Asaancart Simple PHP Shopping Cart 0.9 - Arbitrary File Upload SQL Injection

Asaancart Simple PHP Shopping Cart 0.9 - Arbitrary File Upload SQL Injection Exploit Title: Simple PHP Shopping Cart 0.9 - Arbitrary File Upload Dork: N/A Date: 2018-10-30 Exploit Author: Ihsan Sencan Vendor Homepage: https://asaancart.wordpress.com/ Software Link:...

LFCMS 3.7.0 - Cross-Site Request Forgery (Add Admin)

LFCMS 3.7.0 - Cross-Site Request Forgery Add Admin Exploit Title: A CSRF vulnerability exists in LFCMS3.7.0: administrator account can be added arbitrarily. Date: 2018-06-20 Exploit Author: bay0net Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9203899.html Software Link:...

Schools Alert Management Script - Arbitrary File Deletion

Schools Alert Management Script - Arbitrary File Deletion Exploit Title: Schools Alert Management Script - Arbitrary File Deletion Date: 2018-06-07 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web...

Schneider Electric PLCs - Cross-Site Request Forgery

Schneider Electric PLCs - Cross-Site Request Forgery Exploit Title: Schneider Electric PLCs - Cross-Site Request Forgery Date: 2018-05-12 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.schneider-electric.com/ Tested on: Windows CVE: CVE-2013-0663 Version: Schneider Electric Quantum PLC:...

WampServer 3.1.2 - Cross-Site Request Forgery

WampServer 3.1.2 - Cross-Site Request Forgery Exploit Title: WampServer 3.1.2 CSRF to add or delete any virtual hostsremotely Date: 31-03-2018 Software Link: http://www.wampserver.com/en/ Version: 3.1.2 Tested On: Windows 10 Exploit Author: Vipin Chaudhary Contact: http://twitter.com/vipinxsec...

Netis WF2419 Router - Cross-Site Scripting

Netis WF2419 Router - Cross-Site Scripting Exploit Title: Netis-WF2419 HTML Injection Date: 20/01/2018 Exploit Author: Sajibe Kanti Author Contact :https://twitter.com/@sajibekantibd Vendor Homepage: http://www.netis-systems.com/ Version: Netis-WF2419 , V3.2.41381 Tested on: Windows 10 CEV :...

vBulletin 5 - cacheTemplates Remote Arbitrary File Deletion

vBulletin 5 - cacheTemplates Remote Arbitrary File Deletion SSD Advisory – vBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion Source: https://blogs.securiteam.com/index.php/archives/3573 Vulnerability Summary The following advisory describes a unauthenticated deserialization...

Winamp Pro 5.66.Build.3512 - Denial of Service

Winamp Pro 5.66.Build.3512 - Denial of Service ! /usr/bin/perl Exploit Title: Winamp Pro .wav|.wmv|.au|.asf|.aiff|.aif Denial of Service Date: 2017-11-22 Exploit Author: R.Yavari Version: v5.66.Build.3512 Tested on: Windows 10 , Windows 7 other version should be affected CVE-2017-16951...

DblTek - Multiple Vulnerabilities

DblTek - Multiple Vulnerabilities Vulnerabilities summary The following advisory describes 2 two vulnerabilities found in DblTek webserver. DBL is “specialized in VoIP products, especially GoIPs. We design, develop, manufacture, and sell our products directly and via distributors to customers. Ou...

Mura CMS 6.2 - Server-Side Request Forgery XML External Entity Injection

Mura CMS 6.2 - Server-Side Request Forgery XML External Entity Injection Exploit Title: Mura CMS before 6.2 SSRF + XXE Date: 30-10-2017 Exploit Author: Anthony Cole Vendor Homepage: http://www.getmura.com/ Version: before 6.2 Contact: http://twitter.com/acole76 Website: http://twitter.com/acole76...

Kaltura 13.2.0 - Remote Code Execution

Kaltura 13.2.0 - Remote Code Execution !/usr/bin/env python Kaltura = 13.1.0 RCE CVE-2017-14143 https://telekomsecurity.github.io/2017/09/kaltura-rce.html $ python kalturarce.py "https://example.com" 0xxxxxxxx "system'id'" host: https://example.com entryid: 0xxxxxxxx code: system'id' + sending...

Trend Micro OfficeScan 11.0XG (12.0) - Memory Corruption

Trend Micro OfficeScan 11.0XG 12.0 - Memory Corruption + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14089-TRENDMICRO-OFFICESCAN-XG-PRE-AUTH-REMOTE-MEMORY-CORRUPTION.txt + ISR: ApparitionSec Vendor:...

