Joomla! Component Proclaim 9.1.1 - Backup File Download

Exploit Title: Joomla! Component Proclaim 9.1.1 - Backup Download Dork: N/A Date: 22.02.2018 Vendor Homepage: https://www.christianwebministries.org/ Software Link: https://extensions.joomla.org/extensions/extension/living/religion/proclaim/ Software Download:...

Joomla! Component PrayerCenter 3.0.2 - 'sessionid' SQL Injection

Exploit Title: Joomla! Component PrayerCenter 3.0.2 - SQL Injection Dork: N/A Date: 22.02.2018 Vendor Homepage: http://www.mlwebtechnologies.com/ Software Link: https://extensions.joomla.org/extensions/extension/living/religion/prayercenter/ Software Download:...

Joomla! Component OS Property Real Estate 3.12.7 - SQL Injection

Exploit Title: Joomla! Component OS Property Real Estate 3.12.7 - SQL Injection Dork: N/A Date: 22.02.2018 Vendor Homepage: https://www.joomdonation.com/ Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/os-property/ Version: 3.12.7 Category: Webapps...

Wavpack 5.1.0 - Denial of Service

Exploit title: Wavpack 5.1.0 - Denial of Service Date: 20.02.2018 Exploit Author: r4xis https://github.com/r4xis Vendor Homepage: http://www.wavpack.com/ Software Links: http://www.wavpack.com/downloads.html https://github.com/dbry/WavPack Version: Wavpack 5.1.0 Tested on: Debian 9.3.0 64 bit...

EChat Server 3.1 - 'CHAT.ghp' Buffer Overflow

Exploit Author: Juan Sacco Vulnerability found using Exploit Pack v10 - http://exploitpack.com Impact: An attacker could exploit this vulnerability to execute arbitrary code in the context of the application. Failed exploit attempts will result in adenial-of-service condition. Program description...

Disk Pulse Enterprise 10.4.18 - 'Import Command' Buffer Overflow (SEH)

!/usr/bin/env python Exploit Title: Disk Pulse Enterprise v10.4.18 - 'Import Command' Buffer Overflow SEH Date: 2018-01-22 Exploit Author: Daniel Teixeira Author Homepage: www.danielteixeira.com Vendor Homepage: http://www.diskpulse.com Software Link:...

Disk Savvy Enterprise 10.4.18 - Buffer Overflow (SEH)

Exploit Title: Disk Savvy Enterprise v10.4.18 Server - Unauthenticated Remote Buffer Overflow SEH Date: 01/02/2018 Exploit Author: Daniel Teixeira Vendor Homepage: http://www.disksavvy.com/ Software Link: http://www.disksavvy.com/setups/disksavvyentsetupv10.4.18.exe Version: 10.4.18 CVE:...

Microsoft Windows - Constrained Impersonation Capability Privilege Escalation

Windows: Constrained Impersonation Capability EoP Platform: Windows 10 1703/1709 not tested earlier versions Class: Elevation of Privilege Summary: It’s possible to use the constrained impersonation capability added in Windows 10 to impersonate a lowbox SYSTEM token leading to EoP. Description:...

Microsoft Windows - StorSvc SvcMoveFileInheritSecurity Arbitrary File Creation Privilege Escalation

Windows: StorSvc SvcMoveFileInheritSecurity Arbitrary File Creation EoP Platform: Windows 10 1709 not tested earlier versions Class: Elevation of Privilege Summary: The SvcMoveFileInheritSecurity RPC method in StorSvc can be used to move an arbitrary file to an arbitrary location resulting in...

Microsoft Windows - NPFS Symlink Security Feature Bypass/Elevation of Privilege/Dangerous Behavior

Windows: NPFS Symlink Security Feature Bypass/Elevation of Privilege/Dangerous Behavior Platform: Windows 10 1709 functionality not present prior to this version Class: Security Feature Bypass/Elevation of Privilege/Dangerous Behavior Summary: It’s possible to create NPFS symlinks as a low IL or...

