GNU binutils - bfd_get_string Stack Buffer Overflow

GNU binutils - bfdgetstring Stack Buffer Overflow Source: https://sourceware.org/bugzilla/showbug.cgi?id=21581 I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer. Please find attached the minimized file causing the issue "Input" and the ASAN report log "Output". Below is the...

Sudo 1.8.20 - get_process_ttyname() Local Privilege Escalation

Sudo 1.8.20 - getprocessttyname Local Privilege Escalation / E-DB Note: http://www.openwall.com/lists/oss-security/2017/05/30/16 E-DB Note: http://seclists.org/oss-sec/2017/q2/470 LinuxsudoCVE-2017-1000367.c Copyright C 2017 Qualys, Inc. This program is free software: you can redistribute it and/...

INFOR EAM 11.0 Build 201410 - filtervalue SQL Injection

INFOR EAM 11.0 Build 201410 - filtervalue SQL Injection SQL injection in INFOR EAM V11.0 Build 201410 search fields web/base/.. via filtervalue parameter ------------------- Assigned CVE: CVE-2017-7952 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to any page with ...

Intel Active Management Technology - System Privileges

Intel Active Management Technology - System Privileges !/usr/bin/python -- coding: utf-8 -- Author: Nixawk CVE-2017-5689 = dork="Server: IntelR Active Management Technology" port:"16992", ports= 623, 664, 16992, 16993, 16994, 16995 products= Active Management Technology AMT, Intel Standard...

Admidio 3.2.8 - Cross-Site Request Forgery

Admidio 3.2.8 - Cross-Site Request Forgery Exploit Title :Admidio 3.2.8 CSRF to Delete Users Date: 28/April/2017 Exploit Author: Faiz Ahmed Zaidi Organization: Provensec LLC Website: http://provensec.com/ Vendor Homepage: https://www.admidio.org/ Software Link: https://www.admidio.org/download.ph...

Linux Kernel 3.11 4.8 0 - SO_SNDBUFFORCE SO_RCVBUFFORCE Local Privilege Escalation

Linux Kernel 3.11 4.8 0 - SOSNDBUFFORCE SORCVBUFFORCE Local Privilege Escalation // CAPNETADMIN - root LPE exploit for CVE-2016-9793 // No KASLR, SMEP or SMAP bypass included // Affected kernels: 3.11 - 4.8 // Tested in QEMU only // https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-97...

Fiyo CMS 2.0.6.1 - Privilege Escalation

Fiyo CMS 2.0.6.1 - Privilege Escalation Exploit Title: Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter Google Dork: no Date: 11-03-2017 Exploit Author: @runggareksya, @dvnrcy Vendor Homepage: http://www.fiyo.org Software Link:...

WePresent WiPG-1500 - Backdoor Account

WePresent WiPG-1500 - Backdoor Account Exploit Title: CVE-2017-6351 - WePresent undocumented privileged manufacturer backdoor account Date: 27/02/2017 Exploit Author: Quentin Olagne Vendor Homepage: http://www.wepresentwifi.com/ or http://www.awindinc.com/productswepresentwipg1500.html Software...

F5 BIG-IP SSL Virtual Server - Ticketbleed Memory Disclosure

F5 BIG-IP SSL Virtual Server - Ticketbleed Memory Disclosure / Exploit Title: Ticketbleed CVE-2016-9244 F5 BIG-IP SSL virtual server Memory Leakage Date: 10.02.2017 Exploit Author: Ege Balcı Vendor Homepage: https://f5.com/ Version: 12.0.0 - 12.1.2 && 11.4.0 - 11.6.1 Tested on: Multiple CVE :...

Microsoft Windows - DFS Client Driver Arbitrary Drive Mapping Privilege Escalation (MS16-123)

Microsoft Windows - DFS Client Driver Arbitrary Drive Mapping Privilege Escalation MS16-123 / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=885 Windows: DFS Client Driver Arbitrary Drive Mapping EoP Platform: Windows 10 10586, Edge 25.10586.0.0 not tested 8.1 Update 2 or Windo...

