Linux Kernel 3.13.0 3.19 (Ubuntu 12.0414.0414.1015.04) - overlayfs Local Privilege Escalation

Linux Kernel 3.13.0 3.19 Ubuntu 12.0414.0414.1015.04 - overlayfs Local Privilege Escalation / Exploit Title: ofs.c - overlayfs local root in ubuntu Date: 2015-06-15 Exploit Author: rebel Version: Ubuntu 12.04, 14.04, 14.10, 15.04 Kernels before 2015-06-15 Tested on: Ubuntu 12.04, 14.04, 14.10,...

Linux Kernel 3.13.0 3.19 (Ubuntu 12.0414.0414.1015.04) - overlayfs Local Privilege Escalation (Access etcshadow)

Linux Kernel 3.13.0 3.19 Ubuntu 12.0414.0414.1015.04 - overlayfs Local Privilege Escalation Access etcshadow The overlayfs filesystem does not correctly check file permissions when creating new files in the upper filesystem directory. This can be exploited by an unprivileged process in kernels wi...

Moodle 2.5.92.6.82.7.52.8.3 - Block Title Handler Cross-Site Scripting

Moodle 2.5.92.6.82.7.52.8.3 - Block Title Handler Cross-Site Scripting Moodle 2.5.9/2.6.8/2.7.5/2.8.3 Block Title Handler Cross-Site Scripting Vendor: Moodle Pty Ltd Product web page: https://www.moodle.org Affected version: 2.8.3, 2.7.5, 2.6.8 and 2.5.9 Summary: Moodle is a learning platform...

Intel Network Adapter Diagnostic Driver - IOCTL Handling

Intel Network Adapter Diagnostic Driver - IOCTL Handling / Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Vendor: Intel Product webpage: http://www.intel.com Affected products: Network Adapter Driver for Windows XP Network Adapter Driver for Windows 7 Network Adapter Driver...

CodoForum 2.5.1 - Arbitrary File Download

CodoForum 2.5.1 - Arbitrary File Download Exploit Title: Codoforum 2.5.1 Arbitrary File Download Date: 23-11-2014 Software Link: https://codoforum.com/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps CVE: CVE-2014-9261 1...

PHP-Calendar 0.10.1 - Arbitrary File Inclusion

PHP-Calendar 0.10.1 - Arbitrary File Inclusion PHP-Calendar Arbitrary File Inclusion Vendor: Sean Proctor Product: PHP-Calendar Version: = 0.10.1 Website: http://php-calendar.sourceforge.net/ BID: 12127 CVE: CVE-2004-1423 OSVDB: 12700 12701 SECUNIA: 22516 PACKETSTORM: 35563 Description: I was...

IPUX CL5452CL5132 IP Camera - UltraSVCamX.ocx ActiveX Stack Buffer Overflow

IPUX CL5452CL5132 IP Camera - UltraSVCamX.ocx ActiveX Stack Buffer Overflow IPUX CL5452/CL5132 IP Camera UltraSVCamX.ocx ActiveX Stack Buffer Overflow Vendor: Big Good Holdings Limited | Fitivision Technology Inc. Product web page: http://www.ipux.net | http://www.fitivision.com Affected version:...

InterWorx Control Panel 5.0.13 build 574 - xhr.php?i SQL Injection

InterWorx Control Panel 5.0.13 build 574 - xhr.php?i SQL Injection ================================================= Title: SQL injection in InterWorx Control Panel Product: InterWorx Web Control Panel Vendor: InterWorx LLC Tested Version: 5.0.13 build 574 Vulnerability Type: SQL Injection CWE-89...

GetGo Download Manager 4.9.0.1982 - HTTP Response Header Buffer Overflow Remote Code Execution

GetGo Download Manager 4.9.0.1982 - HTTP Response Header Buffer Overflow Remote Code Execution !/usr/bin/python Exploit Title: GetGo Download Manager HTTP Response Header Buffer Overflow Remote Code Execution Version: v4.9.0.1982 CVE: CVE-2014-2206 Date: 2014-03-09 Author: Julien Ahrens @MrTuxrac...

