Joomla! Component JS Autoz 1.0.9 - SQL Injection

Joomla! Component JS Autoz 1.0.9 - SQL Injection Exploit Title: Joomla! Component JS Autoz 1.0.9 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.joomsky.com/ Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/vehicles/js-autoz/ Software...

iTech Gigs Script 1.21 - SQL Injection

iTech Gigs Script 1.21 - SQL Injection Exploit Title: iTech Gigs Script 1.21 - SQL Injection Dork: N/A Date: 30.10.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/the-gigs-script/ Demo: http://gigs.itechscripts.com/ Version: 1.21 Category: Webapps Tested on:...

Microsoft Windows Kernel - ATMFD.DLL Out-of-Bounds Read due to Malformed Name INDEX in the CFF Table

Microsoft Windows Kernel - ATMFD.DLL Out-of-Bounds Read due to Malformed Name INDEX in the CFF Table Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1213 We have encountered a Windows kernel crash in the ATMFD.DLL OpenType driver while processing a corrupted OTF font file, see...

wolfSSL 3.10.2 - x509 Certificate Text Parsing Off-by-One

wolfSSL 3.10.2 - x509 Certificate Text Parsing Off-by-One TALOS-2017-0293 WOLFSSL LIBRARY X509 CERTIFICATE TEXT PARSING CODE EXECUTION VULNERABILITY MAY 8, 2017 CVE-2017-2800 SUMMARY An exploitable off-by-one write vulnerability exists in the x509 certificate parsing functionality of wolfSSL...

DIGISOL DG-HR1400 1.00.02 Wireless Router - Privilege Escalation

DIGISOL DG-HR1400 1.00.02 Wireless Router - Privilege Escalation Title: ====== Cookie based privilege escalation in DIGISOL DG-HR1400 1.00.02 wireless router. CVE Details: ============ CVE-2017-6896 Reference: ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6896...

Sitecore CMS 8.1 Update-3 - Cross-Site Scripting

Sitecore CMS 8.1 Update-3 - Cross-Site Scripting Exploit Title: Stored Cross Site Scripting XSS in Sitecore Experience Platform 8.1 Update-3 Date: March 15, 2017 Exploit Author: Pralhad Chaskar Vendor Homepage: http://www.sitecore.net/en Version: 8.1 rev. 160519 Tested on: Sitecore Experience...

EMC ViPR SRM - Cross-Site Request Forgery

EMC ViPR SRM - Cross-Site Request Forgery !-- EMC M&R Watch4net lacks Cross-Site Request Forgery protection Abstract It was discovered that EMC M&R Watch4net does not protect against Cross-Site Request Forgery CSRF attacks. A successful CSRF attack can compromise end user data and may allow an...

ATutor LMS - install_modules.php Cross-Site Request Forgery Remote Code Execution

ATutor LMS - installmodules.php Cross-Site Request Forgery Remote Code Execution / exp.js ATutor LMS " in it - You will need to set the Access-Control-Allow-Origin header to allow the target to pull zips - Use this with your favorite XSS attack - Student proof, aka bullet proof Timeline: 23/02/20...

Ubuntu 15.10 - PT Chown Arbitrary PTs Access Via User Namespace Privilege Escalation

Ubuntu 15.10 - PT Chown Arbitrary PTs Access Via User Namespace Privilege Escalation Source: http://www.halfdog.net/Security/2015/PtChownArbitraryPtsAccessViaUserNamespace/ Introduction Problem description: With Ubuntu Wily and earlier, /usr/lib/ptchown was used to change ownership of slave pts...

Apache Sling Framework (Adobe AEM) 2.3.6 - Information Disclosure

Apache Sling Framework Adobe AEM 2.3.6 - Information Disclosure Document Title: =============== Apache Sling Framework v2.3.6 Adobe AEM CVE-2016-0956 - Information Disclosure Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1536 Adobe...

Zen Cart 1.5.4 - Local File Inclusion

Zen Cart 1.5.4 - Local File Inclusion Advisory ID: HTB23282 Product: Zen Cart Vendor: Zen Ventures, LLC Vulnerable Versions: 1.5.4 Tested Version: 1.5.4 Advisory Publication: November 25, 2015 without technical details Vendor Notification: November 25, 2015 Vendor Patch: November 26, 2015 Public...

abrt (Centos 7.1 Fedora 22) - Local Privilege Escalation

abrt Centos 7.1 Fedora 22 - Local Privilege Escalation !/usr/bin/python CVE-2015-5273 + CVE-2015-5287 CENTOS 7.1/Fedora22 local root probably works on SL and older versions too abrt-hook-ccpp insecure open usage + abrt-action-install-debuginfo insecure temp directory usage rebel 09/2015...

