Redmine SCM Repository 0.9.x/1.0.x - Arbitrary Command Execution (Metasploit)

$Id: redminescmexec.rb 11516 2011-01-08 01:13:26Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

Novell iPrint Client Browser Plugin embed Tag Parameter Buffer Overflow

Added: 01/03/2011 CVE: CVE-2010-4314 BID: 45301 OSVDB: 66959 Background Novell iPrint is an application which allows users to install and manage printers. Problem A buffer overflow vulnerability in Novell iPrint browser plugin allows command execution when a user loads a web page with an overly...

Microsoft IIS FTP Server Encoded Response Overflow Trigger

This module triggers a heap overflow when processing a specially crafted FTP request containing Telnet IAC 0xff bytes. When constructing the response, the Microsoft IIS FTP Service overflows the heap buffer with 0xff bytes. This issue can be triggered pre-auth and may in fact be exploitable for...

TYPSoft FTP Server 1.10 Denial Of Service

!/usr/bin/python TYPSoft FTP Server v 1.10 RETR CMD Denial Of Service CVE-2005-3294 OSVDB 19992 12/23/2010 C Emanuele Gentili Notes: I have wrote this exploit because the code published here 1 do not work correctly. 1 http://www.exploit-db.com/exploits/12604/ import socket import sys user="test"...

TYPSoft FTP Server 1.10 - 'RETR' Denial of Service (2)

!/usr/bin/python TYPSoft FTP Server v 1.10 RETR CMD Denial Of Service CVE-2005-3294 OSVDB 19992 12/23/2010 C Emanuele Gentili Notes: I have wrote this exploit because the code published here 1 do not work correctly. 1 http://www.exploit-db.com/exploits/12604/ import socket import sys user="test"...

HP Power Manager formLogin buffer overflow

Added: 12/28/2010 CVE: CVE-2010-4113 OSVDB: 69969 Background HP Power Manager is a web-based application that enables administrators to manage an HP UPS from a browser-based management console. Problem A buffer overflow vulnerability in the Administration interface allows remote attackers to...

Redmine SCM Repository Arbitrary Command Execution

This module exploits an arbitrary command execution vulnerability in the Redmine repository controller. The flaw is triggered when a rev parameter is passed to the command line of the SCM tool without adequate filtering. This module requires Metasploit: https://metasploit.com/download Current...

Cisco IOS HTTP access level authentication bypass

Added: 12/23/2010 CVE: CVE-2001-0537 BID: 2936 OSVDB: 578 Background The Cisco Internetwork Operating System IOS is the operating system used by Cisco routers. Problem A remote attacker could execute arbitrary commands at the highest privilege level level 15 without needing to authenticate by...

Cisco IOS HTTP access level authentication bypass

Added: 12/23/2010 CVE: CVE-2001-0537 BID: 2936 OSVDB: 578 Background The Cisco Internetwork Operating System IOS is the operating system used by Cisco routers. Problem A remote attacker could execute arbitrary commands at the highest privilege level level 15 without needing to authenticate by...

Mitel Audio and Web Conferencing Command Injection

$Id: mitelawcexec.rb 11389 2010-12-21 19:16:18Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Microsoft Internet Explorer CSS Import Use-After-Free Code Execution

Added: 12/22/2010 CVE: CVE-2010-3971 BID: 45246 OSVDB: 69796 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Cascading Style Sheets CSS is a simple mechanism for adding style to web documents. Problem Microsoft Internet Explorer is...

SAP Crystal Reports PrintControl.dll ServerResourceVersion buffer overflow

Added: 12/22/2010 CVE: CVE-2010-2590 BID: 45387 OSVDB: 69917 Background SAP Crystal Reports allows developers to design interactive reports from virtually any data source. Problem A buffer overflow vulnerability in the PrintControl.dll ActiveX control allows command execution when a user loads a...

Redmine SCM Repository - Arbitrary Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Redmine SCM Repository Arbitrary Command Execution', 'Description' = %q This module exploits an arbitrary command execution...

Java - 'Statement.invoke()' Trusted Method Chain (Metasploit)

$Id: javatrustedchain.rb 11345 2010-12-15 22:46:22Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Trixbox langChoice PHP Local File Inclusion

$Id: $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ -- coding: utf-8 -- require 'msf/core' class...

Trixbox langChoice PHP Local File Inclusion

This module injects php into the trixbox session file and then, in a second call, evaluates that code by manipulating the langChoice parameter as described in OSVDB-50421. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewo...

Oracle Secure Backup Administration preauth variable command injection

Added: 12/06/2010 CVE: CVE-2010-0906 BID: 41597 OSVDB: 67128 Background Oracle Secure Backup is a centralized tape backup management solution for Oracle Database. Problem A vulnerability in the Administration server allows remote, authenticated attackers to execute arbitrary commands which are...

UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit)

$Id: unrealircd3281backdoor.rb 11227 2010-12-05 15:08:22Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Dradis v2.6 - Tool for sharing information during security testing !

"Dradis is a tool for sharing information during security testing. While plenty of tools exist to help in the different stages of the test, not so many exist to share interesting information captured. When a team of testers is working on the same set of targets, having a common repository of...

Image Viewer CP Gold v5.5 Image2PDF() Buffer Overflow (msf)

Exploit for windows platform in category remote exploits =========================================================== Image Viewer CP Gold v5.5 Image2PDF Buffer Overflow msf =========================================================== Image Viewer CP gold v5.5 Buffer Overflow Found by: bz1p AT...