Exploit for CVE-2020-1938

It is an exploit module for CNVD-2020-10487 CVE-2020-1938, a file read vulnerability in Tomcat AJP. The vulnerability allows an attacker to read files on the server by sending a specially crafted AJP request. The exploit is implemented in Python 2.7 and uses the ajpy library to interact with the...

Exploit for Unrestricted Upload of File with Dangerous Type in Codedropz Drag_And_Drop_Multiple_File_Upload_-_Contact_Form_7

CVE-2020-12800 POC Script for CVE-2020-12800: RCE throug...

Satellian 1.12 - Remote Code Execution

Satellian 1.12 - Remote Code Execution Exploit Title: Satellian 1.12 - Remote Code Execution Date: 2020-01-28 Exploit Author: Xh4H Vendor Homepage: https://www.intelliantech.com/?lang=en Version: v1.12+ Tested on: Kali linux, MacOS CVE : CVE-2020-7980 Github repository:...

New Relic: Passive stored XSS at Synthetics job result page (View resource)

Hey team, I've discovered a stored XSS at Synthetics job result page. There is a View resource link near every URL which was requested by a browser and this link href is the requested URL itself: F577804 All the URLs, the browser interacted with, are saved into the database by a minion, when the...

CVE-2019-14347

Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users editor or developer to create an administrator account via admin/user/add, as demonstrated by a Python PoC script...

XMPlay 3.8.3 - .m3u Local Stack Overflow Code Execution Exploit

Exploit for windows platform in category local exploits !/usr/bin/env python -- coding: utf-8 -- Exploit Title: XMPlay 3.8.3 - '.m3u' Code Execution PoC Exploit Author: s7acktrac3 Vendor Homepage: https://www.xmplay.com/ Software Link: https://support.xmplay.com/filesview.php?fileid=676 Version:...

Blue Server 1.1 - Denial of Service (PoC)

Exploit Title: Blue Server 1.1 - Denial of Service PoC Dork: N/A Date: 2018-11-02 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.mafiatic.org/ Software Link: https://master.dl.sourceforge.net/project/blueserver/Blue-Server-1.1.exe Version: 1.1 Category: Dos Tested on: WiN7x64/KaLiLinuXx...

OpenText Documentum Content Server - Arbitrary File Download

OpenText Documentum Content Server - Arbitrary File Download !/usr/bin/env python Opentext Documentum Content Server formerly known as EMC Documentum Content Server contains following design gap, which allows authenticated user to download arbitrary content files regardless attacker's repository...

Discourse: CSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception)

Hi, I noticed this issue on one of your clients which was using CloudFlare in front of their Discourse. This is not affecting try.discourse.org but the same underlying issue can be seen there as well even though it's not exploitable on that specific domain. The TL;DR of issue is basically:...

Jenkins unauthorized code execution vulnerability analysis-vulnerability warning-the black bar safety net

A, summary CloudBees Jenkins 2.32.1 version exists in Java deserialization vulnerability, and ultimately can lead to remote code execution. Jenkins is a continuous integration continuous integration and continuous delivery system, can improve the software development process of the Central Africa...

shopify-scripts: sprintf gem - format string combined attack

In the sprintf gem, NOT included in mruby-engine, there are severe vulnerabilities, including information leak, and heap buffer overflow. Here are the technical details. Technical Error 1: ============== The CHECKl macro can sometimes receive negative values, that will bypass the size checks, sin...

shopify-scripts: Controlled address leak due to type confusion - ASLR bypass

There are several different places in which arguments are treated as fixnums without a prior check for their type. Since mrbvalue is a union that holds all value types, it can cause a mixup between an object pointer and an integer value: cpp typedef struct mrbvalue union mrbfloat f; void p; mrbin...

The Mac OS X operating system, and found 2 pieces of Privilege elevation 0day vulnerabilities-vulnerability warning-the black bar safety net

Apple Mac OS X operating system, and found 2 pieces new, 0day vulnerabilities, if an attacker successfully exploited, may be in the victim's equipment on elevated privileges to get root access. Vulnerability details These two vulnerabilities is by Italian security researcher Luca Todesco found, a...

Palo Alto Traps Server 3.1.2.1546 - Persistent Cross-Site Scripting

!/usr/bin/ruby =begin ------------------------------------------------------------------------ Product: Palo Alto Traps Server formerly Cyvera Endpoint Protection Vendor: Palo Alto Networks Vulnerable Versions: 3.1.2.1546 Tested Version: 3.1.2.1546 Advisory Publication: 29 March 2015 Vendor...

AOL 9.5 ActiveX Heap Overflow Vulnerability

No description provided by source. Product: AOL 9.5 Vulnerability: ActiveX - Heap Overflow Discussion: Vulnerability is in Activex Control CDDBControl.dll Sending a string to BindToFile , triggering the vulnerability. Successful exploitation allow remote attackers to execute arbitrary code...

PyPAM - Python bindings for PAM - Double Free Corruption

No description provided by source. === LSE Leading Security Experts - Security Advisory 2012-03-01 === PyPAM -- Python bindings for PAM - Double Free Corruption --------------------------------------------------------- Affected Versions ================= PyPAM = 0.4.2 Red Hat PyPAM = 0.5.0-12...

WordPress Count per Day Plugin 3.2.5 (counter.php) - XSS Vulnerability

Exploit for php platform in category web applications Because this is my first Vulnerability I ever found by my self, I wrote a PoC script I know that this is overkill and the Vulnerability is trivial to exploit :P The JavaScript Payload is executed when the Admin views Count per Day - Statistics...

PyPAM Python bindings for PAM - Double-Free Corruption

=== LSE Leading Security Experts - Security Advisory 2012-03-01 === PyPAM -- Python bindings for PAM - Double Free Corruption --------------------------------------------------------- Affected Versions ================= PyPAM = 0.4.2 Red Hat PyPAM = 0.5.0-12 Debian python-pam = 0.4.2-12.2 Ubuntu...

Synergy 1.4 Protocol Cleartext Weakness Proof Of Concept

Exploit Title: Synergy Protocol cleartext weakness PoC Date:April 5th 2011 Author: Sw1tCh Software Link: http://synergy-foss.org/ Version: 1.4 -= Info =- Synergy is Free and Open Source Software that lets you easily share your mouse and keyboard between multiple computers, where each computer has...

Yahoo! Messenger 9 Denial Of Service

Product: Yahoo Messenger 9.0.0.2162 Vulnerability: ActiveX Null Pointer - Denial of Service Description: Yahoo Messenger is prone to a denial-of-service cause of null pointer vulnerability. Vulnerability is in YahooBridgeLib.dll Activex Control An attacker can exploit this vulnerability by entici...