MS15-100 Microsoft Windows Media Center MCL Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS15-100 Microsoft Windows Media Center MCL Vulnerability", 'Description' = %q This module exploits a vulnerability in Windows Media...

MS15-100 Microsoft Windows Media Center MCL Vulnerability

This module exploits a vulnerability in Windows Media Center. By supplying an UNC path in the .mcl file, a remote file will be automatically downloaded, which can result in arbitrary code execution. Module Options msf use exploit/windows/fileformat/ms15/100mclexe msf undefined100mclexe show actio...

WordPress Plugin Recent Backups 0.7 - Arbitrary File Download

WordPress Plugin Recent Backups 0.7 - Arbitrary File Download Title: Remote file download vulnerability in recent-backups v0.7 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-13 Download Site: https://wordpress.org/plugins/recent-backups Vendor:...

WordPress Plugin Candidate Application Form 1.0 - Arbitrary File Download

WordPress Plugin Candidate Application Form 1.0 - Arbitrary File Download Title: Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-12 Download Site: https://wordpress.org/plugins/candidate-application-form...

WordPress Plugin Simple Image Manipulator 1.0 - Arbitrary File Download

Title: Remote file download in simple-image-manipulator v1.0 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-16 Download Site: https://wordpress.org/plugins/simple-image-manipulator Vendor: https://profiles.wordpress.org/kevartpatel/ Vendor Notified: 2015-07-16 Vendor Contact:...

WordPress Recent Backups 0.7 File Download Vulnerability

WordPress Recent Backups plugin version 0.7 suffers from an arbitrary remote file download vulnerability. Title: Remote file download vulnerability in recent-backups v0.7 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-13 Download Site:...

WordPress Simple Image Manipulator 1.0 File Download Vulnerability

WordPress Simple Image Manipulator plugin version 1.0 suffers from an arbitrary remote file download vulnerability. Title: Remote file download in simple-image-manipulator v1.0 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-16 Download Site:...

recent-backups <= 0.7 - Remote File Download

Plugin is still affected and has been closed. The code in download-file.php does not verify if the user is logged in or sanitize which files can be downloaded. This vulnerability can be used to download sensitive system files, such as the Linux passwd file. $ curl -v...

simple-image-manipulator <= 1.0 - Remote File Download

Plugin is still affected and has been closed. In ./simple-image-manipulator/controller/download.php no checks are made to authenticate the user or sanitize input when determining file location. PoC $ curl...

simple-image-manipulator <= 1.0 - Remote File Download

Plugin is still affected and has been closed. In ./simple-image-manipulator/controller/download.php no checks are made to authenticate the user or sanitize input when determining file location. $ curl...

wptf-image-gallery 1.0.3 - Remote File Download

Plugin is still affected and has been closed. The ./wptf-image-gallery/lib-mbox/ajaxload.php code doesn't sanitize user input or check that a user is authorized to download files. This allows an unauthenticated user to download sensitive system files: 1 PoC $ curl...

wptf-image-gallery 1.0.3 - Remote File Download

Plugin is still affected and has been closed. The ./wptf-image-gallery/lib-mbox/ajaxload.php code doesn't sanitize user input or check that a user is authorized to download files. This allows an unauthenticated user to download sensitive system files: 1 $ curl...

WordPress Image Export 1.1 Arbitrary File Download Vulnerability

WordPress Image Export plugin version 1.1 suffers from an arbitrary file download vulnerability. Title: Remote file download vulnerability in Wordpress Plugin image-export v1.1 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-01 Download Site: https://wordpress.org/plugins/image-export Vendor:...

WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download

WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download Title: Remote file download vulnerability in Wordpress Plugin wp-swimteam v1.44.10777 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-02 Download Site: https://wordpress.org/plugins/wp-swimteam Vendor: Mike Walsh...

WordPress WP-SwimTeam 1.44.10777 Arbitrary File Download

Title: Remote file download vulnerability in Wordpress Plugin wp-swimteam v1.44.10777 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-02 Download Site: https://wordpress.org/plugins/wp-swimteam Vendor: Mike Walsh www.MichaelWalsh.org Vendor Notified: 2015-07-02, fixed in v1.45beta3 Vendor...

WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download

Title: Remote file download vulnerability in Wordpress Plugin wp-swimteam v1.44.10777 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-02 Download Site: https://wordpress.org/plugins/wp-swimteam Vendor: Mike Walsh www.MichaelWalsh.org Vendor Notified: 2015-07-02, fixed in v1.45beta3 Vendor...

WordPress MDC-Youtube-Downloader 2.1.0 File Disclosure Vulnerability

WordPress MDC-Youtube-Downloader plugin version 2.1.0 suffers from an arbitrary file download vulnerability. Title: Remote file download in Wordpress Plugin mdc-youtube-downloader v2.1.0 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-01 Download Site:...

WordPress WP-Ecommerce-Shop-Styling 2.5 File Download Vulnerability

WordPress WP-Ecommerce-Shop-Styling plugin version 2.5 suffers from an arbitrary file download vulnerability. Title: Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-05 Download Site:...

Linux/x86 - Download & Execute

Linux/x86 - Download & Execute. Shellcode exploit for linx86 platform Linux/x86 Download&Execute ------WE ARE BOMBERMANS---- Greetz : BombermanLeader Author : B3mB4m Just the two of us LOL. Info! This shellcode has two part.Because when using fork in asm, ocurrs problems in shellcode. So you can...

WordPress SE HTML5 Album Audio Player Plugin 1.1.0 - Directory Traversal

There is a remote file download vulnerability in this plugin. The file called " downloadaudio.php" does not check the file path. Solution Upgrade the plugin...