SAP NetWeaver AS JAVA 7.1 7.5 - Information Disclosure

SAP NetWeaver AS JAVA 7.1 7.5 - Information Disclosure Application:SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.1 - 7.5 Vendor URL: http://SAP.com Bugs: information disclosure Sent: 15.09.2015 Reported: 15.09.2015 Vendor response: 16.09.2015 Date of Public Advisory: 09.02.2016...

IPFire 2.19 Core Update 101 - Remote Command Execution

IPFire 2.19 Core Update 101 - Remote Command Execution Exploit Title: IPFire 2.19 Update Core 101 XSS to CSRF to Remote Command Execution Date: 04/05/2016 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.ipfire.org Version: lesser-than 2.19 Core Update 101 Category: Remote Comman...

PLANET Technology IP Surveillance Cameras - Multiple Vulnerabilities

PLANET Technology IP Surveillance Cameras - Multiple Vulnerabilities | | | | | | | | | | | | / | '\ \ /\ / / \ | | |/ | ' / | | | | \ V V / / | | | | | | \ \ /|| // ||||,|./|/ Security Adivisory 2016-04-06 www.orwelllabs.com Twitter:@orwelllabs mantra: ...not affect a product that is in...

Linux Kernel 3.10.0-229.x (CentOS RHEL 7.1) - iowarrior Driver Crash (PoC)

Linux Kernel 3.10.0-229.x CentOS RHEL 7.1 - iowarrior Driver Crash PoC OS-S Security Advisory 2016-15 Linux iowarrior Nullpointer Dereference Date: March 4th, 2016 Authors: Sergej Schumilo, Hendrik Schwartke, Ralf Spenneberg CVE: not yet assigned CVSS: 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Title: Local...

NTPd ntp-4.2.6p5 - ctl_putdata() Buffer Overflow (PoC)

NTPd ntp-4.2.6p5 - ctlputdata Buffer Overflow PoC / Ntpd Based on: ntpq client from ntp package Provided for legal security research and testing purposes ONLY PoC DoS Denial of Service PoC. Will crash NTPd. You will need to know the KEY ID and MD5 password, for example put this in you ntp.conf...

ZTE ADSL ZXV10 W300 Modems - Multiple Vulnerabilities

ZTE ADSL ZXV10 W300 Modems - Multiple Vulnerabilities Exploit Title: ZTE ADSL ZXV10 W300 modems - Multiple vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.zte.com.cn Versions Reported: W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 CVE-ID: CVE-2015-7257 CVE-2015-7258 CVE-2015-7259...

PHP 5.5.9 - zend_executor_globals CGIMode FPM WriteProcMemFile Disable Functions Bypass Load Dynamic Library

PHP 5.5.9 - zendexecutorglobals CGIMode FPM WriteProcMemFile Disable Functions Bypass Load Dynamic Library ?php // EDB Note: Paper https://www.exploit-db.com/docs/english/38104-shoot-zendexecutorglobals-to-bypass-php-disablefunctions.pdf errorreporting0x66778899; settimelimit0x41424344;...

8 TOTOLINK Router Models - Backdoor Access Remote Code Execution

8 TOTOLINK Router Models - Backdoor Access Remote Code Execution Advisory Information Title: Backdoor and RCE found in 8 TOTOLINK router models Advisory URL: https://pierrekim.github.io/advisories/2015-totolink-0x02.txt Blog URL:...

Moodle 2.5.92.6.82.7.52.8.3 - Block Title Handler Cross-Site Scripting

Moodle 2.5.92.6.82.7.52.8.3 - Block Title Handler Cross-Site Scripting Moodle 2.5.9/2.6.8/2.7.5/2.8.3 Block Title Handler Cross-Site Scripting Vendor: Moodle Pty Ltd Product web page: https://www.moodle.org Affected version: 2.8.3, 2.7.5, 2.6.8 and 2.5.9 Summary: Moodle is a learning platform...

PHP-Calendar 0.10.1 - Arbitrary File Inclusion

PHP-Calendar 0.10.1 - Arbitrary File Inclusion PHP-Calendar Arbitrary File Inclusion Vendor: Sean Proctor Product: PHP-Calendar Version: = 0.10.1 Website: http://php-calendar.sourceforge.net/ BID: 12127 CVE: CVE-2004-1423 OSVDB: 12700 12701 SECUNIA: 22516 PACKETSTORM: 35563 Description: I was...

