Base64 Decoder 1.1.2 SEH Local Buffer Overflow

!/usr/bin/env python Exploit Author: bzyo Twitter: @bzyo Exploit Title: Base64 Decoder 1.1.2 - Local Buffer Overflow SEH Date: 12-20-18 Vulnerable Software: Base64 Decoder 1.1.2 Vendor Homepage: http://4mhz.de/b64dec.html Version: 1.1.2 Software Link:...

PT-2018-3886 · D Link · D-Link 825L +1

Name of the Vulnerable Software and Affected Versions: D-Link myDlink Baby App version 2.04.06 D-Link 825L firmware 1.08 Description: The issue concerns the communication between the myDlink Baby App and the D-Link 825L Wi-Fi camera, where credentials, including username and password, are sent in...

CVE-2018-18767: Inadequate Encryption Strength

An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app e.g., change camera settings or play lullabies, it communicates directly with the Wi-Fi camera D-Link 825L firmware 1.08 with the credentials username and password in base64 cleartext...

Base64 Decoder 1.1.2 - Local Buffer Overflow (SEH)

Base64 Decoder 1.1.2 - Local Buffer Overflow SEH !/usr/bin/env python Exploit Author: bzyo Twitter: @bzyo Exploit Title: Base64 Decoder 1.1.2 - Local Buffer Overflow SEH Date: 12-20-18 Vulnerable Software: Base64 Decoder 1.1.2 Vendor Homepage: http://4mhz.de/b64dec.html Version: 1.1.2 Software...

Base64 Decoder 1.1.2 - Local Buffer Overflow (SEH)

!/usr/bin/env python Exploit Author: bzyo Twitter: @bzyo Exploit Title: Base64 Decoder 1.1.2 - Local Buffer Overflow SEH Date: 12-20-18 Vulnerable Software: Base64 Decoder 1.1.2 Vendor Homepage: http://4mhz.de/b64dec.html Version: 1.1.2 Software Link:...

CVE-2018-15717

Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes...

Open redirect

Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes...

CVE-2018-15717

Open Dental before version 18.4 stores user passwords as base64-encoded MD5 hashes, a weak hashing method exposing credentials if hashes are exposed. The affected software is Open Dental, with the cutoff version noted as pre-18.4. The CVE entry indicates the vulnerability’s existence but does not...

CVE-2018-15717

Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes...

PT-2018-13167

Name of the Vulnerable Software and Affected Versions Open Dental versions prior to 18.4 Description The issue concerns the storage of user passwords in a insecure manner, specifically as base64 encoded MD5 hashes. Recommendations For versions prior to 18.4, update to version 18.4 or later to...

CVE-2018-15717: Use of Password Hash With Insufficient Computational Effort

Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes...

CVE-2018-19748

app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&c=admin&a=index&p=attachment&root= directory traversal. The value of the root parameter must be base64 encoded note that base64 encoding, instead of URL encoding, is very rare in a...

CVE-2018-19748

app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&c=admin&a=index&p=attachment&root= directory traversal. The value of the root parameter must be base64 encoded note that base64 encoding, instead of URL encoding, is very rare in a...

PHP imap_open - Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'php imapopen Remote Code Execution', 'Description' = %q The imapopen function within php, if called without the /norsh flag, will attempt to...

CVE-2018-19518

University of Washington IMAP Toolkit 2007f on UNIX, as used in imapopen in PHP and other products, launches an rsh command by means of the imaprimap function in c-client/imap4r1.c and the tcpaopen function in osdep/unix/tcpunix.c without preventing argument injection, which might allow remote...

CVE-2018-19329

GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...

Design/Logic Flaw

GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...

CVE-2018-19329

GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...

CVE-2018-19329

GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...

CVE-2018-19329

GreenCMS v2.3.0603 contains a stored/reflective issue where remote authenticated administrators can delete arbitrary files by altering a base64-encoded pathname in the m=admin&c=media&a=delfilehandle&id= request, related to the m=admin&c=media&a=restorefile delete button. The root cause is manipu...