12604 matches found
Fedora 22 : php-symfony (2016-4ad874e6c2)
Version 2.7.13 2016-05-09 - security 18733 limited the maximum length of a submitted username fabpot - bug 18730 FrameworkBundle prevent calling get for servicecontainer service xabbuh - bug 18709 DependencyInjection top-level anonymous services must be public xabbuh - bug 18692 add Event...
dropbear -- multiple vulnerabilities
Matt Johnston reports: If specific usernames including "%" symbols can be created on a system validated by getpwnam then an attacker could run arbitrary code as root when connecting to Dropbear server. A dbclient user who can control username or host arguments could potentially run arbitrary code...
Path traversal with SaveDir and UploadDir
PMASA-2016-37 Announcement-ID: PMASA-2016-37 Date: 2016-07-12 Summary Path traversal with SaveDir and UploadDir Description A vulnerability was reported with the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a...
The vulnerability of the Unified Infrastructure Manager, a monitoring program for IT infrastructure, allows a perpetrator to bypass the authentication process through the LDAP service.
The vulnerability of the Unified Infrastructure Manager’s IT-infrastructure monitoring software exists due to an error in the access management subsystem. Exploiting this vulnerability allows a malicious actor to bypass the authentication process through the LDAP service, by providing only the...
Linux/x86-64 - Ncat Shellcode (SSL, MultiChannel, Persistant, Fork, IPv4/6, Password) (176 bytes)
include include // Exploit Title: Linux 64bit Ncat + SSL + MultiChannel + Persistant + Fork + IPv4/6 + Password 176byte // Date: 7/5/2016 // Exploit Author: CripSlick // Tested on: Kali 2.0 // Version: Ncat: Version 7.01 // email protected // OffSec ID: OS-20614 // http://50.112.22.183/...
Linux 64bit Ncat Shellcode SSL, MultiChannel, Persistant, Fork, IPv4/6, Password - 176 bytes
Linux 64bit Ncat Shellcode SSL, MultiChannel, Persistant, Fork, IPv4/6, Password - 176 bytes. Shellcode exploit for linx86-64 platform include include // Exploit Title: Linux 64bit Ncat + SSL + MultiChannel + Persistant + Fork + IPv4/6 + Password 176byte // Date: 7/5/2016 // Exploit Author:...
The vulnerability of the Simatic PCS 7 software allows a remote attacker to compromise the confidentiality of protected information.
The vulnerability exists in Web Navigator of Siemens WinCC due to the different behaviors of NetBIOS user names, depending on whether a user account exists or not. Exploiting this vulnerability allows remote users who have been authenticated to list user accounts using specially crafted URL...
Linux/x86-64 - Ncat Shellcode (SSL, MultiChannel, Persistant, Fork, IPv4/6, Password) (176 bytes)
include include // Exploit Title: Linux 64bit Ncat + SSL + MultiChannel + Persistant + Fork + IPv4/6 + Password 176byte // Date: 7/5/2016 // Exploit Author: CripSlick // Tested on: Kali 2.0 // Version: Ncat: Version 7.01 // email protected // OffSec ID: OS-20614 // http://50.112.22.183/...
The vulnerability of the Dr.Web Enterprise Security Suite, a antivirus software, allows a malicious individual to carry out XSS attacks.
The vulnerability of the Dr.Web Enterprise Security Suite anti-virus protection allows for XSS attacks due to insufficient validation of the user name in the web administrator’s login page. This means that before the user name is returned to the user, it may be compromised by a malicious actor...
Keybase: Register multiple users using one invitation (race condition)
Hi, It is possible to create multiple accounts using a single invitationid due to a race condition bug in //api/1.0/signup.json. I have successfully created 8 accounts using invitation with id = 37c5a121adf23e90b875500d The account usernames: novijosiptest1,2,4,5,6,8,9,10 you can delete them, I...
Cron Persistence
This module will create a cron or crontab entry to execute a payload. The module includes the ability to automatically clean up those entries to prevent multiple executions. syslog will get a copy of the cron entry. This module requires Metasploit: https://metasploit.com/download Current source:...
S8000 rotating machinery online condition monitoring and analysis system /default. asp parameter username injection vulnerability
No description provided by source...
Acer Admits E-commerce Site Breached
Taiwanese electronics company Acer began sending letters to customers last week indicating that some of their sensitive financial information–credit card data included–may have been accessed over the last year or so. Customers’ names, addresses, card numbers, expiration dates, and three digit CVV...
Nextcloud: help.nextcloud Email Address/Username enumeration
Hello nextcloud, i have another findings, i found that email address enumeration and or username enumeration is possible in signup/registration and forgot password under https://help.nextcloud.com/ , email/username enumeration can be use in any malicious intent by a malicious minded user. - For...
TUTOS phpinfo() Information Disclosure (HTTP) - Active Check
TUTOS allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls the phpinfo function. SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...
iSQL 1.0 - Shell Command Injection
Exploit for linux platform in category local exploits !/bin/ruby Exploit Title: iSQLRL 1.0 - Shell Command Injection Date: 2016-06-13 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: https://github.com/roselone/iSQL Software Link:...
SQL Injection Vulnerability in Communication Application Server username Parameter of Shenou Communication Equipment Co.
Shenou Communication Equipment Co., Ltd. is a national non-regional enterprise integrating R&D, production, sales and service. Communication Application Server SOC1000 model products are softswitch servers for IP networks, supporting voice, fax and video at the same time. Shenou Communication...
HDCMS内容管理系统 spacecontroller.class.php 参数username SQL注入漏洞
0x01漏洞简介 HDCMS内容管理系统在文件spacecontroller.class.php处的参数username存在SQL注入漏洞。 0x02漏洞详情 member/controller/spacecontroller.class.php public function init //用户名 if $username = Q'username' $uid = M'user'-where"username='$username'"-getField'uid'; goU"index", array'uid' = $uid; $this-uid = Q'uid', 0, 'intval...