阿信

icon location 梦想是成为美少女战士

Results 5 issues of 阿信

There is a Arbitrary File Download vulnerability in v3.8

From the spring-mvc.xml, we can figure out that we are able to access chat/imController/showOrDownByurl.do ![屏幕截图_303](https://user-images.githubusercontent.com/30264078/68671469-56510f00-058a-11ea-9e21-aaf42111b957.png) and then we go to the source code: ![屏幕截图_304](https://user-images.githubusercontent.com/30264078/68671711-e98a4480-058a-11ea-8e0f-aeb7b4bfd079.png) as you can see, the variable...

dubbo远程方法调用检测场景下存在污点丢失问题

### Preflight Checklist - [X] I agree to follow the [Code of Conduct](https://github.com/HXSecurity/DongTai/blob/main/.github/CODE_OF_CONDUCT.md) that this project adheres to. - [X] I have searched the [issue tracker](https://www.github.com/HXSecurity/DongTai/issues) for an issue that...

bug

从freebuf过来

听了前辈的扫描器开发经验课程，里面提到了这个工具，结果过来发现没开源，期待开源，学习

There is a RCE vulnerability in wtcms

wtcms is based on thinkcmf,but there is a RCE vulnerability has been exposed about thinkcmf in October(detail:https://www.freebuf.com/vuls/218105.html)。An attacker can execute any command by requesting `?a=fetch&content=` To demonstrate this vulnerability, we...

同一url三个sink点却只会检出一个漏洞

2 comment

### Preflight Checklist - [X] I agree to follow the [Code of Conduct](https://github.com/HXSecurity/DongTai/blob/main/.github/CODE_OF_CONDUCT.md) that this project adheres to. - [X] I have searched the [issue tracker](https://www.github.com/HXSecurity/DongTai/issues) for an issue that...