Oracle Hyperion Smart View for Office 11.1.2.3.000 - Crash (PoC)

Oracle Hyperion Smart View for Office 11.1.2.3.000 - Crash PoC Exploit Title: Buffer Overflow in Oracle� Hyperion Smart View for Office DOS Exploit Author: sajith Vendor Homepage: http://oracle.com vulnerable Version: Fusion Edition 11.1.2.3.000 Build 157 Vulnerable Link:...

Abrt (Fedora 21) - Race Condition

Abrt Fedora 21 - Race Condition include include include include include include include include include include include include include include include // // This is a race condition exploit for CVE-2015-1862, targeting Fedora. // // Note: It can take a few minutes to win the race condition. // /...

Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal

Ericsson Drutt MSDP Instance Monitor - Directory Traversal +------------------------------------------------------------------------------------------------------+ + Ericsson Drutt MSDP Instance Monitor - Directory Traversal Vulnerability and Arbitrary File Access +...

IBM Endpoint Manager - Persistent Cross-Site Scripting

IBM Endpoint Manager - Persistent Cross-Site Scripting Advisory: Cross-Site Scripting in IBM Endpoint Manager Relay Diagnostics Page During a penetration test, RedTeam Pentesting discovered that the IBM Endpoint Manager Relay Diagnostics page allows anybody to persistently store HTML and JavaScri...

Microsoft Windows 8.1 (x86x64) - User Profile Service Privilege Escalation (MS15-003)

Microsoft Windows 8.1 x86x64 - User Profile Service Privilege Escalation MS15-003 Source: https://code.google.com/p/google-security-research/issues/detail?id=123 Platform: Windows 8.1 Update 32/64 bit No other OS tested When a user logs into a computer the User Profile Service is used to create...

Inmatrix-Ltd.-Zoom-Player-8.5-.jpeg

Exploit Title: Inmatrix Ltd. Zoom Player Crafted JPEG File Memory Corruption and Arbitrary Code Execution Exploit. Version: Zoom Player v8.5 Date: 09-1-2013 Author: Debasish Mandal. Blog : http://www.debasish.in/ d =...

PhotoPost 4.85 - Multiple Vulnerabilities

PhotoPost 4.85 - Multiple Vulnerabilities PhotoPost Multiple Vulnerabilities Vendor: All Enthusiast, Inc. Product: PhotoPost Version: = 4.85 Website: http://www.photopost.com/ BID: 12157 CVE: CVE-2005-0273 CVE-2005-0274 OSVDB: 12741 12741 SECUNIA: 13680 PACKETSTORM: 35595 Description: PhotoPost w...

D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery Denial of Service

D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery Denial of Service Exploit Title: Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service Google dork : N/A Exploit Author: Blessen Thomas Date : 29/07/14 Vendor Homepage : http://www.dlink.com/ Software Link : N/A Firmware version: v2.02 2013-03-...

Ubiquiti UbiFi mFi AirVision - Cross-Site Request Forgery

Ubiquiti UbiFi mFi AirVision - Cross-Site Request Forgery Vendor Homepage: http://www.ubnt.com/ Tested on: Kali Linux ----------------------------------------- Affected Products/Versions: ----------------------------------------- UniFi Controller v2.4.6 mFi Controller v2.0.15 AirVision Controller...

Yealink VoIP Phone SIP-T38G - Default Credentials

Yealink VoIP Phone SIP-T38G - Default Credentials Title: Yealink VoIP Phone SIP-T38G Default Credentials Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5755 Description: Web interface use...

Linux Kernel 3.3.5 - driversmediamedia-device.c Local Information Disclosure

Linux Kernel 3.3.5 - driversmediamedia-device.c Local Information Disclosure / source: https://www.securityfocus.com/bid/68048/info The Linux kernel is prone to a local information-disclosure vulnerability. Local attackers can exploit this issue to cause a memory leak to obtain sensitive...

Skybox Security 6.3.x 6.4.x - Multiple Denial of Service Vulnerabilities

Skybox Security 6.3.x 6.4.x - Multiple Denial of Service Vulnerabilities Exploit Title: SKYBOX Security - DDOS Date: 22-Jan-2014 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.skyboxsecurity.com Version: Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54,...

pChart 2.1.3 - Multiple Vulnerabilities

pChart 2.1.3 - Multiple Vulnerabilities Exploit Title: pChart 2.1.3 Directory Traversal and Reflected XSS Date: 2014-01-24 Exploit Author: Balazs Makany Vendor Homepage: www.pchart.net Software Link: www.pchart.net/download Google Dork: intitle:"pChart 2.x - examples" intext:"2.1.3" Version: 2.1....

