Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers

Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers Inductive Automation Ignition 7.8.1 Remote Leakage Of Shared Buffers Vendor: Inductive Automation Product web page: http://www.inductiveautomation.com Affected version: 7.8.1 b2016012216 and 7.8.0 b2015101414 Platform: Java...

Linux Kernel 4.4.1 - REFCOUNT Overflow Use-After-Free in Keyrings Local Privilege Escalation (1)

Linux Kernel 4.4.1 - REFCOUNT Overflow Use-After-Free in Keyrings Local Privilege Escalation 1 / Exploit Title: Linux kernel REFCOUNT overflow/Use-After-Free in keyrings Date: 19/1/2016 Exploit Author: Perception Point Team CVE : CVE-2016-0728 / / $ gcc cve20160728.c -o cve20160728 -lkeyutils -Wa...

ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal

ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal Exploit Title: ManageEngine ServiceDesk Plus Product Description ------------------- ServiceDesk Plus is an ITIL ready IT help desk software for organizations of all sizes. With advanced ITSM functionality and easy-to-use...

WordPress Plugin Simple Ads Manager - Information Disclosure

WordPress Plugin Simple Ads Manager - Information Disclosure Vulnerability title: Wordpress plugin Simple Ads Manager - Information Disclosure Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 and 2.5.96 Downlo...

WordPress Plugin Marketplace 2.4.0 - Arbitrary File Download

WordPress Plugin Marketplace 2.4.0 - Arbitrary File Download Exploit Title: WP Marketplace 2.4.0 Arbitrary File Download Date: 26-10-2014 Software Link: https://wordpress.org/plugins/wpmarketplace/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...

phpMyAdmin 4.0.x4.1.x4.2.x - Denial of Service

phpMyAdmin 4.0.x4.1.x4.2.x - Denial of Service ============= DESCRIPTION: ============= A vulnerability present in in phpMyAdmin 4.0.x before 4.0.10.7, 4.1. x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service resource consumption via a long password...

Aireplay-ng 1.2 beta3 - tcp_test Length Stack Overflow

Aireplay-ng 1.2 beta3 - tcptest Length Stack Overflow / Exploit Title: Aireplay "tcptest" Length Parameter Inconsistency Date: 10/3/2014 Exploit Author: Nick Sampanis Vendor Homepage: http://www.aircrack-ng.org/ Version: Aireplay-ng 1.2 beta3 Tested on: Kali Linux 1.0.9 x64 CVE : CVE-2014-8322...

Bosch Security Systems DVR 630650670 Series - Multiple Vulnerabilities

Bosch Security Systems DVR 630650670 Series - Multiple Vulnerabilities :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2014-10-01 Bosch Security Systems DVR 630/650/670 Series...

Yealink VoIP Phone SIP-T38G - Default Credentials

Yealink VoIP Phone SIP-T38G - Default Credentials Title: Yealink VoIP Phone SIP-T38G Default Credentials Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5755 Description: Web interface use...

Yealink VoIP Phone SIP-T38G - Privilege Escalation

Yealink VoIP Phone SIP-T38G - Privilege Escalation Title: Yealink VoIP Phone SIP-T38G Privileges Escalation Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5759 Description: Using the fact...

Apache + PHP 5.3.12 5.4.2 - Remote Code Execution + Scanner

Apache + PHP 5.3.12 5.4.2 - Remote Code Execution + Scanner !/usr/bin/env python ap-unlock-v1337.py - apache + php 5. rem0te c0de execution exploit NOTE: - quick'n'dirty VERY UGLYY C=000DEEE IZ N0T MY STYLE : - for connect back shell start netcat/nc and bind port on given host:port - is ip-range...

Tri-PLC Nano-10 r81 - Denial of Service

Tri-PLC Nano-10 r81 - Denial of Service Exploit Title: Tri-PLC Nano-10 DoS Date: 07/11/2013 Exploit Author: Sapling Vendor Homepage: www.tri-plc.com Version: Firmware Version r81 and prior CVE : CVE-2013-2784 ICSA: ICSA-13-189-02 / The vulnerability exists due to a flaw in the PLC's ability to...

Cisco ASA 8.4.4.6 8.2.5.32 - Ethernet Information Leak

Cisco ASA 8.4.4.6 8.2.5.32 - Ethernet Information Leak !/usr/bin/env python CVE-2003-0001 'Etherleak' exploit ================================= Exploit for hosts which use a network device driver that pads ethernet frames with data which vary from one packet to another, likely taken from kernel...

