Goahead webserver <= 2.1.8-path bypass-sensitive File Download vulnerability

1 Introduction Goahead webserver is an embedded OpenSource server that can be build on a lot of systems CE, Ecos, GNU/Linux, Lynx, MacOS, NW, QNX4, VXWORKS, Win32 and others. It is supported by a lot of companies that use it for their projects and it is also used like "base" for other webservers,...

Microsoft Edge read:// urlhandler Information Disclosure Vulnerability (CVE-2017-0065 )

This exploit was reported to Microsoft and I was acknowledged for doing so. The exploit has been patched on March 14th 2017 under names cve-2017-0065 and MS17-007 and will not work if related patches are applied. Sourcecode is provided for educational purposes only. General This exploit requires...

BrainDamage - A fully featured backdoor that uses Telegram as a C&C server

A python based backdoor which uses Telegram as C&C server. /\ /.\ ,.-'/ ",'-., -^ /-^: | \ | \ | | | | | | | | Coded by: Mehul [email protected] -- Github: https://github.com/mehulj94 -- Twitter: https://twitter.com/wayfarermj -- For windows only | | | | | | | | | / / | | | | | '/ / |...

CVE-2016-8017

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...

Design/Logic Flaw

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...

CVE-2016-8017

CVE-2016-8017 is a concrete vulnerability in McAfee VirusScan Enterprise for Linux (VSEL) up to version 2.0.3 where the web interface handles special elements (tplt) in user input, enabling an authenticated remote attacker to read files on the webserver. The underlying issue is a Special Element ...

CVE-2016-8017

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...

Code injection

An issue was discovered in Eaton xComfort Ethernet Communication Interface ECI Versions 1.07 and prior. By accessing a specific uniform resource locator URL on the webserver, a malicious user may be able to access files without authenticating...

CVE-2016-9368

An issue was discovered in Eaton xComfort Ethernet Communication Interface ECI Versions 1.07 and prior. By accessing a specific uniform resource locator URL on the webserver, a malicious user may be able to access files without authenticating...

CVE-2016-8017: Improper Input Validation

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...

PT-2017-10092

Name of the Vulnerable Software and Affected Versions Eaton xComfort Ethernet Communication Interface ECI versions 1.07 and prior Description An issue allows a malicious user to access files without authenticating by accessing a specific URL on the webserver. Recommendations For versions 1.07 and...

CVE-2016-9368: Improper Access Control

An issue was discovered in Eaton xComfort Ethernet Communication Interface ECI Versions 1.07 and prior. By accessing a specific uniform resource locator URL on the webserver, a malicious user may be able to access files without authenticating...

Attacks Heating Up Against Apache Struts 2 Vulnerability

Public attacks and scans looking for exposed Apache webservers have ramped up dramatically since Monday when a vulnerability in the Struts 2 web application framework was patched and proof-of-concept exploit code was introduced into Metasploit. The vulnerability, CVE-2017-5638, was already under...

Evostream Media Server 1.7.1 (x64) - Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: Evostream Media Server 1.7.1 – Built-in Webserver DoS Date: 2017-03-07 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: https://evostream.com/software-downloads/ Version: 1.7.1 Tested on:...

Evostream Media Server 1.7.1 Denial Of Service

Exploit Title: Evostream Media Server 1.7.1 a Built-in Webserver DoS Date: 2017-03-07 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: https://evostream.com/software-downloads/ Version: 1.7.1 Tested on: Windows Server 2008 R2 Standard x64 CVE : CVE-2017-64...

Fully Featured Backdoor – Telegram C&C: BrainDamage

A python based backdoor which uses Telegram as C&C server. Features Persistance USB spreading Port Scanner Router Finder Run shell commands Keylogger Insert keystrokes Record audio Webserver Screenshot logging Download files in the host Execute shutdown, restart, logoff, lock Send drive tree...

HiSilicon ASIC Firmware Multiple Vulnerabilities (Feb 2017) - Active Check

HiSilicon ASIC firmware are prone to multiple vulnerabilities: 1. Buffer overflow in built-in webserver 2. Directory path traversal built-in webserver SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respecti...

CVE-2016-9332

An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. Moxa SoftCMS Webserver does not properly validate input. An attacker could provide unexpected values and cause the program to crash or excessive consumption of resources could result in a denial-of-service condition...

Race condition

An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. Moxa SoftCMS Webserver does not properly validate input. An attacker could provide unexpected values and cause the program to crash or excessive consumption of resources could result in a denial-of-service condition...

CVE-2016-9332

An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. Moxa SoftCMS Webserver does not properly validate input. An attacker could provide unexpected values and cause the program to crash or excessive consumption of resources could result in a denial-of-service condition...