Oracle Internet Directory 10.1.4 - Remote Denial of Service

Oracle Internet Directory 10.1.4 - Remote Denial of Service !/usr/bin/python """ Oracle Internet Directory 10.1.4 preauthentication Denial Of Service NOTES: Under 32 bits platforms it crashes immediately. Under 64 bits it may take even hours. Sometimes you need 2 shoots to crash OID completely. T...

Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure

Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure source: https://www.securityfocus.com/bid/27706/info Apache Tomcat is prone to an information-disclosure vulnerability because it fails to adequately sanitize user-supplied data. Attackers can exploit this issue to access...

ACal 2.2.6 - day.php Remote File Inclusion

ACal 2.2.6 - day.php Remote File Inclusion $$ $ Title: ACal 2.2.6 = Remote File Inclusion $ $$ $ URL: http://acalproj.sourceforge.net/ $ $$ $ Dork: intitle:"Login to Calendar" $ $$ $ Credits: PiNGuX $ $$ $ Greetz : 0o $ $$ Exploit:...

Invision Power Board 2.1.4 - Register Users Denial of Service

Invision Power Board 2.1.4 - Register Users Denial of Service !/usr/bin/perl use IO::Socket; | | | \ | | |/ IPB Register Multiple Users Denial of Service Doesn't Work on forums using "Code Confirmation" Created By SkOd SED security Team http://www.sed-team.be [email protected] ISRAEL print q...

Gemitel 3.50 - affich.php Remote File Inclusion Command Injection

Gemitel 3.50 - affich.php Remote File Inclusion Command Injection source: https://www.securityfocus.com/bid/10156/info A vulnerability has been identified in the handling of input by Gemitel. Because of this, it may be possible for a remote user to gain unauthorized access to a system using the...

SCPOnly 2.32.4 - SSH Environment Shell Escaping

SCPOnly 2.32.4 - SSH Environment Shell Escaping source: https://www.securityfocus.com/bid/5526/info scponly is a freely available, open source restricted secure copy client. It is available for Unix and Linux operating systems. The default installation of scponly does not place sufficient access...

Microsoft SQL Server 2000 - User Authentication Remote Buffer Overflow

Microsoft SQL Server 2000 - User Authentication Remote Buffer Overflow source: https://www.securityfocus.com/bid/5411/info A vulnerability has been discovered in Microsoft SQL Server that could make it possible for remote attackers to gain access to target hosts. It is possible for an attacker to...

I6032B-P POE 2.0MP Outdoor Camera - Remote Configuration Disclosure

I6032B-P POE 2.0MP Outdoor Camera - Remote Configuration Disclosure Exploit Title: I6032B-P POE 2.0MP Outdoor Camera - Remote Configuration Disclosure Author: Todor Donev Date: 2020-02-23 Vendor: https://www.revotec.com/ Product Link: CVE: N/A !/usr/bin/perl Revotech I6032B-P POE 1920x1080P 2.0MP...

Adaware Web Companion version 4.8.2078.3950 - WCAssistantService Unquoted Service Path

Adaware Web Companion version 4.8.2078.3950 - WCAssistantService Unquoted Service Path Exploit Title: Adaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service Path Date: 2019-11-06 Exploit Author: Mariela L Martínez Hdez Vendor Homepage: https://webcompanion.com/en/...

WordPress Plugin WooCommerce Product Feed 2.2.18 - Cross-Site Scripting

WordPress Plugin WooCommerce Product Feed 2.2.18 - Cross-Site Scripting Exploit Title: WordPress Plugin WooCommerce Product Feed = 2.2.18 - Cross-Site Scripting Date: 30 August 2019 Exploit Author: Damian Ebelties https://zerodays.lol/ Vendor Homepage:...

