Mavenlink: privilege escalation

Consider Two browsers say X and Y, also consider two users say A and B. 2. Sign in to https://app.mavenlink.com using user A through browser X, same as login with user B through browser Y. 3. Now create a project through user A, and add user B as a consultant with Team Lead privilege. 4. Now...

RHEL 6 : MRG (RHSA-2013:1852)

Updated Grid component packages that fix multiple security issues are now available for Red Hat Enterprise MRG 2.4 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, whi...

RHEL 6 : MRG Messaging (RHSA-2012:1279)

Updated Messaging component packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.2 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common...

RHEL 6 : Red Hat Enterprise MRG Messaging 2.3 (RHSA-2013:0562)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0562 advisory. Red Hat Enterprise MRG Messaging, Realtime, and Grid is a next-generation IT infrastructure for enterprise computing. MRG offers increased...

vBulletin 5.1.2 SQL Injection

?php / Author: Nytro Powered by: Romanian Security Team Price: Free. Educational. / errorreportingEALL; iniset'displayerrors', 1; // Get arguments $targeturl = isset$argv1 ? $argv1 : 'https://rstforums.com/v5'; $expression = strreplace'/', '\/', $targeturl; // Function to send a POST request...

SA-CONTRIB-2014-070 - Password Policy - Access Bypass

The Password Policy module enables you to define and enforce password policies with various constraints on allowable user passwords. Access Bypass 7.x only Password Policy has a Password Change Tab submodule which provides a tab for a user to change their password. Password Policy also has a...

Linux x86 - Socket Re-use Shellcode 50 bytes

Linux x86 - Socket Re-use Shellcode 50 bytes. CVE-2014-4943. Shellcode exploit for linx86 platform / Socket Re-use Combo for linux x86 systems by ZadYree -- 50 bytes Made using sockfd trick + dup20,0, dup20,1, dup20,2 + execve /bin/sh Thanks: Charles Stevenson, ipv, 3LRVS research team gcc -o...

SA-CONTRIB-2014-069 - Logintoboggan - Access Bypass and Cross Site Scripting (XSS)

This module enables you to customise the standard Drupal registration and login processes. Cross Site Scripting The module doesn't filter user-supplied information from the URL resulting in a reflected Cross Site Scripting XSS vulnerability. Access Bypass The module introduces a concept of a...

Microsoft Internet Explorer 9/10 - CFormElement Use-After-Free / Memory Corruption (PoC) (MS14-035)

loaded = false ; function func if loaded document.body.innerHTML = "" ; // free CFormElement input1 = document.getElementById"input1" ; input1.onclick = func ; loaded = true ; input1.click; // Call DoClick function !-- Vulnerability details MSHTML!CInput::DoClick 66943670 8bcf mov ecx,edi 6694367...

Microsoft Internet Explorer 910 - CFormElement Use-After-Free Memory Corruption (PoC) (MS14-035)

Microsoft Internet Explorer 910 - CFormElement Use-After-Free Memory Corruption PoC MS14-035 loaded = false ; function func if loaded document.body.innerHTML = "" ; // free CFormElement input1 = document.getElementById"input1" ; input1.onclick = func ; loaded = true ; input1.click; // Call DoClic...

SA-CONTRIB-2014-067 - Meta Tags Quick - Multiple vulnerabilities

Meta tags quick adds meta tags editing to all non-administrative pages of Drupal site. Redirector abuse in path-based meta tag editing form When editing a path-based meta tag, module does not check destination parameter of the URL, allowing attacker to pass arbitrary URL to meta tag editing form...

ZipScan 2.2c SEH

No description provided by source. !/usr/bin/perl Software : ZipScan 2.2c .zip Bug found by : Lincoln Author : Lincoln & corelanc0d3r OS : Windows Tested on : XP SP3 En VirtualBox Type of vuln : SEH Greetz to : Corelan Security Team...

Joomla Component com_jcalpro 1.5.3.6 - Remote File Inclusion

No description provided by source. Author : kaMtiEz [email protected] Homepage:http://www.indonesiancoder.com Software Information + Vendor : http://www.anything-digital.com + version : 1.5.3.6 Stable or upper / lower maybe also affected + Dork : inurl:comjcalpro Vulnerable File...

Cyclope Internet Filtering Proxy 4.0 - CEPMServer.exe DoS (Poc)

No description provided by source. !/usr/bin/python Title: Cyclope Internet Filtering Proxy 4.0 - CEPMServer.exe DoS Poc. From: The eh?-Team || The Great White Fuzz we're not sure yet Found by: loneferret Software link: http://www.cyclope-series.com/download/index.aspx?p=2 Date Found: Oct 20th 20...

Total Commander 6.x - (unacev2.dll) Buffer Overflow PoC Exploit

No description provided by source. / -- /\ / Total Commander unacev2.dll Buffer Overflow PoC Exploit /\ by Darkeagle of Unl0ck Research Team / http://unl0ck.net /\ / when file will be created, try to open archive in TotalCmd and then unpack it ; /\ / -- / include string.h include stdio.h...

Mocha W32 LPD 1.9 Remote Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/39498/info Mocha W32 LPD is prone to a remote buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data. Successful exploits may allow attackers to execute arbitrar...

PHPNUKE CMS (Survey and Poll) SQL Injection Vulnerability

No description provided by source. Tittle :PHPNUKE CMS Survey&poll SQLi Vulner Author : SENOT [email protected] Homepage : http://www.indonesiancoder.com Date : Thursday 04 March, 2010 Location : - INDONESIA - + CMS INFO + Name : PHPNUKE CMS + Vendor : http://phpnuke.org/ + Download :...

RM Downloader .m3u BOF (SEH)

No description provided by source. !/usr/bin/perl -w Author: Jacky Version: 3.0.2.1 Tested on: Windows XP SP2 RM Downloader m3u Buffer Overflow SEH Perl Edition Discovered by :: Peter Van Eeckhoutte VERY BIG GREETZ TO HIM ;- Written by Jacky All Greetz for Peter Van Eeckhoutte and Corelan Team !!...

OneForum (topic.php) SQL Injection Vulnerability

No description provided by source. Title : OneForum SQL Injection Vulnerability Author : Red Security TEAM Date : 22/02/2012 Risk : High Software : http://www.onescripts.de/ Download : http://www.onescripts.de/download/oneforum.zip Tested On : CentOS Contact : Info at RedSecurity . COM Home :...

Evince PDF Reader - 2.32.0.145 (Windows) and 3.4.0 (Linux) - Denial of Service

No description provided by source. Advisory Information : ====================== Title : Evince 2.32.0.145 - Denial Of Service Product : Evince pdf reader Vendor Homepage: https://projects.gnome.org/evince/ Vulnerable Versions : Windows 2.32.0.145, Linux 3.4.0 and probably prior release Tested...