Cacti Superlinks Plugin 1.4-2 - SQL Injection Local File Inclusion

Cacti Superlinks Plugin 1.4-2 - SQL Injection Local File Inclusion !/bin/sh Exploit Title: Cacti - Superlinks Plugin 1.4-2 RCELFI via SQL Injection Date: 19/12/2014 Exploit Author: Wireghoul Software Link: http://docs.cacti.net/plugin:superlinks Identifiers: CVE-2014-4644, EDB-ID-33809 Exploit...

vldPersonals 2.7 - Multiple Vulnerabilities

vldPersonals 2.7 - Multiple Vulnerabilities Exploit Title: VLD Personal – Multiple Vulnerabilities Date: 09/11/2014 Exploit Author: Mr T Exploit Authors Website: http://www.securitypentester.ninja Vendor Homepage: http://www.vldpersonals.com/ Software Link:...

Aireplay-ng 1.2 beta3 - tcp_test Length Stack Overflow

Aireplay-ng 1.2 beta3 - tcptest Length Stack Overflow / Exploit Title: Aireplay "tcptest" Length Parameter Inconsistency Date: 10/3/2014 Exploit Author: Nick Sampanis Vendor Homepage: http://www.aircrack-ng.org/ Version: Aireplay-ng 1.2 beta3 Tested on: Kali Linux 1.0.9 x64 CVE : CVE-2014-8322...

Linux Kernel 3.16.1 - Remount FUSE Local Privilege Escalation

Linux Kernel 3.16.1 - Remount FUSE Local Privilege Escalation / FUSE-based exploit for CVE-2014-5207 Copyright c 2014 Andy Lutomirski Based on code that is: Copyright C 2001-2007 Miklos Szeredi This program can be distributed under the terms of the GNU GPL. See the file COPYING. gcc -Wall...

Zenoss Monitoring System 4.2.5-2108 (x64) - Persistent Cross-Site Scripting

Zenoss Monitoring System 4.2.5-2108 x64 - Persistent Cross-Site Scripting Exploit Title: Stored XSS vulnerability in Zenoss core open source monitoring system Date: 12/05/2014 Exploit author: Dolev Farhi dolevatopenflare.org Vendor homepage: http://zenoss.com Software Link: http://www.zenoss.com...

McAfee ePolicy Orchestrator 4.6.0 4.6.5 - ePowner Multiple Vulnerabilities

McAfee ePolicy Orchestrator 4.6.0 4.6.5 - ePowner Multiple Vulnerabilities Exploit Title: McAfee ePolicy Orchestrator 4.6.0-4.6.5 ePowner - Multiple vulnerabilities Date: 20 November 2012 Exploit Author: [email protected] a.k.a. [email protected] Vendor Homepage:...

InterWorx Control Panel 5.0.13 build 574 - xhr.php?i SQL Injection

InterWorx Control Panel 5.0.13 build 574 - xhr.php?i SQL Injection ================================================= Title: SQL injection in InterWorx Control Panel Product: InterWorx Web Control Panel Vendor: InterWorx LLC Tested Version: 5.0.13 build 574 Vulnerability Type: SQL Injection CWE-89...

Conceptronic Wireless Pan Tilt Network Camera - Cross-Site Request Forgery

Conceptronic Wireless Pan Tilt Network Camera - Cross-Site Request Forgery General Details Affected Product: Conceptronic camera CIPCAMPTIWL Tested Firmware: 21.37.2.49 Tested Web UI Firmware: 0.61.4.18 Assigned CVE: CVE-2013-7204 CVSSv2 Base Score: 5.8 AV:N/AC:M/AU:N/C:P/I:P/A:N Vulnerability...

Technicolor TC7200 - Multiple Cross-Site Scripting Vulnerabilities

Technicolor TC7200 - Multiple Cross-Site Scripting Vulnerabilities Exploit Title: Technicolor TC7200 - Multiple XSS Vulnerabilities Google Dork: N/A Date: 02-01-2013 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.technicolor.com/en/solutions-services/connected-home/modems-gatew...

