Linux Embedded Firmware Dynamic Analysis: FIRMADYNE

FIRMADYNE is an automated and scalable system for performing emulation and dynamic analysis of Linux-based embedded firmware. It includes the following components: modified kernels MIPS: v2.6.32 , ARM: v4.1 , v3.10 for instrumentation of firmware execution; a userspace NVRAM library to emulate a...

PageSpeed Modules (mod_pagespeed/ngx_pagespeed) Admin Pages accessible

The script attempts to identify Admin Pages of the PageSpeed Modules modpagespeed/ngxpagespeed. SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Centreon 2.6.x < 2.6.2 File Upload RCE

According to its version number, the Centreon application hosted on the remote web server is 2.6.x prior to 2.6.2. It is, therefore, affected by a remote code execution vulnerability due to improper sanitization of user-uploaded files via the main.php script. An authenticated, remote attacker can...

D-Link DIR-615 Buffer Overflow Vulnerability

D-Link DIR-615 suffers from multiple buffer overflow vulnerabilities. Title: Dlink DIR-615 Authenticated Buffer overflow in Ping and Send email functionality Vendors contacted: William Brown , Patrick Cline email protected CVE: None Note: All these security issues have been discussed with the...

Zenario CMS 7.0.7c Remote Code Execution Vulnerability

Summary Zenario is a web-based content management system for sites with one or many languages. It's designed to grow with your site, adding extranet, online database and custom functionality when you need it. Description The vulnerability is caused due to the improper verification of uploaded fil...

D-Link DIR-818W - Multiple Vulnerabilities

Advisory Information Title: DIR-818W Buffer overflows and Command injection in authentication and HNAP functionalities Vendors contacted: William Brown , Patrick Cline [email protected] CVE: None Note: All these security issues have been discussed with the vendor and vendor indicated...

D-Link DIR-615 Buffer Overflow

Advisory Information Title: Dlink DIR-615 Authenticated Buffer overflow in Ping and Send email functionality Vendors contacted: William Brown , Patrick Cline [email protected] CVE: None Note: All these security issues have been discussed with the vendor and vendor indicated that they...

D-Link DIR-866L Buffer Overflow Vulnerability

D-Link DIR-866L suffers from multiple buffer overflow vulnerabilities. Title: DIR-866L Buffer overflows in HNAP and send email functionalities Vendors contacted: William Brown , Patrick Cline email protected CVE: None Note: All these security issues have been discussed with the vendor and vendor...

Netgear N300 Authentication Bypass

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Netgear Router Firmware N3001.1.0.311.0.1.img and N300-1.1.0.281.0.1.img Vendor: NETGEAR CVE ID: requested Subject: Authentication Bypass Risk: High Effect: Remotely exploitable over LAN/WLAN Author: Daniel Haake...

Apache Struts Cross-Site Scripting Vulnerability

Apache Struts is an open source framework for creating enterprise Java Web applications. Apache Struts suffers from a cross-site scripting vulnerability when the JSP is directly accessible, allowing remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be...

SUSE-SU-2015:1509-1 Security update for java-1_6_0-ibm

IBM Java was updated to version 6 SR16 FP7 6.0-16.7 to fix several security issues and bugs. The following vulnerabilities were fixed: CVE-2015-1931: IBM Java Security Components store plain text data in memory dumps, which could allow a local attacker to obtain information to aid in further...

WordPress Video Gallery 2.7 SQL Injection

Exploit Title: WordPress Video Gallery 2.7 SQL Injection Date: 20-01-2015 Software Link: https://wordpress.org/plugins/contus-video-gallery/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description $GET'vid' is not...

CVE-2015-4737

CVE-2015-4737 affects Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier, with an unspecified vulnerability in Server: Pluggable Auth that could affect confidentiality for remote authenticated users. Public remediation is in vendor advisories (e.g., RHSA-2015:1647) upgrading MariaDB/My...

Endian Firewall Proxy Password Change Command Injection

This module exploits an OS command injection vulnerability in a web-accessible CGI script used to change passwords for locally-defined proxy user accounts. Valid credentials for such an account are required. Command execution will be in the context of the "nobody" account, but this account had...

ManageEngine SupportCenter 7.90 - Multiple Vulnerabilities

Document Title: =============== ManageEngine SupportCenter 7.90 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1501 Release Date: ============= 2015-06-19 Vulnerability Laboratory ID VL-ID: ====================================...

ProFTPD mod_copy Information Disclosure

The remote host is running a version of ProFTPD that is affected by an information disclosure vulnerability in the modcopy module due to the SITE CPFR and SITE CPTO commands being available to unauthenticated clients. An unauthenticated, remote attacker can exploit this flaw to read and write to...

CVE-2014-7810

The Expression Language EL implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanis...

UBUNTU-CVE-2014-7810

The Expression Language EL implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanis...

Framework: directory traversal flaw

A directory traversal flaw was found in the way the Spring Framework sanitized certain URLs. A remote attacker could use this flaw to obtain any file on the file system that was also accessible to the process in which the Spring web application was running...

WordPress Plugin WP EasyCart - Unrestricted Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WordPress WP EasyCart Unrestricted File Upload', 'Description' = %qWordPress Shopping Cart WP EasyCart Plugin for WordPress...