TECO AP-PCLINK 1.094 - .tpc File Handling Buffer Overflow (PoC)

TECO AP-PCLINK 1.094 - .tpc File Handling Buffer Overflow PoC TECO AP-PCLINK 1.094 TPC File Handling Buffer Overflow Vulnerability Vendor: TECO Electric and Machinery Co., Ltd. Product web page: http://www.teco-group.eu Download: http://globalsa.teco.com.tw/supportdownload.aspx?KindID=9 Affected...

ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal

ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal Exploit Title: ManageEngine ServiceDesk Plus Product Description ------------------- ServiceDesk Plus is an ITIL ready IT help desk software for organizations of all sizes. With advanced ITSM functionality and easy-to-use...

FAROL - SQL Injection

FAROL - SQL Injection Exploit Title: Web Application Farol with anauthenticated SQLi injection Date: 2015-09-16 Exploit Author: Thierry Fernandes Faria a.k.a SoiL thierryfariaa at gmail dot com Vendor Homepage:http://www.teiko.com.br/pt/solucoes/infraestrutura-em-ti/farol Version: All CVE :...

Linux Kernel 3.13.0 3.19 (Ubuntu 12.0414.0414.1015.04) - overlayfs Local Privilege Escalation

Linux Kernel 3.13.0 3.19 Ubuntu 12.0414.0414.1015.04 - overlayfs Local Privilege Escalation / Exploit Title: ofs.c - overlayfs local root in ubuntu Date: 2015-06-15 Exploit Author: rebel Version: Ubuntu 12.04, 14.04, 14.10, 15.04 Kernels before 2015-06-15 Tested on: Ubuntu 12.04, 14.04, 14.10,...

Linux Kernel 3.13.0 3.19 (Ubuntu 12.0414.0414.1015.04) - overlayfs Local Privilege Escalation (Access etcshadow)

Linux Kernel 3.13.0 3.19 Ubuntu 12.0414.0414.1015.04 - overlayfs Local Privilege Escalation Access etcshadow The overlayfs filesystem does not correctly check file permissions when creating new files in the upper filesystem directory. This can be exploited by an unprivileged process in kernels wi...

WordPress Plugin Simple Ads Manager - Information Disclosure

WordPress Plugin Simple Ads Manager - Information Disclosure Vulnerability title: Wordpress plugin Simple Ads Manager - Information Disclosure Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 and 2.5.96 Downlo...

Intel Network Adapter Diagnostic Driver - IOCTL Handling

Intel Network Adapter Diagnostic Driver - IOCTL Handling / Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Vendor: Intel Product webpage: http://www.intel.com Affected products: Network Adapter Driver for Windows XP Network Adapter Driver for Windows 7 Network Adapter Driver...

IPUX CL5452CL5132 IP Camera - UltraSVCamX.ocx ActiveX Stack Buffer Overflow

IPUX CL5452CL5132 IP Camera - UltraSVCamX.ocx ActiveX Stack Buffer Overflow IPUX CL5452/CL5132 IP Camera UltraSVCamX.ocx ActiveX Stack Buffer Overflow Vendor: Big Good Holdings Limited | Fitivision Technology Inc. Product web page: http://www.ipux.net | http://www.fitivision.com Affected version:...

InterWorx Control Panel 5.0.13 build 574 - xhr.php?i SQL Injection

InterWorx Control Panel 5.0.13 build 574 - xhr.php?i SQL Injection ================================================= Title: SQL injection in InterWorx Control Panel Product: InterWorx Web Control Panel Vendor: InterWorx LLC Tested Version: 5.0.13 build 574 Vulnerability Type: SQL Injection CWE-89...

Winamp 5.12 - .m3u Local Stack Buffer Overflow

Winamp 5.12 - .m3u Local Stack Buffer Overflow Exploit Title: Winamp 5.12 .m3u stack based buffer overflow Date: 16 June 2013 Exploit Author: superkojiman - http://www.techorganic.com Vendor Homepage: http://www.winamp.com/ Software Link: http://www.oldapps.com/winamp.php?oldwinamp=211 Version:...

Cisco ASA 8.4.4.6 8.2.5.32 - Ethernet Information Leak

Cisco ASA 8.4.4.6 8.2.5.32 - Ethernet Information Leak !/usr/bin/env python CVE-2003-0001 'Etherleak' exploit ================================= Exploit for hosts which use a network device driver that pads ethernet frames with data which vary from one packet to another, likely taken from kernel...

VMware Virtual Machine Communication Interface (VMCI) - vmci.sys

VMware Virtual Machine Communication Interface VMCI - vmci.sys / CVE-2013-1406 exploitation PoC by Artem Shishkin, Positive Research, Positive Technologies, 02-2013 / void stdcall FireShellDWORD dwSomeParam EscalatePrivilegeshProcessToElevate; // Equate the stack and quit the cycle ifndef AMD64 a...