Microsoft Windows - Global Reparse Point Security Feature Bypass/Elevation of Privilege

Windows: Global Reparse Point Security Feature Bypass/Elevation of Privilege Platform: Windows 10 1709 functionality not present prior to this version Class: Security Feature Bypass/Elevation of Privilege Summary: It’s possible to use the new Global Reparse Point functionality introduced in Windo...

Microsoft Internet Explorer 11 - 'Js::RegexHelper::RegexReplace' Use-After-Free

var vars = new Array2; function main vars0 = Array1000000.joinString.fromCharCode0x41; vars1 = String.prototype.substring.callvars0, 1, vars0.length; String.prototype.replace.callvars1, RegExp, f; function farg1, arg2, arg3 alertarg3; vars0 = 1; CollectGarbage; return 'a'; main; +0x122e5d:...

Microsoft Windows Kernel - 'nt!RtlpCopyLegacyContextX86' Stack Memory Disclosure

/ We have discovered a new Windows kernel memory disclosure vulnerability in the creation and copying of a CONTEXT structure to user-mode memory. Two previous bugs in the nearby code area were reported in issues 1177 and 1311 ; in fact, the problem discussed here appears to be a variant of 1177 b...

μTorrent (uTorrent) Classic/Web - JSON-RPC Remote Code Execution / Information Disclosure

By default, utorrent create an HTTP RPC server on port 10000 uTorrent classic or 19575 uTorrent web. There are numerous problems with these RPC servers that can be exploited by any website using XMLHTTPRequest. To be clear, visiting any website is enough to compromise these applications. uTorrent...

MagniComp SysInfo - mcsiwrapper Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MagniComp SysInfo mcsiwrapper Privilege Escalation', 'Description' = %q This module attempts to gain root privileges on systems running MagniComp...

Mobile Application Hacking Diary Ep.2

Mobile Application Hacking Diary Ep.2 |=--------------------------------------------------------------------=| |=------------= Mobile Application Hacking Diary Ep.2=--------------=| |=------------------------= 18 February 2018 =----------------------=| |=----------------------= By CWH Underground...

Linux/ARM - Bind TCP (4444/TCP) Shell (/bin/sh) + IP Controlled (192.168.1.190) + Null-Free Shellcode (168 bytes)

Linux/ARM - Bind TCP 4444/TCP Shell /bin/sh + IP Controlled 192.168.1.190 + Null-Free Shellcode 168 bytes. Shellcode exploit for ARM platform / Title: Linux/ARM - IP Controlled Bind Shell TCP /bin/sh. Null free shellcode 168 bytes Date: 2018-02-17 Tested: armv7l Raspberry Pi v3 and armv6l Raspber...

October CMS < 1.0.431 - Cross-Site Scripting

Exploit Title: October CMS Stored Code Injection Date: 16-02-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://octobercms.com/ Version: All versions till date from 1.0.431 CVE : CVE- 2018-7198 Category:...

Aastra 6755i SIP SP4 - Denial of Service

Exploit Title: Aastra 6755i SIP SP4 | Unauthorized Remote Reboot Date: 17/02/2018 Exploit Author: Wadeek Hardware Version: 6755i Firmware Version: 3.3.1.4053 SP4 Vendor Homepage: http://www.aastra.sg/ Firmware Link:...

Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < 4.25 - Denial of Service

Exploit Title: Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module V4.25 - Denial of Service Date: 14.02.2018 Exploit Author: M. Can Kurnaz Contact: https://twitter.com/0x43414e Vendor Homepage: https://www.siemens.com Version: All devices that include the EN100 Ethernet module version...

Joomla! Component Gallery WD 1.3.6 - SQL Injection

Exploit Title: Joomla! Component Gallery WD 1.3.6 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: https://web-dorado.com/ Software Link: https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-wd/ Software Download:...

Joomla! Component InviteX 3.0.5 - 'invite_type' SQL Injection

Exploit Title: Joomla! Component InviteX 3.0.5 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://techjoomla.com/ Software Link: https://extensions.joomla.org/extensions/extension/content-sharing/bookmark-a-recommend/invitex/ Version: 3.0.5 Category: Webapps Tested on:...

Joomla! Component JB Bus 2.3 - 'order_number' SQL Injection

Exploit Title: Joomla! Component JB Bus 2.3 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://joombooking.com/ Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/jbtransport/ Version: 2.3 Category: Webapps Tested on:...

