Joomla! Component Portfolio Gallery 1.0.6 - SQL Injection

Joomla! Component Portfolio Gallery 1.0.6 - SQL Injection Title: Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Joomla extension v1.0.6 Author: Larry W. Cashdollar, @larry0 Date: 2016-09-16 Download Site: http://huge-it.com/joomla-portfolio-gallery/ Vendor: huge-it.com Vendor Notified...

OpenCart 2.1.0.2 2.2.0.0 - json_decode Function Remote Code Execution

OpenCart 2.1.0.2 2.2.0.0 - jsondecode Function Remote Code Execution OpenCart jsondecode function Remote PHP Code Execution Author: Naser Farhadi Twitter: @naserfarhadi Date: 9 April 2016 Version: 2.1.0.2 to 2.2.0.0 Latest version Vendor Homepage: http://www.opencart.com/ Vulnerability:...

Linux Kernel 3.10.0 (CentOS RHEL 7.1) - aiptek Nullpointer Dereference

Linux Kernel 3.10.0 CentOS RHEL 7.1 - aiptek Nullpointer Dereference OS-S Security Advisory 2016-05 Linux aiptek Nullpointer Dereference Date: March 4th, 2016 Authors: Sergej Schumilo, Hendrik Schwartke, Ralf Spenneberg CVE: CVE-2015-7515 CVSS: 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Title: Local RedHat...

Joomla! 3.2.x 3.4.4 - SQL Injection

Joomla! 3.2.x 3.4.4 - SQL Injection --==Mannu joomla SQL Injection exploiter by Team Indishell==-- body font-family: Tahoma; color: white; background: 444444; input border : solid 2px ; border-color : black; BACKGROUND-COLOR: 444444; font: 8pt Verdana; color: white; submit BORDER: buttonhighlight...

PHP 5.5.9 - zend_executor_globals CGIMode FPM WriteProcMemFile Disable Functions Bypass Load Dynamic Library

PHP 5.5.9 - zendexecutorglobals CGIMode FPM WriteProcMemFile Disable Functions Bypass Load Dynamic Library ?php // EDB Note: Paper https://www.exploit-db.com/docs/english/38104-shoot-zendexecutorglobals-to-bypass-php-disablefunctions.pdf errorreporting0x66778899; settimelimit0x41424344;...

Moodle 2.5.92.6.82.7.52.8.3 - Block Title Handler Cross-Site Scripting

Moodle 2.5.92.6.82.7.52.8.3 - Block Title Handler Cross-Site Scripting Moodle 2.5.9/2.6.8/2.7.5/2.8.3 Block Title Handler Cross-Site Scripting Vendor: Moodle Pty Ltd Product web page: https://www.moodle.org Affected version: 2.8.3, 2.7.5, 2.6.8 and 2.5.9 Summary: Moodle is a learning platform...

Gitlist-0.4.0

Date: 06/20/2014 Vendor Homepage: http://gitlist.org/ Software link: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz Fixed in: 0.5.0 Tested on: Debian 7 More information: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/ from commands import getoutput import urllib import sys """ Exploi...

Varnish Cache CLI Interface - Remote Code Execution (Metasploit)

Varnish Cache CLI Interface - Remote Code Execution Metasploit This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Varnish Cache CLI Interface Bruteforce Utility', 'Description' = 'This...

WordPress 4.0 - Denial of Service

WordPress 4.0 - Denial of Service $argv2, 'pwd' = strrepeat"A",1000000, 'redirectto' = $argv1 . "/wp-admin/", 'reauth' = 1, 'testcookie' = '1', 'wp-submit' = "Log%20In"; $cookieFiles = "cookie.txt"; curlsetoptarray$ch, array CURLOPTHEADER = 1, CURLOPTUSERAGENT = "Mozilla/5.0 Windows; U; Windows N...

Pimcore CMS 1.4.9 2.1.0 - Multiple Vulnerabilities

Pimcore CMS 1.4.9 2.1.0 - Multiple Vulnerabilities Vulnerabilities in Pimcore 1.4.9 to 2.1.0 inclusive Discovered by Pedro Ribeiro [email protected] of Agile Information Security ==================================================================== Disclosure: 14/04/2014 / Last updated: 12/10/2014...

WordPress Plugin ShortCode 0.2.3 - Local File Inclusion

WordPress Plugin ShortCode 0.2.3 - Local File Inclusion Title : WordPress ShortCode Plugin - Local File Inclusion Vulnerability Severity : High+/Critical Reporters : Mehdi Karout & Christian Galeone Google Dork : inurl:wp/wp-content/force-download.php Plugin Version : 0.2.3 Plugin Name : Download...

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting !/usr/bin/env python ''' Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe...

