CVE-2017-7760

The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be altered by a malicious user by passing a special path to the callback parameter through the Mozilla Maintenance Service, allowing the...

10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow (SEH)

Exploit Title : 10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow SEH Exploit Author : Hashim Jawad - ihack4falafel Vendor Homepage : https://www.10-strike.com/ Vulnerable Software: https://www.10-strike.com/networkinventoryexplorer/network-inventory-setup.exe Tested on : Windows ...

GNU Beep 1.3 - HoleyBeep Local Privilege Escalation

GNU Beep 1.3 - HoleyBeep Local Privilege Escalation !/usr/bin/env python3 E-DB Note https://gist.github.com/Arignir/0b9d45c56551af39969368396e27abe8/ec853f14afd6e86fb3f2efce2086e28f33039ddc E-DB Note https://sigint.sh//holeybeep This is an exploit for HoleyBeep. To use it, place any command you...

LogicalDOC Enterprise 7.7.4 - Root Remote Code Execution Vulnerability

Exploit for java platform in category web applications LogicalDOC Enterprise 7.7.4 Post-Auth Command Execution Via Binary Path Manipulation Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalD...

LogicalDOC Enterprise 7.7.4 - Root Remote Code Execution

LogicalDOC Enterprise 7.7.4 - Root Remote Code Execution LogicalDOC Enterprise 7.7.4 Post-Auth Command Execution Via Binary Path Manipulation Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary:...

LogicalDOC Enterprise 7.7.4 Post-Auth Command Execution

LogicalDOC Enterprise 7.7.4 Post-Auth Command Execution Via Binary Path Manipulation Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document management system that is designe...

LogicalDOC Enterprise 7.7.4 Post-Auth Command Execution Via Binary Path Manipulation

Summary LogicalDOC is a free document management system that is designed to handle and share documents within an organization. LogicalDOC is a content repository, with Lucene indexing, Activiti workflow, and a set of automatic import procedures. Description LogicalDOC suffers from multiple...

OMERO Elevation of Privilege Vulnerability

OMERO is an open source image management viewing application. A security vulnerability exists in OMERO 5.3.3 and earlier versions. An attacker can exploit the vulnerability by creating an OriginalFile and adjusting its path to manipulate other users' data...

CVE-2017-1000438

In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its path such that it now points to another user's file on the underlying filesystem, then manipulate the user's data...

ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability

Summary ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identificatio...

CVE-2017-16661

Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd with a Log Path under /etc to read /etc/passwd...

CVE-2017-16660

CVE-2017-16660 affects Cacti 1.1.27, where remote authenticated administrators can trigger Remote Code Execution by placing the Log Path under the web root and issuing a remote_agent.php request containing PHP code in the Client-ip header. This vulnerability is documented as an arbitrary-code-exe...

Afian AB FileRun 2017.03.18 - Multiple Vulnerabilities

Afian AB FileRun 2017.03.18 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact:...

Afian AB FileRun 2017.03.18 - Multiple Vulnerabilities

Exploit for php platform in category web applications ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact: critical homepage: https://www.filerun.com |...

Afian AB FileRun 2017.03.18 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact: critical homepage: https://www.filerun.com |...

Afian AB FileRun 2017.03.18 CSRF / Shell Upload / XSS / Redirection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact: critical homepage: https://www.filerun.com |...

File upload vulnerability in PHPCMS Content Publishing Management function module

PHPCMS is a website management software. The software adopts modular development and supports a variety of classification methods, using it can easily realize the design, development and maintenance of personalized websites. There is a file upload vulnerability in the PHPCMS content publishing...

PHP 7.1.0 / 5.6.29 missing null byte checks for paths in exif_imagetype Vulnerability

Exploit for php platform in category dos / poc Description: ------------ exifimagetype doesn’t ensure that pathnames lack NULL byte, which might allow attacker to manipulate the file path. =============================================== Affected code: PHPFUNCTIONexifimagetype char imagefile; size...

Debian DSA-3702-1 : tar - security update

Harry Sintonen discovered that GNU tar does not properly handle member names containing '..', thus allowing an attacker to bypass the path names specified on the command line and replace files and directories in the target directory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

ZKTeco ZKBioSecurity 3.0 Directory Traversal Vulnerability

ZKBioSecurity is a comprehensive management platform for biometric security. A directory traversal vulnerability exists in ZKTeco ZKBioSecurity 3.0, which can be exploited by an attacker to obtain sensitive information by modifying a file path...