jira 4.4.3 greenhopper 5.9.8 - Multiple Vulnerabilities

jira 4.4.3 greenhopper 5.9.8 - Multiple Vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CVE-2012-1500, Stored XSS in JIRA v4.4.3663-r165197, GreenHopper Resolved in Version 5.9.8, Proof of Concept External References: CVE-2112-1500 CVE-2112-1500 XSS.Cx Blog GHS-5642 Reported to...

Slimpdf Reader 1.0 - Memory Corruption

Slimpdf Reader 1.0 - Memory Corruption Exploit Title: Date: June 24 2012 Exploit Author: Carlos Mario Penagos Hollmann Vendor Homepage: www.investintech.com Version:1.0 Tested on: Windows 7 CVE : cve-2011-4220 payload ="A"10000 crash="startxref" pdf=payload+crash filename = "slimpdPoC.pdf" file =...

e-ticketing - SQL Injection

e-ticketing - SQL Injection 'e-ticketing' SQL Injection CVE-2012-1673 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in loginscript.php that allows for SQL injection of the 'username' and 'password' POST parameters. II. TEST...

OpenSSL - Remote Denial of Service

OpenSSL - Remote Denial of Service / hoagieopensslrecordofdeath.c OPENSSL REMOTE DENIAL-OF-SERVICE EXPLOIT - OpenSSL 0.9.8m short = 16 bit - OpenSSL 0.9.8f through 0.9.8m short != 16 bit CVE-2010-0740 Bug discovered by: Bodo Moeller and Adam Langley Google Philip Olausson...

Pligg 9.9.5b - Arbitrary File Upload SQL Injection

Pligg 9.9.5b - Arbitrary File Upload SQL Injection !/usr/bin/perl =about Pligg 9.9.5 Beta Perl exploit AUTHOR discovered & written by Ams ax330d doggy gmail dot com VULN. DESCRIPTION: Vulnerability hides in 'evb/checkurl.php' unfiltered $GET'url' parameter. Actually, it has filtration. Filtration...

Linux Kernel 2.6.13 2.6.17.4 - sys_prctl() Local Privilege Escalation (3)

Linux Kernel 2.6.13 2.6.17.4 - sysprctl Local Privilege Escalation 3 / $Id: raptorprctl.c,v 1.1 2006/07/13 14:21:43 raptor Exp $ raptorprctl.c - Linux 2.6.x suiddumpable vulnerability Copyright c 2006 Marco Ivaldi The suiddumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and...

Sabdrimer PRO 2.2.4 - pluginpath Remote File Inclusion

Sabdrimer PRO 2.2.4 - pluginpath Remote File Inclusion VIRANGAR SECURITY TEAM Discovered By : A.nosrati www.virangar.org Public www.virangar.net Priv8 Mail: infoatvirangar.net Sabdrimer PRO v.2.2.4 Remote File Include Vulnerability Google Dork : "© Sabdrimer CMS" bug found in file : advanced1.php...

Linux Kernel 2.6.x - IPv6 Local Denial of Service

Linux Kernel 2.6.x - IPv6 Local Denial of Service / source: https://www.securityfocus.com/bid/15156/info Linux Kernel is reported prone to a local denial-of-service vulnerability. This issue arises from an infinite loop when binding IPv6 UDP ports. / / Linux kernel IPv6 UDP port selection infinit...

Veritas NetBackup - Remote Command Execution (Metasploit)

Veritas NetBackup - Remote Command Execution Metasploit $Id: veritasnetbackupcmdexec.rb 10617 2010-10-09 06:55:52Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

Gemitel 3.50 - affich.php Remote File Inclusion Command Injection

Gemitel 3.50 - affich.php Remote File Inclusion Command Injection source: https://www.securityfocus.com/bid/10156/info A vulnerability has been identified in the handling of input by Gemitel. Because of this, it may be possible for a remote user to gain unauthorized access to a system using the...

Microsoft Windows NT 4.02000 - NetBIOS Name Conflict

Microsoft Windows NT 4.02000 - NetBIOS Name Conflict source: https://www.securityfocus.com/bid/1514/info An attacker can send the NetBIOS name service a NetBIOS Name Conflict message even when the receiving machine is not in the process of registering its NetBIOS name. The target will then not...