WoltLab Community Gallery - Persistent Cross-Site Scripting

WoltLab Community Gallery - Persistent Cross-Site Scripting Vulnerability title: Community Gallery - Stored Cross-Site Scripting vulnerability Product: Community Gallery Vendor: https://www.woltlab.com Affected version: Community Gallery 2.0 before 12/10/2014 Download link:...

Piwigo 2.7.3 - SQL Injection

Piwigo 2.7.3 - SQL Injection CVE-2015-1517 Piwigo - SQL Injection in Version 2.7.3 ---------------------------------------------------------------- Product Information: Software: Piwigo Tested Version: 2.7.3, released on 9 January 2015 Vulnerability Type: SQL Injection CWE-89 Download link:...

K7 Computing (Multiple Products) - Arbitrary Write Privilege Escalation

K7 Computing Multiple Products - Arbitrary Write Privilege Escalation / Exploit Title - K7 Computing Multiple Products Arbitrary Write Privilege Escalation Date - 04th February 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.k7computing.co.uk/ Tested Version - 14.2.0.240...

GParted 0.14.1 - OS Command Execution

GParted 0.14.1 - OS Command Execution SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: OS Command Execution product: GParted - Gnome Partition Editor vulnerable version: =0.15.0, =0.14.1 with fix for CVE-2014-7208 appli...

EntryPass N5200 - Credentials Exposure

EntryPass N5200 - Credentials Exposure Advisory: EntryPass N5200 Credentials Disclosure EntryPass N5200 Active Network Control Panels allow the unauthenticated downloading of information that includes the current administrative username and password. Details ======= Product: EntryPass N5200 Activ...

vBulletin 4.x - breadcrumbs via xmlrpc API (Authenticated) SQL Injection

vBulletin 4.x - breadcrumbs via xmlrpc API Authenticated SQL Injection CVE-2014-2022 - vbulletin 4.x - SQLi in breadcrumbs via xmlrpc API post-auth ============================================================================== Overview -------- date : 10/12/2014 cvss : 7.1...

iOS 7 - Kernel Mode Memory Corruption

iOS 7 - Kernel Mode Memory Corruption ...................................... Vulnerability Summary ...................................... Title iOS 7 arbitrary code execution in kernel mode Release Date 14 March 2014 Reference NGS00596 Discoverer Andy Davis Vendor Apple Vendor Reference 600217059...

ownCloud 4.0.x4.5.x - upload.php?Filename Remote Code Execution

ownCloud 4.0.x4.5.x - upload.php?Filename Remote Code Execution Vulnerability title: Remote Code Execution in ownCloud CVE: CVE-2014-2044 Vendor: ownCloud Product: ownCloud Affected version: 4.0.x & 4.5.x Fixed version: 5.0 Reported by: Alejo Murillo Moya Details: A remote code execution has been...

TVT TD-2308SS-B DVR - Directory Traversal

TVT TD-2308SS-B DVR - Directory Traversal Exploit Title: TVT TD-2308SS-B DVR directory traversal Shodan Dork: "Cross Web Server" Date: 01 Dec 2013 Disclosure date: 10 Sep 2013 Exploit Author: Cesar Neira Vendor Homepage: http://en.tvt.net.cn/ Affected Firmware Versions: 3.1.43.B 3.1.43.P...

Fortigate Firewalls - Cross-Site Request Forgery

Fortigate Firewalls - Cross-Site Request Forgery Vulnerability ID: CVE-2013-1414 Vulnerability Type: CSRF Cross-Site Request Forgery Product: All Fortigate Firewalls Vendor: Fortinet http://www.fortinet.com Vulnerable Version:...

Group Office Calendar - calendarjson.php SQL Injection

Group Office Calendar - calendarjson.php SQL Injection /-------------------------------------\ | Group-Office Calendar SQL Injection | -------------------------------------/ Summary ======= Versions of Group-Office a web app for online collaboration prior to 4.0.90 are subject to a SQL injection...

RealVNC 4.1.04.1.1 - Authentication Bypass

RealVNC 4.1.04.1.1 - Authentication Bypass Exploit Title: RealVNC 4.1.0 and 4.1.1 Authentication Bypass Exploit Date: 2012-05-13 Author: @fdiskyou e-mail: rui at deniable.org Version: 4.1.0 and 4.1.1 Tested on: Windows XP CVE: CVE-2006-2369 Requires vncviewer installed Basic port of hdmoore/msf2...

Invision Power Board 3.3.0 - Local File Inclusion

Invision Power Board 3.3.0 - Local File Inclusion waraxe-2012-SA086 - Local File Inclusion in Invision Power Board 3.3.0 ======================================================================== ======= Author: Janek Vind "waraxe" Date: 12. April 2012 Location: Estonia, Tartu Web:...