PHP-Fusion 7.02.05 - Multiple Vulnerabilities

PHP-Fusion 7.02.05 - Multiple Vulnerabilities waraxe-2013-SA097 - Multiple Vulnerabilities in PHP-Fusion 7.02.05 =============================================================================== Author: Janek Vind "waraxe" Date: 27. February 2013 Location: Estonia, Tartu Web:...

Centreon Enterprise Server 2.3.3 2.3.9-4 - Blind SQL Injection

Centreon Enterprise Server 2.3.3 2.3.9-4 - Blind SQL Injection !/usr/bin/env python Exploit Title: Centreon 2.3.3 - 2.3.9-4 menuXML.php Blind SQL Injection Exploit Disclosure Date: December 12, 2012 Author: modpr0be @modpr0be Platform: Linux Tested on: Centreon Enterprise Server with Centreon...

vBulletin Yet Another Awards System 4.0.2 - SQL Injection

vBulletin Yet Another Awards System 4.0.2 - SQL Injection Exploit Title: vBulletin Yet Another Awards System 4.0.2 Time Based SQL Injection 0day Google Dork: inurl:awards.php intext:"powered by vbulletin" Date: 29/08/12 Exploit Author: Backsl@sh/Dan Software Link:...

SugarCRM CE 6.3.1 - Unserialize() PHP Code Execution

SugarCRM CE 6.3.1 - Unserialize PHP Code Execution populateFromArrayunserializebase64decode$query; include/generic/Save2.php:197: $currentquerybypagearray = unserializebase64decode$currentquerybypage; include/MVC/Controller/SugarController.php:593: $REQUEST =...

Google Android 2.3.5 - PowerVR SGX Driver Information Disclosure

Google Android 2.3.5 - PowerVR SGX Driver Information Disclosure // source: https://www.securityfocus.com/bid/57900/info The PowerVR SGX driver in Android is prone to an information-disclosure vulnerability. Successful exploits allows an attacker to gain access to sensitive information. Informati...

Adobe Photoshop Elements 8.0 - Multiple Arbitrary Code Execution Vulnerabilities

Adobe Photoshop Elements 8.0 - Multiple Arbitrary Code Execution Vulnerabilities Title: ------ Adobe Photoshop Elements 8.0 Multiple Arbitrary Code Execution Vulnerabilities Vendor: ------- Adobe Systems Inc. http://www.adobe.com Product web page: -----------------...

cubecart 2.0.7 - Multiple Vulnerabilities

cubecart 2.0.7 - Multiple Vulnerabilities Exploit Title: CubeCart 2.0.7 XSS && Remote SQL Injection = Multiple Vulnerabilities Date: June, 14th 2011 GMT +7 Author: Shamus Software Link: http://www.cubecart.com/ Version : CubeCart 2.0.7 Tested on: windows 7, ubuntu 11.04 CVE : -...

PHP 5.3.5 libzip 0.9.3 - _zip_name_locate Null Pointer Dereference

PHP 5.3.5 libzip 0.9.3 - zipnamelocate Null Pointer Dereference Source: http://securityreason.com/securityalert/8146 libzip 0.9.3 zipnamelocate NULL Pointer Dereference incl PHP 5.3.5 Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - Dis.: 03.01.2011 - Pub.:...

Microsoft Windows XP - WmiTraceMessageVa Integer Truncation (PoC) (MS11-011)

Microsoft Windows XP - WmiTraceMessageVa Integer Truncation PoC MS11-011 / Exploit Title: MS11-011CVE-2011-0045: MS Windows XP WmiTraceMessageVa Integer Truncation Vulnerability PoC Date: 2011-03-01 Author: Nikita Tarakanov CISS Research Team Software Link: Version: prior to MS11-011 Tested on: W...

Camtron CMNC-200 IP Camera - Denial of Service

Camtron CMNC-200 IP Camera - Denial of Service Finding 5: Camera Denial of Service CVE: CVE-2010-4234 The CMNC-200 IP Camera has a built-in web server that is vulnerable to denial of service attacks. Sending multiple requests in parallel to the web server may cause the camera to reboot. Requests...

Mozilla Firefox - Simplified Memory Corruption (PoC)

Mozilla Firefox - Simplified Memory Corruption PoC Hi there, For those who still do not know .. The proof of concept that I have extracted for CVE-2010-3765 is the following: function Gstr var cobj=document.createElementstr; document.body.appendChildcobj; cobj.scrollWidth; function crashme...