Dokeos 2.2 RC2 - index.php?language SQL Injection

Dokeos 2.2 RC2 - index.php?language SQL Injection Advisory ID: HTB23181 Product: Dokeos Vendor: Dokeos Vulnerable Versions: 2.2 RC2 and probably prior Tested Version: 2.2 RC2 Advisory Publication: October 30, 2013 without technical details Vendor Notification: October 30, 2013 Public Disclosure:...

Galil-RIO Modbus - Denial of Service

Galil-RIO Modbus - Denial of Service Exploit Title: Galil RIO-47100 Date: 05-01-2013 Exploit Author: Sapling Vendor Homepage: www.galilmc.com Version: Rio Firmware Prior to 1.1d CVE : CVE-2013-0699 ICSA: ICSA-13-116-01 / There are many different ways to crash this PLC but most of them are...

Centreon Enterprise Server 2.3.3 2.3.9-4 - Blind SQL Injection

Centreon Enterprise Server 2.3.3 2.3.9-4 - Blind SQL Injection !/usr/bin/env python Exploit Title: Centreon 2.3.3 - 2.3.9-4 menuXML.php Blind SQL Injection Exploit Disclosure Date: December 12, 2012 Author: modpr0be @modpr0be Platform: Linux Tested on: Centreon Enterprise Server with Centreon...

Trend Micro Interscan Messaging Security Suite - Persistent Cross-Site Scripting Cross-Site Request Forgery

Trend Micro Interscan Messaging Security Suite - Persistent Cross-Site Scripting Cross-Site Request Forgery Exploit Title: Trend Micro InterScan Messaging Security Suite Stored XSS and CSRF Date: 13/09/2012 Exploit Author: modpr0be modpr0beatspentera.com Vendor Homepage: http://www.trendmicro.com...

vBulletin Yet Another Awards System 4.0.2 - SQL Injection

vBulletin Yet Another Awards System 4.0.2 - SQL Injection Exploit Title: vBulletin Yet Another Awards System 4.0.2 Time Based SQL Injection 0day Google Dork: inurl:awards.php intext:"powered by vbulletin" Date: 29/08/12 Exploit Author: Backsl@sh/Dan Software Link:...

Slimpdf Reader 1.0 - Memory Corruption

Slimpdf Reader 1.0 - Memory Corruption Exploit Title: Date: June 24 2012 Exploit Author: Carlos Mario Penagos Hollmann Vendor Homepage: www.investintech.com Version:1.0 Tested on: Windows 7 CVE : cve-2011-4220 payload ="A"10000 crash="startxref" pdf=payload+crash filename = "slimpdPoC.pdf" file =...

Supernews 2.6.1 - noticias.php?cat SQL Injection

Supernews 2.6.1 - noticias.php?cat SQL Injection Supernews Date: 31/05/2012 Version: 2.6.1 Software Link: http://phpbrasil.com/script/vT0FaOCySSH/supernews ISRAEL Author will be not responsible for any damage. Vulnerable Code - noticias.php 30-31: 30. $idcategoria = formatDados$GET'cat'; 31. $que...

Google Android 2.3.5 - PowerVR SGX Driver Information Disclosure

Google Android 2.3.5 - PowerVR SGX Driver Information Disclosure // source: https://www.securityfocus.com/bid/57900/info The PowerVR SGX driver in Android is prone to an information-disclosure vulnerability. Successful exploits allows an attacker to gain access to sensitive information. Informati...

Adobe Photoshop Elements 8.0 - Multiple Arbitrary Code Execution Vulnerabilities

Adobe Photoshop Elements 8.0 - Multiple Arbitrary Code Execution Vulnerabilities Title: ------ Adobe Photoshop Elements 8.0 Multiple Arbitrary Code Execution Vulnerabilities Vendor: ------- Adobe Systems Inc. http://www.adobe.com Product web page: -----------------...

