UBUNTU-CVE-2014-1725

The base64DecodeInternal function in wtf/text/Base64.cpp in Blink, as used in Google Chrome before 34.0.1847.116, does not properly handle string data composed exclusively of whitespace characters, which allows remote attackers to cause a denial of service out-of-bounds read via a window.atob...

CVE-2014-1725

Removed by vendor...

destoon /v5.0/ 存储型xss指哪打哪

简要描述： 存储型xss 指哪打哪 详细说明： 注册一个用户 http://127.0.0.1/v5.0/member/message.php?action=send&touser=oboi123&title=RE:RE%3ARE%3Asdaaaaaaa 回复处用了编辑器 编辑器有些标签没过滤，导致xss执行 xsscode: object 经过base64 可形成xss语句 漏洞证明：...

CVE-2012-3359

Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect...

Design/Logic Flaw

Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect...

Design/Logic Flaw

Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user...

CVE-2012-3359

Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect...

CVE-2012-3359

CVE-2012-3359 concerns Luci in Red Hat Conga storing the user’s username and password in a Base64-encoded string in the __ac session cookie. This encoding is not secure, and access to the cookie can allow an attacker to gain privileges. The issue is explicitly split from CVE-2013-7347, which cove...

TCCMS-PHP内容管理系统存储型xss

简要描述： 存储型xss 详细说明： 发帖时没过滤好黑名单 导致可绕过 进行xss url:http://bbs.teamcen.com/thread-3-10.html 使用的payload： 当然你想要获取cookies也行 payload换成 只要是base64解码就行 漏洞证明： 过...

Post Exploitation - Getting username and password in the Lotus Sametime 8.5.1

Exploit Title: Post Exploitation - Getting username and password in the Lotus Sametime 8.5.1 Google Dork: n/a Date: 18/02/2014 Exploit Author: Adriano Marcio Monteiro [email protected] Vendor Homepage: http://www.ibm.com/us/en/ Software Link:...

Lotus Sametime 8.5.1 Password Disclosure

Exploit Title: Post Exploitation - Getting username and password in the Lotus Sametime 8.5.1 Google Dork: n/a Date: 18/02/2014 Exploit Author: Adriano Marcio Monteiro Vendor Homepage: http://www.ibm.com/us/en/ Software Link: http://www-01.ibm.com/support/docview.wss?uid=swg24027054 Version: 8.5.1...

Lotus Sametime 8.5.1 - Password Disclosure

Lotus Sametime 8.5.1 - Password Disclosure Exploit Title: Post Exploitation - Getting username and password in the Lotus Sametime 8.5.1 Google Dork: n/a Date: 18/02/2014 Exploit Author: Adriano Marcio Monteiro Vendor Homepage: http://www.ibm.com/us/en/ Software Link:...

Lotus Sametime 8.5.1 - Password Disclosure

Exploit Title: Post Exploitation - Getting username and password in the Lotus Sametime 8.5.1 Google Dork: n/a Date: 18/02/2014 Exploit Author: Adriano Marcio Monteiro Vendor Homepage: http://www.ibm.com/us/en/ Software Link: http://www-01.ibm.com/support/docview.wss?uid=swg24027054 Version: 8.5.1...

Linksys系列未明远程代码执行漏洞

No description provided by source. !/usr/bin/php ?php / Exploit for 0day linksys unauthenticated remote code execution vulnerability. As exploited by TheMoon worm; Discovered in the wild on Feb 13, 2013 by Johannes Ullrich. I was hoping this would stay under-wraps until a firmware patch could be...

EasyTalk任意用户密码重置

简要描述： EasyTalk任意用户密码重置 详细说明： EasyTalk的用户密码重置功能存在重大缺陷，可重置任意用户密码。 我们看看发送的重置密码的链接： 打开此链接，容易看出使用base64编码，解码看看内容： 尽然是：username，mailadres，userid，dateline 那么，我们把这些参数改了就可以修改任意用户的密码了。 注意上述参数的内容，除了mailadres不能直接得到外，其他参数都可以直接从站内得到。 mailadres也是很容易得到的。 我们测试如下账户，修改如下： 成功重置了admin的密码：...

开源微博EasyTalk任意用户密码修改

简要描述： 开源微博系统EasyTalk任意用户密码修改,包括管理员 而且不用登陆,非常强大... （其实只是一个小小的设计缺陷）:- 详细说明： 1 CMS介绍 EasyTalk是国内首款多用户PHP+Mysql开源微博系统，支持网页、手机Wap、手机短信、QQ、Gtalk、飞信等多种方式发表或接收信息，EasyTalk全面符合国人的上网习惯，真正轻量级架构，使得使用者上手容易，管理者安装部署容易、管理便捷。EasyTalk功能强大，便捷的插件系统，可二次开发性高，人性化的模板自定义功能大幅提高了用户的体验，因此EasyTalk相比国内其他微博系统有绝对的优势！ 2 漏洞分析...

Linksys E-Series Remote Code Execution

!/usr/bin/php ?php / Exploit for 0day linksys unauthenticated remote code execution vulnerability. As exploited by TheMoon worm; Discovered in the wild on Feb 13, 2013 by Johannes Ullrich. I was hoping this would stay under-wraps until a firmware patch could be released, but it appears the cat is...

Dexter CasinoLoader SQL Injection

Exploit Title: Dexter CasinoLoader Panel SQLi Date: Feb, 13, 2014 Exploit Author: Brian Wallace @botnethunter Version: CasinoLoader Tested on: Windows 7, Ubuntu, Debian import pycurl import urllib import cStringIO import base64 import argparse import sys import string import pygeoip version =...

Powershell Base64 Command Encoder

This encodes the command as a base64 encoded command for powershell. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework include Msf::Post::Windows class MetasploitModule 'Powershell Base64 Command Encoder', 'Description'...

[Router Password Decryptor v2.0] Recover internet login/PPPoE authentication passwords, Wireless WEP keys, WPA/WPA2 Passphrases from your Router/Modem configuration file

Router Password Decryptor is the FREE tool to instantly recover internet login/PPPoE authentication passwords, Wireless WEP keys, WPA/WPA2 Passphrases from your Router/Modem configuration file. Currently it supports password recovery from following type of Routers/Modems Cisco Juniper DLink BSNL ...