Hewlett Packard Enterprise Intelligent Management Center mibFileServlet Directory Traversal Denial of Service Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

macOS Kernel 10.12.3 (16D32) - audit_pipe_open Off-by-One Memory Corruption Exploit

Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1126 MacOS kernel memory corruption due to off-by-one in auditpipeopen auditpipeopen is the special file open handler for the auditpipe device major number 10. Here's the code:...

USN-2933-1: Exim vulnerabilities

It was discovered that Exim incorrectly filtered environment variables when used with the perlstartup configuration option. If the perlstartup option was enabled, a local attacker could use this issue to escalate their privileges to the root user. This issue has been fixed by having Exim clean th...

Redis unauthorized access with SSH key file use analysis: ZoomEye the latest global exclusive data V2-vulnerability warning-the black bar safety net

Updates ! 2. Vulnerability overview Redis by default, it will bind on 0.0.0.0:6 3 7 9, This will be the Redis service exposed to the public Internet, if there is no open authentication, can cause any user can access the target server is not authorized to access Redis and read the Redis data...

DiscuzX 任意文件操作漏洞

简要描述： DiscuzX 任意文件操作漏洞 详细说明： 漏洞实际上是任意文件删除，但是由于删除的函数容易被定位，所以不方便写在简要描述或标题内。 昨天下载DiscuzX 3.2的代码，在 source/include/spacecp/spacecpprofile.php 中找到以下代码： if$GET'deletefile' && isarray$GET'deletefile' foreach$GET'deletefile' as $key = $value ifisset$G'cache''profilesetting'$key echo...

ThinkSAAS某功能设计不当可能导致可以csrf后台GETSHELL

简要描述： ThinkSAAS某处处存在任意文件操作，利用CSRF直接前台导致GETSHELL 详细说明： 首先这里存在问题的是后台系统管理的数据备份还原处。 这里没有过滤sql参数，直接带入，拼接data/baksql/目录，然后进入恢复数据 这里在恢复是判断有没有分卷，没有分卷就直接恢复了，没有处理所要备份的sql文件的路径，类型，内容等，导致操作任意文件。 然后来看看这里数据恢复的操作： 我们抓个包： 我们在前台上传一个图片，图片内容为： Drop TABLE IF EXISTS temp; Create TABLE tempcmd text NOT NULL; Insert IN...

ShopEx 最新版后台getshell

简要描述： 最新版shopex-single-4.8.5.81518 后台某处设计缺陷，可以绕过限制，导致可以操作任意文件，最终getshell。 详细说明： 现在流传的拿shell的方法好像都失效了，最新版的getshell。 在后台页面管理——模版列表——模板文件管理中，编辑任意文件： 然后在文件的内容中写入php木马，然后保存，截包： 在修改截获的数据包，修改name的值为php后缀的，这里直接输入php后缀是不行的，可以使用%00绕过： 保存成功。模板文件列表中已经生产了xiaoma.php文件。 最后连接一下：...

Drupal Stage File Proxy模块拒绝服务漏洞

Bugtraq ID:61080 Drupal是使用PHP语言编写的开源内容管理框架，它由内容管理系统和PHP开发框架共同构成 Drupal Stage File Proxy模块存在一个拒绝服务漏洞，允许攻击者长时间重复向服务器提交多次请求，会降低所有文件操作的性能，也可能使得某些文件操作不能使用，造成拒绝服务攻击 0 Drupal Stage File Proxy 7.x-1.x 厂商解决方案 Drupal Stage File Proxy 7.x-1.4已经修复此漏洞，建议用户下载更新： http://drupal.org/project/stagefileproxy...

2X ApplicationServer 10.1 - TuxSystem Class ActiveX Control Remote File Overwrite

2X ApplicationServer 10.1 - TuxSystem Class ActiveX Control Remote File Overwrite 2X ApplicationServer 10.1 TuxSystem Class ActiveX Control TuxScripting.dll ExportSettings Remote File Overwrite Vulnerability tested against: Microsoft Windows Server 2003 r2 sp2 Internet Explorer 8 vendor...

7T Interactive Graphical SCADA System File Operations Buffer Overflows (CVE-2011-1567; CVE-2011-4050)

7-Technologies' IGSS is a Supervisory Control and Data Acquisition SCADA system used for monitoring and controlling industrial processes. Multiple buffer overflow vulnerabilities have been reported in 7T Interactive Graphical SCADA System IGSS. The vulnerability is due to boundary errors in the...

CVE-2010-1768

Unspecified vulnerability in Apple iTunes before 9.1 allows local users to gain console privileges via vectors related to log files, "insecure file operation," and syncing an iPhone, iPad, or iPod touch...

CVE-2010-1768

Unspecified vulnerability in Apple iTunes before 9.1 allows local users to gain console privileges via vectors related to log files, "insecure file operation," and syncing an iPhone, iPad, or iPod touch...

iTunes < 9.1 Multiple Vulnerabilities

Binary data 5491.prm...

Apple iTunes < 9.1 Multiple Vulnerabilities (uncredentialed check)

The version of Apple iTunes on the remote host is prior to version 9.1. It is, therefore, affected by multiple vulnerabilities : - A buffer underflow in ImageIO's handling of TIFF images can lead to a denial of service or arbitrary code execution. CVE-2009-2285 - An integer overflow in the...

CVE-2009-0011

Certificate Assistant in Apple Mac OS X 10.5.6 allows local users to overwrite arbitrary files via unknown vectors related to an "insecure file operation" on a temporary file...

Design/Logic Flaw

Certificate Assistant in Apple Mac OS X 10.5.6 allows local users to overwrite arbitrary files via unknown vectors related to an "insecure file operation" on a temporary file...

CVE-2009-0011

Certificate Assistant in Apple Mac OS X 10.5.6 allows local users to overwrite arbitrary files via unknown vectors related to an "insecure file operation" on a temporary file...

Discuz! admin\runwizard.inc.php get-webshell bug

由于Discuz!的admin\runwizard.inc.php里saverunwizardhistory写文件操作没有限制导致执行代码漏洞. 在文件admin\runwizard.inc.php里代码: $runwizardhistory = array; $runwizardfile = DISCUZROOT.'./forumdata/logs/runwizardlog.php'; if$fp = @fopen$runwizardfile, 'r' $runwizardhistory = @unserializefread$fp, 99999; fclose$fp;...

CVE-2008-4214

Unspecified vulnerability in Script Editor in Mac OS X 10.4.11 and 10.5.5 allows local users to cause the scripting dictionary to be written to arbitrary locations, related to an "insecure file operation" on temporary files...

Design/Logic Flaw

Unspecified vulnerability in Script Editor in Mac OS X 10.4.11 and 10.5.5 allows local users to cause the scripting dictionary to be written to arbitrary locations, related to an "insecure file operation" on temporary files...