Pulse Secure 8.1R15.18.28.39.0 SSL VPN - Arbitrary File Disclosure (Metasploit)

Pulse Secure 8.1R15.18.28.39.0 SSL VPN - Arbitrary File Disclosure Metasploit Exploit Title: File disclosure in Pulse Secure SSL VPN metasploit Google Dork: inurl:/dana-na/ filetype:cgi Date: 8/20/2019 Exploit Author: 0xDezzy Justin Wagner, Alyssa Herrera Vendor Homepage: https://pulsesecure.net...

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation

Microsoft Windows 10 19031809 - RPCSS Activation Kernel Security Callback Privilege Escalation Windows: RPCSS Activation Kernel Security Callback EoP Platform: Windows 10 1903/1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User...

myPHPCalendar 10192000b - cal_dir Remote File Inclusion

myPHPCalendar 10192000b - caldir Remote File Inclusion script name : myPHPCalendar Script Downloads : http://freshmeat.net/projects/myphpcalendar/ Web Site : http://myphpcalendar.sourceforge.net/ Version : 10.1 Risk : High Found By : Cr@zyKing Thanks : | eTNR | ApAci | Eno7 | TheHacker | Kormali4...

vBulletin 3.6.0 4.2.3 - ForumRunner SQL Injection

vBulletin 3.6.0 4.2.3 - ForumRunner SQL Injection Exploit Title : vBulletin = 4.2.3 SQL Injection CVE-2016-6195 Author : Manish Kishan Tanwar AKA error1046 https://twitter.com/IndiShell1046 Date : 25/08/2015 Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Jagriti,Kishan Singh and ritu...

WordPress Plugin Adserve 0.2 - adclick.php SQL Injection

WordPress Plugin Adserve 0.2 - adclick.php SQL Injection getvar"SELECT url FROM $tablename WHERE id=$id;"; Exploit id variable isnt filtered so we can inject and check the output in the Location response-header If exploit is succesfull Wordpress administrators login and md5 hashed password is...

Apple macOS 10.14.5 iOS 12.3 XNU - in6_pcbdetach Stale Pointer Use-After-Free

Apple macOS 10.14.5 iOS 12.3 XNU - in6pcbdetach Stale Pointer Use-After-Free Reproduction Repros on 10.14.3 when run as root. It may need multiple tries to trigger. $ clang -o in6selectsrc in6selectsrc.cc $ while 1; do sudo ./in6selectsrc; done res0: 3 res1: 0 res1.5: -1 // failure expected here...

IBM Lotus Domino R8 - Password Hash Extraction

IBM Lotus Domino R8 - Password Hash Extraction Exploit Title: IBM Lotus Domino = R8 Password Hash Extraction Exploit Google Dork: inurl:names.nsf?opendatabase Date: 02-24-2016 Exploit Author: Jonathan Broche Contact: https://twitter.com/g0jhonny Vendor Homepage:...

BIND 9.4.1 9.4.2 - Remote DNS Cache Poisoning (Metasploit)

BIND 9.4.1 9.4.2 - Remote DNS Cache Poisoning Metasploit / \ / \ | | | | ----====/ /\/ /\ | || |====---- | | | || | | | | | | | | | | | | | ------======\ / /| || || || |======------ / || || / Computer Academic Underground http://www.caughq.org Exploit Code...

Mambo Component com_a6mambocredits 1.0.0 - Remote File Inclusion

Mambo Component coma6mambocredits 1.0.0 - Remote File Inclusion Title : Mambo a6mambocredits component v1.0.0 == mosConfiglivesite Remote File Include Vulnerabilities Affected Application: Mambo a6mambocredits component v1.0.0 Mambo CMS Component . . : contact :...

Mambo Component cropimage 1.0 - Remote File Inclusion

Mambo Component cropimage 1.0 - Remote File Inclusion C Y B E R - W A R R I O R T I M Mambo comcropimage 1.0 Component Remote Include Vulnerability Author: XORON Class: Remote cont@ct: x0r0nathotmaildotcom Code: in admin.cropcanvas.php , line 7 requireonce $cropimagedir."class.cropinterface.php";...

TP-Link Archer C50 3 - Denial of Service (PoC)

TP-Link Archer C50 3 - Denial of Service PoC Exploit Title: TP-Link Archer C50 3 - Denial of Service PoC Date: 2020-01-25 Exploit Author: thewhiteh4t Vendor Homepage: https://www.tp-link.com/ Version: TP-Link Archer C50 v3 Build 171227 Tested on: Arch Linux x64 CVE: CVE-2020-9375 Description:...

Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service (PoC)

Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service PoC Exploit Title: Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service PoC Google Dork: N/A Date: 2020-02-21 Exploit Author: Cem Onat Karagun of Diesec GmBH Vendor Homepage: https://www.google.com/ Version:...