Linux Kernel 2.6.36-rc6 (RedHat Ubuntu 10.04) - pktcdvd Kernel Memory Disclosure

Linux Kernel 2.6.36-rc6 RedHat Ubuntu 10.04 - pktcdvd Kernel Memory Disclosure / cve-2010-3437.c Linux Kernel http://jon.oberheide.org Information: https://bugzilla.redhat.com/showbug.cgi?id=638085 The PKTCTRLCMDSTATUS device ioctl retrieves a pointer to a pktcdvddevice from the global pktdevs...

Joomla! Component com_dateconverter 0.1 - SQL Injection

Joomla! Component comdateconverter 0.1 - SQL Injection ----------------------------------------------------------------------------------------- Joomla Component comdateconverter SQL Injection Vulnerability -----------------------------------------------------------------------------------------...

Tembria Server Monitor 5.6.0 - Denial of Service

Tembria Server Monitor 5.6.0 - Denial of Service !/usr/bin/python Exploit Title : Tembria Server Monitor 5.6.0 CVE-ID : CVE-2010-1316 Date : April 9, 2010 Author : Lincoln Software Link : http://www.tembria.com/ Version : 5.6.0 OS : Windows Tested on : XP SP3 En VirtualBox Type of vuln : Remote D...

Elkagroup - SQL Injection

Elkagroup - SQL Injection Dork : "powered by: elkagroup" + |SadHaCkEr|\ + ||||\ + ||||""|", + ||||""|"||| + " @''@""""""|@@@ +========================================================================================================================================|| About : elkagroup SQL Injection...

Silentum Guestbook 2.0.2 - silentum_Guestbook.php SQL Injection

Silentum Guestbook 2.0.2 - silentumGuestbook.php SQL Injection Silentum Guestbook v2.0.2 silentumguestbook.php Sql Injection Vuln. Yazar: Bgh7 Turk Bilisim Gucleri Group / Ihlilal Hatti ByBgh7amsn.com Http://Bgh7.Blogspot.Com Bug: Sql Injection Ä°ndir/Download:...

HP Multiple LaserJet Printer - Cross-Site Scripting

HP Multiple LaserJet Printer - Cross-Site Scripting Digital Security Research Group DSecRG Advisory DSECRG-09-048 http://dsecrg.ru/pages/vul/show.php?id=148 Application: HP LaserJet printer web interface Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others Vendor URL: http://www.hp.com...

Apple Safari - RSS feed: Buffer Overflow via libxml2 (PoC)

Apple Safari - RSS feed: Buffer Overflow via libxml2 PoC !/usr/bin/ruby Quick-n-dirty PoC for APPLE-SA-2009-05-12 ala CVE-2008-3529 Safari RSS feed:// buffer overflow via libxml2 by KF of Digitalmunition and Netragard http://www.digitalmunition.com , http://www.netragard.com The application...

Microsoft Office - Communicator SIP Remote Denial of Service

Microsoft Office - Communicator SIP Remote Denial of Service !usr/bin/perl -w Microsoft Communicator allows remote attackers to cause a denial of service memory consumption via a large number of SIP INVITE requests, which trigger the creation of many sessions. Refer:...

NASM 2.0 - ppscan() Off-by-One Buffer Overflow

NASM 2.0 - ppscan Off-by-One Buffer Overflow source: https://www.securityfocus.com/bid/29656/info NASM is prone to an off-by-one buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue will allow...

Smoothflash - cid SQL Injection

Smoothflash - cid SQL Injection Powered by Smoothflash SQL injection Powered by Newartonline AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 BLOG : http://my.opera.com/SQL-Injection/blog/ MAiL : [email protected] DORK 1 : "Powered by Smoothflash" DORK 2 : allinurl:...

Microsoft Windows - DNS DnssrvQuery Remote Stack Overflow

Microsoft Windows - DNS DnssrvQuery Remote Stack Overflow / Copyright c 2007 devcode ^^ D E V C O D E ^^ Windows DNS DnssrvQuery Stack Overflow CVE-2007-1748 Description: A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable...

PHP-Nuke - iframe.php Remote File Inclusion

PHP-Nuke - iframe.php Remote File Inclusion iFRAME for PhpNuke iframe.php Remote File Include Vulnerabilities script :http://www.desarrollonuke.org http://up.9q9q.net/up/index.php?f=uTRRQnIjG file : iframe.php Dork : "/nuke/iframe.php" Found by & Contact : Cold z3ro , [email protected] ,...