DotNetNuke 9.5 - Persistent Cross-Site Scripting

DotNetNuke 9.5 - Persistent Cross-Site Scripting Exploit Title: DotNetNuke 9.5 - Persistent Cross-Site Scripting Date: 2020-02-23 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link:...

qdPM 9.1 - Remote Code Execution

qdPM 9.1 - Remote Code Execution Exploit Title: qdPM 9.1 - Remote Code Execution Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net Date: 2020-01-22 Exploit Author: Rishal Dwivedi Loginsoft Vendor Homepage: http://qdpm.net/ Software Link: http://qdpm.net/download-qdpm-free-project-managemen...

ManageEngine Desktop Central - FileStorage getChartImage Deserialization Unauthenticated Remote Code Execution

ManageEngine Desktop Central - FileStorage getChartImage Deserialization Unauthenticated Remote Code Execution !/usr/bin/python3 """ ManageEngine Desktop Central FileStorage getChartImage Deserialization of Untrusted Data Remote Code Execution Vulnerability Download:...

Bash 5.0 Patch 11 - SUID Priv Drop Exploit

Bash 5.0 Patch 11 - SUID Priv Drop Exploit Exploit Title : Bash 5.0 Patch 11 - SUID Priv Drop Exploit Date : 2019-11-29 Original Author: Ian Pudney , Chet Ramey Exploit Author : Mohin Paramasivam Shad0wQu35t Version : pwn.c cat pwn.c include...

macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common()

macOS XNU - Missing Locking in checkdirscallback Enables Race with fchdircommon On macOS, when a new mount point is created, the kernel uses checkdirs to, as a comment above the function explains: "Scan all active processes to see if any of them have a current or root directory onto which the new...

Microsoft DirectWrite AFDKO - Stack Corruption in OpenType Font Handling Due to Incorrect Handling of blendArray

Microsoft DirectWrite AFDKO - Stack Corruption in OpenType Font Handling Due to Incorrect Handling of blendArray -----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font...

Sahi pro 7.x8.x - Directory Traversal

Sahi pro 7.x8.x - Directory Traversal Exploit Title: Sahi pro :/s/dyn/Loghighlight?href=../../../../windows/win.ini&n=1selected...

D-Link DWL-2600AP - Multiple OS Command Injection

D-Link DWL-2600AP - Multiple OS Command Injection Document Title: =============== D-Link DWL-2600AP - Authenticated OS Command Injection Restore Configuration Product & Service Introduction: =============================== The D-Link DWL-2600AP has a web interface for configuration. You can use a...

MyBB IP History Logs Plugin 1.0.2 - Cross-Site Scripting

MyBB IP History Logs Plugin 1.0.2 - Cross-Site Scripting Exploit Title: MyBB IP History Logs Plugin 1.0.2 - Cross-Site Scripting Date: 1/25/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=1213 Version: 1.0.2 Tested on:...

Hucart CMS 5.7.4 - Cross-Site Request Forgery (Add Administrator Account)

Hucart CMS 5.7.4 - Cross-Site Request Forgery Add Administrator Account function posturl,fields var p = document.createElement"form"; p.action = url; p.innerHTML = fields; p.target = "self"; p.method = "post"; document.body.appendChildp; p.submit; function csrfhack var fields; fields += ""; field...

DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting

DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting Date: 2018-11-22 Exploit Author: Mohammed Abdul Raheem Vendor Homepage: domainmod https://domainmod.org/ Software Link: domainmod https://github.com/domainmod/domainmod Version:...

Linux Kernel 4.8 (Ubuntu 16.04) - Leak sctp Kernel Pointer

Linux Kernel 4.8 Ubuntu 16.04 - Leak sctp Kernel Pointer / Exploit Title: Linux Kernel 4.8 Ubuntu 16.04 - Leak sctp kernel pointer Google Dork: - Date: 2018-11-20 Exploit Author: Jinbum Park Vendor Homepage: - Software Link: - Version: Linux Kernel 4.8 Ubuntu 16.04 Tested on: 4.8.0-36-generic...

ServersCheck Monitoring Software 14.3.3 - id SQL Injection

ServersCheck Monitoring Software 14.3.3 - id SQL Injection Exploit Title: ServersCheck Monitoring Software 14.3.3 - 'id' SQL Injection Author: John Page aka hyp3rlinx Date: 2018-10-23 Vendor: www.serverscheck.com Software link: http://downloads.serverscheck.com/monitoringsoftware/setup.exe CVE: N...

LG SuperSign EZ CMS 2.5 - Local File Inclusion

LG SuperSign EZ CMS 2.5 - Local File Inclusion Exploit Title: LG SuperSign EZ CMS 2.5 - Local File Inclusion Date: 2018-09-13 Exploit Author: Alejandro Fanjul Vendor Homepage: https://www.lg.com/ar/software-lg-supersign Version: SuperSign EZ CMS Tested on: Web OS 4.0 CVE : CVE-2018-16288 More inf...