SocialEngine Timeline Plugin 4.2.5p9 - Arbitrary File Upload

SocialEngine Timeline Plugin 4.2.5p9 - Arbitrary File Upload Exploit Title: Sending php file in the timeline plugin cover image of SocialEngine 4.5 Date: 2013-08-17 Discovered by: Wesley Henrique Leite aka "spyk2r" Vendor Homepage: http://webhive.com.ua/ Software Link:...

Airlive IP Cameras - Multiple Vulnerabilities

Airlive IP Cameras - Multiple Vulnerabilities =========================================================================== AIRLIVE ==================================================================== =========================================================================== 1.Advisory Information...

Centreon Enterprise Server 2.3.3 2.3.9-4 - Blind SQL Injection

Centreon Enterprise Server 2.3.3 2.3.9-4 - Blind SQL Injection !/usr/bin/env python Exploit Title: Centreon 2.3.3 - 2.3.9-4 menuXML.php Blind SQL Injection Exploit Disclosure Date: December 12, 2012 Author: modpr0be @modpr0be Platform: Linux Tested on: Centreon Enterprise Server with Centreon...

Axway Secure Transport 5.1 SP2 - Directory Traversal

Axway Secure Transport 5.1 SP2 - Directory Traversal Secure Transport Path Traversal Vulnerability Public Disclosure Date: November 11, 2012 Vendors Affected: Axway http://www.axway.com Systems Affected: Secure Transport Problem: A path traversal vulnerability was identified in SecureTransport...

phpMyAdmin 3.3.x3.4.x - Local File Inclusion via XML External Entity Injection (Metasploit)

phpMyAdmin 3.3.x3.4.x - Local File Inclusion via XML External Entity Injection Metasploit Exploit Title: poc-phpmyadmin-local-file-inclusion-via-xxe-injection Date: 12-01-2012 Author: Marco Batista Blog Link:...

cubecart 2.0.7 - Multiple Vulnerabilities

cubecart 2.0.7 - Multiple Vulnerabilities Exploit Title: CubeCart 2.0.7 XSS && Remote SQL Injection = Multiple Vulnerabilities Date: June, 14th 2011 GMT +7 Author: Shamus Software Link: http://www.cubecart.com/ Version : CubeCart 2.0.7 Tested on: windows 7, ubuntu 11.04 CVE : -...

Adobe Flash Player 10.1.53.64 - Action Script Type Confusion (ASLR + DEP Bypass)

Adobe Flash Player 10.1.53.64 - Action Script Type Confusion ASLR + DEP Bypass Source: http://www.abysssec.com/blog/2011/04/exploiting-adobe-flash-player-on-windows-7/ Adobe Flash player Action script type confusion exploit DEP+ASLR bypass advisory text : Here is another reliable windows 7 exploi...

Microsoft Windows XP - WmiTraceMessageVa Integer Truncation (PoC) (MS11-011)

Microsoft Windows XP - WmiTraceMessageVa Integer Truncation PoC MS11-011 / Exploit Title: MS11-011CVE-2011-0045: MS Windows XP WmiTraceMessageVa Integer Truncation Vulnerability PoC Date: 2011-03-01 Author: Nikita Tarakanov CISS Research Team Software Link: Version: prior to MS11-011 Tested on: W...

Pulse CMS Basic - Local File Inclusion

Pulse CMS Basic - Local File Inclusion 'Pulse CMS Basic' Local File Inclusion Vulnerability CVE-2010-4330 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in the 'includes/controller.php' script that allows for arbitrary local...

Camtron CMNC-200 IP Camera - Denial of Service

Camtron CMNC-200 IP Camera - Denial of Service Finding 5: Camera Denial of Service CVE: CVE-2010-4234 The CMNC-200 IP Camera has a built-in web server that is vulnerable to denial of service attacks. Sending multiple requests in parallel to the web server may cause the camera to reboot. Requests...

Fat Player 0.6b - .WAV File Processing Buffer Overflow (SEH)

Fat Player 0.6b - .WAV File Processing Buffer Overflow SEH Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a .wav file. NOTE: some of these details are obtained from third party information. Reference:...

Microsoft Windows Server 2000 2008 - Embedded OpenType Font Engine Remote Code Execution (MS09-065) (Metasploit)

Microsoft Windows Server 2000 2008 - Embedded OpenType Font Engine Remote Code Execution MS09-065 Metasploit $Id: ms09065eotinteger.rb 7470 2009-11-11 23:48:53Z hdm $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the...

Sun VirtualBox 3.0.6 - Local Privilege Escalation

Sun VirtualBox 3.0.6 - Local Privilege Escalation !/bin/sh CVE-2009-3692 Sun VirtualBox runme.c include include include include include int mainint argc, char argv FILE from, to; int fd; char ch; setuid0; setgid0; from = fopen"/bin/sh","rb"; to = fopen"./sh","wb"; while!feoffrom ch = fgetcfrom;...

