OS-Command Injection via UPnP Interface in multiple D-Link devices

Vendor: D-Link Devices: DIR-300 rev B / DIR-600 rev B / DIR-645 / DIR-845 / DIR-865 / DAP1522 ============ Vulnerable Firmware Releases: ============ DIR-300 rev B - 2.14b01 DIR-600 - 2.16b01 DIR-645 - 1.04b01 DIR-845 - 1.01b02 DIR-865 - 1.05b03 Other devices and firmware versions may be also...

D-Link DIR-645 / DIR-815 diagnostic.php Command Execution

Some D-Link Routers are vulnerable to OS Command injection in the web interface. On DIR-645 versions prior 1.03 authentication isn't needed to exploit it. On version 1.03 authentication is needed in order to trigger the vulnerability, which has been fixed definitely on version 1.04. Other D-Link...

Intramaps <= 7.0.128 Rev 318 Multiple Vulnerabilities - Active Check

Intramaps is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[security bulletin] HPSBHF02819 SSRT100920 rev.2 - HP, 3COM, and H3C Routers &amp; Switches, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03515685 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03515685 Version: 2 HPSBHF02819...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in XWiki Watch 1.0 allow remote attackers to inject arbitrary web script or HTML via the rev parameter to 1 bin/viewrev/Main/WebHome and 2 bin/view/Blog, and the 3 registerfirstname and 4 registerlastname parameters to bin/register/XWiki/Register...

Redmine SCM Repository Arbitrary Command Execution

$Id: redminescmexec.rb 11414 2010-12-25 14:43:13Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Redmine SCM Repository Arbitrary Command Execution

This module exploits an arbitrary command execution vulnerability in the Redmine repository controller. The flaw is triggered when a rev parameter is passed to the command line of the SCM tool without adequate filtering. Module Options msf use exploit/unix/webapp/redmine/scmexec msf...

Re: D-Link DIR-300 authentication bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Polish D-Link branch confirmed the bug and produced relevant patched firmware: DIR-300: ftp://ftp.dlink.pl/dir/dir-300/driversoftware/DIR-300fwrevA1-05B09allen20101130.zip...

Linux/ARM - execve"/bin/sh", 0, 0 vars 27 bytes

Linux/ARM - execve"/bin/sh", 0, 0 vars - 27 bytes. Shellcode exploit for arm platform / Title: Linux/ARM - execve"/bin/sh", 0, 0 vars - 27 bytes Date: 2010-08-31 Tested on: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan - twitter: @jonathansalwan shell-storm.org Shellcode ARM with not a 0x20, 0x0a...

Linux/ARM - polymorphic chmod"/etc/shadow", 0777 84 Bytes

Linux/ARM - polymorphic chmod"/etc/shadow", 0777 - 84 Bytes. Shellcode exploit for linux platform / | Title: Linux/ARM - polymorphic chmod"/etc/shadow", 0777 - 84 Bytes | Type: Shellcode | Author: Florian Gaultier | Platform: Linux ARM ARM926EJ-S rev 5 v51 | + http://www.shell-storm.org / include...

Trouble Ticket Software ttx.cgi Remote File Download

No description provided by source. Exploit Title: Trouble Ticket Software 0Day Date: 3/12/2010 Author: n01d Software Link: http://www.troubleticketexpress.com Version: TTX v3.0.640 Tested on: =3.0.640 / \ / | | | | ' \ | | | || | / | | | | || || || || | | || || / || ,| Bob @ http://n01d.com Type:...

Solaris/Open Solaris UCODE_GET_VERSION IOCTL - Denial of Service

/ cve-2010-0453.c -- Patroklos Argyroudis, argp at domain census-labs.com Denial of service kernel panic PoC exploit for the UCODEGETVERSION ioctl NULL pointer dereference vulnerability on Solaris/OpenSolaris: http://www.trapkit.de/advisories/TKADV2010-001.txt...

HP-UX PHSS_39510 : HP OpenView Storage Data Protector, Local Unauthorized Access (HPSBMA02502 SSRT090171 rev.1)

s700800 11.X OV DP6.10 HP-UX PA-Risc - Core patch : A potential security vulnerability has been identified with HP OpenView Storage Data Protector. The vulnerability could be exploited to gain unauthorized access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and patch...

HP LaserJet Printers - Multiple Persistent Cross-Site Scripting Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-09-048 http://dsecrg.ru/pages/vul/show.php?id=148 Application: HP LaserJet printer web interface Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others Vendor URL: http://www.hp.com/ Bug: Multiple Stored XSS Vulnerabilities Exploits:...

CVE-2009-2946

Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages...

HP Data Protector dpwinsup.dll内存泄漏漏洞

BUGTRAQ ID: 34955 CVECAN ID: CVE-2009-0714 HP Data Protector软件能够实现自动化的高性能备份与恢复，支持通过磁盘和磁带进行备份和恢复。 HP Data Protector使用私有协议与远程客户端通讯。如果远程客户端向Data Protector备份域服务器的dpwinsup.dll模块发送了特制报文，就可能泄露任意内存，导致运行在3817/TCP端口上的dpwingad进程崩溃。 ; Buggy code @dpwinsup module of dpwingad process ; running at 3817/TCP port...

CVE-2009-1090

Directory traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uploaded parameter...

CVE-2009-1091

CVE-2009-1091 : Cross-site scripting (XSS) vulnerability in upload.php of Rapidleech rev.36 and earlier. Remote attackers can inject arbitrary web script or HTML via the uploaded parameter. Affected: Rapidleech upload.php (rev.36 and earlier). Impact: partial integrity; no confidentiality or avai...

CVE-2008-5919

Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magicquotesgpc is disabled, allows remote attackers to overwrite arbitrary files via directory traversal sequences in the rev parameter...

Numark Cue 5.0 rev 2 Local .M3U File Stack Buffer Overflow Exploit

No description provided by source. /Numark Cue 5.0 rev 2 Local .M3U File Stack Buffer Overflow This sploit Launches calc.exe .. classical buffer overflow ,a 500 byte buffer is causing the exeption. Tested on WinXP Pro sp3,compiled with DEv-C++ 4.9.9.2. After preparation: |Access violation when...