University of Washington Pico 3.x/4.x File Overwrite Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2097/info A vulnerability exists in several versions of University of Washington's Pico, a widely-distributed text editor shipped with most versions of Linux / Unix. Under very specific circumstances, it is possible to...

Pico MP3 Player 1.0 (.mp3 /.pls File) Local Crash PoC

No description provided by source. !/usr/bin/perl Usage--file created--load file--b00m.mp3 BOOM print \n; print ! Pico MP3 Player 1.0 .mp3 Local Crash PoC\n; print \n; print ! Author: cr4wl3r\n; print ! Mail: cr4wl3r!linuxmail.org\n; print \n; my $boom = A x 1337; my $filename = b00m.mp3; open...

Yoggie Pico and Pico Pro Backticks Remote Code Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/24743/info Yoggie Pico and Pico Pro are prone to a remote code-execution vulnerability because the device fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary code wi...

DEBIAN-CVE-2013-2899

drivers/hid/hid-picolcdcore.c in the Human Interface Device HID subsystem in the Linux kernel through 3.11, when CONFIGHIDPICOLCD is enabled, allows physically proximate attackers to cause a denial of service NULL pointer dereference and OOPS via a crafted device...

UBUNTU-CVE-2013-2899

drivers/hid/hid-picolcdcore.c in the Human Interface Device HID subsystem in the Linux kernel through 3.11, when CONFIGHIDPICOLCD is enabled, allows physically proximate attackers to cause a denial of service NULL pointer dereference and OOPS via a crafted device...

PicoPublisher 2.0 SQL Injection

Exploit Title : PicoPublisher v2.0 Remote SQL injection Date : 29/03/2012 Author : ZeTH Contact : zeth/at/hacktheplan8/dot/com http://www.hacktheplan8.com Vendor : Pico Software Site : http://pico.no/ Version : 2.0 Price : $29,00 Demo : http://picopublisher.com/demo/ Dork : intext:"Drives med...

PicoPublisher 2.0 - SQL Injection

PicoPublisher 2.0 - SQL Injection Exploit Title : PicoPublisher v2.0 Remote SQL injection Date : 29/03/2012 Author : ZeTH Contact : zeth/at/hacktheplan8/dot/com http://www.hacktheplan8.com Vendor : Pico Software Site : http://pico.no/ Version : 2.0 Price : $29,00 Dork : intext:"Drives med...

Pico overseas game currency leveling system 0day-vulnerability warning-the black bar safety net

漏洞 文件 :index.php code......） hhadmin/up.php an arbitrary upload vulnerability Default background address:hhadmin exp http://hack58.com/index.php?mainpage=buyitems&gid=-10 union select 1,adminname from yuadmin/qing http://hack58.com/index.php?mainpage=buyitems&gid=-10 union select 1,adminpwd from...

nano: Multiple vulnerabilities

Background nano is a GNU GPL'd Pico clone with more functionality. Description Multiple race condition vulnerabilities have been discovered in nano. For further information please consult the CVE entries referenced below. Impact Under certain conditions, a local, user-assisted attacker could...

Pico MP3 Player 1.0 - .mp3 .pls Local Crash (PoC)

Pico MP3 Player 1.0 - .mp3 .pls Local Crash PoC !/usr/bin/perl Usage--file created--load file--b00m.mp3 BOOM print "\n"; print "! Pico MP3 Player 1.0 .mp3 Local Crash PoC\n"; print "\n"; print "! Author: cr4wl3r\n"; print "! Mail: cr4wl3r!linuxmail.org\n"; print "\n"; my $boom = "A" x 1337; my...

Pico MP3 Player 1.0 (.mp3 /.pls File) Local Crash PoC

Exploit for unknown platform in category dos / poc ===================================================== Pico MP3 Player 1.0 .mp3 /.pls File Local Crash PoC ===================================================== !/usr/bin/perl Usage--file created--load file--b00m.mp3 BOOM print "\n"; print "! Pico...

Pico MP3 Player 1.0 - '.mp3' / '.pls' Local Crash (PoC)

!/usr/bin/perl Usage--file created--load file--b00m.mp3 BOOM print "\n"; print "! Pico MP3 Player 1.0 .mp3 Local Crash PoC\n"; print "\n"; print "! Author: cr4wl3r\n"; print "! Mail: cr4wl3r!linuxmail.org\n"; print "\n"; my $boom = "A" x 1337; my $filename = "b00m.mp3"; open FILE,"$filename"; pri...

Pico MP3 Player 1.0 Denial Of Service

!/usr/bin/perl -------------------------------------------------------------------------------------------- Found By: PLATEN platen.secure at gmail.com Pico MP3 Player 1.0 .mp3 File Local File Crash PoC web : Blog: Www.platen.gigfa.com Www.pentesters.IR Greetings: b3hz4d Cru3l.b0y Cdef3nder Snake...

CVE-2002-2295

CVE-2002-2295 affects Pico Server (pServ) 2.0 beta 1–beta 5. The issue is a buffer overflow in the HTTP handling path, triggered by: (1) a 1024-byte TCP stream message (off-by-one overflow), (2) long method name, (3) long version number, (4) long User-Agent header, or (5) long file path. This can...

CVE-2002-2295

Buffer overflow in Pico Server pServ 2.0 beta 1 through beta 5 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via 1 a 1024-byte TCP stream message, which triggers an off-by-one buffer overflow, or 2 a long method name in an HTTP request, 3 a long...

Input validation

Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the param parameter, as demonstrated by URL encoded "" backtick characters %60 sequences...

CVE-2007-3572

Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the param parameter, as demonstrated by URL encoded "" backtick characters %60 sequences...

CVE-2007-3572

The vulnerability CVE-2007-3572 affects the Yoggie Pico and Pico Pro (web interface cgi-bin/runDiagnostics.cgi). An incomplete blacklist allows remote attackers to execute arbitrary commands by supplying shell metacharacters in the param parameter, demonstrated with URL-encoded backtick character...

Yoggie Pico/Pico Pro反引号远程命令执行漏洞

Yoggie Pico是一款小巧的USB设备，可实现防火墙和反病毒功能。 Yoggie Pico在处理用户提交的请求数据时存在漏洞，远程攻击者可能利用此漏洞在设备上执行任意命令。 Yoggie Pico安全设备的Web接口开放了ping功能以便于诊断。这个接口以ping -c 10 given ip的形式将输入的IP/主机名直接传送给了ping命令，并对“&”、“；”和管道执行了基本安全检查，但没有检查反引号（“”），这允许攻击者通过提交特制的URL请求在设备上以root用户权限执行任意命令。 Yoggie Pico Yoggie Pico Pro...

yoggie-exec.txt

This vulnerability affects the Yoggie Pico Pro and most certainly the Yoggie Pico, due to them being effectively identical security appliance. They expose a 'ping' function in their web interface for diagnostic purposes, which passes the IP/hostname given directly to ping in the form of 'ping -c ...