#jingwang

[noirbriar]

画不了美男的我彻底放弃了。我又来献丑了。

tianchi is such a sweet husband,he deserves fish and everything.

[yunchu]

경쟁 사이트 독립 사이트 구축 서비스 업체:당신이 쉽게 전 세계 비즈니스를 시작할 수 있도록 지원합니다

글로벌화된 오늘날, 기업은 국제 시장을 개척하기 위해 강력한 온라인 플랫폼을 필요로 한다.경쟁 사이트 독립 사이트 구축 서비스 업체는 자사의 글로벌 브랜드 맞춤 사이트 구축 시스템을 통해 기업을 위해 강력한 글로벌 업무 지원을 제공했다.경쟁 사이트 클라우드의 글로벌 가속 보호 시스템은 분산 배치와 전 세계 cdn 노드에 의탁하여 전 세계 범위 내에서의 웹 사이트의 방문 속도와 보안을 보장한다.동시에, 경쟁 사이트의 다언어 시스템 지원은 기업이 쉽게 여러 국가와 지역의 웹 사이트를 관리할 수 있도록, 각 언어는 독립적인 배경을 가지고, 기업의 지역화 운영에 편리를 제공합니다.국제화 발전에 진력하는 기업으로 말하면, 경쟁 넷은 기술 지원을 제공했을 뿐만 아니라, 더욱 전세계 업무의 확장은 강력한 보장을 제공하여, 기업이 손쉽게 세계 시장의 도전에 대응할 수 있게 하였다.글로벌 서비스를 시작하려면 http://jw.ko-kr.hnjing.net/을 방문하세요.

[noirbriar]

Must carry wifey at all times.

[awardseasonblog]

E' stato rilasciato il trailer del dramma indipendente cinese dal titolo #TheBestIsYetToCome opera prima di #JingWang. Presentato con successo ai recenti Festival di Venezia e Toronto, il film è ambientato a Pechino nel 2003 e vede come protagonista uno stagista di giornalismo che riesce a cambiare il destino di 100 milioni di persone con un solo articolo. Questo film è ispirato a fatti realmente accaduti. Nel cast spiccano Bai-Ke, Songwen Zhang e Yang Song #previews TRAILER: https://vimeo.com/455479146 https://www.instagram.com/p/CFZRSRbICxP/?igshid=silgt86cf7yk

[xingti]

CVE-2015-2563 - Vastal I-tech phpVID 1.2.3 SQL Injection Web Security Vulnerabilities

Exploit Title: CVE-2015-2563 Vastal I-tech phpVID /groups.php Multiple Parameters SQL Injection Web Security Vulnerabilities

Product: phpVID

Vendor: Vastal I-tech

Vulnerable Versions: 1.2.3   0.9.9

Tested Version: 1.2.3   0.9.9

Advisory Publication: March 13, 2015

Latest Update: April 25, 2015

Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [CWE-89]

CVE Reference: CVE-2015-2563

CVSS Severity (version 2.0):

CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 10.0

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

Credit: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Direction Details:

(1) Vendor & Product Description:

Vendor:

Vastal I-tech

Product & Vulnerable Versions:

phpVID

1.2.3

0.9.9

Vendor URL & Download:

phpVID can be approached from here,

http://www.vastal.com/phpvid-the-video-sharing-software.html#.VP7aQ4V5MxA

Product Introduction Overview:

"phpVID is a video sharing software or a video shating script and has all the features that are needed to run a successful video sharing website like youtube.com. The features include the following. phpVID is the best youtube clone available. The latest features include the parsing of the subtitles file and sharing videos via facebook. With phpVID Video Sharing is extremely easy."

"The quality of code and the latest web 2.0 technologies have helped our customers to achieve their goals with ease. Almost all customers who have purchased phpVID are running a successful video sharing website. The quality of code has helped in generating more then 3 million video views a month using a "single dedicated server". phpVID is the only software in market which was built in house and not just purchased from someone. We wrote the code we know the code and we support the code faster then anyone else. Have any questions/concerns please contact us at: [email protected]. See demo at: www.phpvid.com. If you would like to see admin panel demo please email us at: [email protected]."