VMware Virtual Machine Communication Interface (VMCI) - vmci.sys

VMware Virtual Machine Communication Interface VMCI - vmci.sys / CVE-2013-1406 exploitation PoC by Artem Shishkin, Positive Research, Positive Technologies, 02-2013 / void stdcall FireShellDWORD dwSomeParam EscalatePrivilegeshProcessToElevate; // Equate the stack and quit the cycle ifndef AMD64 a...

Cisco DPC2100 - Denial of Service

Cisco DPC2100 - Denial of Service Exploit Title: Cisco DPC2100 Denial of Service Date: 09/01/2010 Author: Daniel Smith Software Link: http://www.cisco.com/ Version: HW:2.1/SW:v2.0.2r1256-060303 Tested on: OSX 10.6/Win7 CVE: CVE-2011-1613 =======================================================...

Linux Kernel 2.6.36 IGMP - Remote Denial of Service

Linux Kernel 2.6.36 IGMP - Remote Denial of Service / linux-undeadattack.c Linux IGMP Remote Denial Of Service Introduced in linux-2.6.36 CVE-2012-0207 credits to Ben Hutchings: http://womble.decadent.org.uk/blog/igmp-denial-of-service-in-linux-cve-2012-0207.html written By Kingcope Year 2012...

Google Android 2.3.5 - PowerVR SGX Driver Information Disclosure

Google Android 2.3.5 - PowerVR SGX Driver Information Disclosure // source: https://www.securityfocus.com/bid/57900/info The PowerVR SGX driver in Android is prone to an information-disclosure vulnerability. Successful exploits allows an attacker to gain access to sensitive information. Informati...

ClanSphere 2010.0 Final - Multiple Vulnerabilities

ClanSphere 2010.0 Final - Multiple Vulnerabilities Vulnerability ID: HTB22694 Reference: http://www.htbridge.ch/advisory/sqlinjectioninclansphere.html Product: CLANSPHERE Vendor: csphere.eu http://www.csphere.eu/ Vulnerable Version: 2010.0 Final Vendor Notification: 02 November 2010 Vulnerability...

Joomla! Component CCBoard 1.2-RC - Multiple Vulnerabilities

Joomla! Component CCBoard 1.2-RC - Multiple Vulnerabilities Exploit Title: Joomla Component comccboard Multiple Vulnerabilities Date: 13 Nov 2010 Author: jdc Category: webapps/0day Version: 1.2-RC Download:...

Camtron CMNC-200 IP Camera - Undocumented Default Accounts

Camtron CMNC-200 IP Camera - Undocumented Default Accounts Finding 4: Undocumented Default Accounts CVE: CVE-2010-4233 The CMNC-200 IP Camera has undocumented default accounts on its Linux operating system. These accounts can be used to login via the cameras telnet interface, which cannot be...

Oracle Solaris - su Crash

Oracle Solaris - su Crash From http://cvs.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/cmd/su/su.c 521 for j = 0; initenvj != 0; j++ 1 522 if initvar = getenvinitenvj 2 ... 535 else 536 var = char 537 mallocstrleninitenvj 3 538 + strleninitvar 539 + 2; 540 void strcpyvar, initenvj; 4 'su'...

Achievo 1.3.4 - Cross-Site Scripting

Achievo 1.3.4 - Cross-Site Scripting Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Achievo 1. Advisory Information Title: Multiple XSS in Achievo Advisory ID: BONSAI-2009-0101 Advisory URL:...

Multiple Browsers - Denial of Service

Multiple Browsers - Denial of Service One bug to rule them all IE5,IE6,IE7,IE8,Netscape,Firefox,Safari,Opera,Konqueror, Seamonkey,Wii,PS3,iPhone,iPod,Nokia,Siemens.... and more. Don't wet your pants - it's DoS only Release mode: Tried hard to coordinate - gave up Reference : GSEC-TZO-26-2009 - On...

WebPhotoPro - Multiple SQL Injections

WebPhotoPro - Multiple SQL Injections source: https://www.securityfocus.com/bid/32829/info WebPhotoPro is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker t...

phpBB Plus 1.53 - phpbb_root_path Remote File Inclusion

phpBB Plus 1.53 - phpbbrootpath Remote File Inclusion AUTHOR = Mehrad Ansari Targhi E-Mail : [email protected] My Yahoo Messenger ID : mehrad1989 Script Download URL : http://www.phpbbplus.net/PhpBBPlus1.53.zip This Is A RFI Bug . This Bug Is In : PHPBBPLUS INSTALLED /language/langgerman/lang...

STPHPLibrary - STPHPLIB_DIR Remote File Inclusion

STPHPLibrary - STPHPLIBDIR Remote File Inclusion ?????????? ??????????????? ??????????????????? ??????????????????????? ?????????????????????????? ?????????????????????????????? ????????????????????????????????? ??????????????????????????????????? ?????????????????????????????????????...