MailEnable Webmail - Cross-Site Scripting

MailEnable Webmail - Cross-Site Scripting ME020567: MailEnable webmail cross-site scripting vulnerability CWE-79 References: CVE-2012-0389 Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567 Vendor...

Microsoft Internet Explorer 678 - Memory Corruption

Microsoft Internet Explorer 678 - Memory Corruption Internet Explorer Memory Corruption 0day Vulnerability CVE-2010-3962 Tested on Windows XP SP3 IE6 IE7 IE8 Coded by Matteo Memelli ryujin at offsec.com http://www.offensive-security.com/0day/ie-0day.txt Thx to dookie at offsec.com notes : This is...

Linux Kernel 2.42.6 (RedHat Linux 9 Fedora Core 4 11 Whitebox 4 CentOS 4) - sock_sendpage() Ring0 Privilege Escalation (5)

Linux Kernel 2.42.6 RedHat Linux 9 Fedora Core 4 11 Whitebox 4 CentOS 4 - socksendpage Ring0 Privilege Escalation 5 / 0x82-CVE-2009-2692 Linux kernel 2.4/2.6 32bit socksendpage local ring0 root exploit simple ver Tested RedHat Linux 9.0, Fedora core 411, Whitebox 4, CentOS 4.x. -- Discovered by...

Hammer Software MetaGauge 1.0.0.17 - Directory Traversal

Hammer Software MetaGauge 1.0.0.17 - Directory Traversal Title: MetaGauge 1.0.0.17 Directory Traversal ------------------------------------------------------------- Vendor: Hammer Software Vendor URL: www.Hammer-Software.com Vendor Response: Vendor has been notified and has since addressed the...

Mapbender 2.4.4 - gaz SQL Injection

Mapbender 2.4.4 - gaz SQL Injection Advisory: SQL-Injections in Mapbender During a penetration test RedTeam Pentesting discovered multiple SQL-Injections in Mapbender. A remote attacker is able to execute arbitrary SQL commands and therefore can get e.g. valid usernames and password hashes of the...

CuteNews 1.4.5 - Admin Password md5 Hash Fetching

CuteNews 1.4.5 - Admin Password md5 Hash Fetching ?php errorreportingEALL; /////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////// // Cutenews = 1.4.5 admin password md5 hash fetching exploit // Version 1.0 //...

Apple QuickTime 7.27.3 (OSXWindows) - RSTP Response Universal

Apple QuickTime 7.27.3 OSXWindows - RSTP Response Universal Copyright C 2007 Subreption LLC. All rights reserved. Visit http://blog.subreption.com for exploit development notes. References: http://www.milw0rm.com/exploits/4648 original Microsoft Windows code http://www.milw0rm.com/exploits/4651...

BinGo News 3.01 - bnrep Remote File Inclusion

BinGo News 3.01 - bnrep Remote File Inclusion ============================================================================================== BinGo News = v3.01 bnrep Remote File Inclusion Exploit ===============================================================================================...

Solaris 10 sysinfo(2) - Local Kernel Memory Disclosure (2)

Solaris 10 sysinfo2 - Local Kernel Memory Disclosure 2 / $Id: raptorsysinfo.c,v 1.2 2006/08/22 13:47:54 raptor Exp $ raptorsysinfo.c - Solaris sysinfo2 kernel memory leak Copyright c 2006 Marco Ivaldi systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count...

CaLogic Calendars 1.2.2 - CLPath Remote File Inclusion

CaLogic Calendars 1.2.2 - CLPath Remote File Inclusion DEVIL TEAM THE BEST POLISH TEAM CaLogic Calendars V1.2.2 - Remote File Include Find by Kacper Rahim. Greetings For ALL DEVIL TEAM members, Special DragonHeart : Contact: [email protected] or http://www.devilteam.yum.pl dork: CaLogic Calenda...

MSI Packages Symbolic Links Processing - Windows 10 Privilege Escalation

MSI Packages Symbolic Links Processing - Windows 10 Privilege Escalation Exploit Title: MSI Packages Symbolic Links Processing - Windows 10 Privilege Escalation Author: nu11secur1ty Date: 2020-02-14 Vendor: Microsoft Link:...

QuickDate 1.3.2 - SQL Injection

QuickDate 1.3.2 - SQL Injection Exploit Title: QuickDate 1.3.2 - SQL Injection Dork: N/A Date: 2020-02-07 Exploit Author: Ihsan Sencan Vendor Homepage: https://quickdatescript.com/ Version: 1.3.2 Tested on: Linux CVE: N/A POC: 1 POST /findmatches HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0...

Schneider Electric U.Motion Builder 1.3.4 - Authenticated Command Injection

Schneider Electric U.Motion Builder 1.3.4 - Authenticated Command Injection Exploit Title: Schneider Electric U.Motion Builder 1.3.4 - Authenticated Command Injection Date: 2018-08-01 Exploit Author: Cosmin Craciun Vendor Homepage: https://www.se.com Version: = 1.3.4 Tested on: Delivered Virtual...

