Wordpress CP Image Store with Slideshow Plugin 1.0.5 Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress CP Image Store with Slideshow 1.0.5 Arbitrary file download vulnerability Date: 2015-07-10 Google Dork: Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Vendor Homepage: http://wordpress.dwbooster.com/...

Immunity Debugger 1.85 - Crash PoC

Exploit for windows platform in category dos / poc Title: Immunity Debugger - Crash Date: 08/07/2015 Author: Arsyntex Vendor Homepage: http://www.immunityinc.com/products/debugger/ Version: v1.85 Tested on: Windows 8.1 Pro Incorrect path/file EXtEnsion parsing. -Create folder with the name:...

WordPress Plugin CP Image Store with Slideshow 1.0.5 - Arbitrary File Download

Exploit Title: WordPress CP Image Store with Slideshow 1.0.5 Arbitrary file download vulnerability Date: 2015-07-10 Google Dork: Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Vendor Homepage: http://wordpress.dwbooster.com/ Software Link:...

File Roller 3.4.1 Denial Of Service

!/usr/bin/perl Title: File Roller - DoS PoC Date: 08/07/2015 Author: Arsyntex Homepage: https://wiki.gnome.org/Apps/FileRoller Version: v3.4.1 Tested on: Linux lab 3.2.0-85-generic-pae 122-Ubuntu i686 i386 GNU/Linux ------------------------------------------------------------------------- Create ...

File Roller v3.4.1 - Denial of Service (PoC)

!/usr/bin/perl Title: File Roller - DoS PoC Date: 08/07/2015 Author: Arsyntex Homepage: https://wiki.gnome.org/Apps/FileRoller Version: v3.4.1 Tested on: Linux lab 3.2.0-85-generic-pae 122-Ubuntu i686 i386 GNU/Linux ------------------------------------------------------------------------- Create ...

Wordpress S3Bubble Cloud Video With Adverts & Analytics 0.7 - Arbitrary File Download Vulnerabil

Exploit for php platform in category web applications Exploit Title: Wordpress S3Bubble Cloud Video With Adverts & Analytics - Arbitrary File Download Google Dork: inurl:/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/ Date: 04/07/2015 Exploit Author: CrashBandicot @DosPerl Vendor Homepage:...

Merethis Centreon 2.5.4 SQL Injection / Remote Command Execution

Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution CVEs: CVE-2015-1560, CVE-2015-1561 Vendor: Merethis - www.centreon.com Product: Centreon Version affected: 2.5.4 and prior Product description: Centreon is the choice of some of the world's largest companies...

UDID+ v2.5 iOS - Mail Command Inject Vulnerability

Document Title: =============== UDID+ v2.5 iOS - Mail Command Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1542 Release Date: ============= 2015-07-06 Vulnerability Laboratory ID VL-ID: ==================================== 1542...

WK UDID 1.0.1 Command Injection

Document Title: =============== WK UDID v1.0.1 iOS - Command Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1539 Release Date: ============= 2015-07-01 Vulnerability Laboratory ID VL-ID: ==================================== 1539...

WordPress S3Bubble Cloud Video With Adverts / Analytics Arbitrary File Download

Exploit Title: Wordpress S3Bubble Cloud Video With Adverts & Analytics - Arbitrary File Download Google Dork: inurl:/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/ Date: 04/07/2015 Exploit Author: CrashBandicot @DosPerl Vendor Homepage: https://s3bubble.com Software Link:...

Discuz CSRF发帖POC可蠕虫

简要描述： TSRC西安沙龙议题案例之Discuz（影响大量站点，即使修改某文件做过部分防御仍可绕过）。 详细说明： 0x01 窃取Token 默认安装的Discuz，crossdomain.xml中的allow-access-from为，所以任意域下的flash均可窃取discuz的Token（formhash），造成csrf。 经过统计，常见的八个安全社区： 其中红色的四个在我统计的时候仍然存在该问题。 从安全社区的现状即可预估所有Discuz社区的现状，存在漏洞的概率至少在50%以上，而且肯定远比这个值高（毕竟统计的是安全社区，站长和管理员都是相对懂的，就高达50%）。...

AirDroid - Arbitrary File Upload

/IN THE NAME OF GOD /auth====PARSA ADIB import sys,requests,re,urllib2 def logo: print"\t\t . . . ." print"\t\t || | / || | /" print"\t\t\ \ | \ / |\ / | |/ | " print"\t\t / | || | / // | | | \ / // | " print"\t\t /||| \ | || /|\ | " print"\t\t / / / " print "\t\tAIRDROID VerAll UPLOAD...

Image Export <= 1.1.0 - Directory Traversal

The image-export WordPress plugin was affected by a Directory Traversal security vulnerability. PoC $ curl http://www.example.com/wp-content/plugins/image-export/download.php?file=/etc/passwd...

WordPress Plugin S3Bubble Cloud Video With Adverts Analytics 0.7 - Arbitrary File Download

WordPress Plugin S3Bubble Cloud Video With Adverts Analytics 0.7 - Arbitrary File Download Exploit Title: Wordpress S3Bubble Cloud Video With Adverts & Analytics - Arbitrary File Download Google Dork: inurl:/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/ Date: 04/07/2015 Exploit Author:...

Swim Team <= v1.44.10777 - Local File Inclusion

The code in ./wp-swimteam/include/user/download.php doesn't sanitize user input from downloading sensitive system files. PoC $ curl "http://www.vapidlabs.com/wp-content/plugins/wp-swimteam/include/user/download.php?file=/etc/passwd=/etc/passwd=text/html=1=/usr/share/wordpress"...

McAfee SiteAdvisor 3.7.2 (firefox) Use After Free PoC

Exploit for windows platform in category dos / poc McAfee SiteAdvisor 3.7.2 for firefox Use After Free Poc / Title: McAfee SiteAdvisor 3.7.2 firefox Use After Free Author: Marcin Ressel Twitter: https://twitter.com/mressel NPMcFFPlg32.dll McAfee SiteAdvisor 3.7.2 Tested on: Windows 8.1 x64 and...

D-Link DSP-W w110 v1.05b01 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: D-Link DSP-W Arbitrary Arbitrary file upload Date: 30/06/2015 Exploit Author: DNO Vendor Homepage: link Version: w110 v1.05b01 Tested on: linux CVE : N/A ======================================== the only 'filtering' on this...

Blueberry Express v5.9.x - Buffer Overflow Vulnerability

Document Title: =============== Blueberry Express v5.9.x - Buffer Overflow Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1535 Video: http://www.vulnerability-lab.com/getcontent.php?id=1537 Release Date: ============= 2015-06-28...

phpyun注入漏洞#2

简要描述： phpyun注入漏洞2 详细说明： 文件名： \app\controller\friend\index.class.php中 有这样一句 $nid=$M-SaveFriendInfo$POST,array"uid"=$this-uid; 传入了整个post,我们跟进SaveFriendInfo看看. 文件名： \app\model\friend.model.php function SaveFriendInfo$Values=array,$Where=array ifempty$Where $ValuesStr=$this-FormatValues$Values; retur...

Microsoft refused to fix the 3 2-bit the IE vulnerability, the reason given is: 3 2-bit programs to be eliminated-vulnerability warning-the black bar safety net

! HP security expert Dustin Childs recently disclosed one that affects millions of 3 2-bit Windows systems the IE vulnerability. Looks pretty serious isn't it? However, Microsoft does not seem to intend to fix this vulnerability...... This is a based on ASLR, address space layout randomization of...