MS13-009 Microsoft Internet Explorer SLayoutRun Use-After-Free

This Metasploit module exploits a use-after-free vulnerability in Microsoft Internet Explorer where a CParaElement node is released but a reference is still kept in CDoc. This memory is reused when a CDoc relayout is performed. This file is part of the Metasploit Framework and may be subject to...

[WAppEx v2.0] Web Application Exploitation Tool

WAppEx is an integrated Web Application security assessment and exploitation platform designed with the whole spectrum of security professionals to web application hobbyists in mind. It suggests a security assessment model which revolves around an extensible exploit database. Further, it...

Microsoft Internet Explorer - SLayoutRun Use-After-Free (MS13-009) (Metasploit) (1)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Microsoft Interne...

[NTFS Permissions Reporter] Display Windows User Access Rights

If you are working as a standalone user on a system running one of the latest flavors of the Microsoft Windows operating system, you do not really have much need to assess and verify user permissions on the system. If a PC is shared by many, and maybe even multiple users with administration right...

Polycom Command Shell Authorization Bypass

The login component of the Polycom Command Shell on Polycom HDX video endpoints, running software versions 3.0.5 and earlier, is vulnerable to an authorization bypass when simultaneous connections are made to the service, allowing remote network attackers to gain access to a sandboxed telnet prom...

SAP NetWeaver DI - Arbitrary file upload

Application: SAP NetWeaver J2EE Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs: Arbitrary file upload/Security bypass Exploits: YES Reported: 11.12.2012 Vendor response: 12.12.2012 Date of SAP Security Note Published: 12.02.2013 Date of Public Advisory: 20.02.2013 Reference:...

SAP NetWeaver RSDDCVER_COUNT_TAB_COLS - Potential SQL Injection

Application: SAP NetWeaver Versions Affected: 7.30 Basis 720 SP 0, Kernel 720 patch 68 Vendor URL: http://www.sap.com Bugs: SQL injection Exploits: NO Reported: 22.10.2012 Vendor response: 23.10.2012 Date of Public Advisory: 16.11.2013 Reference: SAP Security Note 1836718 CVSS:...

ViArt Shop Evaluation 4.1 - Multiple Remote File Inclusions

ViArt Shop Evaluation 4.1 - Multiple Remote File Inclusions Exploit Title: ViArt Shop Evaluation v4.1 Multiple Remote File Inclusion Vulnerability Date: 26/9/2012 Author: L0n3ly-H34rT Contact: [email protected] My Site: http://se3c.blogspot.com/ Vendor Link: http://www.viart.com/ Software...

SAP NetWeaver HTTP - Partial HTTP POST requests DoS

Application: SAP Versions Affected: SAP Netweaver 7.02/7.3, probably others Vendor URL: http://www.sap.com Bugs: Denial of Service Exploits: YES Reported: 25.09.2012 Vendor response: 26.09.2012 Date of Public Advisory: 17.10.2014 Reference: SAP Security Note 1986725 Author: Alexey Tyurin ERPScan...

PT-2015-10: Privilege Gaining in Siemens SIMATIC STEP 7 (TIA Portal)

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in Siemens SIMATIC STEP 7 TIA Portal. Vulnerability exists in TIA Portal due to improper integrity protection of project-file fields containing user’s privileges, which allows attackers to modify user...

Cryptographp Local File Inclusion / HTTP Response Splitting

Exploit for php platform in category web applications During a security assessment, I’ve found that my target was using Cryptographp which is a PHP script used for generate « captchas ». It was easily noticeable when I’ve found the following URL: http://WWWW/cryptographp.inc.php?cfg=XX&sn=YYYY&ZZ...

Cryptographp Local File Inclusion / HTTP Response Splitting

During a security assessment, I’ve found that my target was using Cryptographp which is a PHP script used for generate « captchas ». It was easily noticeable when I’ve found the following URL: http://WWWW/cryptographp.inc.php?cfg=XX&sn=YYYY&ZZZZ So I've decided to take a look at the source code a...

Oracle GlassFish Server 3.1.1 (build 12) - Multiple Cross-Site Scripting Vulnerabilities

Oracle GlassFish Server 3.1.1 build 12 - Multiple Cross-Site Scripting Vulnerabilities Details Vendor Site: Oracle www.oracle.com Date: April, 19th 2012 – CVE 2012-0551 Affected Software: Oracle GlassFish Server 3.1.1 build 12 Researcher: Roberto Suggi Liverani PDF version:...

Android Security - Boot Camp Workshop & Presentation #2

Document Title: =============== Android Security - Boot Camp Workshop & Presentation 2 References: =========== Mirror: http://www.vulnerability-lab.com/resources/documents/471.rar Release Date: ============= 2012-03-07 Vulnerability Laboratory ID VL-ID: ==================================== 471...

stoneware webnetwork6 - Multiple Vulnerabilities

Stoneware WebNetwork6 Vulnerability Assessment CVE-2012-0285 – XSS CVE-2012-0286 - CSRF Conducted by: Leland Public Schools Stoneware Customer Jacob Holcomb Network Engineer for LPS Conducted for: Leland Public Schools Purchaser of WebNetwork product. Test was to assure cloud security Stoneware...

stoneware webnetwork6 - Multiple Vulnerabilities

stoneware webnetwork6 - Multiple Vulnerabilities Stoneware WebNetwork6 Vulnerability Assessment CVE-2012-0285 – XSS CVE-2012-0286 - CSRF Conducted by: Leland Public Schools Stoneware Customer Jacob Holcomb Network Engineer for LPS Conducted for: Leland Public Schools Purchaser of WebNetwork...

Stoneware WebNetwork6 Multiple Vulnerabilities

Exploit for jsp platform in category web applications Stoneware WebNetwork6 Vulnerability Assessment Conducted by: Leland Public Schools Stoneware Customer Jacob Holcomb Network Engineer for LPS Conducted for: Leland Public Schools Purchaser of WebNetwork product. Test was to assure cloud securit...

IT-Grundschutz M4.277: Absicherung der SMB-, LDAP- und RPC-Kommunikation unter Windows Server 2003(Windows)

IT-Grundschutz M4.277: Absicherung der SMB-, LDAP- und RPC-Kommunikation unter Windows Server 2003Windows. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94223 Diese...

Windows Gather Windows Host File Enumeration

This module returns a list of entries in the target system's hosts file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Windows Host File Enumeration', 'Description' = %q This...

Windows Manage Hosts File Injection

This module allows the attacker to insert a new entry into the target system's hosts file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'English' class MetasploitModule 'Windows Manage Hosts File Injection'...