Cloud Security

LibVNCServer Denial of Service Vulnerability (CVE-2014-6054) Release date:Updated on: 2014-10-05 Affected Systems:LibVNCServerDescription:Bugtraq id: 70094CVE (CAN) ID: CVE-2014-6054 LibVNCServer is a cross-platform C library that can implement

CVE2014-6287 Analysis Report0x00 Preface In wooyun zone, I saw the article HFS 2.3x remote command execution (the last day of hacker capture). Previously, I only analyzed binary vulnerabilities. This command injection vulnerability was the first

Gitlab-shell is affected by Bash CVE-2014-6271 Vulnerability Today, US-CERT announced a serious Bash Security Vulnerability (CVE-2014-6271) that also affects the OpenSSH daemon. The default git account of the Gitlab server uses Bash to execute

Adobe Reader and Acrobat Memory Corruption Vulnerability (CVE-2014-0563) Release date:Updated on: Affected Systems:Adobe Reader 11.xAdobe Reader 10.xDescription:Bugtraq id: 69826CVE (CAN) ID: CVE-2014-0563 Adobe Reader (also known as Acrobat Reader)

Wireshark RTP parser DoS Vulnerability (CVE-2014-6422) Release date:Updated on: Affected Systems:Wireshark 1.12.0Description:Bugtraq id: 69856CVE (CAN) ID: CVE-2014-6422 Wireshark is the most popular network protocol parser. Wireshark 1.12.0 has

Joomla! Spider Contacts 'index. php' SQL Injection Vulnerability Release date:Updated on: Affected Systems:Joomla! Spider Contacts Description:Bugtraq id: 69757 Joomla! Spider Contacts is Joomla! To facilitate the management of contact

CacheGuard OS Cross-Site Request Forgery (CVE-2014-4865) Release date:Updated on: Affected Systems:CacheGuard OS 5.7.7Description:Bugtraq id: 69731CVE (CAN) ID: CVE-2014-4865 CacheGuard OS is a web traffic management solution. CacheGuard OS v5.7.

GNU Automake insecure temporary File Processing Vulnerability Release date:Updated on: Affected Systems:GNU AutomakeDescription:Bugtraq id: 69777 GNU Automake is a tool that automatically generates 'makefile. in' files that comply with the GNU

Defense methods for cc and capturingI have been crawled by an SB on my personal website recently. I haven't found it before. It has been crawling for several months. The reason is that SB is holding a locomotive and thinks that it is no longer

The flying fish star router command can be run as ROOT to control the route It was first found that the fat paper that @ wants to lose weight exists. The version found by this user exists. However, in the later versions, feiyuxing has fixed the

Letv MySQL blind injection, callback reflective XSS and an absolute path Leakage The injection point is located (parameter ID ): Http://joyearcars2014happy.hz.letv.com/php/votenum.php? Callback = jquery171017738118954002857_14087927555 & id = 1 & _ =

Tccms SQL Injection #2 The constant is not defined. View/system/core/controller. class. php  private function forceAttack() { $attack = M('attack'); if (Config::get("blackcheck") == 1 && !defined('IN_ADMIN') && $_GET['ac'] !=

Horizontal permission of a pharmaceutical house network APP When saving the address modification screen, you can change the userid to the ID of another user and then save the address to another user. In addition, CSRF exists in this screen. You

Where does the destoon storage xss address? The member sends a letter and uploads an attachment. Files in swf format can be uploaded, The label is not filtered.We construct a malicious swf. For example  Upload the attachment f12 and view the

Arbitrary File Deletion caused by Phpyun design defects can cause reinstallation of getshell or injection. Design defects can cause deletion of arbitrary files and lock, which can be directly reinstalled to achieve getshell.Or you can delete an

Ecmall second injection fourth bomb 20140618Although anti-injection is added in 20140618, it can be barely bypassed. First register a member and then apply to open a shop.Change the store nameYu ', user (), 1 and extractvalue (1, concat (0x5c, (user

Other user password vulnerabilities in the host room Modify others' passwordsFirst, we need to register an account on the host and bind the mailbox Then, go to the homepage and find the forgot password feature.  Enter the registered account

A school management system vulnerability package (including XSS storage-SQL Injection Vulnerabilities) "School website system" This is a keyword. You can add. Or not! Baidu found   Okay .. Let's do this first... Get injection exists? [root@Hacker~]#

Phpyun injection bypass 360 Protection Check member usage during registration Model \ register. class. php23 rows  Function ajax_reg_action () {$ post = array_keys ($ _ POST); $ key_name = $ post [0]; if ($ key_name = "username ") {$ username = @

74cms (20140709) the latest version of the second injection 74cms V3.4.20140709Instead of modifying the vulnerability code, you can modify the filter function.Although the filtering Code cannot be bypassed .. However, the data can still be found.On