Indusoft Web Studio - Directory Traversal Information Disclosure (Metasploit)

Indusoft Web Studio - Directory Traversal Information Disclosure Metasploit require 'msf/core' class MetasploitModule 'Indusoft Web Studio Directory Traversal', 'Description' = %q This module exploits a flaw found in Indusoft Web Studio 'James Fitts' , 'License' = MSFLICENSE, 'Version' =...

Geneko Routers - Path Traversal

Geneko Routers - Path Traversal Vulnerability Summary The following advisory describes a Unauthenticated Path Traversal vulnerability found in Geneko GWR routers series. Geneko GWG is compact and cost effective communications solution that provides cellular capabilities for fixed and mobile...

Apple Safari 10.0.3 - JSC::CachedCall Use-After-Free

Apple Safari 10.0.3 - JSC::CachedCall Use-After-Free function makecompiledfunction function targetx return x5 + x - xx; // Call only once so that function gets compiled with low level interpreter // but none of the optimizing JITs target0; return target; function pwn var haxs = new Array0x100; fo...

Zend Framework zend-mail 2.4.11 - Remote Code Execution

Zend Framework zend-mail 2.4.11 - Remote Code Execution 09607 09607 09607 See the full advisory URL for the exploit details. / // Attacker's input coming from untrusted source such as $GET , $POST etc. // For example from a Contact form with sender field $emailfrom = '"attacker" -oQ/tmp/...

Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 - Multiple Vulnerabilities Exploit Title: Trend Micro Interscan Web Security Virtual Appliance IWSVA 6.5.x Multiple Vulnerabilities Date: 28/11/2016 Exploit Author: SlidingWindow , Twitter: @KapilKhot Vendor Homepage:...

Microsoft Windows Diagnostics Hub - DLL Load Privilege Escalation (MS16-125)

Microsoft Windows Diagnostics Hub - DLL Load Privilege Escalation MS16-125 / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=887 Windows: Diagnostics Hub DLL Load EoP Platform: Windows 10 10586, not tested 8.1 Update 2 or Windows 7 Class: Elevation of Privilege Summary: The fix...

WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities

WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt + ISR: ApparitionSec Vendor: ============= www.wso2.com Product:...

Microsoft Word 2007201020132016 - Out-of-Bounds Read Code Execution (MS16-099)

Microsoft Word 2007201020132016 - Out-of-Bounds Read Code Execution MS16-099 Application: Microsoft Office Word Platforms: Windows, OSX Versions: Microsoft Office Word 2007,2010,2013,2016 Author: Sébastien Morin of COSIG Website: https://cosig.gouv.qc.ca/en/advisory/ Twitter: @SebMorin1, @COSIG...

Apple Intel HD 3000 Graphics Driver 10.0.0 - Local Privilege Escalation

Apple Intel HD 3000 Graphics Driver 10.0.0 - Local Privilege Escalation / ░▀█▀░█▀█░█░░░█▀█░█▀▀░░░█░█░█░█░█░░░█▀█░█▀▄░█▀▀░█░█░ ░░█░░█▀█░█░░░█░█░▀▀█░░░▀▄▀░█░█░█░░░█░█░█░█░█▀▀░▀▄▀░ ░░▀░░▀░▀░▀▀▀░▀▀▀░▀▀▀░░░░▀░░▀▀▀░▀▀▀░▀░▀░▀▀░░▀▀▀░░▀░░ T A L O S V U L N D E V Proof-of-Concept Exploit Advisory:...

Multiple CCTV-DVR Vendors - Remote Code Execution

Multiple CCTV-DVR Vendors - Remote Code Execution !/usr/bin/python Blog post: http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html ''' Vendors List Ademco ATS Alarmes technolgy and ststems Area1Protection Avio Black Hawk Security Capture China security systems Cocktail...

libotr 4.1.0 - Memory Corruption

libotr 4.1.0 - Memory Corruption ''' X41 D-Sec GmbH Security Advisory: X41-2016-001 Memory Corruption Vulnerability in "libotr" =========================================== Overview -------- Severity Rating: high Confirmed Affected Version: 4.1.0 and below Confirmed Patched Version: libotr 4.1.1...

Zimbra 8.0.9 GA - Cross-Site Request Forgery

Zimbra 8.0.9 GA - Cross-Site Request Forgery ====================================== Multiple CSRF in Zimbra Mail interface ====================================== CVE-2015-6541 Description =========== Multiple CSRF vulnerabilities have been found in the Mail interface of Zimbra 8.0.9 GA Release,...

Microsoft Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (MS16-008) (1)

Microsoft Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux MS16-008 1 Source: https://code.google.com/p/google-security-research/issues/detail?id=573 Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux Platform: Windows 10, not tested any other OS Class...

