CVE-2017-9430

Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service application crash or possibly have unspecified other impact via a command line with a long name argument that is mishandled in a strcpy call for argv0. An example threat model is a web application...

CVE-2017-9430

Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service application crash or possibly have unspecified other impact via a command line with a long name argument that is mishandled in a strcpy call for argv0. An example threat model is a web application...

CVE-2017-9430

Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service application crash or possibly have unspecified other impact via a command line with a long name argument that is mishandled in a strcpy call for argv0. An example threat model is a web application...

DNSTracer 1.8.1 Buffer Overflow

Exploit Title: DNSTracer Stack-based Buffer Overflow CVE: CVE-2017-9430 CWE: CWE-119 Exploit Author: Hosein Askari FarazPajohan Vendor HomePage: http://www.mavetju.org Version : 1.8.1 Tested on: Parrot OS Date: 04-06-2017 Category: Application Author Mail : [email protected] Description:...

DNSTracer 1.8.1 - Buffer Overflow (PoC)

DNSTracer 1.8.1 - Buffer Overflow PoC Exploit Title: DNSTracer Stack-based Buffer Overflow CVE: CVE-2017-9430 CWE: CWE-119 Exploit Author: Hosein Askari FarazPajohan Vendor HomePage: http://www.mavetju.org Version : 1.8.1 Tested on: Parrot OS Date: 04-06-2017 Category: Application Author Mail :...

Kronos Telestaff 2.92EU29 - SQL Injection

Kronos Telestaff 2.92EU29 - SQL Injection Software: Kronos Telestaff Web Application Version: compare timing with device=stdbrowser&action=doLogin&user='ifDBNAME'TELESTAFF'waitfor%20delay'00%3a00%3a12';--&pwd=&code= PoC 2 - Execute Code Remotely example inject benign code e.g. ping a remote syste...

DNSTracer 1.8.1 - Buffer Overflow Vulnerability

Exploit for linux platform in category dos / poc Exploit Title: DNSTracer Stack-based Buffer Overflow CVE: CVE-2017-9430 CWE: CWE-119 Exploit Author: Hosein Askari FarazPajohan Vendor HomePage: http://www.mavetju.org Version : 1.8.1 Tested on: Parrot OS Date: 04-06-2017 Category: Application Auth...

Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities

Document Title: =============== Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2076 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15949 CVE-ID: ======= CVE-2017-15949 Release Date:...

Kronos Telestaff < 2.92EU29 - SQL Injection

Software: Kronos Telestaff Web Application Version: compare timing with device=stdbrowser&action=doLogin&user='ifDBNAME'TELESTAFF'waitfor%20delay'00%3a00%3a12';--&pwd=&code= PoC 2 - Execute Code Remotely example inject benign code e.g. ping a remote systems ?php $cmdtoexecute = strToHex"ping -n 1...

OV3 Online Administration 3.0 - Directory Traversal

OV3 Online Administration 3.0 - Directory Traversal OV3 Online Administration 3.0 Parameter Traversal Arbitrary File Access PoC Exploit Vendor: novaCapta Software & Consulting GmbH Product web page: http://www.meacon.de Affected version: 3.0 Summary: With the decision to use the OV3 as a platform...

Roundcube Webmail < 1.0.6, 1.1.x < 1.1.2 Multiple Vulnerabilities

Roundcube Webmail is prone to multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

lua-resty-waf

It is an offensive tool for web application firewalls WAFs. The repository, huangjacky/lua-resty-waf, contains a high-performance WAF built on the OpenResty stack. The tool is designed to protect against various types of attacks, including HTTP violations, HTTP anomalies, SQL injection, and gener...

SQL Injection Vulnerability in Lazy WorkPass OA Web Intelligent Office System

Lazy work pass OA network intelligent office system is suitable for enterprises and institutions of the general network office software, the system uses B / S operation mode, free version for small and medium-sized enterprises. There is a SQL injection vulnerability in the OA Network Intelligent...

Weblate: Uploaded XLF files result in External Entity Execution

Summary: ======== Weblate users in the Translate group or those with the ability to upload translation files can trigger XML External Entity Execution. This is a well known and high/critical vector of attack that often can completely compromise the security of a web application or in some cases...

InvoicePlane Multiple Vulnerabilities

InvoicePlane is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:invoiceplane:invoiceplane"; if...

IBM Distributed Marketing, Marketing Platform and Marketing Operations Remote Elevation of Privilege Vulnerability

IBM Distributed Marketing, Marketing Platform and Marketing Operations are all products of IBM Corporation in the U.S. IBM Distributed Marketing is a suite of omni-channel marketing solutions.IBM Marketing Platform IBM Distributed Marketing is an omni-channel marketing solution. IBM Marketing...

InvoicePlane Detection (HTTP)

HTTP based detection of InvoicePlane. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.106829";...

F5 Networks BIG-IP : BIG-IP Azure cloud vulnerability (K61757346)

In some circumstances, a BIG-IP Azure cloud instance may contain a default administrative password which can be used to remotely log in to the BIG-IP system. The affected administrative account is the Azure instance administrative user created at deployment. The root and admin accounts are not...

Wordpress Contentive Theme - Cross Site Web Vulnerability

Document Title: =============== Wordpress Contentive Theme - Cross Site Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2065 Release Date: ============= 2017-05-23 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2016-6112

IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative permissions over the web application. IBM X-Force ID: 118282...