UliCMS 2019.1 Spitting Lama - Persistent Cross-Site Scripting

UliCMS 2019.1 Spitting Lama - Persistent Cross-Site Scripting Exploit Title: UliCMS 2019.1 "Spitting Lama" - Stored Cross-Site Scripting Google Dork: intext:"by UliCMS" Date: 2019-05-12 Exploit Author: Unk9vvN Vendor Homepage: https://en.ulicms.de Software Link:...

NUUO NVRMini 2 3.9.1 - sscanf Stack Overflow

NUUO NVRMini 2 3.9.1 - sscanf Stack Overflow !/usr/bin/python Exploit Title: NUUO NVRMini2 3.9.1 'sscanf' stack overflow Google Dork: n/a Date: Advisory Published: Nov 18 Exploit Author: @0x00string Vendor Homepage: nuuo.com Software Link: https://www.nuuo.com/ProductNode.php?node=2 Version: 3.9....

Zotonic 0.47.0 mod_admin - Cross-Site Scripting

Zotonic 0.47.0 modadmin - Cross-Site Scripting Exploit Title: Zotonic prompt‘XSS’ Affected source code file zotonicmodadmin: - zotonicmodadminidentity\priv\templates\adminsortheader.tpl - zotonicmodadminidentity\priv\templates\adminusers.tpl References...

Craft CMS 3.1.12 Pro - Cross-Site Scripting

Craft CMS 3.1.12 Pro - Cross-Site Scripting Exploit Title: Craft CMS 3.1.12 Pro - Cross-Site Scripting Date: 2019-03-04 Exploit Author: Ismail Tasdelen Vendor Homepage: https://craftcms.com/ Software Link : https://github.com/craftcms/cms Software : Craft CMS 3.1.12 Pro Version : 3.1.12 Pro...

Jinja2 2.10 - from_string Server Side Template Injection

Jinja2 2.10 - fromstring Server Side Template Injection ''' Exploit Title: Jinja2 Command injection fromstring function Date: date Exploit Author: JameelNabbo Website: Ordina.nl Vendor Homepage: http://jinja.pocoo.org Software Link: https://pypi.org/project/Jinja2/files Version: 2.10 Tested on:...

Asaancart Simple PHP Shopping Cart 0.9 - Arbitrary File Upload SQL Injection

Asaancart Simple PHP Shopping Cart 0.9 - Arbitrary File Upload SQL Injection Exploit Title: Simple PHP Shopping Cart 0.9 - Arbitrary File Upload Dork: N/A Date: 2018-10-30 Exploit Author: Ihsan Sencan Vendor Homepage: https://asaancart.wordpress.com/ Software Link:...

Apple iOSmacOS - Sandbox Escape due to Trusted Length Field in Shared Memory used by HID Event Subsystem

Apple iOSmacOS - Sandbox Escape due to Trusted Length Field in Shared Memory used by HID Event Subsystem iohideventsystem is a MIG service which provides proxy access to various HID devices for untrusted clients. On iOS it's hosted by backboardd and on MacOS by hidd. The actual implementation is ...

Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection

Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection Exploit Title: Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection Date: 2018-10-10 Author: John Page aka hyp3rlinx Website: hyp3rlinx.altervista.org Venodor: www.microsoft.com Software: SQL Server...

Geutebrueck re_porter 7.8.974.20 - Credential Disclosure

Geutebrueck reporter 7.8.974.20 - Credential Disclosure Exploit Title: Geutebrueck reporter 7.8.974.20 - Credential Disclosure Date: 2018-08-03 Exploit Author: Kamil Suska Vendor: https://www.geutebrueck.com/enUS.html Link:...

WebkitGTK+ 2.20.3 - ImageBufferCairo::getImageData() Buffer Overflow (PoC)

WebkitGTK+ 2.20.3 - ImageBufferCairo::getImageData Buffer Overflow PoC Exploit Title: WebkitGTK+ 2.20.3 - 'ImageBufferCairo::getImageData' Buffer Overflow PoC Date: 2018-08-15 Exploit Author: PeregrineX Vendor Homepage: https://webkitgtk.org/ & https://webkit.org/wpe/ Software Link:...

