8279 matches found
Uber: SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/
The Wordpress blog located at https://drive.uber.com/frmarketplace/ had a plugin called Huge IT Video Gallery which suffered from an SQL injection vulnerability. While this site did not contain customer information, the vulnerability could be possibly used to deface the Wordpress blog or extract...
The vulnerability of the OpenSSL library, which allows a hacker to compromise RSA keys
The vulnerability of the MODEXPCTIMECOPYFROMPREBUF function crypto/bn/bnexp.c in the OpenSSL library is related to the lack of protection for service data. Exploiting this vulnerability could allow a local attacker to extract RSA keys by running a specially created application...
Yeager SQL Injection Vulnerability
Yeager is an open source content management system . Yeager has a SQL injection vulnerability that allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or obtain database data...
IBM Lotus Domino R8 - Password Hash Extraction
Exploit Title: IBM Lotus Domino = R8 Password Hash Extraction Exploit Google Dork: inurl:names.nsf?opendatabase Date: 02-24-2016 Exploit Author: Jonathan Broche Contact: https://twitter.com/g0jhonny Vendor Homepage: https://www-01.ibm.com/software/lotus/category/messaging/ Tested on: Lotus Domino...
libgcrypt: secret key extraction
A vulnerability was found in a way the ECDH encryption algorithm decrypts data. An attacker with a specialized setup can extract the secret decryption key from a target located in an adjacent room within seconds. This is done by measuring the target's electromagnetic emanations...
Gratipay: The POODLE attack (SSLv3 supported) for https://grtp.co/
Websites that support SSLv3 and CBC-mode ciphers are potentially vulnerable to an active MITM Man-in-the-middle attack. This attack, called POODLE, is similar to the BEAST attack and also allows a network attacker to extract the plaintext of targeted parts of an SSL connection, usually cookie dat...
NetworkMiner 2.0 - Network Forensic Analysis Tool (NFAT)
NetworkMiner is a Network Forensic Analysis Tool NFAT for Windows but also works in Linux / Mac OS X / FreeBSD. NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the...
ariacms 系统后台任意文件上传漏洞
试了几次上传点都是失败，后来发现这里可以传压缩包。发现上传点。数据库必须以cbd3d20160112hnX8NP1.php这样命名。否则会提示恢复失败 恢复数据库，命名好的php会自动解压。直接解压到wwwroot/admin/databack/sql目录内，运行即可。...
USN-2878-1: Perl vulnerability
David Golden discovered that the canonpath function in the Perl File::Spec module did not properly preserve the taint attribute. An attacker could possibly use this issue to bypass the taint protection mechanism...
CVE-2015-8361: Services exposed without authentication Vulnerability
Bamboo exposed services without first performing authentication checks. Attackers can use this vulnerability to extract confidential information from Bamboo, modify certain settings and manage build agents. To exploit this issue, attackers need to be able to access the Bamboo JMS port. Affected...
CVE-2015-8361: Services exposed without authentication Vulnerability
Bamboo exposed services without first performing authentication checks. Attackers can use this vulnerability to extract confidential information from Bamboo, modify certain settings and manage build agents. To exploit this issue, attackers need to be able to access the Bamboo JMS port. Affected...
AVM FRITZ!OS Arbitrary Code Execution Vulnerability
AVM FRITZ!OS is an operating system from the German company AVM. A security vulnerability exists in AVM FRITZ!OS versions prior to 6.30, which originates from a program that extracts the encrypted signature of a firmware update before verifying its contents. A remote attacker could exploit the...
Mail.ru: [cfire.mail.ru] Time Based SQL Injection
Добрый день. Уязвимо кукис с названием cfiresid. Рабочий PoC GET /account/userbar/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/47.0.2526.73 Safari/537.36 OPR/34.0.2036.25 Host: cfire.mail.ru Accept: text/html, application/xml;q=0.9,...
Firmware Analysis Tool: Binwalk
Binwalk is a fast, easy to use tool for analyzing and extracting firmware images Firmware Analysis Tool Binwalk is: Fast Flexible Extendable Easy to use Binwalk can: Find and extract interesting files / data from binary images Find and extract raw compression streams Identify opcodes for a variet...
Red Hat Automatic Bug Reporting Tool任意文件写入漏洞
问题在abrt-action-install-debuginfo-to-abrt-cache 在默认的情况下，它会在/var/tmp/abrt-tmp-debuginfo-RANDOMSUFFIX创建一个临时文件,然后会下载rpm文件到这个文件夹，之后会进行解压，因为是临时文件夹，所以解压的路径不是这个，而是在/var/cache/abrt-di,但是因为这个文件夹并不是随机创建的，而且可预测性极强，所以我们可以提前创建这个文件夹，依靠控制unpacked.cpio这个文件，我们就能欺骗abrt-action-install-debuginfo提取一个我们可控制的cpio文件...
HomeMatic WebUI Detection
The script sends a HTTP request to the server and attempts to extract the version from the reply. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Icinga Web Detection
The script sends a HTTP request to the server and attempts to extract the version from the reply. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
FLARE IDA Pro Script Series: Automating Function Argument Extraction
...
Debian DLA-341-1 : php5 security update
CVE-2015-6831 Use after free vulnerability was found in unserialize function. We can create ZVAL and free it via Serializable::unserialize. However the unserialize will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute...