"Server Requirements:

Preferred Server: Linux any Version

PHP 4.1.0 or above

MySQL 3.1.10 or above

GD Library 2.0.1 or above

Mod Rewrite and .htaccess enabled on server.

FFMPEG (If you wish to convert the videos to Adobe Flash)"

(2) Vulnerability Details:

phpVID web application has a computer security bug problem. It can be exploited by SQL Injection attacks. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. Other bug hunter researchers have found some SQL Injection vulnerabilities related to it before, too. phpVID has patched some of them.

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. phpVID has patched some of them. "Openwall software releases and other related files are also available from the Openwall file archive and its mirrors. You are encouraged to use the mirrors, but be sure to verify the signatures on software you download. The more experienced users and software developers may use our CVSweb server to browse through the source code for most pieces of Openwall software along with revision history information for each source file. We publish articles, make presentations, and offer professional services." Openwall has published suggestions, advisories, solutions details related to important vulnerabilities.

(2.1) The first code programming flaw occurs at "&order_by" "&cat" parameters in "groups.php?" page.

Related Links:

http://packetstormsecurity.com/files/130754/Vastal-I-tech-phpVID-1.2.3-SQL-Injection.html

https://progressive-comp.com/?l=full-disclosure&m=142601071700617&w=2

http://seclists.org/fulldisclosure/2015/Mar/58

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1699

http://lists.openwall.net/full-disclosure/2015/03/10/8

http://static-173-79-223-25.washdc.fios.verizon.net/?l=full-disclosure&m=142601071700617&w=2

http://www.tetraph.com/blog/xss-vulnerability/cve-2015-2563/

http://static-173-79-223-25.washdc.fios.verizon.net/?l=full-disclosure&m=142551597501701&w=2

https://cxsecurity.com/issue/WLB-2015020091

https://www.facebook.com/permalink.php?story_fbid=935563809832135&id=874373602617823

http://t.qq.com/p/t/482410003538035

http://biboying.lofter.com/post/1cc9f4f5_6ee2aa5

http://mathpost.tumblr.com/post/118768553885/xingti-cve-2015-2563-vastal-i-tech-phpvid

http://essayjeans.lofter.com/post/1cc7459a_6ee4fcb

http://xingti.tumblr.com/post/118768481545/cve-2015-2563-vastal-i-tech-phpvid-1-2-3-sql

https://plus.google.com/113698571167401884560/posts/gftS84rfD3A

https://itswift.wordpress.com/2015/05/12/cve-2015-2563-vastal-i-tech-phpvid/

https://www.facebook.com/essayjeans/posts/827458144012006

https://tetraph.wordpress.com/2015/05/12/cve-2015-2563-vastal-i-tech-phpvid/

http://mathstopic.blogspot.com/2015/05/cve-2015-2563-vastal-i-tech-phpvid-123.html

http://yurusi.blogspot.sg/2015/05/cve-2015-2563-vastal-i-tech-phpvid-123.html

https://twitter.com/tetraphibious/status/598057025247907840

http://tetraph.blog.163.com/blog/static/23460305120154125453111/

[ithut]

CVE-2015-2209 - DLGuard Full Path Disclosure (Information Leakage) Web Security Vulnerabilities

Exploit Title: DLGuard "/index.php?" "&c" parameter Full Path Disclosure Web Security Vulnerabilities

Product: DLGuard

Vendor: DLGuard

Vulnerable Versions: v4.5

Tested Version: v4.5

Advisory Publication: January 18, 2015

Latest Update: March 20, 2015

Vulnerability Type: Information Exposure [CWE-200]

CVE Reference: CVE-2015-2209

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 5.0 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:N/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 10.0

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information

Credit: Wang Jing [School of Mathematical Sciences (001), University of Science and Technology of China (USTC)] (@justqdjing)

Consultation Details:

(1) Vendor & Product Description:

Vendor:

DLGuard

Product & Version:

DLGuard

v4.5

Vendor URL & Download:

DLGuard can be obtained from here,

http://www.dlguard.com/dlginfo/index.php

Product Introduction Overview:

“DLGuard is a powerful, yet easy to use script that you simply upload to your website and then rest assured that your internet business is not only safe, but also much easier to manage, automating the tasks you just don't have the time for."

