CVE-2017-15194

include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page...

CVE-2017-15194

include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page...

CVE-2017-15194

include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page...

ClipShare 7.0 SQL Injection

Exploit Title: ClipShare v7.0 - SQL Injection Date: 2017-10-09 Exploit Author: 8bitsec Vendor Homepage: http://www.clip-share.com/ Software Link: http://www.clip-share.com/ Version: 7.0 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected] Contact: https://twitter.com/8bitsec Relea...

cacti -- Cross Site Scripting issue

cacti developers report: The file include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page...

ClipShare 7.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: ClipShare v7.0 - SQL Injection Exploit Author: 8bitsec Vendor Homepage: http://www.clip-share.com/ Software Link: http://www.clip-share.com/ Version: 7.0 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: email protected Contact:...

ClipShare 7.0 - SQL Injection

Exploit Title: ClipShare v7.0 - SQL Injection Date: 2017-10-09 Exploit Author: 8bitsec Vendor Homepage: http://www.clip-share.com/ Software Link: http://www.clip-share.com/ Version: 7.0 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected] Contact: https://twitter.com/8bitsec Relea...

ClipShare 7.0 - SQL Injection

ClipShare 7.0 - SQL Injection Exploit Title: ClipShare v7.0 - SQL Injection Date: 2017-10-09 Exploit Author: 8bitsec Vendor Homepage: http://www.clip-share.com/ Software Link: http://www.clip-share.com/ Version: 7.0 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected] Contact:...

RubyGems: Request Hijacking Vulnerability in RubyGems 2.6.13 and earlier

We received this report via security@ from [email protected], I'm filing here for tracking and visibility purposes... "I was looking at commit 8d91516fb7037ecfb27622f605dc40245e0f8d32, which was the fix for the DNS hijacking issue CVE-2017-0902. The function still handles the DNS response in ...

Mac OS X Local Javascript Quarantine Bypass

Advisory ID: SGMA17-002 Title: Mac OS X Local Javascript Quarantine Bypass Product: Mac OS X Version: 10.12, 10.11, 10.10 and probably prior Vendor: apple.com Type: DOM Based XSS Risk level: 3 / 5 Credits: [email protected] CVE: N/A Vendor notification: 2017-07-27 Vendor fix:...

Adult Script Pro 2.2.4 SQL Injection

Exploit Title: Adult Script Pro 2.2.4 - SQL Injection Dork: N/A Date: 29.09.2017 Vendor Homepage: http://www.adultscriptpro.com/ Software Link: http://www.adultscriptpro.com/order.html Demo: http://www.adultscriptpro.com/demo.html Version: 2.2.4 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...

PG All Share Video 1.0 SQL Injection

Exploit Title: PG All Share Video 1.0 - SQL Injection Dork: N/A Date: 29.09.2017 Vendor Homepage: http://www.pilotgroup.net/ Software Link: http://www.allsharevideo.com/features.php Demo: http://demo.allsharevideo.com/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploi...

Mac OS X Local Javascript Quarantine Bypass youtube Vulnerability

Exploit for macOS platform in category local exploits Details Mac OS X contains a vulnerability that allows the bypass of the Apple Quarantine and the execution of arbitrary Javascript code without restrictions. Basically, Apple's Quarantine works by setting an extended attribute to downloaded...

LFiFreak - An automated LFi Exploiter with Bind/Reverse Shells

LFiFreak is a tool for exploiting local file inclusions using PHP Input, PHP Filter and Data URI methods. Features Works with Windows, Linux and OS X Includes bind and reverse shell for both Windows and Linux Written in Python 2.7 Dependencies BeautifulSoup Download LFiFreak...

Code injection

SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by 1 the Insert Media option in the content editor or 2 an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017...

Consumer Review Script 1.0 SQL Injection

Exploit Title: Consumer Review Script v1.0 - SQL Injection Date: 2017-09-12 Exploit Author: 8bitsec Vendor Homepage: http://www.phpscriptsmall.com/product/consumer-review-script/ Software Link: http://www.phpscriptsmall.com/product/consumer-review-script/ Version: 1.0 Tested on: Kali Linux 2.0 |...

Trend Micro Control Manager - ImportFile Directory Traversal RCE Exploit

Exploit for windows platform in category remote exploits require 'msf/core' require 'msf/core/exploit/phpexe' class MetasploitModule 'Trend Micro Control Manager importFile Directory Traversal RCE', 'Description' = %q This module exploits a directory traversal vulnerability found in Trend Micro...

XYZ Auto Classifieds 1.0 - SQL Injection

Exploit Title: XYZ Auto Classifieds v1.0 - SQL Injection Date: 2017-09-12 Exploit Author: 8bitsec Vendor Homepage: http://xyzscripts.com/ Software Link: https://xyzscripts.com/php-scripts/xyz-auto-classifieds/details Version: 1.0 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected]...

AirStar Airbnb Clone Script 1.0 SQL Injection

Exploit Title: AirStar Airbnb Clone Script v1.0 - SQL Injection Date: 2017-09-11 Exploit Author: 8bitsec Vendor Homepage: https://www.abservetech.com/ Software Link: https://www.abservetech.com/airstar-airbnb-clone/ Version: 1.0 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected]...

CVE-2017-14263

Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in a userManager.addUser request to the /RPC2 URI. The attacker can login to the device with that new user...