Java - Web Start Double Quote Injection Remote Code Execution (Metasploit)

Java - Web Start Double Quote Injection Remote Code Execution Metasploit ======================================================== Java Web Start Double Quote Inject Remote Code Execution ======================================================== Date: Jun 12 2012 updated: Jun 6 2013 Author: Rh0...

WordPress Plugin Portable phpMyAdmin - Authentication Bypass

WordPress Plugin Portable phpMyAdmin - Authentication Bypass 'portable-phpMyAdmin WordPress Plugin' Authentication Bypass CVE-2012-5469 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- portable-phpMyAdmin doesn't verify an existing WordPress session...

Elcom CMS 7.4.10 - Community Manager Insecure Arbitrary File Upload

Elcom CMS 7.4.10 - Community Manager Insecure Arbitrary File Upload Elcom CMS - Community Manager Insecure File Upload Vulnerability - Security Advisory - SOS-12-008 Release Date. 24-Aug-2012 Last Update. - Vendor Notification Date. 28-Oct-2011 Product. Elcom CMS - Community Manager Platform...

Yealink VOIP Phone - Persistent Cross-Site Scripting

Yealink VOIP Phone - Persistent Cross-Site Scripting ============================================================== Secur-I Research Group Security Advisory SV-2012-005 ============================================================== Title: Yealink VOIP Phone Persistent Cross Site Scripting...

Linux Kernel 2.6.36 IGMP - Remote Denial of Service

Linux Kernel 2.6.36 IGMP - Remote Denial of Service / linux-undeadattack.c Linux IGMP Remote Denial Of Service Introduced in linux-2.6.36 CVE-2012-0207 credits to Ben Hutchings: http://womble.decadent.org.uk/blog/igmp-denial-of-service-in-linux-cve-2012-0207.html written By Kingcope Year 2012...

PmWiki 2.2.34 - pagelist Remote PHP Code Injection (1)

PmWiki 2.2.34 - pagelist Remote PHP Code Injection 1 $r 454. if @$PageListSortCmp$o 455. $code .= "$c = $PageListSortCmp$o; "; 456. else 457. $code .= "$c = @strcasecmp$PCache$x'$o',$PCache$y'$o'; "; 458. $code .= "if $c return $r$c;\n"; 459. 460. StopWatch'PageListSort sort'; 461. if $code...

Google Android 2.3.5 - PowerVR SGX Driver Information Disclosure

Google Android 2.3.5 - PowerVR SGX Driver Information Disclosure // source: https://www.securityfocus.com/bid/57900/info The PowerVR SGX driver in Android is prone to an information-disclosure vulnerability. Successful exploits allows an attacker to gain access to sensitive information. Informati...

BisonWare BisonFTP Server 3.5 - Remote Buffer Overflow (Metasploit)

BisonWare BisonFTP Server 3.5 - Remote Buffer Overflow Metasploit Title : BisonFTP Server Remote Buffer Overflow Exploit Author : Veerendra G.G SecPod Technologies www.secpod.com Advisory : http://secpod.org/blog/?p=384 http://secpod.org/msf/bisonserverbof.rb Version : BisonFTP Server 'BisonFTP...

Adobe Audition 3.0 build 7283 - Session File Handling Buffer Overflow (PoC)

Adobe Audition 3.0 build 7283 - Session File Handling Buffer Overflow PoC !/usr/bin/perl Adobe Audition 3.0 build 7283 Session File Handling Buffer Overflow PoC Vendor: Adobe Systems Inc. Product web page: http://www.adobe.com/products/audition/ Affected version: 3.0 build 7238 Summary: Recording...

ClanSphere 2010.0 Final - Multiple Vulnerabilities

ClanSphere 2010.0 Final - Multiple Vulnerabilities Vulnerability ID: HTB22694 Reference: http://www.htbridge.ch/advisory/sqlinjectioninclansphere.html Product: CLANSPHERE Vendor: csphere.eu http://www.csphere.eu/ Vulnerable Version: 2010.0 Final Vendor Notification: 02 November 2010 Vulnerability...