"DLGuard supports the three types, or methods, of sale on the internet:

<1>Single item sales (including bonus products!)

<2>Multiple item sales

<3>Membership websites"

"DLGuard is fully integrated with: PayPal, ClickBank, 2Checkout, Authorize.Net, WorldPay, AlertPay, Ebay, PayDotCom, E-Gold, 1ShoppingCart, Click2Sell, Mal's E-Commerce, LinkPoint, PagSeguro, CCBill, CommerseGate, DigiResults, FastSpring, JVZoo, MultiSafePay, Paypal Digital Goods, Plimus, RevenueWire/SafeCart, SWReg, WSO Pro, and even tracks your free product downloads. The DLGuard built-in Shopping Cart offers Paypal, Authorize.net, and 2Checkout payment options. The Membership areas allow Paypal, Clickbank, 2Checkout, and LinkPoint recurring billing as well as linking to any PayPal, ClickBank, 2Checkout, Authorize.Net, WorldPay, AlertPay, Ebay, PayDotCom, E-Gold, 1ShoppingCart, E-Bullion, LinkPoint, PagSeguro, CCBill, CommerseGate, DigiResults, FastSpring, JVZoo, MultiSafePay, Paypal Digital Goods, Plimus, RevenueWire/SafeCart, SWReg, WSO Pro single sale and free products so that people who buy your products can access your members area. DLGuard is the perfect solution to secure your single sale item, such as a niche marketing website, software sales, ebook sales, and more! DLGuard not only protects your download page, but it makes setting up new products, or making changes to existing products so much quicker and easier than before."

(2) Vulnerability Details:

DLGuard web application has a computer security bug problem. It can be exploited by information leakage attacks - Full Path Disclosure (FPD). This may allow a remote attacker to disclose the software's installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

Several similar products vulnerabilities have been found by some other bug hunter researchers before. DLguard has patched some of them. NVD is the U.S. government repository of standards based vulnerability management data (This data enables automation of vulnerability management, security measurement, and compliance (e.g. FISMA)). It has published suggestions, advisories, solutions related to important vulnerabilities.

(2.1) The first bug flaw occurs at "&c" parameter in “index.php?” page.

References:

http://seclists.org/fulldisclosure/2015/Feb/67

https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01702.html

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1606

http://lists.openwall.net/full-disclosure/2015/02/18/5

https://www.bugscan.net/#!/x/21288

http://packetstormsecurity.com/files/authors/11270

http://www.tetraph.com/blog/information-leakage-vulnerability/cve-2015-2209-dlguard-full-path-disclosure/

http://static-173-79-223-25.washdc.fios.verizon.net/?a=139222176300014&r=2&w=2

https://www.facebook.com/permalink.php?story_fbid=831917900176921&id=767438873291491

http://ithut.tumblr.com/post/118694258318/cve-2015-2209-dlguard-full-path-disclosure

https://computertechhut.wordpress.com/2015/05/11/cve-2015-2209-dlguard-full-path-disclosure-information-leakage-web-security-vulnerabilities/

http://russiapost.blogspot.ru/2015/05/cve-2015-2209-dlguard-full-path.html

https://plus.google.com/100242269120759811496/posts/fTMm4nvGvjx

http://tetraph.blog.163.com/blog/static/234603051201541193034183/

http://www.weibo.com/5337321538/ChnJKf55t?

http://itprompt.blogspot.com/2015/05/cve-2015-2209-dlguard-full-path.html

http://webtech.lofter.com/post/1cd3e0d3_6eafc8b

https://twitter.com/buttercarrot/status/597757492098048000