PT-2019-6675

Name of the Vulnerable Software and Affected Versions Polipo versions prior to 1.0.4.1 Description The issue arises from a specially-crafted HTTP POST or PUT request, which can cause a Denial of Service DoD. Recommendations For versions prior to 1.0.4.1, update to version 1.0.4.1 or later to...

Wing FTP Server <= 4.3.8 Authenticated Command Execution Vulnerability

Wing FTP Server is prone to an authenticated command execution vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Wing FTP Server Authenticated Command Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote include Msf::Exploit::CmdStager include Msf::Exploit::Remote::HttpClient def...

Wing FTP Server - (Authenticated) Command Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Wing FTP Server Authenticated Command Execution', 'Description' = %q This module exploits the embedded Lua interpreter in the admin w...

Wing FTP Server Authenticated Command Execution Exploit

This Metasploit module exploits the embedded Lua interpreter in the admin web interface for versions 4.3.8 and below. When supplying a specially crafted HTTP POST request an attacker can use os.execute to execute arbitrary system commands on the target with SYSTEM privileges. This module requires...

Wing FTP Server Authenticated Command Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Wing FTP Server Authenticated Command Execution', 'Description' = %q This module exploits the embedded Lua interpreter in the admin w...

PhpWiki RCE Vulnerability

PhpWiki is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Rocket Servergraph Admin Center fileRequestor Directory Traversal (CVE-2014-3914)

A code execution vulnerability exists in Rocket Servergraph Admin Center. The vulnerability occurs when making an HTTP POST request to the URI /SGPAdmin/fileRequest with the parameters cmd=writeDataFile, cmd=run, cmd=runClear or cmd=del, which can be present in the Body of the request. A remote...

SlowHTTPTest - Application Layer DoS attack simulator

SlowHTTPTest is a highly configurable tool that simulates some Application Layer Denial of Service attacks. It works on majority of Linux platforms, OSX and Cygwin - a Unix-like environment and command-line interface for Microsoft Windows. It implements most common low-bandwidth Application Layer...

D-Link DIR-505 HNAP Request Remote Buffer Overflow Exploit

Stack-based buffer overflow in the dohnap function in www/mycgi.cgi in D-Link DSP-W215 Rev. A1 with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in...

BoltWire 4.10 Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Vulnerability in BoltWire, which can be exploited to execute arbitrary PHP code on the target system and gain complete control over vulnerable web application. 1 Unrestricted Upload of File with Dangerous Type in BoltWire: CVE-2014-4169 The...

华天动力OA任意文件删除

简要描述： Just another bug. 详细说明： 以官网http://demo.oa8000.com/为例， user:123456 登陆后， 向http://demo.oa8000.com/OAapp/bfapp//buffalo/oaPubptUploadService POST如下参数： \n removeFile\n C:/PROGRA1/htoa/Tomcat/webapps/OAapp/1.html\n 即可删除1.html 漏洞证明： 在删除前，利用wooyun-2014-065670看到的结果本来是这样的 删除后，...

SQL Injection in Е2

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in Е2, which can be exploited to perform SQL injection attacks and gain control over the vulnerable application. 1 SQL Injection in Е2: CVE-2014-4736 The vlnerability exists due to insufficient sanitization of input dat...

Simple Machines Forum 1.1.6 HTTP POST Request Filter Security Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/31594/info Simple Machines Forum SMF is prone to a security-bypass vulnerability because the application fails to sufficiently sanitize user-supplied input. Attackers can exploit this issue to bypass filter restrictions a...

Kimai 0.9.2 - 'db_restore.php' SQL Injection

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = AverageRanking include Msf::Exploit::Remote::HttpClient include...

Oracle WebLogic Session Fixation Via HTTP POST

No description provided by source...

McAfee ePolicy Orchestrator 1.x/2.x/3.0 Agent HTTP POST Buffer Mismanagement Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9476/info The McAfee ePolicy Orchestrator agent has been reported to a buffer management vulnerability that may be exploited to crash the affected agent. Although unconfirmed, it has been reported that the issue may also...

MOJO's IWMS <= 7 SQL Injection & Cross Site Scripting

No description provided by source. Exploit Title: MOJO's IWMS = 7 SQL Injection & Cross Site Scripting. Date: 2/02/10 Author: cp77fk4r | empty0pageSHIFT+2gmail.comhttp://gmail.com | www.DigitalWhisper.co.ilhttp://www.DigitalWhisper.co.il Software Link: http://www.mojo.co.il Version: = 7 Tested on...

Invision Power Board 1.x/2.0 HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12888/info Invision Power Board is reported prone to an HTML injection vulnerability. This issue arises due to insufficient sanitization of user-supplied data. It is reported that due to a lack of filtering of HTML tags, ...

PHPWebFTP 2.3 - Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/17688/info phpWebFTP is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input using the HTTP 'POST' method when submitting a...