AirOS 6.x Arbitrary File Upload

Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's possible to a unauthenticated user to exploit this vulnerability. Example Consider the following request:...

Unauthenticated Command Injection in Management Web Interface

Palo Alto Networks PAN-OS implements an API to enable programmatic device configuration and administration of the device. An issue was identified where the management API incorrectly parses input to a specific API call, leading to execution of arbitrary OS commands without authentication via the...

WordPress Booking Calendar Contact Form 1.0.23 Blind SQL Injection

Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Unauthenticated blind SQL injection Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin Ramirez Martinez i0 SEC-LABORATORY Vendor Homepage: http://wordpress.dwbooster.com...

Network Vision IntraVue Code Injection Vulnerability

OVERVIEW Researcher Jürgen Bilberger from Daimler TSS GmbH has identified a code injection vulnerability in Network Vision’s IntraVue software. Network Vision has produced a new version that mitigates this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The...

IBM System Networking Switch Center DB Service Remote Elevation of Privilege Vulnerability

This vulnerability allows remote attackers to disclose information on vulnerable installations of IBM System Networking Switch Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IBM SNSC DB Service, that listens by default on port 40999. This...

HP Photosmart B210 printer SMB server buffer overflow vulnerability

Overview The HP Photosmart B210 printer utilizes an SMB server for managing the print queue. An invalid SMB packet may cause a denial of service condition, requiring the printer to be restarted. Description Fuzzing the first 296 bytes of an SMB packet may in some cases cause a denial of service...

WordPress Plugin CP Reservation Calendar 1.1.6 - SQL Injection

WordPress Plugin CP Reservation Calendar 1.1.6 - SQL Injection Exploit Title: WordPress: cp-reservation-calendar 1.1.6 SQLi injection Date: 2015-09-15 Google Dork: Index of /wp-content/plugins/cp-reservation-calendar/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Software Link:...

Django: possible DoS by filling session store

A flaw was found in the Django session backend, which could allow an unauthenticated attacker to create session records in the configured session store, causing a denial of service by filling up the session store...

WordPress Plugin WPTF Image Gallery 1.03 - Arbitrary File Download

WordPress Plugin WPTF Image Gallery 1.03 - Arbitrary File Download Title: Remote file download vulnerability in wptf-image-gallery v1.03 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-17 Download Site: https://wordpress.org/plugins/wptf-image-gallery Vendor:...

WordPress WPTF Image Gallery 1.03 File Download

Title: Remote file download vulnerability in wptf-image-gallery v1.03 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-17 Download Site: https://wordpress.org/plugins/wptf-image-gallery Vendor: https://profiles.wordpress.org/sakush100/ Vendor Notified: 0000-00-00 Vendor Contact:...

Remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms v3.0beta Wordpress plugin

Title: Remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms v3.0beta Wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-06-07 Download Site: https://wordpress.org/plugins/aviary-image-editor-add-on-for-gravity-forms Vendor: Waters Edge Web Design and...

WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload

WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload Title: Remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms v3.0beta Wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-06-07 Download Site:...

Pandora FMS 5.0, 5.1 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Authentication Bypass in Pandora FMS Google Dork: intitle:"Pandora FMS - The Flexible Monitoring System" intitle:"Pandora FMS - el Sistema Flexible de Monitorización" Date: 10/06/2015 Exploit Author: Manuel Mancera sinkmanu |...

WordPress Aviary Image Editor Add On For Gravity Forms 3.0 Beta Shell Upload Exploit

WordPress Aviary Image Editor Add On For Gravity Forms plugin version 3.0 beta suffers from a remote shell upload vulnerability. Title: Remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms v3.0beta Wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-06-07...

SysAid Help Desk Administrator Account Creation

This module exploits a vulnerability in SysAid Help Desk that allows an unauthenticated user to create an administrator account. Note that this exploit will only work once. Any subsequent attempts will fail. On the other hand, the credentials must be verified manually. This module has been tested...

SysAid Help Desk Database Credentials Disclosure

This module exploits a vulnerability in SysAid Help Desk that allows an unauthenticated user to download arbitrary files from the system. This is used to download the server configuration file that contains the database username and password, which is encrypted with a fixed, known key. This modul...

SysAid Help Desk Arbitrary File Download

This module exploits two vulnerabilities in SysAid Help Desk that allows an unauthenticated user to download arbitrary files from the system. First, an information disclosure vulnerability CVE-2015-2997 is used to obtain the file system path, and then we abuse a directory traversal CVE-2015-2996 ...

CP Multi View Event Calendar WordPress Plugins 1.1.4 - SQL Injection vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress: cp-multi-view-calendar.1.1.4 SQL Injection vulnerabilities Date: 2015-02-28 Google Dork: Index of /wordpress/wp-content/plugins/cp-multi-view-calendar Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY...

subversion: NULL pointer dereference flaw in mod_dav_svn when handling REPORT requests

A NULL pointer dereference flaw was found in the way the moddavsvn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash moddavsvn...

ManageEngine ServiceDesk 9.0 User Enumeration Vulnerability

ManageEngine ServiceDesk version 9.0 prior to build 9031 suffers from a remote user enumeration vulnerability. Title: ManageEngine ServiceDesk Plus User Enumeration Vulnerability Product: ServiceDesk Plus http://www.manageengine.com/ Affected Version: 9.0 Other versions could also be affected Fix...