Redaxo 5.2.0 - Cross-Site Request Forgery

Exploit Title : redaxo CMS CSRFAdd Admin Author : Ashiyane Digital Security Team Google Dork : intitle:Login · REDAXO Date : 1/11/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.redaxo.org/ Software link :http://www.redaxo.org/de/download/file/?f=redaxo5.2.0.zip Version : 5.2lates...

sNews 1.7.1 - Arbitrary File Upload

Exploit Title : Snews CMS upload sheller Author : Ashiyane Digital Security Team Google Dork : "This site is powered by sNews" Date : 04/11/2016 Type : webapps Platform : PHP Vendor Homepage : http://snewscms.com/ Software link : http://snewscms.com/download/snews1.7.1.zip Version : 1.7latest 3...

SweetRice 1.5.1 File Upload

||/usr/bin/python -- Coding: utf-8 -- Exploit Title: SweetRice 1.5.1 - Unrestricted File Upload Exploit Author: Ashiyane Digital Security Team Date: 03-11-2016 Vendor: http://www.basic-cms.org/ Software Link: http://www.basic-cms.org/attachment/sweetrice-1.5.1.zip Version: 1.5.1 Platform: WebApp ...

D8 Editor File upload - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-059

This module enables you to upload files directly within the CKEditor and create a link to download the given file. The module doesn't sufficiently check the uploaded file extensions when the allowed extensions list is not the default one. This vulnerability is mitigated by the fact that an attack...

SweetRice 1.5.1 Local File Inclusion

||/usr/bin/python -- Coding: utf-8 -- Exploit Title: SweetRice 1.5.1 - Local File Inclusion Exploit Author: Ashiyane Digital Security Team Date: 03-11-2016 Vendor: http://www.basic-cms.org/ Software Link: http://www.basic-cms.org/attachment/sweetrice-1.5.1.zip Version: 1.5.1 Platform: WebApp - PH...

My Little Forum 2.3.7 - Multiple Vulnerabilities

My Little Forum 2.3.7 - Multiple Vulnerabilities Title: ====== My Little Forum 2.3.7 - Multiple Vulnerability Product & Service Introduction: =============================== My little forum is a simple PHP and MySQL based internet forum that displays the messages in classical threaded view tree...

My Little Forum 2.3.7 File Disclosure

Title: ====== My Little Forum 2.3.7 - Source Code Disclosure Product & Service Introduction: =============================== My little forum is a simple PHP and MySQL based internet forum that displays the messages in classical threaded view tree structure. It is Open Source licensed under the GN...

My Little Forum 2.3.7 Cross Site Request Forgery / Cross Site Scripting

Title: ====== My Little Forum 2.3.7 - Multiple Vulnerability Product & Service Introduction: =============================== My little forum is a simple PHP and MySQL based internet forum that displays the messages in classical threaded view tree structure. It is Open Source licensed under the GN...

On the Dyn DDoS Attack, Keen Team, and a Phony Windows Installer

Mike Mimoso and Chris Brook recap the news of the week, including the storylines around last week’s Dyn DDoS attack, Keen Team winning big again at Pwn2Own, and a fake Windows installer. Download: ThreatpostNewsWrapOctober282016.mp3 Music by Chris Gonsalves...

VideoCharge Studio DLL Hijacking

Exploit Title: VideoCharge Studio DLL Hijacking Exploit quserex.dll Date: 13-09-2016 Author: Ashiyane Digital Security Team Vendor Homepage:http://www.videocharge.com/ Software Link: http://www.videocharge.com/download/VideoChargeStudioInstall.exe Tested on:Windows 7...

Vivaldi 1.4.589.11 DLL Hijacking

Exploit Title: Vivaldi browser DLL Hijacking Author: Ashiyane Digital Security Team Vendor Homepage: https://vivaldi.com/ software link: https://downloads.vivaldi.com/stable/Vivaldi.1.4.589.11.exe Tested on:Windows 7 Date: 13-09-2016...

Tripal BLAST UI - Highly Critical - Remote Code Execution - SA-CONTRIB-2016-054

This module enables you to run NCBI BLAST jobs on the host system. The module doesn't sufficiently validate advanced options available to users submitting BLAST jobs, thereby exposing the ability to enter a short snippet of shell code that will be executed when the BLAST job is run. This...

BigTree CMS 4.2.13 Cross Site Request Forgery

-------------------------- - Exploit Title : bigtree cms CSRF Exploit - Author : Ashiyane Digital Security Team - Vendor Homepage: https://www.bigtreecms.org/ - Software Link: - https://www.bigtreecms.org/ajax/download-installer/?installer=53 - Version : 4.2.13 - Date: 26-10-2016 - Tested On :...

Adobe Reader 9.3.0 DLL Hijacking

===================================================== Adobe Reader 9.3.0 - DLL Hijacking ===================================================== Vendor Homepage: https://www.adobe.com/ Date: 24 Oct 2016 Version : 9.3.0 Author: Ashiyane Digital Security Team Contact: [email protected]...

Orange Inventel LiveBox 5.08.3-sp - Cross-Site Request Forgery

Exploit Title: Orange Inventel LiveBox CSRF Google Dork: N/A Date: 10-24-2016 Exploit Author: BlackMamba TEAM BM1 Vendor Homepage: N/A Version: Inventel - v5.08.3-sp Tested on: Windows 7 64bit CVE : N/A Category: Hardware 1. Description This Router is vulnerable to Cross Site Request Forgery , a...

Orange Inventel LiveBox 5.08.3-sp Cross Site Request Forgery

Exploit Title: Orange Inventel LiveBox CSRF Google Dork: N/A Date: 10-24-2016 Exploit Author: BlackMamba TEAM BM1 Vendor Homepage: N/A Version: Inventel - v5.08.3-sp Tested on: Windows 7 64bit CVE : N/A Category: Hardware 1. Description This Router is vulnerable to Cross Site Request Forgery , a...

Telegram Web 0.5.5 Username Bypass Vulnerability

Exploit for tricks platform in category remote exploits Exploit Title: Telegram Web Empty Username Bypass Date: 18/10/2016 Author: Ashiyane Digital Security Team Software Link: https://web.telegram.org version : Telegram Web 0.5.5 Tested on: Windows 7 Description: Telegram filters null bytes for...

Event Calendar PHP 1.5 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications input type='hidden' name='caln...

Telegram Web 0.5.5 Username Bypass

Exploit Title: Telegram Web Empty Username Bypass Date: 18/10/2016 Author: Ashiyane Digital Security Team Software Link: https://web.telegram.org version : Telegram Web 0.5.5 Tested on: Windows 7 Description: Telegram filters null bytes for username input but you can bypass this filter with "NOP"...

MBRFilter — Open Source Tool to Protect Against 'Master Boot Record' Malware

Ransomware threat has risen exponentially so much that ransomware authors have started abusing the MBR in their attacks to lock down your entire computer instead of just encrypting your important files on hard drive. Talos team at Cisco Systems has released a free, open-source tool that protects...