MySQL 4.x5.0 (Windows) - User-Defined Function Command Execution

MySQL 4.x5.0 Windows - User-Defined Function Command Execution -- raptorwinudf.sql - A MySQL UDF backdoor kit for Windows -- Copyright c 2007 Marco Ivaldi -- -- This is a MySQL backdoor kit for Windows based on the UDFs User Defined -- Functions mechanism. Use it to spawn a reverse shell netcat U...

PHPKit 1.6.1 - comment.php SQL Injection

PHPKit 1.6.1 - comment.php SQL Injection source: https://www.securityfocus.com/bid/21962/info PHPKIT is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to...

Mambo Component SMF Forum 1.3.1.3 - Remote File Inclusion

Mambo Component SMF Forum 1.3.1.3 - Remote File Inclusion Joomla-SMF Forum Bridge For Mambo 4.5.3+ And Mambo 4.5.3+ Remote File Inclusion Vulnebrality Discovered by : ASIANEAGLE Remote:Yes Level:High --------------------------------------------------------- Application: SMF Forum 1.3.1.3 Bridge...

Linux Kernel 2.6.13 2.6.17.4 - sys_prctl() Local Privilege Escalation (3)

Linux Kernel 2.6.13 2.6.17.4 - sysprctl Local Privilege Escalation 3 / $Id: raptorprctl.c,v 1.1 2006/07/13 14:21:43 raptor Exp $ raptorprctl.c - Linux 2.6.x suiddumpable vulnerability Copyright c 2006 Marco Ivaldi The suiddumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and...

Mambo Module galleria 1.0b - Remote File Inclusion

Mambo Module galleria 1.0b - Remote File Inclusion Title : galleria = 1.0 Remote File InclusionVulnerability - URL : http://binarydigit.at/ - Author : sikunYuk - Mail : inealatgmail.com - exploit :...

phpBB Knowledge Base 2.0.2 - Mod KB_constants.php Remote File Inclusion

phpBB Knowledge Base 2.0.2 - Mod KBconstants.php Remote File Inclusion source: https://www.securityfocus.com/bid/17763/info Knowledge Base Mod for phpbb is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An...

Microsoft Windows - DTC Remote (MS05-051) (2)

Microsoft Windows - DTC Remote MS05-051 2 / Hard to exploit, isn't it? I have tested it on 10+ box, most of them allocated 0x9X0058 for me, however, I cannot write the pointer to 0x7ffdf020 since the length I can control should be divided exactly by 8 merde, so I choose 0x684191c4. This following...

Microsoft Windows - CSRSS Privilege Escalation (MS05-018)

Microsoft Windows - CSRSS Privilege Escalation MS05-018 include include include pragma comment lib,"Advapi32.lib" typedef struct CONSOLESTATEINFO / 0x00 / DWORD cbSize; / 0x04 / COORD ScreenBufferSize; / 0x08 / COORD WindowSize; / 0x0c / POINT WindowPosition; / 0x14 / COORD FontSize; / 0x18 / DWO...

Microsoft Windows - COM Structured Storage Local (MS05-012)

Microsoft Windows - COM Structured Storage Local MS05-012 // by Cesar Cerrudo - Argeniss - www.argeniss.com // MS05-012 - COM Structured Storage Vulnerability - CAN-2005-0047 Exploit // // More exploits at www.argeniss.com/products.html // // Works on Win2k sp4, WinXP sp2, Win2k3 sp0 // Close all...

MetaCart E-Shop - ProductsByCategory.asp Cross-Site Scripting

MetaCart E-Shop - ProductsByCategory.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/13639/info MetaCart e-Shop is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage...

Libc locale - Local Privilege Escalation (2)

Libc locale - Local Privilege Escalation 2 / source: https://www.securityfocus.com/bid/1634/info ectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems provide...

Cuckoo Clock v5.0 - Buffer Overflow

Cuckoo Clock v5.0 - Buffer Overflow Exploit Title: Cuckoo Clock 5.0 - Buffer Overflow Exploit Author: boku Date: 2020-02-14 Vendor Homepage: https://en.softonic.com/author/pxcompany Software Link: https://en.softonic.com/download/parallaxis-cuckoo-clock/windows/post-download Version: 5.0 Tested O...

Netgear R6400 - Remote Code Execution

Netgear R6400 - Remote Code Execution Exploit Title: Netgear R6400 - Remote Code Execution Date: 2019-12-14 Exploit Author: Kevin Randall CVE: CVE-2016-6277 Vendor Homepage: https://www.netgear.com/ Category: Hardware Version: V1.0.7.21.1.93 PoC !/usr/bin/python import urllib2 IPADDR =...

