Privacy Pro v1.2 HZ iOS - File Include Web Vulnerability

Document Title: =============== Privacy Pro v1.2 HZ iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1267 Release Date: ============= 2014-05-22 Vulnerability Laboratory ID VL-ID: ====================================...

ClassAd Cross Site Scripting

Cross Site Scripting on ClassAd Risk: Low CWE number: CWE-79 Date: 19/05/2014 Vendor: projects-and-software.de Version:3.00 Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Windows 8 pro Vulnerable File: showads.php Exploit: http:/host/path/showads.php?catid=xss PoC: -Targe...

CyberLink Power2Go Essential 9.0.1002.0 Overflow

!/usr/bin/perl Exploit Title: CyberLink Power2Go Essential 9.0.1002.0 - Registry SEH/Unicode Buffer Overflow Discovery date: 11-26-2013 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software/Version: CyberLink Power2Go 9 Essential 9.0.1002.0 Vendor Site: http://www.cyberlink.com...

RealPlayer - '.3gp' File Processing Memory Corruption

source: https://www.securityfocus.com/bid/67434/info RealPlayer is prone to a memory-corruption vulnerability. An attacker can leverage this issue to crash the affected application, causing a denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible bu...

Files Desk Pro v1.4 iOS - File Include Web Vulnerability

Document Title: =============== Files Desk Pro v1.4 iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1266 Release Date: ============= 2014-05-15 Vulnerability Laboratory ID VL-ID: ====================================...

SpiceWorks 7.2.00174 Cross Site Scripting

Exploit Title: Multiple Stored XSS vulnerabilities in SpiceWorks Ticketing system Date: 12/05/2014 Exploit author: Dolev Farhi @f1nhack Vendor homepage: http://spiceworks.com Software Link: http://download.spiceworks.com/Spiceworks.exe Version: 7.2.00174 Latest Tested on: Kali Linux Vendor alerte...

InvisionPower CMS Links To Titles 3.0 Cross Site Scripting

InvisionPower cms Links to Titles utility Presistent XSS =========================================== Author: UmPire Version: 3.0 Full details for version 3.1 patch is not mentioned. It's suspicious to affect all versions. Vendor URL: http://invisionpower.com Product URL:...

CMS HINTWEB Cross Site Scripting / SQL Injection

Cross Site Scripting on CMS HINTWEB + Date: 04/05/2014 + Risk: LOW + Author: Felipe Andrian Peixoto + Vendor Homepage: http://www.hintweb.com.br/ + Contact: [email protected] + Tested on: Windows 7 and Linux + Vulnerable File: index.php + Exploit : http://host//index.php?txtMSG=XSS + PoC...

K-Lite CODEC 9.x Memory Corruption

Exploit Title: K-lite codec Version 9.x Memory corruption vulnerability Date: 2014/05/3 Author: Aryan Bayaninejad Linkedin : https://www.linkedin.com/profile/view?id=276969082 Vendor Homepage: http://www.codecguide.com Software Link: http://www.oldapps.com/k-litecodecpack.php?oldklitecodec=12328...

SQL Injection in Orbit Open Ad Server

Advisory ID: HTB23208 Product: Orbit Open Ad Server Vendor: OrbitScripts, LLC Vulnerable Versions: 1.1.0 and probably prior Tested Version: 1.1.0 Advisory Publication: March 19, 2014 without technical details Vendor Notification: March 19, 2014 Vendor Patch: March 21, 2014 Public Disclosure: Apri...

Apache Struts ClassLoader Manipulation Remote Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Apache Struts ClassLoader Manipulation Remote Code Execution', 'Description' = %q This module exploits a remote command execution...

Fritz!Box - Remote Command Execution Exploit

Exploit for hardware platform in category web applications App : Fritz!Box Author : 0x4148 Fritz!Box is Networking/voice Over ip router produced by AVM it suffer from Unauthenticated remote command execution flaw Poc :...

Docker Privileged Container Kernel Escape

This module performs a container escape onto the host as the daemon user. It takes advantage of the SYSMODULE capability. If that exists and the linux headers are available to compile on the target, then we can escape onto the host. Module Options msf use...

Heartbleed patch bypass vulnerability,is bitcoin a Scam or Oolong? - Vulnerability warning-the black bar safety net

Someone in the seclists questions, the new Heartbleed is true? And provide an original link http://pastebin. com/qPxR9BRv to turnthe wallyou know） ! The original of the brief meaning is: They found that the OpenSSL patch scheme to throw the natural vulnerability exists in the processing variables...

Symantec Endpoint Protection Manager 12.1.x - Overflow (SEH) (PoC)

Symantec Endpoint Protection Manager 12.1.x - Overflow SEH PoC Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/33056-sepm-secars-poc-v0.3.tar.gz !/usr/bin/perl -w Exploit Title: Symantec Endpoint Protection Manager 12.1.x - SEH Overflow POC...

Shortcode Ninja <= 1.4 - Unauthenticated Reflected XSS

The last time it was checked the plugin was still affected and had been closed. PoC http://www.example.com/wp-content/plugins/shortcode–ninja/preview-shortcode-external.php?shortcode=shortcode%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E...

Movies <= 0.6 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The last time it was checked the plugin was still affected and had been closed. PoC http://www.example.com/wp-content/plugins/movies/getid3/demos/demo.mimeonly.php?filename=filename%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&...

LogiVert Webshop Software Cross Site Scripting

Cross Site Scripting on LogiVert Webshop Software Risk: Low CWE number: CWE-79 Date: 23/04/2014 Vendor: www.logivert.com Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Windows 8 pro Vulnerable File: index.php Exploit: http:/host/index.php%3fitem=xss PoC: - Target:...

Ian Dunn: Xss in CampTix Event Ticketing

Xss present in tools -- Notify I have made small video poc please have a look : https://www.dropbox.com/s/smuy4lfjwt9fx1v/ticket.mp4 Looking forward Atul...

AirPhoto WebDisk 4.1.0 Code Execution

Document Title: =============== AirPhoto WebDisk v4.1.0 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1258 Release Date: ============= 2014-04-22 Vulnerability Laboratory ID VL-ID: ====================================...