xWPE Local Buffer Overflow Vulnerability

A buffer overflow vulnerability exists in xwpe v1.5.30a-2.1 and earlier versions due to a failure to strictly limit user input. An attacker is able to exploit this vulnerability to arbitrarily execute code in the context of the application, potentially resulting in a denial of service...

Cisco UCS Manager 2.1(1b) Shellshock

!/usr/bin/python Cisco UCS Manager 2.11b Shellshock Exploit CVE-2014-6278 Confirmed on version 2.11b, but more are likely vulnerable. Cisco's advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash Exploit generates a reverse shell to a nc listener...

CVE-2016-0886

EMC Documentum xCP 2.1 before patch 24 and 2.2 before patch 12 allows remote authenticated users to obtain sensitive user-account metadata via a members/xcpmember API call...

Code injection

EMC Documentum xCP 2.1 before patch 24 and 2.2 before patch 12 allows remote authenticated users to obtain sensitive user-account metadata via a members/xcpmember API call...

Prepopulate - Moderately Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-009

The Prepopulate module allows form fields to be pre-populated in the request. The Prepopulate module does not adequately prevent a user from overwriting arbitrary parts of $REQUEST. It also does not prevent pre-populating certain fields that are not displayed or manipulating markup fields to alte...

Xxe

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to read arbitrary files via a POST request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Design/Logic Flaw

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and obtain sensitive repository information by appending a query to a REST request...

CVE-2016-0881

EMC Documentum xCP is affected: versions 2.1 before patch 23 and 2.2 before patch 11 expose a DQL injection via REST requests, allowing remote authenticated attackers to obtain sensitive repository information. The root cause is improper handling of XCP REST requests, enabling execution of SQL-li...

CVE-2016-0881

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and obtain sensitive repository information by appending a query to a REST request...

ASP Forums 2.1 Database Disclosure

| Title : ASP Forums version 2.1 Database Disclosure Exploit | Author : indoushka | email : [email protected] | Tested on: windows 8.1 Français V.Pro | Vendor : http://adyou.me/4TVD ========================================================= !/usr/bin/perl -w Author : indoushka use...

CenoCipher - Easy-To-Use, End-To-End Encrypted Communications Tool

CenoCipher is a free, open-source, easy-to-use tool for exchanging secure encrypted communications over the internet. It uses strong cryptography to convert messages and files into encrypted cipher-data, which can then be sent to the recipient via regular email or any other channel available, suc...

Apple Releases Multiple Security Updates

Apple has released security updates for iOS, tvOS, OS X, watchOS, Safari, and Xcode to address multiple vulnerabilities, one of which could allow a remote attacker to take control of an affected system. Updates available include: iOS 9.2 for iPhone 4s and later, iPod touch 5th generation and late...

Aeris Calandar 2.1 - Buffer Overflow Vulnerability

Exploit for windows platform in category local exploits - Title : Aeris Calandar 2.1 - Buffer Overflow Vulnerability - Author : ZwX - Date : 27/11/2015 - Software Link : http://www.esumsoft.com/download/?prod=aeriscalendar - Vendor : http://www.esumsoft.com/ - Tested On : Windows 7 & Windows XP S...

SMF 2.1 Beta 2 Remote Code Execution 0day Exploit

SMF 2.1 Beta 2 0day Exploit allow a remote attacker with the ability to create a basic user account to execute arbitrary code with the privileges of the application. You use python exploit and can authomatic shell upload and remote code execution Usage Info example Remote code execution: exploit....

Multiple Cross-Site Scripting Vulnerabilities in HP ArcSight Management Center

HP ArcSight Management Center is a security management center from Hewlett-Packard HP in the U.S. HP ArcSight Logger is a log management software tool. Multiple cross-site scripting vulnerabilities exist in HP ArcSight Management Center versions prior to 2.1, and ArcSight Logger versions prior to...

CVE-2015-3270

Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords...

PT-2015-3351

Name of the Vulnerable Software and Affected Versions Omron CX-One CX-Programmer versions prior to 9.6 Omron CJ2M PLC devices versions prior to 2.1 Omron CJ2H PLC devices versions prior to 1.5 Description The issue is related to the transmission of passwords in cleartext, which can be exploited b...

Multiple XSS vulnerabilities in FortiSandbox WebUI

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-FORTISANDBOX-0801.txt Vendor: ================================ www.fortinet.com PSIRT ID: 1418018 Product: ================================== FortiSandbox 3000D v2.02...

Endian Firewall < 3.0.0 - OS Command Injection (Metasploit Module) Exploit

Exploit for cgi platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Endian Firewall %q This module exploits an OS command injection vulnerability i...

Aegir - Moderately Critical - Code Execution Prevention - SA-CONTRIB-2015-113

The Aegir Hosting System enables you to deploy and manage Drupal sites. When writing Apache vhost files for hosted sites on a common platform multi-site, Aegir doesn't block execution of code uploaded to another site on the same platform. This vulnerability is mitigated by the fact that an attack...