MistServer 2.12 - Cross-Site Scripting

MistServer 2.12 - Cross-Site Scripting + Credits: John Page aka Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MIST-SERVER-v2.12-UNAUTHENTICATED-PERSISTENT-XSS-CVE-2017-16884.txt + ISR: ApparitionSec Vendor: ============= mistserver.org Product:...

Debut Embedded HTTPd 1.20 - Denial of Service

Debut Embedded HTTPd 1.20 - Denial of Service Exploit Title: Remote un-authenticated DoS in Debut embedded httpd server in Brother printers Date: 11/02/2017 Exploit Author: z00n @0xz00n Vendor Homepage: http://www.brother-usa.com Version: = 1.20 CVE : CVE-2017-16249 Description: The Debut embedde...

Netdecision 5.8.2 - Local Privilege Escalation

Netdecision 5.8.2 - Local Privilege Escalation // Netdecision.cpp : Defines the entry point for the console application. / Exploit Title: Netdecision 5.8.2 - Local Privilege Escalation - Winring0x32.sys Date: 2017.09.17 Exploit Author: Peter Baris Vendor Homepage: www.netmechanica.com Software...

VMware WorkStation 12.5.5 - Virtual Machine Escape

VMware WorkStation 12.5.5 - Virtual Machine Escape VMware Escape Exploit VMware Escape Exploit before VMware WorkStation 12.5.5 Host Target: Win10 x64 Compiler: VS2013 Test on VMware 12.5.2 build-4638234 Known issues Failing to heap manipulation causes host process crash. Not quite elaborate...

Net Monitor for Employees Pro 5.3.4 - Unquoted Service Path Privilege Escalation

Net Monitor for Employees Pro 5.3.4 - Unquoted Service Path Privilege Escalation Exploit Title: Unquoted Service Path Privilege Escalation - Net Monitor for Employees Pro gmail.com, saeid Nsecurity.org Linkedin: https://www.linkedin.com/in/saeidatabaki Vendor Homepage: http://networklookout.com/...

LightDM (Ubuntu 16.0416.10) - Guest Account Local Privilege Escalation

LightDM Ubuntu 16.0416.10 - Guest Account Local Privilege Escalation Source: https://blogs.securiteam.com/index.php/archives/3134 Vulnerability Summary The following advisory describes a local privilege escalation via LightDM found in Ubuntu versions 16.10 / 16.04 LTS. Ubuntu is an open source...

OpenSSL 1.1.0 - Remote Client Denial of Service

OpenSSL 1.1.0 - Remote Client Denial of Service // Source: https://guidovranken.wordpress.com/2017/01/26/cve-2017-3730-openssl-1-1-0-remote-client-denial-of-service-affects-servers-as-well-poc/ / SSL server demonstration program Copyright C 2006-2015, ARM Limited, All Rights Reserved...

Nagios 4.2.2 - Arbitrary Code Execution

Nagios 4.2.2 - Arbitrary Code Execution !/usr/bin/env python Source: https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html intro = """\03394m Nagios Core 4.2.0 Curl Command Injection / Code Execution PoC Exploit CVE-2016-9565 nagioscmdinjection.py ver...

eXtplorer 2.1.9 - .ZIP Directory Traversal

eXtplorer 2.1.9 - .ZIP Directory Traversal / + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EXTPLORER-ARCHIVE-PATH-TRAVERSAL.txt + ISR: apparitionsec Vendor: ============== extplorer.net Product: ==================...

DotNetNuke 07.04.00 - Administration Authentication Bypass

DotNetNuke 07.04.00 - Administration Authentication Bypass Exploit Title: DotNetNuke 07.04.00 Administration Authentication Bypass Date: 06-05-2016 Exploit Author: Marios Nicolaides Vendor Homepage: http://www.dnnsoftware.com/ Software Link: https://dotnetnuke.codeplex.com/releases/view/611324...

Tomabo MP4 Player 3.11.6 - Local Stack Overflow (SEH)

Tomabo MP4 Player 3.11.6 - Local Stack Overflow SEH !/usr/bin/python Exploit Title: Tomabo MP4 Player 3.11.6 SEH Based Stack Overflow Exploit Author: @yokoacc, @nudragn, @runggareksya Vendor Homepage: http://www.tomabo.com/ Software Link: http://www.tomabo.com/mp4-player/download.html Vulnerable...

