[Http-enum] Automated HTTP Enumeration Tool

Null Security Team writing a python script for Automated HTTP Enumeration. currently only in the initial beta stage, but includes basic checking of files including the Apache server-status as well as well IIS WebDAV and Microsoft FrontPage Extensions, many more features will be added to this tool...

vBulletin 5.0.0 Beta Release 0day Exploit

It is an SQL Injection, not the same as others one on the wild. It works on any vBulletin 5, any Beta Release including the latest. It doesnt work on lower versions, such as 4.1,4.2,3.8, etc. / The screenshots are taken on a vBulletin 5.0.0 Beta 18, but a moderator can confirm its working on high...

firefox security update

firefox 17.0.3-1.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat ones 17.0.3-1 - Update to 17.0.3 ESR 17.0.2-4 - Added NM preferences 17.0.2-3 - Update to 17.0.2 ESR 17.0.1-2 - Update to 17.0.1 ESR 17.0-1 - Update to 17.0 ESR 17.0-0.2.b4 - Update to 17 Beta 4...

ActFax 5.01 RAW Server Buffer Overflow Vulnerability

This Metasploit module exploits a vulnerability in ActFax Server 5.01 RAW server. The RAW Server can be used to transfer fax messages to the fax server without any underlying protocols. To note significant fields in the fax being transfered, like fax number and recipient, you can use ActFax data...

ActFax 5.01 RAW Server Buffer Overflow

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'ActFax 5.01 RAW...

ISC BIND 9 DNS64 远程拒绝服务漏洞

BUGTRAQ ID: 57556 CVECAN ID: CVE-2012-5689 BIND是一个应用非常广泛的DNS协议的实现。 ISC BIND 9.8.x、9.9.x在某些配置中，DNS64的响应策略区域缺少AAAA重写规则，远程攻击者通过AAAA记录查询，可造成拒绝服务（断言失败并退出指定程序）。 0 ISC BIND 9.9.x ISC BIND 9.8.x 临时解决方法： 2013年1月24日厂商已经发布beta版本，修复了此漏洞。如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 确保RPZ包含每个A重写规则的AAAA重写规则。 厂商补丁： IS...

CVE-2012-6516

SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via the q parameter to index.php...

vBulletin 5.0.0 all Beta releases SQL Injection Exploit 0day

This exploit owns any forum based on vBulletin 5. All versions. Still there is no CVE or patch. On this moment vBulletin 5.0.0 beta 21 is the last version and its affected, including the vendor's site. Wow! This is private exploit. You can buy it at https://0day.today...

Steam Linux Closed Beta bypass authorization

Exploit for linux platform in category local exploits POC: 0x01 - Download the steam client for linux here: http://media.steampowered.com/client/installer/steam.deb 0x02 - Login to your account using the Steam Client normally 0x03 - There will be a MsgBox saying that you do not have authorization...

Feng Office 2.0 Beta 3 XSS / Privilege Escalation

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Author: Ur0b0r0x Tiwtte: @Ur0b0r0x Email: [email protected] Line: GreyHat Home: cyberpunk-ur0x.blogspot.com Exploit Title: Feng Office Version 2.0 Beta 3 -...

PT-2012-5480 · Google · Google Web Toolkit

Name of the Vulnerable Software and Affected Versions: Google Web Toolkit GWT versions 2.4 Beta through 2.4.0 release candidates Description: The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML. Recommendations: For...

Mozilla Adding More Stringent HTTPS Enforcement to Firefox

Mozilla is adding an extra layer of security in its Firefox browser by implementing HTTP Strict Transport Security HSTS, a mechanism that will force some sites into establishing a secure, HTTPS connection with the browser if its presented with the right certificate. According to an entry on...

[DEFT 7.2] Computer Forensic live system

DEFT 7.2 released its last 32bit release but we will support bugfix until 2020. DEFT is a new concept of Computer Forensic live system that uses LXDE as desktop environment and thunar file manager and mount manager as tool for device management. It is a very easy to use system that includes an...

Schoolhos CMS Beta 2.29 - id SQL Injection

Schoolhos CMS Beta 2.29 - id SQL Injection Exploit Title: Schoolhos CMS SQL Injetions Google Dork: intext:Schoolhos Free Open Source CMS Date: 22 Oktober 2012 Exploit Author: Cumi++ Vendor Homepage: http://schoolhos.com/ Version: Beta 2.29 Tested on: Ubuntu 12.04...

Anwsion 1.1 Beta 2盲注漏洞一个

简要描述： 有段时间没研究你们程序了，今天看了下，发现了一个盲注. 详细说明： 该注入存在个人主页上， 由于做了url伪静态，但是还是可以注入 http://wenda.anwsion.com/people/296?notificationid-45654 漏洞证明：...

Stable Channel Update

The Stable channel has been updated to 22.0.1229.92 for Windows, Mac, and Linux. This update contains a number of stability fixes, including an issue with multiple profiles on Mac OS X 10.8.2. It also contains a fix for text display on the Mac, as well as the security updates listed below. Securi...

AlamFifa CMS - 'user_name_cookie' SQL Injection

source: https://www.securityfocus.com/bid/55746/info AlamFifa CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

AlamFifa CMS - user_name_cookie SQL Injection

AlamFifa CMS - usernamecookie SQL Injection source: https://www.securityfocus.com/bid/55746/info AlamFifa CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

KUNAI Browser for Remote Service beta vulnerable in the WebView class

Overview KUNAI Browser for Remote Service beta contains a vulnerability in the WebView class. KUNAI Browser for Remote Service beta is an Android browser software for using Cybozu. KUNAI Browser for Remote Service beta contains a vulnerability in the WebView class. Impact When there is a maliciou...

Plugx RAT targeting government organizations in Japan using spear phishing

Roland Dela Paz Threat Researcher at TrendMirco reported that last year a Malware Campaign to target specific users in Japan, China, and Taiwan once again on rise using new breed of Remote Access Tool RAT called Plugx also known as Korplug. This new custom made version comes for less recognition...