Adobe Audition 3.0 build 7283 - Session File Handling Buffer Overflow (PoC)

Adobe Audition 3.0 build 7283 - Session File Handling Buffer Overflow PoC !/usr/bin/perl Adobe Audition 3.0 build 7283 Session File Handling Buffer Overflow PoC Vendor: Adobe Systems Inc. Product web page: http://www.adobe.com/products/audition/ Affected version: 3.0 build 7238 Summary: Recording...

PHP 5.3.5 libzip 0.9.3 - _zip_name_locate Null Pointer Dereference

PHP 5.3.5 libzip 0.9.3 - zipnamelocate Null Pointer Dereference Source: http://securityreason.com/securityalert/8146 libzip 0.9.3 zipnamelocate NULL Pointer Dereference incl PHP 5.3.5 Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - Dis.: 03.01.2011 - Pub.:...

Adobe Acrobat and Reader - Array Indexing Remote Code Execution

Adobe Acrobat and Reader - Array Indexing Remote Code Execution nSense Vulnerability Research Security Advisory NSENSE-2010-001 --------------------------------------------------------------- Affected Vendor: Adobe Affected Product: Adobe Reader 9.3.4 for Macintosh Platform: OS X Impact: User...

Excel RTD - Memory Corruption

Excel RTD - Memory Corruption ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moaub-10-excel-rtd-memory-corruption/...

Joomla! Component com_dateconverter 0.1 - SQL Injection

Joomla! Component comdateconverter 0.1 - SQL Injection ----------------------------------------------------------------------------------------- Joomla Component comdateconverter SQL Injection Vulnerability -----------------------------------------------------------------------------------------...

Tembria Server Monitor 5.6.0 - Denial of Service

Tembria Server Monitor 5.6.0 - Denial of Service !/usr/bin/python Exploit Title : Tembria Server Monitor 5.6.0 CVE-ID : CVE-2010-1316 Date : April 9, 2010 Author : Lincoln Software Link : http://www.tembria.com/ Version : 5.6.0 OS : Windows Tested on : XP SP3 En VirtualBox Type of vuln : Remote D...

Mozilla Firefox 2.0.0.16 - UTF-8 URL Remote Buffer Overflow

Mozilla Firefox 2.0.0.16 - UTF-8 URL Remote Buffer Overflow !/usr/bin/python FireFox 2.0.0.16 Windows XP SP3 x86 Remote Exploit Author: Dominic Chell Exploits the UTF-8 URL overflow vulnerability described in CVE-2008-0016. As of September 2009 there are no public exploits for this vulnerability...

Linux Kernel 2.6.19 (Debian 4) - udp_sendmsg Local Privilege Escalation (3)

Linux Kernel 2.6.19 Debian 4 - udpsendmsg Local Privilege Escalation 3 / hoagieudpsendmsg.c LOCAL LINUX KERNEL ROOT EXPLOIT include include include include include include include include / this code will be called from NFHOOK via output callback in kernel mode / void setcurrenttaskuidsgidstozero...

Linux Kernel 2.6 2.6.19 (White Box 4 CentOS 4.44.5 Fedora Core 456 x86) - ip_append_data() Ring0 Privilege Escalation (1)

Linux Kernel 2.6 2.6.19 White Box 4 CentOS 4.44.5 Fedora Core 456 x86 - ipappenddata Ring0 Privilege Escalation 1 / 0x82-CVE-2009-2698 Linux kernel 2.6 . / include include include include include include include unsigned int uid, gid; void getrootuidunsigned task unsigned addr=task;...

TugZip 3.00 Archiver - .zip Local Buffer Overflow

TugZip 3.00 Archiver - .zip Local Buffer Overflow /0day TUGzip 3.00 archiver .ZIP File Local Buffer Overflow "If you change things ,forever,there's no going back,you see for them you're just a freak, like me ..Mhaaaahaaaaaaaaaaaaaaaaaaaa"JK Well hello there ,greetz from Romania,here is a exploit...

