MS Internet Explorer "mshtml.dll" CSS Parsing Buffer Overflow

No description provided by source. / Taken from http://www.securiteam.com/exploits/5NP042KF5A.html The exploit will create a .CSS file that should be included in an HTML file. When a user loads the HTML file, Internet Explorer will try to parse the CSS and will trigger the buffer overflow. /...

Ushahidi 2.2 - Multiple Vulnerabilites

No description provided by source. Exploit Title: Ushahidi 2.2 Multiple Vulnerabilites Date: 04/12/2012 Author: shpendk Software Link: http://download.ushahidi.com/ Version: 2.2 Tested on: Xampp on Windows Vendor Contact: 03/25/2012 - Contacted again: 03/28/2012 - No Response yet: 04/11/2012 - Fu...

Linux write() & exit(0) shellcode genearator with customizable text

No description provided by source. !/usr/bin/python Linux write & exit0 shellcode genearator with customizable text Usage: ./generator msg Author: Stoke Tested on: Ubuntu 8.10 E-mail: stoke95atyahoodotit Web: hack2web.altervista.org Visit: blasterhacking.forumcommunity.net import re, sys def...

jetAudio 8.0.0.2 Basic (m3u) Stack Overflow Exploit

No description provided by source. !/usr/bin/perl Title: jetAudio 8.0.0.2 Basic m3u Stack Overflow Exploit Author: cr4wl3r cr4wl3r!linuxmail.org Tested: Windows xpsp2 my $file=b00m.m3u; my $header = http://; my $junk = A x 1017; my $nseh = \xeb\x06\x90\x90; my $seh = pack'V',0x01221045; my...

WebPageTest Arbitrary PHP File Upload

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

Edraw Office Viewer Component 7.4 - ActiveX Stack Buffer Overflow

No description provided by source. !-- Exploit Title: Edraw Office Viewer Component V7.4 Stack Buffer Overflow Date: 25 Feb 2011 Author: Alexander Gavrun http://0x1byte.blogspot.com/ Software Link: http://www.ocxt.com/ Version: 7.4 Tested on: Windows Xp Sp2 + Internet Explorer 7 + OfficeViewer 7....

Sercomm TCP/32674 Backdoor Reactivation

No description provided by source. / PoC to reactivate Sercomm TCP/32674 backdoor See http://www.synacktiv.com/ressources/TCP32764backdooragain.pdf Eloi Vanderbeken - Synacktiv THIS SOFTWARE IS PROVIDED BY SYNACKTIV ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, T...

Threat Outbreak Alert RuleID7930: Email Messages Distributing Malicious Software on February 17, 2015

Medium Alert ID: 34789 First Published: 2014 June 30 14:15 GMT Last Updated: 2015 February 17 20:26 GMT Version: 103 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID7930KV...

WePay: CSRF on email address operations. Also performing unintended operations.

After authentication in the WePay application, a user can navigate to the "My Settings" tab and perform operations like makeprimary and resend on the email addresses. These operations do not have any CSRF tokens present in the request. The only value unknown to an attacker present in the request ...

TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities

TP-LINK TL-WR841N / TL-WR841ND are vulnerable to many CSRF and XSS attacks because of no CSRF prevention technique and poor parameters filtration. Attacker is able to compromise router and steal config & log files. Title: TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities Date:...

[oss-security] CVE request for vulnerability in OpenStack Heat

A vulnerability was discovered in OpenStack see below. In order to ensure full traceability, we need a CVE number assigned that we can attach to further notifications. This issue is already public, although an advisory was not sent yet. Title: Heat template URL information leakage Reporter: Jason...

Discuz跨域数据劫持＋附件类型限制绕过

简要描述： 两个凑一块发了 详细说明： 1 跨域数据劫持（csrf token formhash盗取） 下载远程附件功能不会对文件内容（文件格式）进行检测导致可以上传恶意的swf文件（扩展名还是图片扩展名），进而进行跨域数据劫持： 伪造图片CrossDomainDataHijack.jpg相关代码： package com.powerflasher.SampleApp import flash.external.ExternalInterface; import flash.display.Sprite; import flash.display.Sprite; import...

asterisk -- multiple vulnerabilities

The Asterisk project reports: Asterisk Manager User Unauthorized Shell Access. Manager users can execute arbitrary shell commands with the MixMonitor manager action. Asterisk does not require system class authorization for a manager user to use the MixMonitor action, so any manager user who is...

PayPal GoToMaxx PDFMailer - Local Overflow Vulnerability

Document Title: =============== PayPal GoToMaxx PDFMailer - Local Overflow Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1274 http://www.vulnerability-lab.com/getcontent.php?id=940 Video: https://www.youtube.com/watch?v=IXhwfZV6x0M Release Date:...

Multiple Vulnerabilities in OpenSSL

...

CVE-2014-2577

Multiple cross-site scripting XSS vulnerabilities in the Transform Content Center in Bottomline Technologies Transform Foundation Server before 4.3.1 Patch 8 and 5.x before 5.2 Patch 7 allow remote attackers to inject arbitrary web script or HTML via the 1 pn parameter to index.fsp/document.pdf, ...

SOAPpy 0.12.5 多个漏洞

0×01:Background SOAPpy provides tools for building SOAP clients and servers.The goal of the SOAPpy team is to provide a full featured SOAP library for Python that is very simple to use and that fully supports dynamic interaction between clients and servers. SOAPpy use sax.xml as SOAP parser to...

AuraCMS 3.0 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: AuraCMS 3.0 Multiple Vulnerabilities Date: 05/28/2014 Author: Mustafa ALTINKAYNAK Download URL :http://auracms.org/ Software Link: http://codeload.github.com/auracms/AuraCMS/zip/master Vuln Category: CWE-79 XSS - CWE-98 LFI Test...

Slack: SSRF on https://whitehataudit.slack.com/account/photo

During post request to https://whitehataudit.slack.com/account/photo: POST /account/photo HTTP/1.1 Host: whitehataudit.slack.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:29.0 Gecko/20100101 Firefox/29.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8...

PHPYUN设计缺陷可批量重置全部用户密码

简要描述： 不过重置成了什么我也不知道。 但如果有一天，一个网站所有用户密码全部被重置成随机字符了，所有遗失邮箱的用户就完全丢失自己的账号了。就算没有遗失邮箱，但莫名其妙地被重置密码了，谁会开心？ 详细说明： 0x01. 访问链接friend/index.php?C=profile&id=1可以查看uid=1的用户的信息，其中就有用户名。 因为uid是数字，所以存在遍历的可能，我可以写一个脚本，把数据库中所有用户用户名遍历出来。 0x02...