Linux Kernel 2.6 2.6.19 (White Box 4 CentOS 4.44.5 Fedora Core 456 x86) - ip_append_data() Ring0 Privilege Escalation (1)

Linux Kernel 2.6 2.6.19 White Box 4 CentOS 4.44.5 Fedora Core 456 x86 - ipappenddata Ring0 Privilege Escalation 1 / 0x82-CVE-2009-2698 Linux kernel 2.6 . / include include include include include include include unsigned int uid, gid; void getrootuidunsigned task unsigned addr=task;...

Microsoft XML Core Services DTD - Cross-Domain Scripting (MS08-069)

Microsoft XML Core Services DTD - Cross-Domain Scripting MS08-069 KB955218 - CVE-2008-4029 - JA var dom = new ActiveXObject"Msxml2.DOMDocument.3.0"; dom.async = false; var url = "http://www.milw0rm.com/forfun.dtd"; var xml = ""; if dom.loadXMLxml == 0 alert"Blue or Red Pill? " +...

Attachmax Dolphin 2.1.0 - Multiple Vulnerabilities

Attachmax Dolphin 2.1.0 - Multiple Vulnerabilities \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV101$2008 ----------------------------------------------------------------------------------------- ECHOADV101$2008 Attachmax Dolphin = 2.1.0 Multiple...

PHP 4.4.75.2.3 - MySQLMySQLi Safe_Mode Bypass

PHP 4.4.75.2.3 - MySQLMySQLi SafeMode Bypass Affected Products: Philip Olausson Reported: 2007-06-05 Released: 2007-08-30 CVE: CVE-2007-3997 Issue: A vulnerability exists in PHP's MySQL and MySQLi extenstions which can be used to bypass PHP's safemode security restriction. Description: PHP is a...

ttCMS 4 - ez_sql.php?lib_path Remote File Inclusion

ttCMS 4 - ezsql.php?libpath Remote File Inclusion DEVIL TEAM - HACKING POLISH TEAM Author: Kacper a.k.a Rahim Contact: [email protected] Homepage: http://www.rahim.webd.pl/ Irc: irc.milw0rm.com:6667 devilteam -------------------------------------------- Pozdro dla wszystkich z kanalu IRC oraz...

XMPlay 3.3.0.4 - .ASX Filename Local Buffer Overflow

XMPlay 3.3.0.4 - .ASX Filename Local Buffer Overflow / =================================================================== 0-day XMPlay 3.3.0.4 .ASX Filename Buffer Overflow Exploit =================================================================== XMPlay 3.3.0.4 and lower experiance a stack-bas...

Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation (1)

Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation 1 source: https://www.securityfocus.com/bid/20471/info The Netscape Portable Runtime API running on Sun Solaris 10 operating system is prone to a local privilege-escalation vulnerability. A successful exploit of this iss...

Squirrelcart 2.2.0 - cart_content.php Remote File Inclusion

Squirrelcart 2.2.0 - cartcontent.php Remote File Inclusion Title : Squirrelcart = 2.2.0 Remote File Inclusion URL : http://www.ldev.com/ google Dork : inurl:/squirrelcart/ Author : OLiBekaS greetz : Skulmatic, weleh, brokencode, bigmaster and all papmahackerlink crew Exploit :...

Microsoft Windows XP2003 - Metafile Escape() Code Execution (Metasploit)

Microsoft Windows XP2003 - Metafile Escape Code Execution Metasploit This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the cor...

FileSeek CGI Script - Remote Command Execution

FileSeek CGI Script - Remote Command Execution source: https://www.securityfocus.com/bid/6783/info FileSeek is an example cgi-script from "The CGI/Perl Cookbook from John Wiley & Sons". The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web...

Cyberoam Authentication Client 2.1.2.7 - Buffer Overflow (SEH)

Cyberoam Authentication Client 2.1.2.7 - Buffer Overflow SEH Exploit Title: Cyberoam Authentication Client 2.1.2.7 - Buffer Overflow SEH Date: 2020-02-28 Exploit Author: Andrey Stoykov Version: Cyberoam General Authentication Client 2.1.2.7 Tested on: Windows Vista SP2 x86 Steps to Reproduce: 1 R...

Smartwares HOME easy 1.0.9 - Database Backup Information Disclosure

Smartwares HOME easy 1.0.9 - Database Backup Information Disclosure Title: Smartwares HOME easy 1.0.9 - Database Backup Information Disclosure Author: LiquidWorm Date: 2019-11-05 Vendor: Smartwares Product web page: https://www.smartwares.eu Affected version: =1.0.9 Advisory ID: ZSL-2019-5541...