Acoustica Mixcraft 4.2 Build 98 - mx4 Local Buffer Overflow

Acoustica Mixcraft 4.2 Build 98 - mx4 Local Buffer Overflow !/usr/bin/perl Acoustica Mixcraft mx4 file Local Buffer Overflow Exploit Author: Koshi Date: 08-28-08 0day Application: Acoustica Mixcraft Versions: Possibly Older / 4.1 Build 96 / 4.2 Build 98 Site:...

NASM 2.0 - ppscan() Off-by-One Buffer Overflow

NASM 2.0 - ppscan Off-by-One Buffer Overflow source: https://www.securityfocus.com/bid/29656/info NASM is prone to an off-by-one buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue will allow...

KwsPHP Module jeuxflash 1.0 - id SQL Injection

KwsPHP Module jeuxflash 1.0 - id SQL Injection KwsPHP Module jeuxflash Remote SQL Injection Vulnerability AUTHOR : H-T Team HouSSamix ToXiC350 HOME : http://no-hack.fr & http://no-hack.net Site: http://koogar.alorys-hebergement.com/kwsphp/index.php?mod=downloads&filedl=30&before=8&pdl=1 Dork :...

NavBoard 2.6.0 - Remote Code Execution

NavBoard 2.6.0 - Remote Code Execution "; print ""; print ""; print "Main forum settings"; print ""; print "Board Title"; print ""; print ""; print ""; print "Admin email address blank will not display"; print ""; print "input type=tex...

Microsoft Windows - DNS DnssrvQuery Remote Stack Overflow

Microsoft Windows - DNS DnssrvQuery Remote Stack Overflow / Copyright c 2007 devcode ^^ D E V C O D E ^^ Windows DNS DnssrvQuery Stack Overflow CVE-2007-1748 Description: A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable...

PHP-Nuke - iframe.php Remote File Inclusion

PHP-Nuke - iframe.php Remote File Inclusion iFRAME for PhpNuke iframe.php Remote File Include Vulnerabilities script :http://www.desarrollonuke.org http://up.9q9q.net/up/index.php?f=uTRRQnIjG file : iframe.php Dork : "/nuke/iframe.php" Found by & Contact : Cold z3ro , [email protected] ,...

Premod SubDog 2 - includesfunctions_kb.php?phpbb_root_path Remote File Inclusion

Premod SubDog 2 - includesfunctionskb.php?phpbbrootpath Remote File Inclusion source: https://www.securityfocus.com/bid/22912/info Premod SubDog 2 is prone to multiple remote file-include vulnerabilities. An attacker can exploit these issues to include an arbitrary remote file containing maliciou...

simple file manager 0.24a - Multiple Vulnerabilities

simple file manager 0.24a - Multiple Vulnerabilities /\ | flame vrs Simple File Manager | | http://onedotoh.sourceforge.net/ | | Various Vulnerbilities Including: | / /+++++++++++++++++++++++++++++++++++++++++++\ | Using the scripts supplied by the webapp: | | Reading of Arbitrary files | |...

pandaBB - displayCategory Remote File Inclusion

pandaBB - displayCategory Remote File Inclusion ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::: :+: :+: :+: :+: +:+:+: :+:+:+ +:+ +:+ +:+ +:+ +:+...

Ractive Popper 1.41 - Childwindow.Inc.php Remote File Inclusion

Ractive Popper 1.41 - Childwindow.Inc.php Remote File Inclusion source: https://www.securityfocus.com/bid/19972/info Ractive Popper is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to...

Linux Kernel 2.6.13 2.6.17.4 - sys_prctl() Local Privilege Escalation (1)

Linux Kernel 2.6.13 2.6.17.4 - sysprctl Local Privilege Escalation 1 // / Local r00t Exploit for: / / Linux Kernel PRCTL Core Dump Handling / / BID 18874 / CVE-2006-2451 / / Kernel 2.6.x = 2.6.13 && main PoC code / / - RoMaNSoFt local root code / / 10.Jul.2006 / // include include include include...

