Chrome, Firefox, Java, IE10 exploited at Pwn2Own competition

During the first day of Pwn2Own competition at the CanSecWest conference in Vancouver , latest versions of all major browsers were exploited by hackers. Chrome, Firefox and Internet Explorer 10 on Windows 8 were successfully pwned by various competitors, bringing them tens of thousands of dollars...

Qool CMS 2.0 RC2 Cross Site Scripting

Qool CMS v2.0 RC2 Multiple HTML And JavaScript Injection Vulnerabilities input type="hidden" name="lib" value="default"...

Qool CMS v2.0 RC2 - Multiple Vulnerabilities

Exploit for php platform in category web applications Qool CMS v2.0 RC2 XSRF Add Root Exploit input type="hidden" name="email" value="email pro...

MS13-037 Microsoft Internet Explorer COALineDashStyleArray Integer Overflow

This module exploits an integer overflow vulnerability on Internet Explorer. The vulnerability exists in the handling of the dashstyle.array length for vml shapes on the vgx.dll module. The exploit has been built and tested specifically against Windows 7 SP1 with Internet Explorer 8. It uses eith...

Hanso Player 2.1.0 Buffer Overflow

!/usr/bin/python Exploit Title:Buffer Overflow Vulnerability Hanso Player version 2.1.0 Download link :www.hansotools.com/downloads/hanso-player-setup.exe Author: metacom RST version: 2.1.0 Category: poc Tested on: windows 7 German f=open"fuzzzzz.m3u","w" print "Creating expoit." junk="\x41" 5000...

Hanso Player 2.1.0 - .m3u Buffer Overflow

Hanso Player 2.1.0 - .m3u Buffer Overflow !/usr/bin/python Exploit Title:Buffer Overflow Vulnerability Hanso Player version 2.1.0 Download link :www.hansotools.com/downloads/hanso-player-setup.exe Author: metacom RST version: 2.1.0 Category: poc Tested on: windows 7 German f=open"fuzzzzz.m3u","w"...

Java CMM Remote Code Execution

This module abuses the Color Management classes from a Java Applet to run arbitrary Java code outside of the sandbox as exploited in the wild in February and March of 2013. The vulnerability affects Java version 7u15 and earlier and 6u41 and earlier and has been tested successfully on Windows XP...

Hanso Player 2.1.0 - '.m3u' Buffer Overflow

!/usr/bin/python Exploit Title:Buffer Overflow Vulnerability Hanso Player version 2.1.0 Download link :www.hansotools.com/downloads/hanso-player-setup.exe Author: metacom RST version: 2.1.0 Category: poc Tested on: windows 7 German f=open"fuzzzzz.m3u","w" print "Creating expoit." junk="\x41" 5000...

WordPress plugins wp-catpro arbitrary file upload-vulnerability warning-the black bar safety net

----------------------------------------------------------------------- Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability ----------------------------------------------------------------------- Author = Zikou-1 6 Mailbox = [email protected] Test System : Windows 7 , Backtrack 5r3...

Flatstick CMS PHP Hash Collision Denial Of Service Vulnerability

This CMS is fairly used in New Zealand. We can see through 'Google dorks' that this software is used by the following domains: org.nz ac.nz co.nz govt.nz net.nz school.nz Exploit Title: Flatstick CMS PHP Hash Collision Denial Of Service Vulnerability Google Dork: site:.nz inurl:index.php?pageLoad...

Piwigo任意文件泄露和任意文件删除漏洞

BUGTRAQ ID: 58016 Piwigo是用PHP编写的相册脚本。 Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。 0 Piwigo Piwigo 2.4.6 厂商补丁： Piwigo ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://piwigo.org/bugs/view.php?id=2843...

OpenEMR 4.1.1 Cross Site Scripting

OpenEMR 4.1.1 site param Remote XSS Vulnerability Vendor: OpenEMR Product web page: http://www.open-emr.org Affected version: 4.1.1 Summary: OpenEMR is a Free and Open Source electronic health records and medical practice management application that can run on Windows, Linux, Mac OS X, and many...

Samsung's new OS Tizen 2.0 source code released

The Tizen 2.0 source code and SDK has officially been released. Tizen is a Linux-based open-source software platform backed by Intel and Samsung Electronics, that is designed for smartphones, tablets, smart TVs and in-car systems and it's designed to run apps written using web technologies...

Piwigo 2.4.6 - '/install.php' Arbitrary File Read/Delete

Piwigo 2.4.6 install.php Remote Arbitrary File Read/Delete Vulnerability Vendor: Piwigo project Product web page: http://www.piwigo.org Affected version: 2.4.6 Summary: Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of...

Piwigo 2.4.6 - install.php Arbitrary File ReadDelete

Piwigo 2.4.6 - install.php Arbitrary File ReadDelete Piwigo 2.4.6 install.php Remote Arbitrary File Read/Delete Vulnerability Vendor: Piwigo project Product web page: http://www.piwigo.org Affected version: 2.4.6 Summary: Piwigo is a photo gallery software for the web that comes with powerful...

Photodex ProShow Producer 5.0.3297 Buffer Overflow

Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: Photodex ProShow Producer Vendor URL: www.photodex.com Type: Stack-based Buffer Overflow CWE-121 Date found: 2013-02-16 Date published: 2013-02-16 CVSSv2 Score: 6,8 AV:N/AC:M/Au:N/C:P/I:P/A:P...

Demandware Store Cross Site Scripting

Exploit Title: Demandware Store XSS Vulnerability Date: 2013-02-10 Author: Cyb3rgh0st aka Rajat Vendor or Software Link: http://www.demandware.com/ Version: n/a Category: webapps/php Google Keywords: inurl:on/demandware.store/ or inurl:default/Search-Show?q= Tested on: Windows 7 and Backtrack rc3...

Foxit Reader Plugin URL Processing Buffer Overflow

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Foxit Reader Plug...

Foxit Reader Plugin URL Processing Buffer Overflow

Exploit for windows platform in category remote exploits require 'msf/core' class Metasploit3 "Foxit Reader Plugin URL Processing Buffer Overflow", 'Description' = %q This module exploits a vulnerability in the Foxit Reader Plugin, it exists in the npFoxitReaderPlugin.dll module. When loading PDF...

Adobe Investigating Reports of Reader Zero-Day Exploit

UPDATE-Attackers are using malicious PDFs posing as an application for an international travel visa to exploit a zero-day vulnerability in Adobe Reader and Acrobat, a researcher at FireEye told Threatpost today. The exploit is the first to escape the sandbox included in Reader X and above. Zheng...