Yahoo! Open Redirect

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: Yahoo Bug Bounty Program Vulnerability 2 Open Redirect Advisory ID: SSCHADV2013-YahooBB-002 Author: Stefan Schurtz Affected Software: Successfully tested on ads.yahoo.com Vendor URL: http://yahoo.com Vendor Status: informed...

Joomla Aclassfb Shell Upload

Title : Joomla comaclassfb File Upload Vulnerability Author : DevilScreaM Date : 10 January 2014 Category : Web Applications Vendor : http://www.almondsoft.com Type : PHP Greetz : 0day-id.com | newbie-security.or.id | Borneo Security | Indonesian Security Indonesian Hacker | Indonesian Exploiter ...

Joomla Melody Cross Site Scripting

Author: TUNISIAN CYBER + Exploit Title: Joomla Component commelody XSS Vulnerability + Date: 09-01-2014 + Category: WebApp + Google Dork: :inurl:"components/commelody/" + Tested on: KaliLinux + Friend's blog: www.na3il.com +Exploit: The Joomla melody component suffers from an xss vulnerability...

Command injection vulnerability in Ruby Gem sprout 0.7.246

Title: Command injection vulnerability in Ruby Gem sprout 0.7.246 Date: 11/14/2013 Download: http://rubygems.org/gems/sprout, http://projectsprouts.org/ Vulnerability: The unpackzip function contains the following code: sprout-0.7.246/lib/sprout/archiveunpacker.rb 60 zipdir =...

SAP NetWeaver - SMB Relay

Application: SAP Vendor URL: http://www.sap.com Bugs: Security Bypass, Directory Traversal, SMB Relay Exploits: YES Reported: 01.07.2014 Vendor response: 02.07.2014 Date of Public Advisory: 15.12.2014 Reference: SAP Security Note 2077260 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION...

Hiox Guest Book 5.0 Cross Site Scripting

Exploit Title : HIOX GUEST BOOK 5.0 HGB-5.0 Cross Site Scripting Author : JoKeRStEx Tested On : Windows Download Software Link : www.hscripts.com/scripts/php/downloads/HGB.zip Date : 03/01/2014 + P.O.C prompt'JoKeRStEx'" prompt'xss email'" prompt'xss comment'" + For test The Exploit Example...

Ofilter Player WAV文件处理除零错误拒绝服务漏洞

Ofilter Player是一款简单易用的多媒体播放器。 Ofilter Player不正确处理畸形WAV文件，允许攻击者构建恶意文件，诱使应用程序解析，触发除零错误，可使应用程序崩溃。 0 Ofilter Player 1.1 目前没有详细解决方案提供： http://www.008soft.com/ ?php / Title: Ofilter Player 1.1 .wav Integer Division by Zero Version: 1.1 Tested on: Windows XP SP2 en Vendor: http://www.008soft.com/ Softwa...

Ophcrack 3.6 DLL Hijacking

/ Title: Ophcrack 3.6 Dll Hijacking Exploit quserex.dll Version: 3.6 Tested on: Windows 8 64-bit ,Windows XP SP2 en Vendor: http://ophcrack.sourceforge.net/ Software Link: http://sourceforge.net/projects/ophcrack/files/ophcrack/3.6.0/ophcrack-win32-installer-3.6.0.exe E-Mail:...

CMS Afroditi 1.0 Blind SQL Injection

Exploit Title: CMS Afroditi v.1.0 Blind SQL Injection Date: 30/12/2013 Exploit Author: projectzero labs Vendor Homepage: http://www.naxtech.com Vendor Informed: 20 & 24/12/2013 Software Demo: http://afroditi.naxtech.com Version: v.1.0 About the software: =================== Αs indicated in the...

NoticeBoardPro 1.x SQL Injection

Author: TUNISIAN CYBER + Exploit Title: NoticeBoardPro v1.X SQL Injection vulnerability + Date: 27-12-2013 + Category: WebApp + Google Dork: n/a + Tested on: KaliLinux + Vendor: http://www.noticeboardpro.com/ +Description: NoticeBoardPro is an online, web-based, notice / bulletin board system...

Ofilter Player 1.1 - .wav Integer Division by Zero

Ofilter Player 1.1 - .wav Integer Division by Zero ?php / Title: Ofilter Player 1.1 .wav Integer Division by Zero Version: 1.1 Tested on: Windows XP SP2 en Vendor: http://www.008soft.com/ Software Link: http://www.008soft.com/downloadsOfilterPlayer.exe E-Mail: [email protected] Bug...

Ofilter Player 1.1 Integer Division By Zero

?php / Title: Ofilter Player 1.1 .wav Integer Division by Zero Version: 1.1 Tested on: Windows XP SP2 en Vendor: http://www.008soft.com/ Software Link: http://www.008soft.com/downloadsOfilterPlayer.exe E-Mail: [email protected] Bug Discovered by: Osanda Malith Twitter: @OsandaMalith /!...

AWS Elastic Beanstalk Code Execution

Form:http://en.wooyun.org/bugs/wooyun-2013-040 Abstract£º AWS Elastic Beanstalk is an even easier way for you to quickly deploy and manage applications in the AWS cloud. elasticbeanstalk subdomain exists Struts2 code execution . Details£º poc return /ok:...

SQL Injection in Sexy Polling Joomla Extension

High-Tech Bridge Security Research Lab discovered vulnerability in Sexy Polling Joomla Extension, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in Sexy Polling Joomla Extension: CVE-2013-7219 The vulnerability exists due to insufficient validation of "answerid" HTTP POS...

AFCommerce Remote File Inclusion

o AFCommerce a.k.a Amazing Flash Commerce = Remote File Inclusion Vulnerability Software : AFCommerce Professional Edition Version : n/a Vendor : http://www.afcommerce.com/ Author : NoGe Contact : nogedotcodeatgmaildotcom Desc : AFCommerce is a full and complete online store with both a store fro...

phpBB3 Unified Convertor Framework PHP Code Injection

PhpBB3 Unified Convertor Framework suffers from a PHP Code Injection in installation path. By default it should be disabled but you can find open installation path's by dorking it or seeking for dir's. Title: phpBB3 Unified Convertor Framework PHP Code Injection Date: 12.12.13 Contact:...

IcoFX 2.5.0.0 - .ico Buffer Overflow (PoC)

IcoFX 2.5.0.0 - .ico Buffer Overflow PoC Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ IcoFX Buffer Overflow Vulnerability PoC: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/30208.zip 1. Advisory Information Title: IcoFX Buffer Overflow...

CSRF Horde Groupware Web mail Edition

Exploit Title : CSRF Horde Groupware Web mail Edition Author:Marcela Benetrix Date: 10/28/13 version: 5.1.2 software link:http://www.horde.org/apps/webmail GroupWare Web mail Edition Horde Groupware Webmail Edition is a free, enterprise ready, browser based communication suite. Users can read, se...

Ovidentia 7.9.6 - Multiple Vulnerabilities

Exploit Title: Ovidentia 7.9.6 Multiple Vulnerabilities Author: sajith version: Ovidentia 7.9.6 Vendor Homepage: http://www.ovidentia.org/ vulnerable app link:http://www.ovidentia.org/telecharger 1SQL injection vulnerability Log into admin panel and access delegate functionality managing...

RedAxScript 1.1 SQL Injection

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...