W-Agora 4.1.6 - a redir_url.php?key SQL Injection

W-Agora 4.1.6 - a redirurl.php?key SQL Injection source: https://www.securityfocus.com/bid/11283/info Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to...

Postfix 1.1.x - Denial of Service (1)

Postfix 1.1.x - Denial of Service 1 // source: https://www.securityfocus.com/bid/8333/info Debian has reported two vulnerabilities in the Postfix mail transfer agent. The first vulnerability, CAN-2003-0468, can allow for an adversary to "bounce-scan" a private network. It has also been reported...

Apache mod_ssl 2.8.7 OpenSSL - OpenFuck.c Remote Buffer Overflow

Apache modssl 2.8.7 OpenSSL - OpenFuck.c Remote Buffer Overflow / source: https://www.securityfocus.com/bid/5363/info A buffer-overflow vulnerability has been reported in some versions of OpenSSL. The issue occurs in the handling of the client key value during the negotiation of the SSLv2 protoco...

Cacti 1.2.8 - Remote Code Execution

Cacti 1.2.8 - Remote Code Execution Exploit Title: Cacti 1.2.8 - Remote Code Execution Date: 2020-02-03 Exploit Author: Askar @mohammadaskar2 CVE: CVE-2020-8813 Vendor Homepage: https://cacti.net/ Version: v1.2.8 Tested on: CentOS 7.3 / PHP 7.1.33 !/usr/bin/python3 import requests import sys impo...

Cuckoo Clock v5.0 - Buffer Overflow

Cuckoo Clock v5.0 - Buffer Overflow Exploit Title: Cuckoo Clock 5.0 - Buffer Overflow Exploit Author: boku Date: 2020-02-14 Vendor Homepage: https://en.softonic.com/author/pxcompany Software Link: https://en.softonic.com/download/parallaxis-cuckoo-clock/windows/post-download Version: 5.0 Tested O...

OpenSMTPD 6.6.2 - Remote Code Execution

OpenSMTPD 6.6.2 - Remote Code Execution Exploit Title: OpenSMTPD 6.6.2 - Remote Code Execution Date: 2020-01-29 Exploit Author: 1F98D Original Author: Qualys Security Advisory Vendor Homepage: https://www.opensmtpd.org/ Software Link: https://github.com/OpenSMTPD/OpenSMTPD/releases/tag/6.6.1p1...

ASTPP 4.0.1 VoIP Billing - Database Backup Download

ASTPP 4.0.1 VoIP Billing - Database Backup Download Exploit Title: ASTPP 4.0.1 VoIP Billing - Database Backup Download Date: 2019-11-18 Exploit Author: Fabien AUNAY Vendor Homepage: https://www.astppbilling.org/ Software Link: https://github.com/iNextrix/ASTPP/tree/v4.0.1 Version: 4.0.1 vendor...

Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting

Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting Exploit Title: Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting Date: 2019-12-17 Exploit Author: MTK Vendor Homepage: https://sweethawk.co/zendesk/survey-app Software Link:...

WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting

WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting Exploit Title: WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting Google Dork: inurl:/wp-content/themes/zoner/ Date: 2019-09-24 Exploit Author: m0ze Vendor Homepage: https://fruitfulcode.com/ Software...

Nagios XI 5.6.1 - SQL injection

Nagios XI 5.6.1 - SQL injection Exploit Title: Nagiosxi username sql injection Date: 22/05/2019 Exploit Author: JameelNabbo Website: jameelnabbo.com Vendor Homepage: https://www.nagios.com Software Link: https://www.nagios.com/products/nagios-xi/ Version: xi-5.6.1 Tested on: MacOSX CVE:...

Schneider Electric U.Motion Builder 1.3.4 - track_import_export.php object_id Unauthenticated Command Injection

Schneider Electric U.Motion Builder 1.3.4 - trackimportexport.php objectid Unauthenticated Command Injection RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Schneider Electric U.Motion Builder Vendor URL: www.schneider-electric.com Type: ...