iTwitter v0.04 WP Plugin - XSS & CSRF Web Vulnerability

Document Title: =============== iTwitter v0.04 WP Plugin - XSS & CSRF Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1375 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9336 CVE-ID: ======= CVE-2014-9336 Release Date:...

Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Exploit

Summary Soitec power plants are a profitable and ecological investment at the same time. Using Concentrix technology, Soitec offers a reliable, proven, cost-effective and bankable solution for energy generation in the sunniest regions of the world. The application shows how Concentrix technology...

Advantech AdamView 4.30.003 - (.gni) SEH Buffer Overflow Exploit

Exploit for windows platform in category local exploits !/usr/bin/env ruby Exploit Title: Advantech AdamView .gni SEH Buffer Overflow Date: Dec 09 2014 Vulnerability Discovery: Daniel Kazimirow and Fernando Paez - Core Security Exploit Author: Muhamad Fadzil Ramli Software Link:...

BulletProof FTP Client 2010 - Buffer Overflow (SEH) Exploit

Exploit for windows platform in category local exploits !/usr/bin/env ruby Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow SEH Exploit Date: Dec 03 2014 Vulnerability Discovery: Gabor Seljan Exploit Author: Muhamad Fadzil Ramli Software Link: http://www.bpftp.com/ Version: 2010.75.0....

Advantech AdamView 4.30.003 - .gni Local Buffer Overflow (SEH)

Advantech AdamView 4.30.003 - .gni Local Buffer Overflow SEH !/usr/bin/env ruby Exploit Title: Advantech AdamView .gni SEH Buffer Overflow Date: Dec 09 2014 Vulnerability Discovery: Daniel Kazimirow and Fernando Paez - Core Security Exploit Author: Muhamad Fadzil Ramli Software Link:...

BulletProof FTP Client 2010 - Local Buffer Overflow (SEH)

!/usr/bin/env ruby Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow SEH Exploit Date: Dec 03 2014 Vulnerability Discovery: Gabor Seljan Exploit Author: Muhamad Fadzil Ramli Software Link: http://www.bpftp.com/ Version: 2010.75.0.76 Tested on: Microsoft Windows XP SP3 EN Version 5.1.26...

Thomson Reuters Fixed Assets CS 13.1.4 - Local Privilege Escalation

Exploit Title: Thomson Reuters Fixed Assets CS Windows 7, Windows 8 CVE : 2014-9141 Product Affected: Fixed Assets CS =13.1.4 Workstation Install Note: 2003/2008 Terminal Services/Published apps may be vulnerable, depending on system configuration. This vulnerability has been reference checked...

ManageEngine NetFlow Analyzer Arbitrary File Download

This module exploits an arbitrary file download vulnerability in CSVServlet on ManageEngine NetFlow Analyzer. This module has been tested on both Windows and Linux with versions 8.6 to 10.2. Note that when typing Windows paths, you must escape the backslash with a backslash. Module Options msf us...

ACLs not properly enforced in "documents" application - ownCloud

The "documents" application is a collaborative web-based online editor for ODT files. Using this application you can easily share and collaborate on office documents. This application uses strong and very long random "Session IDs" to limit access to specific resources. Knowledge of this ID allows...

Arris VAP2500 tools_command.php Command Execution

Arris VAP2500 access points are vulnerable to OS command injection in the web management portal via the toolscommand.php page. Though authentication is required to access this page, it is trivially bypassed by setting the value of a cookie to an md5 hash of a valid username. Module Options msf us...

Wordpress wpDataTables 1.5.3 shell Upload Exploit

The wordpress premium plugin wpDataTables 1.5.3 and below suffers from Unauthenticated Shell Upload Vulnerability !/usr/bin/python Exploit Name: Wordpress wpDataTables 1.5.3 and below Unauthenticated Shell Upload Vulnerability Vulnerability discovered by Claudio Viviani Date : 2014-11-22 Exploit...

Advantech EKI-6340 2.05 Command Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech EKI-6340 Command Injection 1. Advisory Information Title: Advantech EKI-6340 Command Injection Advisory ID: CORE-2014-0009 Advisory URL: http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection Date...

Citrix NetScaler SOAP Handler Remote Code Execution

No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpClient include...

HP Data Protector EXEC_INTEGUTIL Remote Code Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Tcp include...

Croogo 2.0.0 - Multiple Stored XSS Vulnerabilities

No description provided by source. Croogo 2.0.0 Multiple Stored XSS Vulnerabilities Vendor: Fahad Ibnay Heylaal Product web page: http://www.croogo.org Affected version: 2.0.0 Summary: Croogo is a free, open source, content management system for PHP, released under The MIT License. It is powered...

Centreon < 2.5.1 / Centreon Enterprise Server < 2.2 - SQL Injection / Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Centreon SQL and Command Injection', 'Description' = %q This module exploits several vulnerabilities on Centreon 2.5.1 and prio...

Telefonica O2 Connection Manager 3.4 - Local Privilege Escalation

Telefonica O2 Connection Manager 3.4 - Local Privilege Escalation Telefonica O2 Connection Manager 3.4 Local Privilege Escalation Vulnerability Vendor: Telefonica S.A. Product web page: http://www.telefonica.com | http://www.o2.co.uk Affected version: 3.4.R1 108 Summary: O2 Connection Manager...

HP Network Node Manager I PMD Buffer Overflow Exploit

Exploit for linux platform in category remote exploits This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'HP Network Node Manager I PMD Buffer Overflow', 'Description' = %q This module...

CUPS Filter Bash Environment Variable Code Injection (Shellshock)

This module exploits the Shellshock vulnerability, a flaw in how the Bash shell handles external environment variables. This module targets CUPS filters through the PRINTERINFO and PRINTERLOCATION variables. A valid username and password is required to exploit this vulnerability through CUPS...

Blackphone Bug Bounty Program Launches on Bugcrowd

During DEF CON in August, Twitter became the preferred medium for submitting bugs found in secure smartphone Blackphone, including one high-profile claim on the social network that the phone had been rooted. That wasn’t the final straw that led to today’s announcement of a bug bounty, rather it w...