File Renaming Vulnerability in HAIRUICMS v2.1.4 /FileManage/fsorename.asp File

HAIRUICMS HAIRUICMS is developed by HAIRUICMS based on Microsoft ASP and general ACCESS/MSSQL database. A file renaming vulnerability exists in the HAIRUICMS v2.1.4 /FileManage/fsorename.asp file. The vulnerability is caused by not filtering the file name suffix, resulting in the image can be...

Yii 'findByCondition' Function SQL Injection Vulnerability

Yii is the Yii team developed a set of component-based , high-performance PHP framework for developing large-scale Web applications . A SQL injection vulnerability exists in the 'findByCondition' function in the framework/db/ActiveRecord.php file in version 2.x of Yii before 2.0.15. A remote...

Gather Ticket Granting Service (TGS) tickets for User Service Principal Names (SPN)

This module will try to find Service Principal Names that are associated with normal user accounts. Since normal accounts' passwords tend to be shorter than machine accounts, and knowing that a TGS request will encrypt the ticket with the account the SPN is running under, this could be used for a...

Potential remote code execution in LUA context of the redis server via methods `yii\redis\ActiveRecord::findOne()` and `::findAll()`

More info at https://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/...

XenMobile Loses Delivery Groups Association After Changing Group Names in Active Directory

After changing Active Directory group names, XenMobile Server can't see the users in the correct groups...

Icebreaker: Chip Away at Active Directory Passwords, Automatically

To break the ice with Active Directory and shorten the cycles penetration testers spend on cracking passwords, I developed Icebreaker, a tool that automates network attacks against Active Directory and provides plaintext credentials. Icebreaker performs five network attacks in order...

The vulnerability of the LDAP server in the Samba networking software package allows a hacker to alter the passwords of other users.

The vulnerability of the LDAP server of the Samba networking software, which is configured as an Active Directory domain controller, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to remotely change the passwords of other users...

Unable to Sign On to SecureHub

Enrolled User unable to login to Secure Hub, while 2 users in Active Directory have same UPNUserPrincipalName. The Active Directory Users and Computers MMC ADUC will enforce unique values, However, duplicate values for userPrincipalName can be assigned to the users via code. Consider In AD that 2...

Workspace Environment Management (WEM): Active Directory search improvements in WEM 4.6

Introduction The Active Directory AD system built into the WEM Administration Console and WEM Infrastructure Server has been refactored in WEM 4.6 to improve performance and stability. Although AD searches performed by the WEM Console and WEM Infrastructure server in previous WEM versions have...

Samba Security Bypass Vulnerability (CNVD-2018-07048)

Samba is a freeware implementation of the SMB protocol on Linux and UNIX systems, consisting of a server and a client program. A security bypass vulnerability exists in Samba due to an LDAP server on a Samba Active Directory AD Domain Controller DC that does not properly validate privileges when...

ALPINE-CVE-2018-1057

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts eg Domain Controllers...

DEBIAN-CVE-2018-1057

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts eg Domain Controllers...

UBUNTU-CVE-2018-1057

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts eg Domain Controllers...

EllisLab CodeIgniter SQL Injection Vulnerability

EllisLab CodeIgniter is the United States EllisLab company for PHP web developers to use a set of application development framework and toolkit . A SQL injection vulnerability exists in the offset method of the Active Record class in EllisLab CodeIgniter versions prior to 2.2.4. A remote attacker...

How to Perform a Partial Site Upgrade in NetScaler SD-WAN 10.0

NetScaler SD-WAN 10.0 has been designed to accommodate large scale deployments, with the capability of supporting up to 2500 sites. The partial site upgrade feature is one enhancement that will accommodate such large scale deployments. This feature allows administrators to stage upgrades at...

icebreaker - Gets Plaintext Active Directory Credentials If You'Re On The Internal Network

Break the ice with that cute Active Directory environment over there. Automates network attacks against Active Directory to deliver you piping hot plaintext credentials when you're inside the network but outside of the Active Directory environment. Performs 5 different network attacks for plainte...

Sql injection

SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable...

CVE-2015-5725

SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable...

IntruderPayloads - A Collection Of Burpsuite Intruder Payloads, Fuzz Lists And File Uploads

A collection of Burpsuite Intruder payloads and fuzz lists and pentesting methodology. To pull down all 3rd party repos, run install.sh in the same directory of the IntruderPayloads folder. Author: 1N3@CrowdShield https://crowdshield.com PENTEST METHODOLOGY v2.0 BASIC PASSIVE AND ACTIVE CHECKS:...

How to View Active Users Sessions Connected to Specific Citrix Gateway vServers

This article helps you identify active user sessions connected to Citrix Gateway vServers. This solution will work on allCitrix Gateway firmware versions...