Oracle WebLogic Server 10.3.6.0.0 12.x - Remote Command Execution

Oracle WebLogic Server 10.3.6.0.0 12.x - Remote Command Execution import requests import sys urlin = sys.argv1 payloadurl = urlin + "/wls-wsat/CoordinatorPortType" payloadheader = 'content-type': 'text/xml' def payloadcommand commandin: htmlescapetable = "&": "&", '"': """, "'": "'", "": "",...

apr: Out-of-bounds array deref in apr_time_exp*() functions

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak...

CVE-2017-3109

An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Adobe Experience Manager has a reflected cross-site scripting vulnerability in the HtmlRendererServlet...

apr: Out-of-bounds array deref in apr_time_exp*() functions

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak...

CVE-2017-7441

In Sophos SurfRight HitmanPro before 3.7.20 Build 286 included in the HitmanPro.Alert solution and Sophos Clean, a crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks. Because the leak occurs at the driver level, an attacker can use this vulnerability to leak some critical informatio...

Privilege escalation

Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability...

unsorted bin attack analysis-vulnerability warning-the black bar safety net

One, Foreword This is before that article overflow using the FILE structure of the follow-up article, mentioned earlier is for the Shanghai network security contest pwn450 of technology to write articles, a total of two techniques, one is the overflow using the FILE structure of the body, one is...

pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18)

PCRE before 8.38 mishandles the /?=di?=?1|?=./ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service buffer overflow or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript...

OIC Exponent CMS SQL Injection Vulnerability

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. A SQL injection vulnerability...

kill. exe overflow vulnerability analysis and EXP discussion-vulnerability warning-the black bar safety net

1. Foreword A few days ago, the author at exploit-db and found a kill. exe overflow vulnerability, in many of the UAF vulnerability, this simple overflow vulnerability simply as a unit of springs in General, then be picked out, deeply looked. The original plan to write a full available EXP, but...

CVE-2016-4169

Adobe Experience Manager 6.0–6.2 contains an information-disclosure vulnerability (CVE-2016-4169) that allows unprivileged users to access sensitive audit log event information via unspecified vectors. The issue affects AEM 6.0, 6.1, and 6.2 and is documented in multiple sources including the thr...

CVE-2 0 1 5-7 5 4 7 analysis and use-vulnerability and early warning-the black bar safety net

0x01 analysis This vulnerability analysis and how to build a test environment k0 chef in seebug and mrh God in the drops of the articles are written very in detail, in the following reference to Annex A of the original address. I was standing on the shoulders of Giants to write some of your own i...

东芝打印机未授权访问漏洞

exp: http://xxx/TopAccess/default.htm...

DotCMS 3.5 Beta Cross Site Scripting

Advisory: DotCMS xss vulnerability Author: Piaox From Pingan Product Safety Group Email: [email protected] Affected Version: dotCMS 3.5 Betathe latest version Vulnerability Description lucenesearch.jsp 26 String query = request.getParameter"query"; 27 if!UtilMethods.isSetquery 28 query ...

GT Racing 2: The Real Car Exp - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application GT Racing 2: The Real Car Exp published at the 'play' market has multiple vulnerabilities...

Theme eXp - Black Z Light - WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Theme eXp - Black Z Light published at the 'play' market has multiple vulnerabilities...

WebDAV local mention the right Vulnerability, CVE-2 0 1 6-0 0 5 1. THE POC & EXP-vulnerability warning-the black bar safety net

Vulnerability information The vulnerability exists in the Microsoft Web Distributed Authoring and Versioning WebDAV, if Microsoft Web Distributed Authoring and Versioning WebDAV client to validate the input properly, then which will present elevation of privilege vulnerability. Successful...

Google Go math/big library private key acquisition vulnerability

Google Go is a programming language optimized for programming applications on multiprocessor systems. A security vulnerability in the Int.Exp Montgomery code in Google Go's math/big library allows a remote attacker to exploit the vulnerability to obtain an RSA private key because the code fails t...

大汉网络 /interface/ldap/ldapconf.xml 密钥泄露

第一步，大汉网络加解密说明 LDAP密钥配置文件，/interface/ldap/ldapconf.xml 获取密钥：o3h2iB8ggnp2 我们可以使用大汉的加解密库进行任意加解密，只要知道服务端的密钥，就可以和服务器进行通讯： 第二步，保存密钥的ldapconf.xml文件，放在了网站目录，直接可以访问： 我们拿官网，进行一下测试： 访问：http://app.hanweb.com.cn/jcms/interface/ldap/ldapconf.xml 拿到了密钥：OJ9Un5JmpTfN0gJx 第三步，通过密钥： OJ9Un5JmpTfN0gJx，我们构造如下几个密文：...

Seemingly tasteless ESPCMS background injected, can actually be a lot of fun-vulnerability warning-the black bar safety net

Yesterday, the black bar safety net loophole platform exposes a ESPCMS of injection vulnerabilities, Ali cloud computing security attack and defense against a team of friends first time on the vulnerability to do an impact assessment. Did not think need to login to the backend before it can be...