Foxit Reader 9.0.1.1049 - Buffer Overflow (ASLR DEP Bypass)

Foxit Reader 9.0.1.1049 - Buffer Overflow ASLR DEP Bypass %PDF 1 0 obj 2 0 obj /S /JavaScript /JS / Exploit Title: Foxit Reader 9.0.1.1049 - Buffer Overflow ASLRDEP Date: 2018-08-04 Exploit Author: Manoj Ahuje Tested on: Windows 7 Pro x32 Software Link:...

Responsive Filemanager 9.13.1 - Server-Side Request Forgery

Responsive Filemanager 9.13.1 - Server-Side Request Forgery Exploit Title: Responsive filemanager 9.13.1 - Server-Side Request Forgery Date: 2018-07-29 Exploit Author: GUIA BRAHIM FOUAD Vendor Homepage: http://responsivefilemanager.com/ Software Link:...

ntop-ng 3.4.180617 - Authentication Bypass

ntop-ng 3.4.180617 - Authentication Bypass ''' Vulnerability title: ntop-ng 3.4.180617 - Authentication Bypass Author: Ioannis Profetis Contact: me at x86.re Vulnerable versions: 3.4.180617-4560 Fixed version: 3.4.180617 Link: ntop.org Date: 2.07.2018 CVE-2018-12520 Product Details ntopng is the...

OEcms 3.1 - Cross-Site Scripting

OEcms 3.1 - Cross-Site Scripting Title: OEcms 3.1 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-06-15 Software: OEcms v3.1 CVE: CVE-2018-12095 Technical Details & Description: A Reflected Cross-Site Scripting web vulnerability has been discovered in the "OEcms v3.1"...

HRSALE The Ultimate HRM 1.0.2 - CSV Injection

HRSALE The Ultimate HRM 1.0.2 - CSV Injection Exploit Title: HRSALE The Ultimate HRM 1.0.2 - CSV Injection Date: 2018-04-23 Exploit Author: 8bitsec CVE: CVE-2018-10257 Vendor Homepage: https://codecanyon.net/ Software Link: https://codecanyon.net/item/hrsale-the-ultimate-hrm/21665619 Version: 1.0...

Advantech WebAccess 8.1 - webvrpcs DrawSrv.dll Path BwBuildPath Stack-Based Buffer Overflow

Advantech WebAccess 8.1 - webvrpcs DrawSrv.dll Path BwBuildPath Stack-Based Buffer Overflow !/usr/bin/python2.7 Exploit Title: Advantech WebAccess 8.1 webvrpcs DrawSrv.dll Path BwBuildPath Stack-Based Buffer Overflow RCE Date: 03-29-2018 Exploit Author: Chris Lyne @lynerc Vendor Homepage:...

Firefox 46.0.1 - ASM.JS JIT-Spray Remote Code Execution

Firefox 46.0.1 - ASM.JS JIT-Spray Remote Code Execution CVE-2016-2819 and ASM.JS JIT-Spray "use strict" var Exploit = function this.asmjs = new Asmjs this.heap = new Heap Exploit.prototype.go = function / target address of fake node object / var nodetargetaddr = 0x5a500000 / target address of...

Papenmeier WiFi Baby Monitor Free Lite 2.02.2 - Remote Audio Record

Papenmeier WiFi Baby Monitor Free Lite 2.02.2 - Remote Audio Record Whilst analysing a number of free communication based applications on the Google Play Store, I took a look at WiFi Baby Monitor: Free & Lite the free version of WiFi Baby Monitor. Although the premium version offered users the...

Joomla! Component SimpleCalendar 3.1.9 - SQL Injection

Joomla! Component SimpleCalendar 3.1.9 - SQL Injection Exploit Title: Joomla! Component SimpleCalendar 3.1.9 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://albonico.ch/ Software Link: http://software.albonico.ch/downloads/file/3-simplecalendar-3-1-9.html Version: 3.1.9 Categor...

