About shellcodes

In this post we have documented a beginners introduction to shellcode writing. We go from zero to a super simple shellcode using tools you may find already installed in any serious operating system. If you are looking for a digested and more mature way of generating shellcode you should check...

WebsiteBaker Addon Concert Calendar 2.1.4 - Multiple Vulnerabilities

Advisory: Websitebaker Add-on 'Concert Calendar 2.1.4' XSS & SQLi vulnerability Advisory ID: SSCHADV2013-001 Author: Stefan Schurtz Affected Software: Successfully tested on Concert Calendar 2.1.4 Vendor URL: http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37 Vendor Status:...

Advantech WebAccess HMI/SCADA Cross Site Scripting

Title : Advantech WebAccess HMI/SCADA Software Persistence Cross-Site Scripting Vulnerability Author : Antu Sanadi SecPod Technologies www.secpod.com Vendor : http://webaccess.advantech.com/ Advisory : http://secpod.org/blog/?p=569...

CubeCart 5.x Cross Site Scripting

OVERVIEW CubeCart 5.x versions are vulnerable to Cross Site Scripting. 2. BACKGROUND CubeCart is an "out of the box" ecommerce shopping cart software solution which has been written to run on servers that have PHP & MySQL support. With CubeCart you can quickly setup a powerful online store which...

SUSE-SU-2015:1177-2 Security update for MySQL

A stack-based buffer overflow in MySQL has been fixed that could have caused a Denial of Service or potentially allowed the execution of arbitrary code CVE-2012-5611. Security Issue references: CVE-2012-5615 CVE-2012-5615 CVE-2012-5613 CVE-2012-5612 CVE-2012-5611...

SolarWinds Orion IPAM web interface reflected xss vulnerability

Overview SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. ...

CVE-2012-4399

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity XXE injection attack...

Trend Micro Control Manager 5.5/6.0 AdHocQuery BlindSQL Injection (post-auth)

Exploit for asp platform in category web applications !/usr/bin/env python Exploit Title: Trend Micro Control Manager 5.5/6.0 AdHocQuery BlindSQL Injection post-auth Disclosure Date: 09/27/2012 Author: otoy @otoyrood & modpr0be @modpr0be Contact: researchatspentera.com Platform: Windows Tested on...

CVE-2012-2888

Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG text references...

Design/Logic Flaw

Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG text references...

CVE-2012-2888

Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG text references...

CVE-2012-2888

Removed by vendor...

CVE-2012-2888

CVE-2012-2888 is a Chromium use-after-free in SVG text references vulnerability that could allow remote DoS (and possibly other impact) on affected Chromium/Chrome builds prior to the patched versions. Publicly documented fixes reference upgrading Chromium to at least 22.0.1229.94 (e.g., openSUSE...

CVE-2012-2888

Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG text references...

VUPEN - Mozilla Firefox "nsHTMLEditRules" Remote Use-after-free (CVE-2012-3958 / MFSA 2012-58)

VUPEN Security Research - Mozilla Firefox "nsHTMLEditRules" Remote Use-after-free CVE-2012-3958 / MFSA 2012-58 Website : http://www.vupen.com/english/research.php Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Mozilla Firefox is a free and open source web browser and...

Trend Micro InterScan Messaging Security Suite XSS / CSRF Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Trend Micro InterScan Messaging Security Suite Stored XSS and CSRF Date: 13/09/2012 Exploit Author: modpr0be modpr0beatspentera.com Vendor Homepage: http://www.trendmicro.com Software Link:...

Trend Micro Interscan Messaging Security Suite - Persistent Cross-Site Scripting / Cross-Site Request Forgery

Exploit Title: Trend Micro InterScan Messaging Security Suite Stored XSS and CSRF Date: 13/09/2012 Exploit Author: modpr0be modpr0beatspentera.com Vendor Homepage: http://www.trendmicro.com Software Link: http://www.trendmicro.com/ftp/products/interscan/IMSSv7.1Win1394.zip Version:...

Trend Micro Interscan Messaging Security Suite - Persistent Cross-Site Scripting Cross-Site Request Forgery

Trend Micro Interscan Messaging Security Suite - Persistent Cross-Site Scripting Cross-Site Request Forgery Exploit Title: Trend Micro InterScan Messaging Security Suite Stored XSS and CSRF Date: 13/09/2012 Exploit Author: modpr0be modpr0beatspentera.com Vendor Homepage: http://www.trendmicro.com...

Foxit Reader < 5.3 Cross-References RCE

The version of Foxit Reader installed on the remote Windows host is prior to 5.3. It is, therefore, affected by a memory corruption issue due to the calculation of a negative number during the processing of cross-references. An attacker can exploit this, by tricking a user into opening a crafted...

Admidio 2.3.5 Multiple security vulnerabilities

Exploit for php platform in category web applications Advisory: Admidio 2.3.5 Multiple security vulnerabilities Author: Stefan Schurtz Affected Software: Successfully tested on Admidio 2.3.5 Vendor URL: http://www.admidio.org/ Vendor Status: fixed ========================== Vulnerability...