RiverBed Stingray Traffic Manager 9.6 Cross Site Scripting

I. VULNERABILITY ------------------------- XSS Reflected vulnerability in RiverBed Stingray Traffic Manager Virtual Appliance V 9.6 II. BACKGROUND ------------------------- Silver Peak VX software marries the cost and flexibility benefits of virtualization with the performance gains associated wi...

php云问答功能处存储型xss

简要描述： 需要主动触发。 详细说明： http://www.hr135.com/ask/index.php 测试地址：http://www.hr135.com/ask/index.php?c=content&id=162 超级链接写入：javascriptalert1 &NewLine是HTML5新增的实体命名编码 firebug之类工具修改链接名称增加欺骗性 成功触发JS 使用追问功能再次添加超级链接：javascriptalertdocument.cookie 成功弹出cookie 漏洞证明：...

Weilian /product.asp SQL注入漏洞

No description provided by source...

Download Manager 0.2 - Arbitrary File Upload Exploit

The downloads-manager WordPress plugin was affected by an Arbitrary File Upload Exploit security vulnerability...

Lian Li NAS - Multiple Vulnerabilities

Lian Li NAS - Multiple Vulnerabilities Exploit Title: Lian Li NAS Multiple vulnerabilities Date: 21/07/2014 Exploit Author: pws Vendor Homepage: http://www.lian-li.com/en/dtportfoliocategory/nas/ Firmware Link: https://www.dropbox.com/s/imvkndl8m5yj7qp/G5S604121826700.tar.gz Tested on: Latest...

Lian Li NAS - Multiple Vulnerabilities

Exploit Title: Lian Li NAS Multiple vulnerabilities Date: 21/07/2014 Exploit Author: pws Vendor Homepage: http://www.lian-li.com/en/dtportfoliocategory/nas/ Firmware Link: https://www.dropbox.com/s/imvkndl8m5yj7qp/G5S604121826700.tar.gz Tested on: Latest version CVE : None yet 1. Hardcoded cookie...

Linux Kernel ptrace/sysret - Local Privilege Escalation Exploit

The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service double...

Phpyun注入一枚绕过360注射附exp

简要描述： 可以引入单引号, 但是在这里也不需要引入单引号。 虽然有360 但是还是能注入出密码。 写了个小脚本来跑。（代码很渣 速度很慢 但是还是能跑完整） - - 特么的完全不会写, 太渣了。 详细说明： 在model/register.class.php中。 function ajaxregaction $post = arraykeys$POST; $keyname = $post0; if$keyname=="username" $username=@iconv"utf-8","gbk",$POST'username';...

华天动力OA任意文件删除

简要描述： Just another bug. 详细说明： 以官网http://demo.oa8000.com/为例， user:123456 登陆后， 向http://demo.oa8000.com/OAapp/bfapp//buffalo/oaPubptUploadService POST如下参数： \n removeFile\n C:/PROGRA1/htoa/Tomcat/webapps/OAapp/1.html\n 即可删除1.html 漏洞证明： 在删除前，利用wooyun-2014-065670看到的结果本来是这样的 删除后，...

pfSense 2.1 build 20130911-1816 - Directory Traversal

No description provided by source...

FreeBSD 9.0-9.1 mmap/ptrace - Privilege Esclation Exploit

No description provided by source. / FreeBSD 9.0,1 mmap/ptrace exploit by Hunger [email protected] Happy Birthday FreeBSD! Now you are 20 years old and your security is the same as 20 years ago... : Greetings to nohup, 2501, boldi, eax, johnnyb, kocka, op, pipacs, prof, sd, sghctoma, snq, spende...

Kolibri+ Webserver 2 - (GET Request) Remote SEH Overwrite Exploit

No description provided by source. !/usr/bin/python Could not get this to work on XP SP3. php5ts.dll is the only module with safe seh off but could not get the pop pop ret to work correctly despite the large number of usable addresses that were tested. $ ./kolibri.py 192.168.1.146 8080 Kolibri+...

Microsoft Windows 2000/NT 4 POSIX Subsystem Buffer Overflow Local Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10710/info The Microsoft POSIX subsystem implementation is prone to a local buffer overflow vulnerability. A local attacker may exploit this vulnerability in order to run code with elevated privileges, fully compromising...

SoX - (.wav) Local Buffer Overflow Exploiter

No description provided by source. //--------------------------------- Begin Code: sox-exploiter.c --------------------------------- / Copyright Rosiello Security 2004 http://www.rosiello.org CVE Reference: CAN-2004-0557 Bug Type: Stack Overflow Date: 01/08/2004 Ulf Harnhammar reported that there...

com_loudmouth Mambo Component <= 4.0j - Include Vulnerability

No description provided by source. Bug Found by h4ntu http://h4ntu.com batamhacker crew Another Mambo component remote inclusion vulneribility download : http://mamboxchange.com/frs/download.php/7911/comloudmouth-4.0j.zip bug found in file abbc.class.php : include...

Invision Power Board <= 1.3.1 Login.PHP SQL Injection (working)

No description provided by source. ?php / = 1.3.1 Final /str0ke / $server = SERVER; $port = 80; $file = PATH; $target = 81; / User id and password used to fake-logon are not important. '10' is a random number. / $id = 10; $pass = ; $hex = 0123456789abcdef; for$i = 1; $i = 32; $i++ $idx = 0; $foun...

BOINC 5.10.20 forum_forum.php id Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/25644/info BOINC Berkeley Open Infrastructure for Network Computing is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage...

Solaris 2.x/7.0/8,IRIX 6.5.x,OpenBSD 2.x,NetBSD 1.x,Debian 3,HP-UX 10 Telnetd Buffer Overflow

No description provided by source. source: http://www.securityfocus.com/bid/3064/info A boundary condition error exists in telnet daemons derived from the BSD telnet daemon. Under certain circumstances, the buffer overflow can occur when a combination of telnet protocol options are received by th...

NovaPlayer 1.0 (.mp3) Local Denial of Service (DoS) #

No description provided by source. !/usr/bin/perl print qq NovaPlayer 1.0 .mp3 Local Denial of Service DoS by Mr.tro0oqy ; author: Mr.tro0oqy email : [email protected]:[email protected] greetz : Red-D3v1L , virushima , Stack system color e; my $bb=tro0oqy.mp3; my $fk=\x41 x 10000; open...

Den Dating 9.01 - (searchmatch.php) SQL Injection Vulnerability

No description provided by source. Scripts Den Dating Demo V9.01searchmatch.php SQL Injection Vulnerability Author: nuclear site: http://www.scriptsden.com SQL vuln: http://localhost/path/searchmatch.php?page=2&sortby=username&sortorder=asc&txtgender=M&txtlookgender=F' union select...