TinyWebGallery 1.8.3 - Remote Command Execution

No description provided by source. 1 -------------- filefunctions.inc : function executecommand $command global $useshellexec; obstart; seterrorhandler"onerrornooutput"; i f substr@phpuname, 0, 7 == "Windows" // Make a new instance of the COM object $WshShell = new COM"WScript.Shell"; // Make the...

phpPgAdmin <= 4.2.1 (_language) Local File Inclusion Vulnerability

No description provided by source. :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP YmmMMMM MMM YM Discovered by dun \ dunatstrcpy.pl phpPgAdmin = 4.2.1 Local File Inclusion Vulnerability Script: phpPgAdmin is a web-based administratio...

Family Connections CMS 2.5.0 & 2.7.1 - (less.php) Remote Command Execution

No description provided by source. ?php / Family connections CMS v2.5.0-v2.7.1 remote command execution exploit vendor: https://www.familycms.com/ software link: https://www.familycms.com/download.php author: mrme::rwx kru email: steventhomasseeley!gmail!com ----------------------------------...

joomla component (com_ponygallery) SQL injection Vulnerability

No description provided by source. Exploit Title: joomla component componygallery SQL injection Vulnerability Download : http://www.adyawinsa.com/index.php/remository?func=fileinfo&id=2 Date: 11/04/2012 Author: xDarkSton3x E-mail : [email protected] Category: webapps Google dork:...

DAMN Hash Calculator 1.5.1 - Local Heap Overflow PoC

No description provided by source. !/usr/bin/python Exploit Title: DAMN Hash Calculator v1.5.1 Local Heap Overflow PoC Version: 1.5.1 Date: 2012-02-21 Author: Julien Ahrens Homepage: http://www.inshell.net Software Link: http://www.google.com Tested on: Windows XP SP3 Professional German Notes: O...

PHP-Nuke <= 8.0 XSS & HTML Code Injection in News Module

No description provided by source. Software Link: http://www.phpnuke.org/modules.php?name=Downloads&dop=viewdownload&cid=1 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= note : This bug found by tampering passed data . coders don't sanitize and check user entry point for news rate...

Hosting Controller <= 0.6.1 Unauthenticated User Registeration (3rd)

No description provided by source. !-- Hi, I'm Soroush Dalili from GSG GrayHatz Security Group. Title: Hosting controller program have a security bug in UserProfile.asp that an authenticated user can change other's profiles. Why is it dangerous: a user can change other's email address and then us...

SimpCMS <= 04.10.2007 (site) Remote File Inclusion Vulnerability

No description provided by source. Bug Found By Dr.RoVeR --Arab48 Hacker Contact: [email protected] --- Script: SimpCMS Light Download: http://www.simpcms.com/light/normal/simp-cms-light.zip -- Bug File: index.php Bug code in line 31: include $site..php; -- Exploit:...

SunShop Shopping Cart <= 3.5 (abs_path) RFI Vulnerabilities

No description provided by source. sunshop 4 index.php Remote File Include Vulnerability ----------------------------------------------------------------------------------------- scripts : SunShop v3.5 Discovered By : irvian scripts site : http://www.turnkeywebtools.com/sunshop/ Thanks To :...

QuickTime 7.5.5 / ITunes 8.0 - Remote off by one Crash Exploit

No description provided by source. Quicktime7.5.5/Itunes 8.0 Remote Heap Overflow Crash Vendor: http://www.apple.com/ Risk : high The ? quicktime type= ? tag fail to handle long strings, which can lead to a heap overflow in Quicktime/Itunes media player. This bug can be remote or local,...

Linux 3.4+ recvmmsg x32 compat - Proof of Concept

No description provided by source. / PoC trigger for the linux 3.4+ recvmmsg x32 compat bug, based on the manpage https://code.google.com/p/chromium/issues/detail?id=338594 $ while true; do echo $RANDOM /dev/udp/127.0.0.1/1234; sleep 0.25; done / define GNUSOURCE include netinet/ip.h include...

Wordpress Mini Mail Dashboard Widget Plugin 1.36 Remote File Inclusion

No description provided by source. Exploit Title: Mini Mail Dashboard Widget Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/mini-mail-dashboard-widget Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

Yogurt Social Network 3.2 rc1 Module for XOOPS seutubo.php uid Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/30618/info Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code ...

Max.Blog <= 1.0.6 (submit_post.php) SQL Injection Vulnerability

No description provided by source. Salvatore drosophila Fresta Application: Max.Blog http://www.mzbservices.com Version: Max.Blog = 1.0.6 Bug: SQL Injection Exploitation: Remote Dork: intext:Powered by Max.Blog Date: 27 Jan 2009 Discovered by: Salvatore drosophila Fresta Author: Salvatore...

Samba nttrans Reply - Integer Overflow Vulnerability

No description provided by source. Exploitation: samba nttrans reply integer overflow / \ / \ | || | | | \ / / . || | | | / | / / | || || //\ // / | CVE-2013-4124 samba integer overflow in nttrans reply reading ealist vulnerable samba daemon has a integer overflow to cause remote dos by...

Windows NDPROXY - 本地权限提升漏洞(MS14-002)

漏洞成因 这是一个windows内核漏洞，漏洞的触发需要开启Routing and Remote Access服务，影响 windowsxp，windows2003. 先上 poc c include include int main HANDLE hDev = CreateFile"\\.\NDProxy", GENERICREAD | GENERICWRITE, FILESHAREREAD | FILESHAREWRITE, NULL, OPENEXISTING , 0, NULL; ifhDev==INVALIDHANDLEVALUE printf"CreateFile...

Hosting Controller <= 0.6.1 HotFix 2.1 Change Credit Limit Exploit

No description provided by source. Hi, I'm Soroush Dalili from GSG GrayHatz Security Group. Title: Hosting controller program have a security bug in AccountActions.asp that an authenticated user can change his/her credit and buy some services! Version: 6.1 HotFix 2.1 and older Developer url:...

Phabricator: Abusing daemon logs for Privilege escalation under certain scenarios

Setup Needed + A normal user account + A momentary disruption of mail services Replication steps + Login as normal user + Wait for momentary disruption of mail services + Use Password Reset Link for admin mail address + BOOM!!! + You can see the password reset link in the daemon logs because of...

openSUSE Security Update : nagstamon (openSUSE-SU-2013:1235-1)

update to 0.9.10 : + added fullscreen option + added Thruk support + added CheckMK cookie-based auth + added new Centreon autologin option + added configurable default sort order + added filter for hosts in hard/soft state for Nagios, Icinga, Opsview and Centreon + added $STATUS-INFO$ variable...

openSUSE Security Update : colord (openSUSE-2011-57)

Update to version 0.1.15 : + This release fixes an important security bug: CVE-2011-4349. + New Features : - Add a native driver for the Hughski ColorHug hardware - Export cd-math as three projects are now using it + Bugfixes : - Documentation fixes and improvements - Do not crash the daemon if...