Joomla! Component JS Jobs 1.1.9 - SQL Injection

Joomla! Component JS Jobs 1.1.9 - SQL Injection Exploit Title: Joomla! Component JS Jobs 1.1.9 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.joomsky.com/ Software Link: https://extensions.joomla.org/extensions/extension/ads-a-affiliates/jobs-a-recruitment/js-jobs/ Softwar...

Joomla! Component JquickContact 1.3.2.2.1 - SQL Injection

Joomla! Component JquickContact 1.3.2.2.1 - SQL Injection Exploit Title: Joomla! Component JquickContact 1.3.2.2.1 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor: http://coderspirit.blogspot.com.tr/2011/07/jquickcontact.html Software:...

MalwareFox AntiMalware 2.74.0.150 - Local Privilege Escalation

MalwareFox AntiMalware 2.74.0.150 - Local Privilege Escalation / Title : MalwareFox AntiMalware 2.74.0.150 - Local Privilege Escalation Date : 02/02/2018 Author : Souhail Hammou Vendor Homepage : https://www.malwarefox.com/ Version : 2.74.0.150 Tested on : Windows 7 32-bit / Windows 10 64-bit CVE...

Joomla! Component Zh GoogleMap 8.4.0.0 - SQL Injection

Joomla! Component Zh GoogleMap 8.4.0.0 - SQL Injection input name="id" value="-11 UNION ALL SELECT...

Synology DiskStation Manager (DSM) 6.1.3-15152 - forget_passwd.cgi User Enumeration

Synology DiskStation Manager DSM 6.1.3-15152 - forgetpasswd.cgi User Enumeration Exploit Title: Synology DiskStation Manager DSM 6.1.3-15152 - 'forgetpasswd.cgi' User Enumeration Date: 01/05/2018 Exploit Author: Steve Kaun Vendor Homepage: https://www.synology.com Version: Before 6.1.3-15152 CVE ...

VX Search Enterprise 10.1.12 - Remote Buffer Overflow

VX Search Enterprise 10.1.12 - Remote Buffer Overflow !/usr/bin/env python Exploit Title : VX Search Enterprise v10.1.12 Remote Buffer Overflow Exploit Author : Revnic Vasile Email : revnicatgmaildotcom Date : 09-10-2017 Vendor Homepage : http://www.flexense.com/ Software Link :...

Indusoft Web Studio - Directory Traversal Information Disclosure (Metasploit)

Indusoft Web Studio - Directory Traversal Information Disclosure Metasploit require 'msf/core' class MetasploitModule 'Indusoft Web Studio Directory Traversal', 'Description' = %q This module exploits a flaw found in Indusoft Web Studio 'James Fitts' , 'License' = MSFLICENSE, 'Version' =...

ZKTime Web Software 2.0 - Cross-Site Request Forgery

ZKTime Web Software 2.0 - Cross-Site Request Forgery Exploit Title: ZKTime Web Software 2.0 - Cross Site Request Forgery CVE-ID: CVE-2017-13129 Vendor Homepage: https://www.zkteco.com/product/ZKTimeWeb2.0435.html Vendor of Product: ZKTeco Affected Product Code: ZKTime Web - 2.0.1.12280 Category:...

libmad 0.15.1b - mp3 Memory Corruption

libmad 0.15.1b - mp3 Memory Corruption libmad memory corruption vulnerability ================ Author : qflb.wu =============== Introduction: ============= libmad is a high-quality MPEG audio decoder capable of 24-bit output. Affected version: ===== 0.15.1b Vulnerability Description:...

FreeBSD - setrlimit Stack Clash (PoC)

FreeBSD - setrlimit Stack Clash PoC / FreeBSDCVE-2017-1085.c Copyright C 2017 Qualys, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or at...

