CVE-2018-17777

An issue was discovered on D-Link DVA-5592 A1WI20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN 0000, it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have access to the router...

phpBB 3.2.3 - Remote Code Execution

phpBB 3.2.3 - Remote Code Execution // All greets goes to RIPS Tech // Run this JS on Attachment Settings ACP page var pluploadsalt = ''; var formtoken = ''; var creationtime = ''; var filepath = 'phar://./../files/plupload/$saltaaae9cba5fdadb1f0c384934cd20d11czip.part'; // md5'evil.zip' =...

CVE-2018-2478

An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40 and 7.50 to 7.53. Not all commands are possible, only those that can be executed by the adm user. The commands executed depen...

Evince 3.24.0 - Command Injection Exploit

Exploit for linux platform in category dos / poc Exploit Title: evince command line injection Exploit Author: Matlink Vendor Homepage: https://wiki.gnome.org/Apps/Evince Software Link: https://wiki.gnome.org/Apps/Evince Version: 3.24.0 Tested on: Debian sid CVE : CVE-2017-1000083 Can be tested on...

Evince 3.24.0 - Command Injection

Exploit Title: evince command line injection Date: 2017-09-05 Exploit Author: Matlink Vendor Homepage: https://wiki.gnome.org/Apps/Evince Software Link: https://wiki.gnome.org/Apps/Evince Version: 3.24.0 Tested on: Debian sid CVE : CVE-2017-1000083 Can be tested on docker with...

Shell In A Box 2.2.0 Denial Of Service Exploit

Exploit for linux platform in category dos / poc Product: Shell In A Box aka shellinabox, shellinaboxd "Shell In A Box implements a web server that can export arbitrary command line tools to a web based terminal emulator. This emulator is accessible to any JavaScript and CSS enabled web browser a...

STOPzilla AntiMalware 6.5.2.59 - Privilege Escalation (2)

/ 3y3t3m th!s - Ivan Ivanovic Ivanov Иван-дурак недействительный 31337 Team clone of https://www.exploit-db.com/exploits/45401 deb yaaaa win7 narrrr fails ch@ng3 p@yl0@d!!!!!!!!!!!!! / include include include include pragma commentlib,"winsta.lib" pragma commentlib,"advapi32.lib" define...

CVE-2018-14503

CVE-2018-14503 is an XSS vulnerability in Coremail XT 3.0, affecting the intervalCheck.jsp page. An attacker can inject arbitrary web script/HTML via the sid parameter, enabling remote script execution in the context of the affected user. The connected documents specify the affected software (Cor...

CVE-2018-14503

Cross-site scripting XSS vulnerability in intervalCheck.jsp in Coremail XT 3.0 allows remote attackers to inject arbitrary web script or HTML via the sid parameter...

Microsoft Windows: Network access: Allow anonymous SID/Name translation

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnaanonymoustranslation.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Network access: Allow anonymous SID/Name translation Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

ASUSTOR SoundsGood Application Cross-Site Scripting Vulnerability

SUSTOR SoundsGood is a web-based audio/video playback application from ASUSTOR for use on ASUSTOR NAS storage systems. A cross-site scripting vulnerability exists in the playlistmanger.cgi file in the ASUSTOR SoundsGood application. A remote attacker can exploit the vulnerability by injecting...

Microsoft Windows - Token Process Trust SID Access Check Bypass Privilege Escalation

Microsoft Windows - Token Process Trust SID Access Check Bypass Privilege Escalation Windows: Token Trust SID Access Check Bypass EOP Platform: Windows 10 1709 also tested current build of RS4 Class: Elevation of Privilege Summary: A token’s trust SID isn’t reset when setting a token after proces...

Microsoft Windows - Token Process Trust SID Access Check Bypass Privilege Escalation Exploit

Exploit for windows platform in category local exploits Windows: Token Trust SID Access Check Bypass EOP Platform: Windows 10 1709 also tested current build of RS4 Class: Elevation of Privilege Summary: A token’s trust SID isn’t reset when setting a token after process creation allowing a user...

Microsoft Windows 10: Accounts: Rename guest account

The Accounts: Rename guest account policy setting determines whether a different account name is associated with the security identifier SID for the Guest account. OpenVAS Vulnerability Test $Id: win10renameguestaccount.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Accounts: Rename...

Out-of-bounds

DISPUTED The libevtrecordvaluesreadevent function in libevtrecordvalues.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub...

CVE-2018-8754

The libevtrecordvaluesreadevent function in libevtrecordvalues.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub...

CVE-2018-8754

The libevtrecordvaluesreadevent function in libevtrecordvalues.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub...

CVE-2018-8754

The libevtrecordvaluesreadevent function in libevtrecordvalues.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub...

CVE-2018-8754

The libevtrecordvaluesreadevent function in libevtrecordvalues.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub...

CVE-2018-8754

The libevtrecordvaluesreadevent function in libevtrecordvalues.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub...