265,CVE-2014-1259,CVE-2014-1264,CVE-2014-1260,CVE-2014-1246,CVE-2014-1247,CVE-2014-1248,CVE-2014-1249,CVE-2014-1250,CVE-2014-1245 OS X(前称Mac OS...

9.3CVSS6.4AI score0.04072EPSS
SaveExploits4
seebug.org
seebug.org
added 2013/09/26 12:00 a.m.80 views

Apache Struts 安全措施绕过漏洞

BUGTRAQ ID: 62584 CVECAN ID: CVE-2013-4310 Struts2 是第二代基于Model-View-Controller MVC模型的java企业级web应用框架。 Apache Struts 2.0.0-2.3.15.1的操作映射机制支持特殊参数前缀操作,这样有可能会在表格底部附加引导信息,在映射 "action:" 前缀操作时存在安全绕过漏洞,可被利用绕过某些安全限制,访问受限制功能。 0 Apache Group Struts 2.3.15.2 厂商补丁: Apache Group ------------ Apache...

5.8CVSS8AI score0.07517EPSS
SaveExploits1
seebug.org
seebug.org
added 2013/09/06 12:00 a.m.80 views

欧朋浏览器官方网易微博被劫持(社工)

简要描述: 大数据HACK 详细说明: 本来想用大数据的能力搞到欧朋论坛的admin,但是admin没搞到,反而弄到了欧朋的网易微博,从而可以发布欺骗或者危害的信息 怎么开始的? 首先我是查看了http://bbs.oupeng.com/home.php?mod=space&username=admin的信息,发现她的名字有点特别,于是,我就利用大数据的能力,获得了Csineneo用户的密码信息等 [email protected] loveyou...

7.1AI score
SaveExploits0
seebug.org
seebug.org
added 2013/01/18 12:00 a.m.80 views

正方高校现代管理系统任意修改成绩查看照片漏洞

简要描述: 还是传说中1000所高校用的正方高校现代管理系统 详细说明: 一般院校都有一个可以查到学号工号的地方,例如: 信息门户-好友系统 有的学校没有这个信息门户,或者信息门户只对教师开放,那么还有一个在线教学平台可以查到哦 具体位置自己找吧。 先输入你老师的名字,找到其工号…… 然后到高校现代管理系统(这里可能会有两个地址,一个是评教系统,没什么用,另一个可以选择登陆身份的就是我们要进的系统了) 当然是弱密码经测试80%的高校都没让老师们修改弱密码!大学老师啊!! 输入工号(密码相同)。 先说查看照片。...

7.1AI score
SaveExploits0
Total number of security vulnerabilities5000