Microsoft Windows Help Centre Handles - Malformed Escape Sequences Incorrectly (MS03-044)

Microsoft Windows Help Centre Handles - Malformed Escape Sequences Incorrectly MS03-044 Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly ---------------------------------------------------------------------------- Help and Support Centre is the default application...

PHPAccess - SQL Injection

PHPAccess - SQL Injection Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title:PHPAccess SQLi Vulnerability Version:n/a Vendor url:http://www.krizleebear.de Published: 2010-06-09 Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue™®, S1ayer,d3c0d3r and to all ICW members PHPAccess SQLi...

AV Arcade - Search Cross-Site Scripting HTML Injection

AV Arcade - Search Cross-Site Scripting HTML Injection Exploit Title: AV Arcade Search Field XSS/HTML Injection Date: 6/5/2010 Author: Vadim Toptunov, http://www.twitter.com/pentesting Software Link: http://www.avscripts.net/avarcade/ Version: 5.1.4 Free and Pro latest and prior Tested on: Any NI...

Achievo 1.3.4 - Cross-Site Scripting

Achievo 1.3.4 - Cross-Site Scripting Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Achievo 1. Advisory Information Title: Multiple XSS in Achievo Advisory ID: BONSAI-2009-0101 Advisory URL:...

HP Multiple LaserJet Printer - Cross-Site Scripting

HP Multiple LaserJet Printer - Cross-Site Scripting Digital Security Research Group DSecRG Advisory DSECRG-09-048 http://dsecrg.ru/pages/vul/show.php?id=148 Application: HP LaserJet printer web interface Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others Vendor URL: http://www.hp.com...

Oracle APEX 3.2 - Unprivileged DB users can see APEX Password hashes

Oracle APEX 3.2 - Unprivileged DB users can see APEX Password hashes Unprivileged DB users can see APEX password hashes in FLOWS030000.WWVFLOWUSER CVE-2009-0981 Name Unprivileged DB users can see APEX password hashes in FLOWS030000.WWVFLOWUSER CVE-2009-0981 Systems Affected APEX 3.0 optional...

Microsoft Office - Communicator SIP Remote Denial of Service

Microsoft Office - Communicator SIP Remote Denial of Service !usr/bin/perl -w Microsoft Communicator allows remote attackers to cause a denial of service memory consumption via a large number of SIP INVITE requests, which trigger the creation of many sessions. Refer:...

Arab Portal 2.1 (Windows) - Remote File Disclosure

Arab Portal 2.1 Windows - Remote File Disclosure Arab Portal v2.1 Remote File Disclosure Win32 AUTHOR : IRCRASH R3d.W0rm Sina Yazdanmehr Discovered by : R3d.W0rm Sina Yazdanmehr Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Sina Yazdanmehr - Hadi Kiamarsi Download :...

PHP-Nuke Module Kose_Yazilari - artid SQL Injection

PHP-Nuke Module KoseYazilari - artid SQL Injection CoRPITX Turkey www.Hayalet-hack.com www.zone-turk.net/ PHP-Nuke KoseYazilari SQL Injection Vulnerability AUTHOR : xcorpitx HOME : www.Hayalet-hack.com / www.zone-turk.net WHEN YOU PUT THIS SQL CODE YOU can SEE ADMýN NAME,ADMIN HASH DorK 1 : ''na...

IBM AIX 5.3.0 - setlocale() Local Privilege Escalation

IBM AIX 5.3.0 - setlocale Local Privilege Escalation setlocale exploit for aix 5.2 CVE-2006-4254 [email protected] from os import execve bof="a"580+"bbbbccccdddd\x2f\xf2\x28\x2f" egg="\x60"2350 shellcode= by intropy caughq.org "\x7c\xa5\x2a\x79" xor. r5,r5,r5 "\x40\x82\xff\xfd" bnel...

Cartweaver 2.16.11 - ProdID SQL Injection

Cartweaver 2.16.11 - ProdID SQL Injection author:meoconxatvnbrain.net product:CartWeaver main site:www.cartweaver.com 1.with CFM CartWeaver: sql injection in: Details.cfm?ProdID=a' demo: http://www.jbracing.co.uk/Details.cfm?ProdID=1' exploit: http://www.xxx.com/Details.cfm?ProdID=sql query link...