JBoss AS versions 3/4/5/6 - Remote Command Execution Exploit

Exploit for multiple platform in category web applications coding: utf-8 JexBoss v1.0. @autor: João Filho Matos Figueiredo email protected Updates: https://github.com/joaomatosf/jexboss Free for distribution and modification, but the authorship should be preserved. import httplib, sys, urllib, os...

JBoss JMXInvokerServlet JMXInvoker 0.3 remote command execution vulnerability-vulnerability warning-the black bar safety net

/ JBoss JMXInvokerServlet Remote Command Execution JMXInvoker.java v0. 3 - Luca Carettoni @ikki This code exploits a common misconfiguration in the JBoss Application Server 4. x, 5. x, .... Whenever the JMX Invoker is exposed with the default configuration, a malicious "MarshalledInvocation"...

Kingsoft enterprise terminal protection optimization system Web Console without having to log any file deleted-bug warning-the black bar safety net

Kingsoft enterprise terminal protection optimization system Web Console without having to log arbitrary file deletion Arbitrary file deletion: File:/tools/manage/deletetools.php code area children; $i++ if $xml-tool$i-id == $id @unlink"../".$ xml-tool$i-name; if$xml-tool$i-image != "test. png"...

Symantec Data Center Security Web Console Interface Detection

Binary data symantecdcsconsoleinterfacedetect.nbin...

Apache ActiveMQ Web Console Default Credentials

ActiveMQ Web Console, an administrative interface for Apache ActiveMQ, is protected using default credentials. Note that no authentication mechanism was provided prior to version 5.4.0. However, in version 5.4.0, HTTP Basic Authentication was an option, and starting with version 5.8.0, this was...

Multiple Cross-Site Scripting Vulnerabilities in Apache ActiveMQ

Apache ActiveMQ is an open source message bus that supports JMS1.1 and J2EE 1.4 specification of the JMS Provider implementation . Apache ActiveMQ WEB-based management console multiple instances of cross-site scripting vulnerabilities , remote attackers can exploit the vulnerability to build...

Ruby on Rails: RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1

With the release of Ruby on Rails 4.2 the so called Web Console was introduced. As the Web Console documentation states: Web Console is built explicitly for Rails 4. By default the Web Console is available in the Rails Development Environment and allows only the IPs 127.0.0.1 and ::1 to access th...

Directory traversal

Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a 1 .. dot dot in the id parameter to webservice/CORE/downloadFullKitEpc/a/1 in the Web Console or 2 %2E%2E encoded dot dot in the default URI to port 7074 ...

CVE-2014-5350

Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a 1 .. dot dot in the id parameter to webservice/CORE/downloadFullKitEpc/a/1 in the Web Console or 2 %2E%2E encoded dot dot in the default URI to port 7074 ...

Sixnet Sixview Web Console Directory Traversal (CVE-2014-2976)

Sixnet Sixview contains a flaw that allows traversing outside of a restricted path. The issue is due to the program not properly sanitizing user input. With a specially crafted request, a remote attacker can gain access to arbitrary files...

BitDefender GravityZone 5.1.5.386 - Multiple Vulnerabilities

BitDefender GravityZone 5.1.5.386 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: Bitdefender GravityZone vulnerable version: =5.1.11.432 impact:...

Facebook Brute Force with Customize Word Lists for Signed In Accounts

Brute Forcing is easy for Any Signed In Facebook Account at Firefox or Chrome. Usage Info Simple is that you just have to run on Developer Console of Google Chrome or Web Console of Firefox, Javascript Console of Safari, you name it. This is private exploit. You can buy it at https://0day.today...

Sybase EAServer 5.2 - Remote Stack Buffer Overflow

No description provided by source. $Id: sybaseeaserver.rb 9583 2010-06-22 19:11:05Z todb $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of us...

Beetel TC1-450 Airtel Wireless Router - Multiple CSRF Vulnerabilities

No description provided by source. Exploit Title: Beetel TC1-450 Airtel Wireless Router - Multiple CSRF Vulnerabilities Date: 12/13/2013 Author: SaMaN @samanL33T Vendor Homepage:http://www.beetel.in/node/10139 Category: Hardware/Wireless Router Firmware Version: TM4-0Q-020 and below Tested on:...

Symantec Gateway Security 5400 Series 2.0 Error Page Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9755/info A vulnerability has been reported to exist in the Symantec Gateway Security Web based management console that may allow a remote user to launch cross-site scripting attacks. The issue is reported to exist due to...

Sagem Fast 3304-V2 - Authentication Bypass

No description provided by source. Title : Sagem F@st 3304-V2 Authentication Bypass Vendor : http://www.sagemcom.com Severity : High Tested on : Firefox, Google Chrome, Internet Explorer Tested Router : Sagem F@st 3304-V2 3304, 3464, 3504 may also be affected Date : 2014-09-04 Author : Yassine...

openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:1064-1)

Mozilla Firefox, Thunderbird, xulrunner, seamonkey 15.0 update bnc777588 - MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety hazards - MFSA 2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-20 12-1975 CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/ CVE-2012-3959...

openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:1065-1)

Mozilla Firefox, Thunderbird, xulrunner, seamonkey 15.0 update bnc777588 - MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety hazards - MFSA 2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-20 12-1975 CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/ CVE-2012-3959...

Binatone DT 850W Router Cross Site Request Forgery Vulnerability

Binatone DT 850W wireless router suffers from multiple cross site request forgery vulnerabilities. Exploit Title: Binatone DT 850W Wireless Router - Multiple CSRF Vulnerabilities Date: 05/20/2014 Author: Samandeep Singh - SaMaN @samanL33T Vendor...

Binatone DT 850W Router Cross Site Request Forgery

Exploit Title: Binatone DT 850W Wireless Router - Multiple CSRF Vulnerabilities Date: 05/20/2014 Author: Samandeep Singh - SaMaN @samanL33T Vendor Homepage:http://www.binatonetelecom.in/4port-adsl2-wifi-router1.html Category: Hardware/Wireless Router Firmware Version: T6W-A1.005 and below Tested...