D-Link DIR-615 - Denial of Service (PoC)

D-Link DIR-615 - Denial of Service PoC Exploit Title: D-Link DIR-615 - Denial of Service PoC Date: 2018-08-09 Vendor Homepage: http://www.dlink.co.in Hardware Link: https://www.amazon.in/D-Link-DIR-615-Wireless-N300-Router-Black/dp/B0085IATT6 Version: D-Link DIR-615 Category: Hardware Exploit...

ManageEngine ADManager Plus 6.5.7 - HTML Injection

ManageEngine ADManager Plus 6.5.7 - HTML Injection Exploit Title: ManageEngine ADManager Plus 6.5.7 - HTML Injection Date: 2018-08-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/ad-manager/ Software : ZOHO Co...

Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution

Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution !/usr/bin/python -- coding: utf-8 -- from argparse import RawTextHelpFormatter import socket, argparse, subprocess, ssl, os.path HELPMESSAGE = '''...

Schools Alert Management Script - Arbitrary File Read

Schools Alert Management Script - Arbitrary File Read Exploit Title: Schools Alert Management Script - Arbitrary File Read Date: 2018-06-07 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/ Category: Web...

SickRage v2018.03.09 - Clear-Text Credentials HTTP Response

SickRage v2018.03.09 - Clear-Text Credentials HTTP Response Exploit Title: SickRage v2018.03.09 - Clear-Text Credentials HTTP Response Date: 2018-04-01 Exploit Author: Sven Fassbender Vendor Homepage: https://sickrage.github.io Software Link: https://github.com/SickRage/SickRage Version:...

October CMS User Plugin 1.4.5 - Persistent Cross-Site Scripting

October CMS User Plugin 1.4.5 - Persistent Cross-Site Scripting Exploit Title: October CMS User Plugin v1.4.5 - Persistent Cross-Site Scripting Date: 2018-04-03 Author: 0xB9 Software Link: https://octobercms.com/plugin/rainlab-user Version: 1.4.5 Tested on: Ubuntu 17.10 CVE: CVE-2018-10366 1...

Monstra cms 3.0.4 - Persitent Cross-Site Scripting

Monstra cms 3.0.4 - Persitent Cross-Site Scripting Exploit Title: Monstra cms 3.0.4 - Persitent Cross-Site Scripting Date: 2018-04-14 Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra Version: 3.0.4 Tested o...

WolfCMS 0.8.3.1 - Open Redirection

WolfCMS 0.8.3.1 - Open Redirection Exploit Title: WolfCMS 0.8.3.1 Open Redirection Vulnerability Google Dork: N/A Date: 04-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: http://www.wolfcms.org Software Link:...

Joomla! Component Acymailing Starter 5.9.5 - CSV Macro Injection

Joomla! Component Acymailing Starter 5.9.5 - CSV Macro Injection Exploit Title: Joomla! Component Acymailing Starter 5.9.5 CSV Macro Injection Google Dork: N/A Date: 22-03-2018 Exploit Author: Sureshbabu Narvaneni Vendor Homepage: https://www.acyba.com Software Link:...

WordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information Disclosure

WordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information Disclosure Exploit Title: WP Security Audit Log Plugin, Sensitive Information Disclosure CheckDirectory $useruploadpath wpmkdirp $useruploadpath ;...

SEGGER embOSIP FTP Server 3.22 - Denial of Service

SEGGER embOSIP FTP Server 3.22 - Denial of Service + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SEGGER-embOS-FTP-SERVER-v3.22-FTP-COMMANDS-DENIAL-OF-SERVICE.txt + ISR: Apparition Security Vendor: =============...

Parallels Remote Application Server 15.5 - Path Traversal

Parallels Remote Application Server 15.5 - Path Traversal Exploit Title: Parallels Remote Application Server RAS 15.5 Path Traversal Date: 22-02-2018 Exploit Author: Nicolas Markitanis - RUNESEC Reviewers: Simon Loizides and Marios Nicolaides - RUNESEC Vendor Homepage: https://www.parallels.com/...

Joomla! Component InviteX 3.0.5 - invite_type SQL Injection

Joomla! Component InviteX 3.0.5 - invitetype SQL Injection Exploit Title: Joomla! Component InviteX 3.0.5 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://techjoomla.com/ Software Link:...

