10021 matches found
F5 BIG-IP crossite scripting
Crossite scripting via POST reuqest...
Wing FTP Server - (Authenticated) Command Execution (Metasploit)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Wing FTP Server Authenticated Command Execution', 'Description' = %q This module exploits the embedded Lua interpreter in the admin w...
Wing FTP Server Authenticated Command Execution Exploit
This Metasploit module exploits the embedded Lua interpreter in the admin web interface for versions 4.3.8 and below. When supplying a specially crafted HTTP POST request an attacker can use os.execute to execute arbitrary system commands on the target with SYSTEM privileges. This module requires...
Kolibri WebServer buffer overflow
Buffer overlow on oversized POST request...
BF and XSS vulnerabilities in Zyxel P660RT2 EE
Hello 3APA3A! These are Brute Force and Cross-Site Scripting vulnerabilities in Zyxel P660RT2 EE ADSL Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: Zyxel P660RT2 EE. ZyNOS Firmware Version: V3.40 AXN.1. This model with other firmware...
CVE-2014-5289 - Kolibri WebServer 2.0 Vulnerable to RCE via Overly Long POST Request
Exploit Details ------------------ Senkas Kolibri WebServer 2.0 available at http://www.senkas.com/kolibri/download.php is vulnerable to RCE via an overly long POST request. Sending the exploit will result in a SEH overwrite, which can then be use to redirect execution to a POP POP RET within the...
Senkas Kolibri WebServer 2.0 Buffer Overflow
Exploit Details ------------------ Senkas Kolibri WebServer 2.0 available at http://www.senkas.com/kolibri/download.php is vulnerable to RCE via an overly long POST request. Sending the exploit will result in a SEH overwrite, which can then be use to redirect execution to a POP POP RET within the...
Senkas Kolibri WebServer 2.0 Buffer Overflow Exploit
Senkas Kolibri WebServer version 2.0 is vulnerable to remote code execution via an overly long POST request. Sending the exploit will result in a SEH overwrite, which can then be use to redirect execution to a POP POP RET within the application's binary itself, which once executed, will allow the...
Raritan PowerIQ 4.1.0 - SQL Injection Vulnerability
Exploit for linux platform in category web applications =begin Raritan PowerIQ suffers from an unauthenticated SQL injection vulnerability within an endpoint used during initial configuration of the licensing for the product. This endpoint is still available after the appliance has been fully...
D-Link Devices - 'info.cgi' POST Buffer Overflow (Metasploit)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'D-Link info.cgi POST Request Buffer Overflow', 'Description' = %q This module exploits an anonymous remote code execution vulnerabili...
D-Link info.cgi POST Request Buffer Overflow
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'D-Link info.cgi POST Request Buffer Overflow', 'Description' = %q This module exploits an anonymous remote code execution vulnerabili...
BoltWire 4.10 Arbitrary File Upload Vulnerability
Exploit for php platform in category web applications Vulnerability in BoltWire, which can be exploited to execute arbitrary PHP code on the target system and gain complete control over vulnerable web application. 1 Unrestricted Upload of File with Dangerous Type in BoltWire: CVE-2014-4169 The...
Monkey HTTP Server 0.4/0.5 Invalid POST Request Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6096/info A denial of service vulnerability has been reported for Monkey HTTP server. The vulnerability is due to inadequate checks being performed when decoding POST requests. An attacker can exploit this vulnerability b...
CGIScript.net 1.0 Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4764/info CGIScript.net provides various webmaster related tools and is maintained by Mike Barone and Andy Angrick. It is possible to cause numerous scripts provided by CGIScript.net to disclose sensitive system...
glFusion 1.1 Anonymous Comment 'username' Field HTML Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/33683/info glFusion is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected site,...
OZJournals 1.2 Vname Parameter Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/17954/info OZJournals is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary...
PHPBB2 Page_Header.PHP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6888/info A SQL injection vulnerability has been reported in phpBB2. phpBB2, in some cases, does not sufficiently sanitize user-supplied input which is used when constructing SQL queries. As a result, attackers may supply...
LibHTTPD 1.2 POST Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6172/info LibHTTPD is vulnerable to a buffer overflow condition. By passing a POST request of excessive length, it is possible to overrun a static buffer. This may result in sensitive locations in memory being overwritten...
XennoBB 1.0.x/2.2 Icon_Topic SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/19606/info XennoBB is prone to an SQL-injection vulnerability that could allow an attacker to influence the structure or logic of SQL queries made by the application. --------------------- EXPLOIT ---------------------...
MOJO's IWMS <= 7 SQL Injection & Cross Site Scripting
No description provided by source. Exploit Title: MOJO's IWMS = 7 SQL Injection & Cross Site Scripting. Date: 2/02/10 Author: cp77fk4r | empty0pageSHIFT+2gmail.comhttp://gmail.com | www.DigitalWhisper.co.ilhttp://www.DigitalWhisper.co.il Software Link: http://www.mojo.co.il Version: = 7 Tested on...