Horde Groupware Webmail 345 - Multiple Remote Code Executions

Horde Groupware Webmail 345 - Multiple Remote Code Executions Source: https://blogs.securiteam.com/index.php/archives/3107 Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in Horde Groupware Webmail. Horde Groupware Webmail Edition is a free, enterprise ready,...

Intermec PM43 Industrial Printer - Local Privilege Escalation

Intermec PM43 Industrial Printer - Local Privilege Escalation TITLE: Intermec Industrial Printers Local root with Busybox jailbreak Date: March 28th, 2017 Author: Bourbon Jean-marie kmkz from AKERVA company | @kmkzsecurity Product Homepage: http://www.intermec.com/products/prtrpm43a/ Firmware...

Kinsey InforLawson ESBUS - SQL Injection

Kinsey InforLawson ESBUS - SQL Injection Exploit Title: Kinsey Infor / Lawson ESBUS - Multiple SQL Injections Date: 3/10/2017 Exploit Author: Michael Benich Vendor homepage: http://www.kinsey.com/infor-lawson.html Version: ALL Tested on: Windows Server 2008 R2; MySQL ver 5.5 CVE: CVE-2017-6550...

Geutebruck 5.02024 G-CamEFD-2250 - testaction.cgi Remote Command Execution (Metasploit)

Geutebruck 5.02024 G-CamEFD-2250 - testaction.cgi Remote Command Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Geutebruck testaction.cgi Remote Command...

PHPMailer 5.2.18 - Remote Code Execution (PHP)

PHPMailer 5.2.18 - Remote Code Execution PHP 09607 "; // ------------------ // mail param injection via the vulnerability in PHPMailer requireonce'class.phpmailer.php'; $mail = new PHPMailer; // defaults to using php "mail" $mail-SetFrom$emailfrom, 'Client Name'...

Symphony CMS 2.6.7 - Session Fixation

Symphony CMS 2.6.7 - Session Fixation + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SYMPHONY-CMS-SESSION-FIXATION.txt + ISR: APPARITIONSEC Vendor: ==================== www.getsymphony.com Product: ==================...

Multiple CCTV-DVR Vendors - Remote Code Execution

Multiple CCTV-DVR Vendors - Remote Code Execution !/usr/bin/python Blog post: http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html ''' Vendors List Ademco ATS Alarmes technolgy and ststems Area1Protection Avio Black Hawk Security Capture China security systems Cocktail...

Adobe Flash - Type Confusion in Serialization with ObjectEncoder.dynamicPropertyWriter

Adobe Flash - Type Confusion in Serialization with ObjectEncoder.dynamicPropertyWriter Source: https://code.google.com/p/google-security-research/issues/detail?id=545 There is a type confusion issue during serialization if ObjectEncoder.dynamicPropertyWriter is overridden with a value that is not...

Tenda N3 Wireless N150 Router - Authentication Bypass

Tenda N3 Wireless N150 Router - Authentication Bypass Exploit Title: Complete Authentication Bypass In Tenda N3 Wireless N150 Routers Date: 03-09-2015 Software Link: http://tendacn.com/en/product/N150.html Exploit Author: Mandeep Jadon Contact: http://twitter.com/1337tr0lls Website:...

CUPS 2.0.3 - Multiple Vulnerabilities

CUPS 2.0.3 - Multiple Vulnerabilities Source: http://googleprojectzero.blogspot.se/2015/06/owning-internet-printing-case-study-in.html Abstract Modern exploit mitigations draw attackers into a game of diminishing marginal returns. With each additional mitigation added, a subset of software bugs...

PHP-Fusion 7.02.07 - SQL Injection

PHP-Fusion 7.02.07 - SQL Injection Exploit Title: PHP-Fusion 7.02.07 SQL Injection Date: 06/11/2014 Exploit Author: Mauricio Correa Vendor Homepage: www.php-fusion.co.uk Software Link: http://ufpr.dl.sourceforge.net/project/php-fusion/PHP-Fusion%20Archives/7.x/ PHP-Fusion-7.02.07.zip Version:...