Flexible Poll 1.2 - SQL Injection

Flexible Poll 1.2 - SQL Injection Exploit Title: Flexible Poll 1.2 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://ddywpro.com/ Software Link: https://codecanyon.net/item/flexible-poll/4363114 Version: 1.2 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: CVE-2018-5988...

Ability Mail Server 3.3.2 - Cross-Site Scripting

Ability Mail Server 3.3.2 - Cross-Site Scripting Exploit Title: Ability Mail Server 3.3.2 Persistent Cross Site Scripting XSS CVE: CVE-2017-17752 Date: 19-12-2017 Software Link: http://download.codecrafters.com/ams3.exe Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr...

Vastal I-Tech Dating Zone 0.9.9 - product_id SQL Injection

Vastal I-Tech Dating Zone 0.9.9 - productid SQL Injection Exploit Title: Vastal I-Tech Dating Zone 0.9.9 - 'productid' Parameter SQL Injection Dork: N/A Date: 30.10.2017 Vendor Homepage: http://vastal.com/ Software http://vastal.com/dating-zone-the-dating-software.html Demo:...

HitmanPro 3.7.15 Build 281 - Kernel Pool Overflow

HitmanPro 3.7.15 Build 281 - Kernel Pool Overflow Exploit-CVE-2017-6008 The CVE-2017-6008 is a vulnerability in the HitmanPro scan that allows privilege escalation by exploiting a kernel pool buffer overflow. The exploits here use the Quota Process Pointer Overwrite attack as described in the...

K7 Total Security 15.1.0.305 - Device Driver Arbitrary Memory Read

K7 Total Security 15.1.0.305 - Device Driver Arbitrary Memory Read Vulnerability Summary The following advisory describes an Crash found in K7 Total Security. Credit An independent security researcher, Kyriakos Economou aka @kyREcon, has reported this vulnerability to Beyond Security’s SecuriTeam...

phpMyFAQ 2.9.8 - Cross-Site Scripting (2)

phpMyFAQ 2.9.8 - Cross-Site Scripting 2 Exploit Title: phpMyFAQ 2.9.8 Stored XSS Vendor Homepage: http://www.phpmyfaq.de/ Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website:...

EPESI 1.8.2 rev20170830 - Cross-Site Scripting

EPESI 1.8.2 rev20170830 - Cross-Site Scripting Exploit Title: Multiple Stored XSS in EPESI Date: 10/03/2017 Exploit Author: Zeeshan Shaikh Vendor Homepage: http://epe.si/ Software Link: http://epe.si/download/ Version: 1.8.2 rev20170830 CVE : CVE-2017-14712 to CVE-2017-14717 Category: webapps XSS...

Microsoft Edge Chakra - Buffer Overflow

Microsoft Edge Chakra - Buffer Overflow sxCall.argCount; //pnode-sxCall.argCount=0xFFFF argCount++; // include "this" //overflow!!!! argCount==0 BOOL fSideEffectArgs = FALSE; unsigned int tmpCount = CountArgumentspnode-sxCall.pnodeArgs, &fSideEffectArgs; AssertargCount == tmpCount; if argCount !=...

AudioCoder 0.8.46 - Local Buffer Overflow (SEH)

AudioCoder 0.8.46 - Local Buffer Overflow SEH !/usr/bin/python Exploit Title : AudioCoder 0.8.46 Local Buffer Overflow SEH CVE : CVE-2017-8870 Exploit Author : Muhann4d @0xSecured Vendor Homepage : http://www.mediacoderhq.com Vulnerable Software:...

Nitro Pro PDF - Multiple Vulnerabilities

Nitro Pro PDF - Multiple Vulnerabilities Vulnerabilities Summary The following advisory describes three vulnerabilities found in Nitro / Nitro Pro PDF. Nitro Pro is the PDF reader and editor that does everything you will ever need to do with PDF files. The powerful but snappy editor lets you chan...

Yaws 1.91 - Remote File Disclosure

Yaws 1.91 - Remote File Disclosure + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/YAWS-WEB-SERVER-v1.91-UNAUTHENTICATED-REMOTE-FILE-DISCLOSURE.txt + ISR: ApparitionSec Vendor: ========== yaws.hyber.org Product: =========...

Sophos XG Firewall 16.05.4 MR-4 - Path Traversal

Sophos XG Firewall 16.05.4 MR-4 - Path Traversal Vulnerabilities Summary The following advisory describe two 2 vulnerabilities, a Path Traversal and a Missing Function Level Access Control, in Sophos XG Firewall 16.05.4 MR-4. Sophos XG Firewall provides “unprecedented visibility into your network...