Alkacon OpenCMS 10.5.x - Cross-Site Scripting

Alkacon OpenCMS 10.5.x - Cross-Site Scripting Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Apollo Template Google Dork: N/A Date: 18/07/2019 Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/apollo-template Version: 10.5.x Tested on...

Open-School 3.0 Community Edition 2.3 - Cross-Site Scripting

Open-School 3.0 Community Edition 2.3 - Cross-Site Scripting Exploit Title: title Date: 2019 08 06 Exploit Author: Greg.Priest Vendor Homepage: https://open-school.org/ Software Link: Version: Open-School 3.0/Community Edition 2.3 Tested on: Windows/Linux CVE : CVE-2019-14696 Open-School 3.0, and...

OpenProject 5.0.0 - 8.3.1 - SQL Injection

OpenProject 5.0.0 - 8.3.1 - SQL Injection SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Unauthenticated SQL Injection vulnerability product: OpenProject vulnerable version: 5.0.0 - 8.3.1 fixed version: 8.3.2 & 9.0.0...

NUUO NVRMini2 3.9.1 - (Authenticated) Command Injection

NUUO NVRMini2 3.9.1 - Authenticated Command Injection Exploit Title: NUUO NVRMini2 Authenticated Command Injection Date: December 3, 2018 Exploit Author: Artem Metla Vendor Homepage: https://www.nuuo.com/ProductNode.php?node=2 Version: 3.9.1 Tested on: NUUO NVRMini2 with firmware 3.9.1 CVE :...

Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal

Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal Exploit Title: Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal Date: 2018-08-29 Exploit Author: Emre ÖVÜNÇ Vendor Homepage: http://www.cybrotech.com/ Software Link:...

HPE VAN SDN 2.7.18.0503 - Remote Root

HPE VAN SDN 2.7.18.0503 - Remote Root ''' -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 KL-001-2018-008 : HPE VAN SDN Unauthenticated Remote Root Vulnerability Title: HPE VAN SDN Unauthenticated Remote Root Vulnerability Advisory ID: KL-001-2018-008 Publication Date: 2018.06.25 Publication URL:...

PowerlogicSchneider Electric IONXXXX Series - Cross-Site Request Forgery

PowerlogicSchneider Electric IONXXXX Series - Cross-Site Request Forgery Exploit Title: Powerlogic Schneider Electric IONXXXX Series - Cross-Site Request Forgery Date: 2018-05-17 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.schneider-electric.com/ Version: ION73XX series, ION75XX series...

WordPress Plugin Responsive Cookie Consent 1.7 1.6 1.5 - (Authenticated) Persistent Cross-Site Scripting

WordPress Plugin Responsive Cookie Consent 1.7 1.6 1.5 - Authenticated Persistent Cross-Site Scripting Exploit Title: Wordpress Responsive Cookie Consent 1.7 / 1.6 / 1.5 - Authenticated Persistent Cross-Site Scripting Date: 2018-04-20 Exploit Author: B0UG Vendor Homepage:...

Drupal 7.58 - Drupalgeddon3 (Authenticated) Remote Code (Metasploit)

Drupal 7.58 - Drupalgeddon3 Authenticated Remote Code Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupalgeddon3', 'Description' = %q CVE-2018-7602 / SA-CORE-2018-004 A remote cod...

Concrete5 8.3.0 - Username Comments Enumeration

Concrete5 8.3.0 - Username Comments Enumeration !/usr/bin/env python3 Concrete5 8.3 vulnerable to Authorization Bypass Through User-Controlled Key IDOR CVE-2017-18195 Chapman R3naissance Schleiss from queue import Queue from threading import Thread from bs4 import BeautifulSoup from tabulate impo...

Oracle Primavera P6 Enterprise Project Portfolio Management - HTTP Response Splitting

Oracle Primavera P6 Enterprise Project Portfolio Management - HTTP Response Splitting Exploit Title: Oracle Primavera P6 Enterprise Project Portfolio Management HTTP Response Splitting Date: 16-02-2018 Exploit Author: Marios Nicolaides - RUNESEC Reviewers: Simon Loizides and Nicolas Markitanis -...

Viap Automation WinPLC7 5.0.45.5921 - Recv Buffer Overflow (Metasploit)

Viap Automation WinPLC7 5.0.45.5921 - Recv Buffer Overflow Metasploit require 'msf/core' class MetasploitModule 'VIPA Authomation WinPLC7 recv Stack Buffer Overflow', 'Description' = %q This module exploits a stack based buffer overflow found in VIPA Automation WinPLC7 'james fitts' , 'License' =...