12100 matches found
Joomla com_blog_calendar SQL injection vulnerability
A SQL Injection Vulnerability has been discovered in the Joomla Module called comblogcalendar. The Vulnerability is located in the index.php?option=comblogcalendar&modid=xxx Parameter. Attackers are able to execute own SQL commands by usage of a GET Method Request with manipulated modid Value...
The vulnerability of the Flash Player software platform, which allows a perpetrator to execute arbitrary code or cause service failures
The vulnerability of the ad method in the PSDP software platform of the Flash Player is caused by an operation that occurs outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure due to a memory corruption error...
shopify-scripts: SIGABRT, SIGSEGV mspace_free() and mrb_default_allocf()
Sample - 1 --------------------- The following code triggers the bug attached as mirbuseafterfree.rb: def methodmissingm"0000000"end m0=w.instanceevalprependm m0.instanceevalprependm0 Crash - Use After Free --------------------- gdb r useafterfree Starting program:...
iOS 10.1.1 / macOS 10.12 16A323 XNU Kernel - set_dp_control_port Lack of Locking Use-After-Free Vuln
Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=965 setdpcontrolport is a MIG method on the hostprivport so this bug is a root-kernel escalation. kernreturnt setdpcontrolport hostprivt hostpriv, ipcportt controlport if hostpriv...
Apple macOS 10.12 16A323 XNU Kernel / iOS 10.1.1 - 'set_dp_control_port' Lack of Locking Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=965 setdpcontrolport is a MIG method on the hostprivport so this bug is a root-kernel escalation. kernreturnt setdpcontrolport hostprivt hostpriv, ipcportt controlport if hostpriv == HOSTPRIVNULL return KERNINVALIDHOST; if...
Microsoft Internet Explorer 9 - IEFRAME CMarkupPointer::MoveToGap Use-After-Free
!-- Source: http://blog.skylined.nl/20161215001.html Synopsis A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. The use appears to happen only once almost immediately after the free, which makes practical exploitation unlikely. Known affecte...
Microsoft Internet Explorer 9 - IEFRAME CMarkupPointer::MoveToGap Use-After-Free
Microsoft Internet Explorer 9 - IEFRAME CMarkupPointer::MoveToGap Use-After-Free !-- Source: http://blog.skylined.nl/20161215001.html Synopsis A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. The use appears to happen only once almost...
Apple macOS 10.12 16A323 XNU Kernel iOS 10.1.1 - set_dp_control_port Lack of Locking Use-After-Free
Apple macOS 10.12 16A323 XNU Kernel iOS 10.1.1 - setdpcontrolport Lack of Locking Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=965 setdpcontrolport is a MIG method on the hostprivport so this bug is a root-kernel escalation. kernreturnt setdpcontrolport hostpri...
NetGear lot of router remote command injection vulnerability analysis(Update Patch analysis)-vulnerability warning-the black bar safety net
0x01 introduction Two days before the NTP just doing the complete thing, the NetGear routerNETGEAR routerand to engage in things of T. T. The current CERT in the last week, five have issued a notice,“if the user comes to the router, it is recommended to stop use until the official release of the...
PortSwigger Web Security: HTTP OPTION Method is Enabled on portswigger.net
Enabled OPTION method on web server allows unauthorized blind submission of privileged GET requests...
NetGear R series multi-router remote command injection vulnerability analysis-vulnerability warning-the black bar safety net
Two days before the NTP just doing the complete thing, the NetGear routerNETGEAR routerand to engage in things of T. T. The current CERT in the last week, five have issued a notice,“if the user comes to the router, it is recommended to stop use until the official release of the patch repair.” Thi...
FTP Password Recovery - Command-line Lost or Forgotten FTP Password Finder Tool for Windows
FTP Password Recovery is a free command-line tool to find your lost or forgotten FTP password for any FTP server. It automatically detects if the target FTP server allows any Anonymous without password connections. In case your FTP server is running on different port other than port 21 then you c...
JXBrowser JavaScript-Java bridge in the RCE vulnerability-vulnerability warning-the black bar safety net
I recently was studying how to use JXBrowser to achieve a set of experimental scanning techniques. When I use JXBrowser library in the process, I suddenly thought, whether it can be by calling different classes to attack the JXBrowser client, and through a Web page to achieve remote code executio...
CVE-2016-9481
In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...
shopify-scripts: Crash: A call to Symbol.new leads to a crash when inspecting the resulting object
Calling Symbol.new leads to a when inspect is called on that method probably even more methods. From my point of view the root cause is related to 185794 the underlying boxing model. Trying the same with Ruby 2.3 will lead to a NoMethodError: undefined method 'new' for Symbol:Class, which is...
Java Applet Method Handle Remote Code Execution (CVE-2012-5088)
A code execution vulnerability has been reported in Oracle's Java and JRE. The vulnerability is due to improper use of the Method Handle class. A remote attacker may exploit this issue by enticing a target user to open a specially crafted Java applet which can enable an attacker to execute...
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)
// // This exploit uses the pokemon exploit of the dirtycow vulnerability // as a base and automatically generates a new passwd line. // The user will be prompted for the new password when the binary is run. // The original /etc/passwd file is then backed up to /tmp/passwd.bak // and overwrites t...
Tenda, Dlink & Tplink TD-W8961ND - DHCP XSS Vulnerability
Document Title: =============== Tenda, Dlink & Tplink TD-W8961ND - DHCP XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1990 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20372...
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)
// EDB-Note: Compile: g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil // EDB-Note: Recommended way to run: ./dcow -s Will automatically do "echo 0 /proc/sys/vm/dirtywritebackcentisecs" // // ----------------------------------------------------------------- // Copyright C 2016...
Perl 'XSLoader Method' Code Execution Vulnerability - Windows
Perl is prone to a code execution vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:perl:perl"; ifdescription...