Qlikview 11.20 SR11 - Blind XML External Entity Injection

Qlikview 11.20 SR11 - Blind XML External Entity Injection Exploit Title: Qlikview blind XXE security vulnerability Product: Qlikview Vulnerable Versions: v11.20 SR11 and previous versions Tested Version: v11.20 SR4 Advisory Publication: 08/09/2015 Latest Update: 08/09/2015 Vulnerability Type:...

Advantech Webaccess 8.0 3.4.3 - ActiveX Multiple Vulnerabilities

Advantech Webaccess 8.0 3.4.3 - ActiveX Multiple Vulnerabilities Introduction Using Advantech WebAccess SCADA Software we can remotely manage Industrial Control systems devices like RTU's, Generators, Motors etc. Attackers can execute code remotely by passing maliciously crafted string to...

Microsoft Word - Local Machine Zone Code Execution (MS15-022)

Microsoft Word - Local Machine Zone Code Execution MS15-022 Exploit Title: Microsoft Word Local Machine Zone Remote Code Execution Vulnerability Date: July 15th, 2015 Exploit Author: Eduardo Braun Prado Vendor Homepage : http://www.microsoft.com Version: 2007 Tested on: Microsoft Windows XP, 2003...

CUPS 2.0.3 - Multiple Vulnerabilities

CUPS 2.0.3 - Multiple Vulnerabilities Source: http://googleprojectzero.blogspot.se/2015/06/owning-internet-printing-case-study-in.html Abstract Modern exploit mitigations draw attackers into a game of diminishing marginal returns. With each additional mitigation added, a subset of software bugs...

Inmatrix-Ltd.-Zoom-Player-8.5-.jpeg

Exploit Title: Inmatrix Ltd. Zoom Player Crafted JPEG File Memory Corruption and Arbitrary Code Execution Exploit. Version: Zoom Player v8.5 Date: 09-1-2013 Author: Debasish Mandal. Blog : http://www.debasish.in/ d =...

WordPress Plugin Download Manager 2.7.2 - Privilege Escalation

WordPress Plugin Download Manager 2.7.2 - Privilege Escalation Exploit Title: WordPress Download Manager 2.7.2 Privilege Escalation Date: 24-11-2014 Software Link: https://wordpress.org/plugins/download-manager/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...

vBulletin 4.0.x 4.1.2 - search.php?cat SQL Injection

vBulletin 4.0.x 4.1.2 - search.php?cat SQL Injection vBulletin 4.0.x = 4.1.2 AUTOMATIC SQL Injection exploit Author: D35m0nd142, Google Dork: inurl:search.php?searchtype=1 Date: 02/09/2014 Vendor Homepage: http://www.vbulletin.com/ Tested on: vBulletin 4.1.2 Usage: perl exploit.pl Tutorial video:...

Skybox Security 6.3.x 6.4.x - Multiple Denial of Service Vulnerabilities

Skybox Security 6.3.x 6.4.x - Multiple Denial of Service Vulnerabilities Exploit Title: SKYBOX Security - DDOS Date: 22-Jan-2014 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.skyboxsecurity.com Version: Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54,...

SocialEngine Timeline Plugin 4.2.5p9 - Arbitrary File Upload

SocialEngine Timeline Plugin 4.2.5p9 - Arbitrary File Upload Exploit Title: Sending php file in the timeline plugin cover image of SocialEngine 4.5 Date: 2013-08-17 Discovered by: Wesley Henrique Leite aka "spyk2r" Vendor Homepage: http://webhive.com.ua/ Software Link:...

Cisco ASA 8.4.4.6 8.2.5.32 - Ethernet Information Leak

Cisco ASA 8.4.4.6 8.2.5.32 - Ethernet Information Leak !/usr/bin/env python CVE-2003-0001 'Etherleak' exploit ================================= Exploit for hosts which use a network device driver that pads ethernet frames with data which vary from one packet to another, likely taken from kernel...

Trend Micro Control Manager 5.56.0 AdHocQuery - (Authenticated) Blind SQL Injection

Trend Micro Control Manager 5.56.0 AdHocQuery - Authenticated Blind SQL Injection !/usr/bin/env python Exploit Title: Trend Micro Control Manager 5.5/6.0 AdHocQuery BlindSQL Injection post-auth Disclosure Date: 09/27/2012 Author: otoy @otoyrood & modpr0be @modpr0be Contact: researchatspentera.com...