PHP-Fusion 7.02.05 - Multiple Vulnerabilities

PHP-Fusion 7.02.05 - Multiple Vulnerabilities waraxe-2013-SA097 - Multiple Vulnerabilities in PHP-Fusion 7.02.05 =============================================================================== Author: Janek Vind "waraxe" Date: 27. February 2013 Location: Estonia, Tartu Web:...

Bitweaver 2.8.1 - Multiple Vulnerabilities

Bitweaver 2.8.1 - Multiple Vulnerabilities Trustwave SpiderLabs Security Advisory TWSL2012-016: Multiple Vulnerabilities in Bitweaver Published: 10/23/2012 Version: 1.0 Vendor: Bitweaver http://www.bitweaver.org/ Product: Bitweaver Version affected: 2.8.1 and earlier versions Product description:...

SugarCRM CE 6.3.1 - Unserialize() PHP Code Execution

SugarCRM CE 6.3.1 - Unserialize PHP Code Execution populateFromArrayunserializebase64decode$query; include/generic/Save2.php:197: $currentquerybypagearray = unserializebase64decode$currentquerybypage; include/MVC/Controller/SugarController.php:593: $REQUEST =...

e-ticketing - SQL Injection

e-ticketing - SQL Injection 'e-ticketing' SQL Injection CVE-2012-1673 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in loginscript.php that allows for SQL injection of the 'username' and 'password' POST parameters. II. TEST...

Linux Kernel 2.6.36 IGMP - Remote Denial of Service

Linux Kernel 2.6.36 IGMP - Remote Denial of Service / linux-undeadattack.c Linux IGMP Remote Denial Of Service Introduced in linux-2.6.36 CVE-2012-0207 credits to Ben Hutchings: http://womble.decadent.org.uk/blog/igmp-denial-of-service-in-linux-cve-2012-0207.html written By Kingcope Year 2012...

Omnidocs - Multiple Vulnerabilities

Omnidocs - Multiple Vulnerabilities -------------------------------------------------------------------- Exploit Title: Multiple Vulnerability in "Omnidocs" Date: 24 Sep 2011 Author: Sohil Garg Software Link: http://www.newgensoft.com/omnidocs.asp Version: All Tested on: Apache-Coyote/1.1 CVE :...

Willscript Recipes Website Script Silver Edition - viewRecipe.php SQL Injection

Willscript Recipes Website Script Silver Edition - viewRecipe.php SQL Injection source: https://www.securityfocus.com/bid/48878/info Willscript Recipes website Script Silver Edition is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before usin...

Microsoft Windows XP - WmiTraceMessageVa Integer Truncation (PoC) (MS11-011)

Microsoft Windows XP - WmiTraceMessageVa Integer Truncation PoC MS11-011 / Exploit Title: MS11-011CVE-2011-0045: MS Windows XP WmiTraceMessageVa Integer Truncation Vulnerability PoC Date: 2011-03-01 Author: Nikita Tarakanov CISS Research Team Software Link: Version: prior to MS11-011 Tested on: W...

Linux Kernel 2.6.36-rc6 (RedHat Ubuntu 10.04) - pktcdvd Kernel Memory Disclosure

Linux Kernel 2.6.36-rc6 RedHat Ubuntu 10.04 - pktcdvd Kernel Memory Disclosure / cve-2010-3437.c Linux Kernel http://jon.oberheide.org Information: https://bugzilla.redhat.com/showbug.cgi?id=638085 The PKTCTRLCMDSTATUS device ioctl retrieves a pointer to a pktcdvddevice from the global pktdevs...

JaMP Player 4.2.2.0 - Denial of Service

JaMP Player 4.2.2.0 - Denial of Service Exploit Title: JaMP Player v4.2.2.0 .m3u DoS Date: 12 / 8 / 2010 Author: Oh Yaw Theng Software Link: http://www.topdownloads.net/software/jamp-player2219088.html?hl=&ia=0 Version: v4.2.2.0 Tested on: Windows XP SP 2 CVE : N / A !/usr/bin/python filename =...

Eyeland Studio Inc. - SQL Injection

Eyeland Studio Inc. - SQL Injection Title: Eyeland Studio Inc. SQL Injection Vulnerability Version: 2.0 Author: Mr.P3rfekT Software Site:http://www.eyeland.com/ Tested on Lunix CVE : N/A Home :www.realmadridsy.com & www.v4-team.com/cc Founded By Mr.P3rfekT Dork :"Eyeland Studio Inc. All Rights...

Modelbook - casting_view.php SQL Injection

Modelbook - castingview.php SQL Injection / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...

Blender 2.342.35a2.42.49b - .blend Command Injection

Blender 2.342.35a2.42.49b - .blend Command Injection -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Blender .blend Project Arbitrary Command Execution 1. Advisory Information Title: Blender .blend Project Arbitrar...