XOOPS 2.0.11 - Multiple Vulnerabilities

XOOPS 2.0.11 - Multiple Vulnerabilities XOOPS Multiple Vulnerabilities Vendor: XOOPS Product: XOOPS Version: = 2.0.11 Website: http://www.xoops.org/ BID: 14094 14096 CVE: CVE-2005-2112 CVE-2005-2113 OSVDB: 17633 17634 17635 SECUNIA: 15843 PACKETSTORM: 38372 Description: XOOPS is a very popular...

Ektron CMS 9.10 SP1 (Build 9.1.0.184.1.114) - Cross-Site Request Forgery

Ektron CMS 9.10 SP1 Build 9.1.0.184.1.114 - Cross-Site Request Forgery Vulnerability type: Cross-site Request Forgery Vendor: http://www.ektron.com/ Product: Ektron Content Management System Affected version: = TIMELINE – 07/04/2015: Vulnerability found – 07/04/2015: Vendor informed – 08/04/2015:...

ASUS-RT-AC66U-acsd-Param

TitleASUS RT-AC66U Remote Root Shell Exploit - acsd param command Discovered and ReportedJune 2013 Discovered/Exploited ByJacob Holcomb/Gimppy and Jacob Thompson Security Analsyts @ Independent Security Evaluators Software Vendorhttp://asus.com Exploit/Advisoryhttp://securityevaluators.com,...

Codiad 2.4.3 - Multiple Vulnerabilities

Codiad 2.4.3 - Multiple Vulnerabilities -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Exploit Title: Codiad 2.4.3 - Cross Site Scripting - Local File Inclusion Vulnerability's Date: 19/12/2014 Url Vendor:...

xEpan 1.0.1 - Cross-Site Request Forgery

xEpan 1.0.1 - Cross-Site Request Forgery Advisory ID: HTB23240 Product: xEpan Vendor: Xavoc Technocrats Pvt. Ltd. Vulnerable Versions: 1.0.1 and probably prior Tested Version: 1.0.1 Advisory Publication: October 22, 2014 without technical details Vendor Notification: October 22, 2014 Public...

NexusPHP 1.5 - SQL Injection

NexusPHP 1.5 - SQL Injection Exploit Title: Nexusphp.v1.5 SQL injection Vulnerability Google Dork: intitle:nexusphp Date: 2011-10-08 Author: flyh4t Software Link: http://sourceforge.net/projects/nexusphp/ Version: nexusphp.v1.5 Tested on: linux+apache CVE : CVE-2011-4026 Nexusphp is BitTorrent...

PHP 5.3.5 - socket_connect() Local Buffer Overflow

PHP 5.3.5 - socketconnect Local Buffer Overflow...

Quick Polls - Local File Inclusion Deletion

Quick Polls - Local File Inclusion Deletion 'Quick Polls' Local File Inclusion & Deletion Vulnerabilities CVE-2011-1099 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- Two vulnerabilities exist in 'Quick Polls' providing local file inclusion & loca...

Pandora Fms 3.1 - SQL Injection

Pandora Fms 3.1 - SQL Injection + Introduction Pandora FMS for Pandora Flexible Monitoring System is a software solution for monitoring computer networks. It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers, applications...

IBM OmniFind Crawler - Denial of Service

IBM OmniFind Crawler - Denial of Service Crawler endless loop CVE-2010-3899 The crawler has no recursion depth limit. A site with dynamic parameter manipulation can cause an endless loop. This loop will block the crawler thread and use permanent server resources. Too many blocks can lead to a...

Avast! 4.7 - aavmker4.sys Local Privilege Escalation

Avast! 4.7 - aavmker4.sys Local Privilege Escalation !/usr/bin/python avast! 4.7 aavmker4.sys privilege escalation http://www.trapkit.de/advisories/TKADV2008-002.txt CVE-2008-1625 Tested on WindXpSp2/Sp3 Dep ON Matteo Memelli ryujin A-T offensive-security.com www.offensive-security.com Spaghetti ...

Oracle Database - Remote Listener Memory Corruption

Oracle Database - Remote Listener Memory Corruption source: https://www.securityfocus.com/bid/37728/info Oracle Database is prone to a remote memory-corruption vulnerability in Listener. The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker does not require privileges to...

list Web - addlink.php?id SQL Injection

list Web - addlink.php?id SQL Injection | | list Web addlink.php id Remote SQL Injection Vulnerability | | |-------------------- Hussin X -------------------| | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | | email: darkangelg85atYahooDoTcom | | | | | | script : http://maker.ir | | DorK :...

HP OpenView Network Node Manager (OV NNM) 7.53 - Invalid DB Error Code

HP OpenView Network Node Manager OV NNM 7.53 - Invalid DB Error Code -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ HP Openview NNM 7.53 Invalid DB Error Code vulnerability 1. Advisory Information Title: HP Openvi...