Symantec Backup Exec 12.5 - Man In The Middle

Symantec Backup Exec 12.5 - Man In The Middle Exploit Title: Symantec Backup Exec MiTM Attack Date: 27/05/2011 Author: Nibin Software Link: http://www.symantec.com/business/products/family.jsp?familyid=backupexec Version: - Symantec Backup Exec for Windows Servers versions 11.0, 12.0, and 12.5 -...

phpMyBitTorrent 2.0.4 - SQL Injection

phpMyBitTorrent 2.0.4 - SQL Injection Exploit Title: phpMyBitTorrent 2.0.4 SQL injection Google Dork: inurl:"user.php?op=register" Date: 14/FEB/2011 Author: [email protected] Software Link: http://sourceforge.net/projects/phpmybittorrent/ Version: 2.0.4 Tested on: nix...

Habari Blog - Multiple Vulnerabilities

Habari Blog - Multiple Vulnerabilities Vulnerability ID: HTB22732 Reference: http://www.htbridge.ch/advisory/pathdisclosureinhabari.html Product: Habari Vendor: Habari http://habariproject.org/en/ Vulnerable Version: 0.6.5 Vendor Notification: 02 December 2010 Vulnerability Type: Path disclosure...

Microsoft Cinepak Codec CVDecompress - Heap Overflow (MS10-055)

Microsoft Cinepak Codec CVDecompress - Heap Overflow MS10-055 ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moaub-26-microsoft-cinepak-codec-cvdecompress-heap-overflow-ms10-055/ ''' ''' Title :...

Interspire SHOPPING CART 5.5.4 - Ultimate Edition backup dump

Interspire SHOPPING CART 5.5.4 - Ultimate Edition backup dump ======================================================================================== | Title INTERSPIRE SHOPPING CART 5.5.4 - Ultimate Edition backup dump Vulnerability | Author indoushka | email [email protected] $ | Web Site...

Employee TimeClock Software 0.99 - SQL Injection

Employee TimeClock Software 0.99 - SQL Injection source: http://www.securityfocus.com/archive/1/509995 ====================================================================== Secunia Research 10/03/2010 - Employee Timeclock Software SQL Injection Vulnerabilities -...

Linux Kernel 2.6.31-rc7 - AF_IRDA 29-Byte Stack Disclosure (2)

Linux Kernel 2.6.31-rc7 - AFIRDA 29-Byte Stack Disclosure 2 / cve-2009-3002.c Linux Kernel http://jon.oberheide.org Information: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3002 The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions,...

Barracuda Spam Firewall 3.5.11.020 Model 600 - SQL Injection

Barracuda Spam Firewall 3.5.11.020 Model 600 - SQL Injection CVE Number: CVE-2008-1094 Vulnerability: SQL Injection Risk: Medium Attack vector: From Remote Vulnerability Discovered: 16th June 2008 Vendor Notified: 16th June 2008 Advisory Released: 15th December 2008 Abstract Barracuda Networks Sp...

Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure

Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure source: https://www.securityfocus.com/bid/27706/info Apache Tomcat is prone to an information-disclosure vulnerability because it fails to adequately sanitize user-supplied data. Attackers can exploit this issue to access...

Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation (1)

Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation 1 source: https://www.securityfocus.com/bid/20471/info The Netscape Portable Runtime API running on Sun Solaris 10 operating system is prone to a local privilege-escalation vulnerability. A successful exploit of this iss...

Apple Mac OSX 10.4.7 - Mach Exception Handling Local (10.3.x)

Apple Mac OSX 10.4.7 - Mach Exception Handling Local 10.3.x / excploit.c - 28 Nov 2005 - [email protected] Exploitable Mach Exception Handling Affected: Mac OS X 10.4.6 darwin 8.6.0 and older When a process executes a setuid executable, all existing rights to the task port are invalidated,...

OpenSSL SSLv2 - Null Pointer Dereference Client Denial of Service

OpenSSL SSLv2 - Null Pointer Dereference Client Denial of Service source: https://www.securityfocus.com/bid/20246/info OpenSSL is prone to a denial-of-service vulnerability. A malicious server could cause a vulnerable client application to crash, effectively denying service. !/usr/bin/perl...

ACal 2.2.6 - day.php Remote File Inclusion

ACal 2.2.6 - day.php Remote File Inclusion $$ $ Title: ACal 2.2.6 = Remote File Inclusion $ $$ $ URL: http://acalproj.sourceforge.net/ $ $$ $ Dork: intitle:"Login to Calendar" $ $$ $ Credits: PiNGuX $ $$ $ Greetz : 0o $ $$ Exploit:...

Linux Kernel 2.6.x - IPv6 Local Denial of Service

Linux Kernel 2.6.x - IPv6 Local Denial of Service / source: https://www.securityfocus.com/bid/15156/info Linux Kernel is reported prone to a local denial-of-service vulnerability. This issue arises from an infinite loop when binding IPv6 UDP ports. / / Linux kernel IPv6 UDP port selection infinit...