Joomla! Component jGive 2.0.9 - SQL Injection

Exploit Title: Joomla! Component JGive 2.0.9 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://techjoomla.com/ Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/donations/jgive/ Version: 2.0.9 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE:...

Joomla! Component JquickContact 1.3.2.2.1 - SQL Injection

Exploit Title: Joomla! Component JquickContact 1.3.2.2.1 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor: http://coderspirit.blogspot.com.tr/2011/07/jquickcontact.html Software: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/contact-forms/jquickcontact/ Download:...

Joomla! Component JTicketing 2.0.16 - SQL Injection

Exploit Title: Joomla! Component JTicketing 2.0.16 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: https://techjoomla.com/ Software Link: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/jticketing/ Version: 2.0.16 Category: Webapps Tested on:...

Joomla! Component AllVideos Reloaded 1.2.x - 'divid' SQL Injection

Exploit Title: Joomla! Component AllVideos Reloaded 1.2.x - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://allvideos.fritz-elfert.de Software Link: http://joomlacode.org/gf/project/allvideos15/frs/?action=FrsReleaseBrowse&frspackageid=3564 Version: 1.2.x Category: Webapps Tested...

Front Accounting ERP 2.4.3 - Cross-Site Request Forgery

!-- 2 This hosted page upo...

Joomla! Component ccNewsletter 2.x.x 'id' - SQL Injection

Exploit Title: Joomla Component ccNewsletter 2.x.x 'id' - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: https://www.chillcreations.com/ Software Link: https://extensions.joomla.org/extension/ccnewsletter/ Version: 2.x Stable Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE:...

Joomla! Component Aist 2.0 - 'id' SQL Injection

Exploit Title: Joomla! Component Aist = 2.0 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://aist.bmstu.ru/ Software Link: http://aist.bmstu.ru/ Version: = 2.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: CVE-2018-5993 Exploit Author: Ihsan Sencan POC: 1...

Joomla! Component Advertisement Board 3.1.0 - 'catname' SQL Injection

Exploit Title: Joomla! Component Advertisement Board 3.1.0 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://ordasoft.com/ Software Link: https://extensions.joomla.org/extensions/extension/ads-a-affiliates/classified-ads/advertisement-board/ Version: 3.1.0 Category: Webapps Teste...

Joomla! Component Fastball 2.5 - 'season' SQL Injection

Exploit Title: Joomla! Component Fastball 2.5 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.fastballproductions.com/ Software Link: http://www.fastballproductions.com/ Version: 2.5 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: CVE-2018-6373 Exploit Author: Ihsan...

Joomla! Component DT Register 3.2.7 - 'id' SQL Injection

Exploit Title: Joomla! Component DT Register 3.2.7 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: https://www.dthdevelopment.com/ Software Link: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/dt-register/ Version: 3.2.7 Category: Webapps Tested on:...

Joomla! Component File Download Tracker 3.0 - SQL Injection

Exploit Title: Joomla! Component File Download Tracker 3.0 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://techsolsystem.com/ Software Link: https://extensions.joomla.org/extensions/extension/directory-a-documentation/downloads/file-download-tracker/ Version: 3.0 Category:...

Joomla! Component Form Maker 3.6.12 - SQL Injection

Exploit Title: Joomla! Component Form Maker 3.6.12 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://demo.web-dorado.com/ Software Link: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/forms/form-maker/ Version: 3.6.12 Category: Webapps Tested on:...

EPIC MyChart - X-Path Injection

Exploit Title: Epic Systems Corporation MyChart X-Path Injection Google Dork: MyChart® licensed from Epic Systems Corporation Date: 8/19/16 Exploit Author: Shayan Sadigh http://threat.tevora.com/author/shayan/ Vendor Homepage: https://www.epic.com/software Software Link: N/A Version: N/A Tested o...

JBoss Remoting 6.14.18 - Denial of Service

Exploit Title: Exploit Denial of Service JBoss Remoting 4447/9999 Date: 14-02-2018 Exploit Author: Frank Spierings Vendor Homepage: https://www.redhat.com/en/technologies/jboss-middleware/application-platform/get-started Software Link: http://ftp.redhat.com/pub/redhat/jboss/eap/ Version: JBoss EA...