Adobe Acrobat Reader DC - Heap-Based Memory Corruption due to Malformed TTF Font

Adobe Acrobat Reader DC - Heap-Based Memory Corruption due to Malformed TTF Font We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Windows, when opening a malformed PDF file: --- cut --- First chance exceptions are reported before any...

Bash 5.0 Patch 11 - SUID Priv Drop Exploit

Bash 5.0 Patch 11 - SUID Priv Drop Exploit Exploit Title : Bash 5.0 Patch 11 - SUID Priv Drop Exploit Date : 2019-11-29 Original Author: Ian Pudney , Chet Ramey Exploit Author : Mohin Paramasivam Shad0wQu35t Version : pwn.c cat pwn.c include...

Smartwares HOME easy 1.0.9 - Database Backup Information Disclosure

Smartwares HOME easy 1.0.9 - Database Backup Information Disclosure Title: Smartwares HOME easy 1.0.9 - Database Backup Information Disclosure Author: LiquidWorm Date: 2019-11-05 Vendor: Smartwares Product web page: https://www.smartwares.eu Affected version: =1.0.9 Advisory ID: ZSL-2019-5541...

Gila CMS 1.11.1 - Local File Inclusion

Gila CMS 1.11.1 - Local File Inclusion Exploit Title: Authenticated Local File InclusionLFI in GilaCMS Google Dork: N/A Date: 04-08-2019 Exploit Author: Sainadh Jamalpur Vendor Homepage: https://github.com/GilaCMS/gila Software Link: https://github.com/GilaCMS/gila Version: 1.10.9 Tested on: XAMP...

CISCO Small Business 200 300 500 Switches - Multiple Vulnerabilities

CISCO Small Business 200 300 500 Switches - Multiple Vulnerabilities Exploit Title: CISCO Small Business 200, 300, 500 Switches Multiple Vulnerabilities. Shodan query: /config/logoffpage.html Discovered Date: 07/03/2014 Reported Date: 08/04/2019 Exploit Author: Ramikan Website:...

SeedDMS 5.1.11 - out.UsrMgr.php Cross-Site Scripting

SeedDMS 5.1.11 - out.UsrMgr.php Cross-Site Scripting Exploit Title: Persistent Cross-Site Scripting or Stored XSS in out/out.UsrMgr.php in SeedDMS before 5.1.11 Google Dork: NA Date: 20-June-2019 Exploit Author: Nimit Jainhttps://secfolks.blogspot.com Vendor Homepage: https://www.seeddms.org...

Thunderbird ESR 60.7.XXX - Type Confusion

Thunderbird ESR 60.7.XXX - Type Confusion -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 X41 D-Sec GmbH Security Advisory: X41-2019-004 Type confusion in Thunderbird ============================= Severity Rating: Medium Confirmed Affected Versions: All versions affected Confirmed Patched Version...

Nvidia GeForce Experience Web Helper - Command Injection

Nvidia GeForce Experience Web Helper - Command Injection //Send request to local GFE server function submitRequestport,secret var xhr = new XMLHttpRequest; xhr.open"POST", "http://127.0.0.1:"+port+"/gfeupdate/autoGFEInstall/", true; xhr.setRequestHeader"Accept",...

Deltek Maconomy 2.2.5 - Local File Inclusion

Deltek Maconomy 2.2.5 - Local File Inclusion Exploit Title: Maconomy Erp local file include Date: 22/05/2019 Exploit Author: JameelNabbo Website: jameelnabbo.com Vendor Homepage: https://www.deltek.com Software Link: https://www.deltek.com/en-gb/products/project-erp/maconomy CVE: CVE-2019-12314...

WeChat for Android 7.0.4 - vcodec2_hls_filter Denial of Service

WeChat for Android 7.0.4 - vcodec2hlsfilter Denial of Service Exploit Title: DoS Wechat with an emoji Date: 16-May-2019 Exploit Author: Hong Nhat Pham Vendor Homepage: http://www.tencent.com/en-us/index.html Software Link: https://play.google.com/store/apps/details?id=com.tencent.mm Version: 7.0....

Schneider Electric U.Motion Builder 1.3.4 - track_import_export.php object_id Unauthenticated Command Injection

Schneider Electric U.Motion Builder 1.3.4 - trackimportexport.php objectid Unauthenticated Command Injection RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Schneider Electric U.Motion Builder Vendor URL: www.schneider-electric.com Type: ...

SolarWinds DameWare Mini Remote Control 10.0 - Denial of Service

SolarWinds DameWare Mini Remote Control 10.0 - Denial of Service Vendor: Solarwinds Site Vendor: https://www.dameware.com/ Product: Dameware Mini Remote Control Version: 10.0 x64 Platform: Windows Tested on: Windows 7 SP1 x64 Dscription: The DWRCC executable file is affected by a buffer overflow...