BPStudent 1.0 - Blind SQL Injection

BPStudent 1.0 - Blind SQL Injection x========================================================================================================================================x | AntiSecuritydotorg |...

Oracle 9i10g Database - Remote Network Authentication

Oracle 9i10g Database - Remote Network Authentication source: https://www.securityfocus.com/bid/35680/info Oracle Database is prone to a remote vulnerability in Network Authentication. The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker doesn't require privileges to...

libvirt_proxy 0.5.1 - Local Privilege Escalation

libvirtproxy 0.5.1 - Local Privilege Escalation / cve-2009-0036.c libvirtproxy http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0036 Buffer overflow in the proxyReadClientSocket function in proxy/libvirtproxy.c in libvirtproxy 0.5.1 might allow local...

Oracle Internet Directory 10.1.4 - Remote Denial of Service

Oracle Internet Directory 10.1.4 - Remote Denial of Service !/usr/bin/python """ Oracle Internet Directory 10.1.4 preauthentication Denial Of Service NOTES: Under 32 bits platforms it crashes immediately. Under 64 bits it may take even hours. Sometimes you need 2 shoots to crash OID completely. T...

MVC-Web CMS 1.01.2 - newsid SQL Injection

MVC-Web CMS 1.01.2 - newsid SQL Injection Bl@ckbe@rD 'Tunisian TerrorisT' ------------------------- $$$$$$$$$$$$$$$$$$$$$$$---------------------------------------- + Script Name : MVC-Web CMS 1.0 and 1.2 Remote SQL Injection Exploit |+| Team : InjEct0r5 + Author : Bl@ckbe@rD 'Tunisian TerrorisT' ...

Microsoft DirectX SAMI File Parsing - Remote Stack Overflow

Microsoft DirectX SAMI File Parsing - Remote Stack Overflow !/usr/bin/python Bug discovered by Jun Mao of VeriSign iDefense https://www.securityfocus.com/bid/26789 CVE-2007-3901 Coded by Matteo Memelli aka ryujin http://www.gray-world.net http://www.be4mind.com Tested on: Windows 2000 SP4 English...

bwired - index.php?newsID SQL Injection

bwired - index.php?newsID SQL Injection / \ / \ | | | | | | | | | | | / | | | | | | | ' / | | ' \ / \ | | | | || | || | | | \ | | | | / | , |/ /|| ||| |||| / | |/ Program Title bwired - Remote SQL Injection Note There is also XSS, PHPSESSID session fixation, and cookie manipulation which I...

Cyberfolio 2.0 RC1 - av Remote File Inclusion

Cyberfolio 2.0 RC1 - av Remote File Inclusion \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV58$2006 ----------------------------------------------------------------------------------------------- ECHOADV58$2006Cyberfolio =2.0 RC1 $av Remote File Inclusion...

PeerCast 0.1216 - Remote Stack Overflow (Metasploit)

PeerCast 0.1216 - Remote Stack Overflow Metasploit $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

X.Org X Server 1.20.4 - Local Stack Overflow

X.Org X Server 1.20.4 - Local Stack Overflow Exploit Title: X.Org X Server 1.20.4 - Local Stack Overflow Date: 2019-10-16 Exploit Author: Marcelo Vázquez aka s4vitar Vendor Homepage: https://www.x.org/ Version: = 1.20.4 Tested on: Linux CVE: CVE-2019-17624 !/usr/bin/python coding: utf-8 Author:...

Oracle Business Intelligence XML Publisher 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0 - XML External Entity Injection

Oracle Business Intelligence XML Publisher 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0 - XML External Entity Injection Exploit Title: XXE in Oracle Business Intelligence and XML Publisher Date: 16.04.19 Exploit Author: @vah13 Vendor Homepage: http://oracle.com Software Link:...

Raisecom XPON ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 - Remote Code Execution

Raisecom XPON ISCOMHT803G-U2.0.0140521R4.1.47.002 - Remote Code Execution Exploit Title: Remote code execution in Raisecom xpon Date: 03/03/2019 Exploit Author: JameelNabbo Website: Ordina.nl Vendor Homepage: https://www.raisecom.com Software Link: https://www.raisecom.com/products/xpon Version:...

HotelDruid 2.3 - Cross-Site Scripting

HotelDruid 2.3 - Cross-Site Scripting =========================================================================================== Exploit Title: Hoteldruid 2.3 - 'nsextt' XSS Injection CVE: CVE-2019-8937 Date: 18-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage:...