IPSwitch IMAP Server 9.20 - Remote Buffer Overflow

IPSwitch IMAP Server 9.20 - Remote Buffer Overflow / Ipsbitch.cpp vs Ipswitch IMAP Tested on: Windows 2000 SP4 Ref: CVE-2007-2795 Author: Dominic Chell Found this half written on a VM so decided to finish it. Payload adds a local admin account USER=r00t PASS=r00tr00t!! / include "stdafx.h" includ...

Linux Kernel 2.6.19 (x86x64) - udp_sendmsg Local Privilege Escalation (2)

Linux Kernel 2.6.19 x86x64 - udpsendmsg Local Privilege Escalation 2 / second verse, same as the first CVE-2009-2698 udpsendmsg, x86/x64 Cheers to Julien/Tavis for the bug, p0c73n1 for just throwing code at NULL and finding it executed This exploit is a bit more nuanced and thoughtful ; use...

Silentum Guestbook 2.0.2 - silentum_Guestbook.php SQL Injection

Silentum Guestbook 2.0.2 - silentumGuestbook.php SQL Injection Silentum Guestbook v2.0.2 silentumguestbook.php Sql Injection Vuln. Yazar: Bgh7 Turk Bilisim Gucleri Group / Ihlilal Hatti ByBgh7amsn.com Http://Bgh7.Blogspot.Com Bug: Sql Injection Ä°ndir/Download:...

Multiple Browsers - Denial of Service

Multiple Browsers - Denial of Service One bug to rule them all IE5,IE6,IE7,IE8,Netscape,Firefox,Safari,Opera,Konqueror, Seamonkey,Wii,PS3,iPhone,iPod,Nokia,Siemens.... and more. Don't wet your pants - it's DoS only Release mode: Tried hard to coordinate - gave up Reference : GSEC-TZO-26-2009 - On...

HP Multiple LaserJet Printer - Cross-Site Scripting

HP Multiple LaserJet Printer - Cross-Site Scripting Digital Security Research Group DSecRG Advisory DSECRG-09-048 http://dsecrg.ru/pages/vul/show.php?id=148 Application: HP LaserJet printer web interface Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others Vendor URL: http://www.hp.com...

Microsoft Office - Communicator SIP Remote Denial of Service

Microsoft Office - Communicator SIP Remote Denial of Service !usr/bin/perl -w Microsoft Communicator allows remote attackers to cause a denial of service memory consumption via a large number of SIP INVITE requests, which trigger the creation of many sessions. Refer:...

ParsBlogger - links.asp SQL Injection

ParsBlogger - links.asp SQL Injection || | | ParsBlogger links.asp id Remote SQL Injection Vulnerability | | |-------------------- Hussin X -------------------| | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | | email: darkangelg85atYahooDoTcom | | | | | | script :...

Smoothflash - cid SQL Injection

Smoothflash - cid SQL Injection Powered by Smoothflash SQL injection Powered by Newartonline AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 BLOG : http://my.opera.com/SQL-Injection/blog/ MAiL : [email protected] DORK 1 : "Powered by Smoothflash" DORK 2 : allinurl:...

X-Cart - Multiple Remote File Inclusions

X-Cart - Multiple Remote File Inclusions xCart Remote file inclusion Download script : http://www.x-cart.com// Discovered By : aLiiF a.k.a arif @debuteam 07/09/2007 HomePage : http://www.debuteam.net// Thx to : Debu Newbie Payment Yogac nyubi Rozi ^S0ng0ku^ Kuris Sonix Toxicity newbi3 R4yn4ld0...

PHP 4.4.75.2.3 - MySQLMySQLi Safe_Mode Bypass

PHP 4.4.75.2.3 - MySQLMySQLi SafeMode Bypass Affected Products: Philip Olausson Reported: 2007-06-05 Released: 2007-08-30 CVE: CVE-2007-3997 Issue: A vulnerability exists in PHP's MySQL and MySQLi extenstions which can be used to bypass PHP's safemode security restriction. Description: PHP is a...

WEBInsta MM 1.3e - absolute_path Remote File Inclusion

WEBInsta MM 1.3e - absolutepath Remote File Inclusion WEBInsta Mailing List Manager = 1.3e initdb.php Remote File Include Exploit function milw0rm if document.exploit.target.value=="" alert"Enter a Target"; return false; exploit.action= document.exploit.target.value;...

Microsoft Windows Media Player 10 - Plugin Overflow (MS06-006)

Microsoft Windows Media Player 10 - Plugin Overflow MS06-006 WMP Plugin EMBED Exploit // Windows Media Player Plug-In EMBED Overflow Universal Exploit MS06-006 // By Matthew Murphy [email protected] // // DISCLAIMER: // // This exploit code is intended only as a demonstration tool for //...