ABRT - 'raceabrt' Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ABRT raceabrt Privilege Escalation', 'Description' = %q This module attempts to gain root privileges on Fedora systems with a vulnerable version ...

Microsoft Edge - 'UnmapViewOfFile' ACG Bypass

Background: To implement ACG https://blogs.windows.com/msedgedev/2017/02/23/mitigating-arbitrary-native-code-execution/VM4y5oTSGCRde3sk.97, Edge uses a separate process for JIT compiling. This JIT Process is also responsible for mapping native code into the requesting Content Process. In order to...

UserSpice 4.3 - Blind SQL Injection

!/usr/env/python """ Application UserSpice PHP user management Vulnerability UserSpice = 4.3 Blind SQL Injection exploit URL https://userspice.com Date 1.2.2018 Author Dolev Farhi About the App: What makes userspice different from almost any other PHP User Management Framework is that it has been...

Oracle Primavera P6 Enterprise Project Portfolio Management - HTTP Response Splitting

Exploit Title: Oracle Primavera P6 Enterprise Project Portfolio Management HTTP Response Splitting Date: 16-02-2018 Exploit Author: Marios Nicolaides - RUNESEC Reviewers: Simon Loizides and Nicolas Markitanis - RUNESEC Vendor Homepage: https://www.oracle.com Affected Software: Oracle Primavera P6...

PSNews Website 1.0.0 - 'Keywords' SQL Injection

Exploit Title: PSNews Website Same Backend with Mobile Apps 1.0.0 - 'Keywords' SQL Injection Dork: N/A Date: 2018-02-16 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage: https://codecanyon.net/item/psnews-website/21360354?srank=9 Version: 1.0.0 Category:...

TV - Video Subscription - Authentication Bypass SQL Injection

Exploit Title: TV - Video Subscription - Authentication Bypass Dork: N/A Date: 2018-02-14 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage: https://codecanyon.net/item/tv-video-subscription/13966427?srank=1677 Version: All version Category: Webapps CVE: N/A...

Twig < 2.4.4 - Server Side Template Injection

Vulnerability details: Exploit Title: Twig Output: 16 2. POC: http://localhost/search?searchkey=44 OUTPUT: 4 http://localhost/search?searchkey=ls OUTPUT: list of files/directories etc…...

Joomla! Component Google Map Landkarten 4.2.3 - SQL Injection

Exploit Title: Joomla! Component Google Map Landkarten = 4.2.3 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.joomla-24.de/ Software Link: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/google-map-landkarten/ Software Download:...

Joomla! Component JomEstate PRO 3.7 - 'id' SQL Injection

Exploit Title: Joomla! Component JomEstate PRO = 3.7 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://comdev.eu/ Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/jomestate-pro/ Version: = 3.7 Category: Webapps Tested on:...

Joomla! Component JS Autoz 1.0.9 - SQL Injection

Exploit Title: Joomla! Component JS Autoz 1.0.9 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.joomsky.com/ Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/vehicles/js-autoz/ Software Download: http://joomsky.com/js-autoz-download.html...

Joomla! Component Kubik-Rubik Simple Image Gallery Extended (SIGE) 3.2.3 - Cross-Site Scripting

Exploit Title: Joomla! Component SIGE version 3. Solution: Update to version 3.3.0 https://downloads.kubik-rubik.de/joomla-extensions/plgsigev3.3.0.zip...

Joomla! Component MediaLibrary Free 4.0.12 - SQL Injection

Exploit Title: Joomla! Component MediaLibrary Free 4.0.12 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://ordasoft.com/ Software Link: https://extensions.joomla.org/extensions/extension/living/education-a-culture/medialibrary-basic/ Software Download:...

Joomla! Component JS Jobs 1.1.9 - SQL Injection

Exploit Title: Joomla! Component JS Jobs 1.1.9 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.joomsky.com/ Software Link: https://extensions.joomla.org/extensions/extension/ads-a-affiliates/jobs-a-recruitment/js-jobs/ Software Download:...