D-Link Routers - Plaintext Password

D-Link Routers - Plaintext Password Password stored in plaintext CVE: CVE-2018-10824 Description: An issue was discovered on D-Link routers: DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02,...

reSIProcate 1.10.2 - Heap Overflow

reSIProcate 1.10.2 - Heap Overflow ''' CVE ID: CVE-2018-12584 TIMELINE Bug report with test code sent to main reSIProcate developers: 2018-06-15 Patch created by Scott Godin: 2018-06-18 CVE ID assigned: 2018-06-19 Patch committed to reSIProcate repository: 2018-06-21 Advisory first published on...

Open-AudIT Community 2.2.6 - Cross-Site Scripting

Open-AudIT Community 2.2.6 - Cross-Site Scripting Exploit Title: Open-AudIT Community 2.2.6 - Cross-Site Scripting Google Dork:NA Exploit Date: 2018-08-01 Exploit Author: Ranjeet Jaiswal Vendor Homepage: https://opmantek.com/ Software Link:https://opmantek.com/network-tools-download/open-audit/...

OpenSLP 2.0.0 - Double-Free

OpenSLP 2.0.0 - Double-Free ''' | | | | | | | || | | | | -| | . | . | | . | . | | | . | | -| | | | -| -| ||| || ||||||| || || ||| || 2018-06-28 SLPD DOUBLE FREE ================ CVE-2018-12938 An issue was found in openslp-2.0.0 that can be used to induce a double free bug or memory corruption by...

MaDDash 2.0.2 - Directory Listing

MaDDash 2.0.2 - Directory Listing Exploit Title: MaDDash 2.0.2 - Directory Listing Date: 2018-06-18 Vendor: perfSONAR Download Link: https://github.com/esnet/maddash/archive/master.zip Version: 2.0.2 Exploit Author: ManhNho CVE: CVE-2018-12522,CVE-2018-12523,CVE-2018-12524,CVE-2018-12525 Category...

Pale Moon Browser 27.9.3 - Use After Free (PoC)

Pale Moon Browser 27.9.3 - Use After Free PoC Exploit Title: Pale Moon Browser function SetVariablefuzzervars, varname, vartype fuzzervarsvartype = varname; function jsfuzzer var var1 = var2.getDistributedNodes; SetVariablevar1, 'NodeList';...

Monstra CMS 3.0.4 - Arbitrary Folder Deletion

Monstra CMS 3.0.4 - Arbitrary Folder Deletion Exploit Title: Monstra CMS 3.0.4 allows remote attackers to delete folder via an get request Date: 2018-03-26 Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra...

DotNetNuke DNNarticle Module 11 - Directory Traversal

DotNetNuke DNNarticle Module 11 - Directory Traversal 01. Advisory Information Title: Directory Traversal Vulnerability in DNNarticle module Date published: n/a Date of last update: n/a Vendors contacted: zldnn.com Discovered by: Esmaeil Rahimian Severity: Critical 02. Vulnerability Information...

LineageOS 14.1 Blueborne - Remote Code Execution

LineageOS 14.1 Blueborne - Remote Code Execution Exploit Title: LineageOS 14.1 Android 7.1.2 Blueborne RCE CVE-2017-0781 Date: 04/01/2018 Exploit Author: Marcin Kozlowski Tested on: LinageOS 14.1 Android 7.1.2 without BlueBorne Patch CVE : CVE-2017-0781 Provided for legal security research and...

Unitrends UEB 10.0 - Root Remote Code Execution

Unitrends UEB 10.0 - Root Remote Code Execution Exploit Title: Unauthenticated root RCE for Unitrends UEB 10.0 Date: 10/17/2017 Exploit Authors: Cale Smith, Benny Husted, Jared Arave Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor...

WebLog Expert Enterprise 9.4 - Denial of Service

WebLog Expert Enterprise 9.4 - Denial of Service + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WEBLOG-EXPERT-WEB-SERVER-ENTERPRISE-v9.4-DENIAL-OF-SERVICE.txt + ISR: Apparition Security Vendor: ======= www.weblogexpert.c...

Papenmeier WiFi Baby Monitor Free Lite 2.02.2 - Remote Audio Record

Papenmeier WiFi Baby Monitor Free Lite 2.02.2 - Remote Audio Record Whilst analysing a number of free communication based applications on the Google Play Store, I took a look at WiFi Baby Monitor: Free & Lite the free version of WiFi Baby Monitor. Although the premium version offered users the...