Microsoft Windows - CSRSS Privilege Escalation (MS05-018)

Microsoft Windows - CSRSS Privilege Escalation MS05-018 include include include pragma comment lib,"Advapi32.lib" typedef struct CONSOLESTATEINFO / 0x00 / DWORD cbSize; / 0x04 / COORD ScreenBufferSize; / 0x08 / COORD WindowSize; / 0x0c / POINT WindowPosition; / 0x14 / COORD FontSize; / 0x18 / DWO...

LHA 1.x - Remote Buffer Overflow Directory Traversal

LHA 1.x - Remote Buffer Overflow Directory Traversal // source: https://www.securityfocus.com/bid/10243/info LHA has been reported prone to multiple vulnerabilities that may allow a malicious archive to execute arbitrary code or corrupt arbitrary files when the archive is operated on. The first...

Samba 2.2.8 (LinuxBSD) - Remote Code Execution

Samba 2.2.8 LinuxBSD - Remote Code Execution / Remote root exploit for Samba 2.2.x and prior that works against Linux all distributions, FreeBSD 4.x, 5.x, NetBSD 1.x and OpenBSD 2.x, 3.x and 3.2 non-executable stack. sambal.c is able to identify samba boxes. It will send a netbios name packet to...

Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure

Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure Exploit Title: Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure Author: Todor Donev Date: 2020-02-23 Vendor: https://acesecurity.jp Product Link: https://acesecurity.jp/support/top/wipseries/wip-90113 CVE: N/A...

Bash 5.0 Patch 11 - SUID Priv Drop Exploit

Bash 5.0 Patch 11 - SUID Priv Drop Exploit Exploit Title : Bash 5.0 Patch 11 - SUID Priv Drop Exploit Date : 2019-11-29 Original Author: Ian Pudney , Chet Ramey Exploit Author : Mohin Paramasivam Shad0wQu35t Version : pwn.c cat pwn.c include...

macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common()

macOS XNU - Missing Locking in checkdirscallback Enables Race with fchdircommon On macOS, when a new mount point is created, the kernel uses checkdirs to, as a comment above the function explains: "Scan all active processes to see if any of them have a current or root directory onto which the new...

Mitsubishi Electric smartRTU INEA ME-RTU - Unauthenticated Configuration Download

Mitsubishi Electric smartRTU INEA ME-RTU - Unauthenticated Configuration Download !/usr/bin/python Exploit Title: Mitsubishi Electric smartRTU & INEA ME-RTU Unauthenticated Configuration Download Date: 29 June 2019 Exploit Author: @xerubus | mogozobo.com Vendor Homepage:...

Moodle Jmol Filter 6.1 - Directory Traversal Cross-Site Scripting

Moodle Jmol Filter 6.1 - Directory Traversal Cross-Site Scripting Exploit Title: Moodle filterjmol multiple vulnerabilities Directory Traversal and XSS Date: 20 May 2019 Exploit Author: Dionach Ltd Exploit Author Homepage: https://www.dionach.com/blog/moodle-jmol-plugin-multiple-vulnerabilities...

Avast Anti-Virus 19.1.2360 - Local Credentials Disclosure

Avast Anti-Virus 19.1.2360 - Local Credentials Disclosure Exploit Title: Avast Anti-Virus Local Credentials Disclosure 19.1.2360 Date: 01/18/2019 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Version: before 19.1.2360 build 19.1.4142.0 Tested on: Windows 10 x64 CVE: CVE-2018-12572...

BEWARD N100 H.264 VGA IP Camera M2.1.6 - Remote Code Execution

BEWARD N100 H.264 VGA IP Camera M2.1.6 - Remote Code Execution BEWARD N100 H.264 VGA IP Camera M2.1.6 Root Remote Code Execution Vendor: Beward R&D Co., Ltd Product web page: https://www.beward.net Affected version: M2.1.6.04C014 Summary: The N100 compact color IP camera with support for a more...

Rundeck Community Edition 3.0.13 - Persistent Cross-Site Scripting

Rundeck Community Edition 3.0.13 - Persistent Cross-Site Scripting Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact:...

NTPsec 1.1.2 - ntp_control (Authenticated) NULL Pointer Dereference (PoC)

NTPsec 1.1.2 - ntpcontrol Authenticated NULL Pointer Dereference PoC !/usr/bin/env python Exploit Title: ntpsec 1.1.2 authenticated NULL pointer exception Proof of concept Bug Discovery: Magnus Klaaborg Stubman @magnusstubman Exploit Author: Magnus Klaaborg Stubman @magnusstubman Website:...