3Com TFTP Service (3CTftpSvc) 2.0.1 - Remote Buffer Overflow (Metasploit)

3Com TFTP Service 3CTftpSvc 2.0.1 - Remote Buffer Overflow Metasploit package Msf::Exploit::3comtftplongmode; use strict; use base "Msf::Exploit"; use Pex::Text; use IO::Socket; my $advanced = ; my $info = 'Name' = 'TFTP Server 3CTftpSvc Buffer Overflow Vulnerability', 'Version' = '$ 1.0 $',...

simple file manager 0.24a - Multiple Vulnerabilities

simple file manager 0.24a - Multiple Vulnerabilities /\ | flame vrs Simple File Manager | | http://onedotoh.sourceforge.net/ | | Various Vulnerbilities Including: | / /+++++++++++++++++++++++++++++++++++++++++++\ | Using the scripts supplied by the webapp: | | Reading of Arbitrary files | |...

pandaBB - displayCategory Remote File Inclusion

pandaBB - displayCategory Remote File Inclusion ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::: :+: :+: :+: :+: +:+:+: :+:+:+ +:+ +:+ +:+ +:+ +:+...

Ractive Popper 1.41 - Childwindow.Inc.php Remote File Inclusion

Ractive Popper 1.41 - Childwindow.Inc.php Remote File Inclusion source: https://www.securityfocus.com/bid/19972/info Ractive Popper is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to...

Linux Kernel 2.6.13 2.6.17.4 - sys_prctl() Local Privilege Escalation (1)

Linux Kernel 2.6.13 2.6.17.4 - sysprctl Local Privilege Escalation 1 // / Local r00t Exploit for: / / Linux Kernel PRCTL Core Dump Handling / / BID 18874 / CVE-2006-2451 / / Kernel 2.6.x = 2.6.13 && main PoC code / / - RoMaNSoFt local root code / / 10.Jul.2006 / // include include include include...

MetaCart E-Shop - ProductsByCategory.asp Cross-Site Scripting

MetaCart E-Shop - ProductsByCategory.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/13639/info MetaCart e-Shop is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage...

Veritas NetBackup - Remote Command Execution (Metasploit)

Veritas NetBackup - Remote Command Execution Metasploit $Id: veritasnetbackupcmdexec.rb 10617 2010-10-09 06:55:52Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

W-Agora 4.1.6 - a redir_url.php?key SQL Injection

W-Agora 4.1.6 - a redirurl.php?key SQL Injection source: https://www.securityfocus.com/bid/11283/info Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to...

Cyberoam Authentication Client 2.1.2.7 - Buffer Overflow (SEH)

Cyberoam Authentication Client 2.1.2.7 - Buffer Overflow SEH Exploit Title: Cyberoam Authentication Client 2.1.2.7 - Buffer Overflow SEH Date: 2020-02-28 Exploit Author: Andrey Stoykov Version: Cyberoam General Authentication Client 2.1.2.7 Tested on: Windows Vista SP2 x86 Steps to Reproduce: 1 R...

Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure

Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure Exploit Title: Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure Author: Todor Donev Date: 2020-02-23 Vendor: https://acesecurity.jp Product Link: https://acesecurity.jp/support/top/wipseries/wip-90113 CVE: N/A...

OpenSMTPD 6.6.2 - Remote Code Execution

OpenSMTPD 6.6.2 - Remote Code Execution Exploit Title: OpenSMTPD 6.6.2 - Remote Code Execution Date: 2020-01-29 Exploit Author: 1F98D Original Author: Qualys Security Advisory Vendor Homepage: https://www.opensmtpd.org/ Software Link: https://github.com/OpenSMTPD/OpenSMTPD/releases/tag/6.6.1p1...

ASTPP 4.0.1 VoIP Billing - Database Backup Download

ASTPP 4.0.1 VoIP Billing - Database Backup Download Exploit Title: ASTPP 4.0.1 VoIP Billing - Database Backup Download Date: 2019-11-18 Exploit Author: Fabien AUNAY Vendor Homepage: https://www.astppbilling.org/ Software Link: https://github.com/iNextrix/ASTPP/tree/v4.0.1 Version: 4.0.1 vendor...

Bash 5.0 Patch 11 - SUID Priv Drop Exploit

Bash 5.0 Patch 11 - SUID Priv Drop Exploit Exploit Title : Bash 5.0 Patch 11 - SUID Priv Drop Exploit Date : 2019-11-29 Original Author: Ian Pudney , Chet Ramey Exploit Author : Mohin Paramasivam Shad0wQu35t Version : pwn.c cat pwn.c include...

WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting

WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting Exploit Title: WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting Google Dork: inurl:/wp-content/themes/zoner/ Date: 2019-09-24 Exploit Author: m0ze Vendor Homepage: https://fruitfulcode.com/ Software...

Canon PRINT 2.5.5 - Information Disclosure

Canon PRINT 2.5.5 - Information Disclosure Exploit Title: Content Provider URI Injection on Canon PRINT 2.5.5 CVE-2019-14339 Date: 24th July, 2019 Exploit Author: 0x48piraj Vendor Homepage:...