Gila CMS 1.11.1 - Local File Inclusion

Gila CMS 1.11.1 - Local File Inclusion Exploit Title: Authenticated Local File InclusionLFI in GilaCMS Google Dork: N/A Date: 04-08-2019 Exploit Author: Sainadh Jamalpur Vendor Homepage: https://github.com/GilaCMS/gila Software Link: https://github.com/GilaCMS/gila Version: 1.10.9 Tested on: XAMP...

Ovidentia 8.4.3 - Cross-Site Scripting

Ovidentia 8.4.3 - Cross-Site Scripting ------------------------------------------------------- Exploit Title: Ovidentia CMS - XSS Ovidentia 8.4.3 Description: The vulnerability permits any kind of XSS attacks. Reflected, DOM and Stored XSS. Date: 06/05/2019 CVE: CVE-2019-13977 Exploit Author:...

CleverDog Smart Camera DOG-2W DOG-2W-V4 - Multiple Vulnerabilities

CleverDog Smart Camera DOG-2W DOG-2W-V4 - Multiple Vulnerabilities 1. Advisory Information ======================================== Title: Clever Dog Smart Camera Vendor Homepage: http://www.cleverdog.com.cn/ Tested on Camera types : DOG-2W, DOG-2W-V4 Vulnerability: Hardware- Multiple...

FusionPBX 4.4.3 - Remote Command Execution

FusionPBX 4.4.3 - Remote Command Execution Exploit Title: FusionPBX = 4.4.3 Command Injection RCE via XSS Date: 06-11-2019 Exploit Author: Dustin Cobb Vendor Homepage: https://www.fusionpbx.com Software Link: https://https://github.com/fusionpbx/fusionpbx Version: = 4.4.3 Tested on: Debian 8.11 C...

Nvidia GeForce Experience Web Helper - Command Injection

Nvidia GeForce Experience Web Helper - Command Injection //Send request to local GFE server function submitRequestport,secret var xhr = new XMLHttpRequest; xhr.open"POST", "http://127.0.0.1:"+port+"/gfeupdate/autoGFEInstall/", true; xhr.setRequestHeader"Accept",...

Microsoft Windows (x86) - Task Scheduler .job Import Arbitrary Discretionary Access Control List Write Local Privilege Escalation

Microsoft Windows x86 - Task Scheduler .job Import Arbitrary Discretionary Access Control List Write Local Privilege Escalation Task Scheduler .job import arbitrary DACL write Tested on: Windows 10 32-bit Bug information: There are two folders for tasks. c:\windows\tasks c:\windows\system32\tasks...

SpiderMonkey - IonMonkey Compiled Code Fails to Update Inferred Property Types (Type Confusion)

SpiderMonkey - IonMonkey Compiled Code Fails to Update Inferred Property Types Type Confusion A bug in IonMonkey leaves type inference information inconsistent, which in turn allows the compilation of JITed functions that cause type confusions between arbitrary objects. Prerequisites In...

DomainMOD 4.11.01 - ssl-accounts.php username Cross-Site Scripting

DomainMOD 4.11.01 - ssl-accounts.php username Cross-Site Scripting Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting Date: 2018-11-22 Exploit Author: Mohammed Abdul Raheem Vendor Homepage: domainmod https://domainmod.org/ Software Link: domainmod https://github.com/DomainMod/DomainMod...

Coship Wireless Router 4.0.0.48 4.0.0.40 5.0.0.54 5.0.0.55 10.0.0.49 - Unauthenticated Admin Password Reset

Coship Wireless Router 4.0.0.48 4.0.0.40 5.0.0.54 5.0.0.55 10.0.0.49 - Unauthenticated Admin Password Reset history.pushState'', '', '/'...

IBM Operational Decision Manager 8.x - XML External Entity Injection

IBM Operational Decision Manager 8.x - XML External Entity Injection Exploit Title: XML External Entity Injection XXE Date: 2018-12-18 Exploit Author: Mohamed M.Fouad - From SecureMisr Company Vendor Homepage: https://www-01.ibm.com/support/docview.wss?uid=ibm10744149 Version: v8.6 - v8.7 - v8.8 ...

DomainMOD 4.11.01 - Custom Domain Fields Cross-Site Scripting

DomainMOD 4.11.01 - Custom Domain Fields Cross-Site Scripting Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting Date: 2018-11-22 Exploit Author: Mohammed Abdul Raheem Vendor Homepage: domainmod https://domainmod.org/ Software Link: domainmod https://github.com/domainmod/domainmod Version:...

Imperva SecureSphere 13 - Remote Command Execution

Imperva SecureSphere 13 - Remote Command Execution Title: Imperva SecureSphere 13 - Remote Command Execution Author: rsp3ar Date: 2018-10-08 Vendor: https://www.imperva.com/products/securesphere/ CVE: N/A Version: 13.0.10, 13.1.10, 13.2.10 Tested on: SecureSphere Virtual Appliance Description PWS...