Netatalk 3.1.12 - Authentication Bypass

Netatalk 3.1.12 - Authentication Bypass Exploit Title: Netatalk Authentication Bypass Date: 12/20/2018 Exploit Author: Jacob Baines Vendor Homepage: http://netatalk.sourceforge.net/ Software Link: https://sourceforge.net/projects/netatalk/files/ Version: Before 3.1.12 Tested on: Seagate NAS OS...

BoastMachine - blog SQL Injection

BoastMachine - blog SQL Injection source: https://www.securityfocus.com/bid/64278/info BoastMachine is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise...

Oracle HTTP Server - Cross-Site Scripting Header Injection

Oracle HTTP Server - Cross-Site Scripting Header Injection --------------------------------------------------------------------------------------------------------- Oracle HTTP Server XSS Header Injection...

Jax Guestbook 3.313.50 - jax_Guestbook.php Cross-Site Scripting

Jax Guestbook 3.313.50 - jaxGuestbook.php Cross-Site Scripting source: https://www.securityfocus.com/bid/28523/info Jax Guestbook is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...

Easy File Sharing Web Server 7.2 - POST Remote Buffer Overflow (DEP Bypass)

Easy File Sharing Web Server 7.2 - POST Remote Buffer Overflow DEP Bypass !/usr/bin/python Exploit Title: Easy File Sharing Web Server 7.2 - 'POST' Buffer Overflow DEP Bypass with ROP Exploit Author: bl4ck h4ck3r Software Link: http://www.sharing-file.com/efssetup.exe Version: Easy File Sharing W...

Simple-HTTPD

Remote root on sfr/ubiquisys femtocell webserver wsal/shttpd/mongoose ToDo: Add execute shell ToDo: Test vulnerable targets Modified by JSacco - [email protected] part of femtocell research by TU-Berlin only for educational purposes Exploit Title: remote root on sfr/ubiquisys femtocell...

Linux Kernel 4.8.0-34 4.8.0-45 (Ubuntu Linux Mint) - Packet Socket Local Privilege Escalation

Linux Kernel 4.8.0-34 4.8.0-45 Ubuntu Linux Mint - Packet Socket Local Privilege Escalation // A proof-of-concept local root exploit for CVE-2017-7308. // Includes a SMEP & SMAP bypass. // Tested on Ubuntu / Linux Mint: // - 4.8.0-34-generic // - 4.8.0-36-generic // - 4.8.0-39-generic // -...

Arm Whois 3.11 - Buffer Overflow (SEH)

Arm Whois 3.11 - Buffer Overflow SEH...

Telerik UI for ASP.NET AJAX 2012.3.1308 2017.1.118 - Arbitrary File Upload

Telerik UI for ASP.NET AJAX 2012.3.1308 2017.1.118 - Arbitrary File Upload Exploit Title: Telerik UI for ASP.NET AJAX RadAsyncUpload uploader Filename: RAUcrypto.py Github: https://github.com/bao7uo/RAUcrypto Date: 2018-01-23 Exploit Author: Paul Taylor / Foregenix Ltd Website:...

MicroTik RouterOS 6.43rc3 - Remote Root

MicroTik RouterOS 6.43rc3 - Remote Root / Exploit Title: RouterOS Remote Rooting Date: 10/07/2018 Exploit Author: Jacob Baines Vendor Homepage: www.mikrotik.com Software Link: https://mikrotik.com/download Version: Longterm: 6.30.1 - 6.40.7 Stable: 6.29 - 6.42 Beta: 6.29rc1 - 6.43rc3 Tested on:...

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing Reserved CVE: CVE-2018-13416 Vulnerability Overview The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML...

Linux Kernel 3.5.0-23 (Ubuntu 12.04.2 x64) - SOCK_DIAG SMEP Bypass Local Privilege Escalation

Linux Kernel 3.5.0-23 Ubuntu 12.04.2 x64 - SOCKDIAG SMEP Bypass Local Privilege Escalation / based on the exploit by SynQ Modified PoC for CVE-2013-1763 with SMEP bypass Presentation: Practical SMEP Bypass Techniques on Linux Vitaly Nikolenko [email protected] Target: Linux ubuntu 3.5.0-23-gener...

MikroTik RouterOS 6.43.12 (stable) 6.42.12 (long-term) - Firewall and NAT Bypass

MikroTik RouterOS 6.43.12 stable 6.42.12 long-term - Firewall and NAT Bypass CVE-2019-3924 A remote, unauthenticated attacker can proxy traffic through RouterOS via probes sent to the agent binary. This PoC demonstrates how to exploit a LAN host from the WAN. A video demonstrating the attack can ...

Dew-NewPHPLinks 2.1b - index.php SQL Injection

Dew-NewPHPLinks 2.1b - index.php SQL Injection Dew-NewPHPLinks v.2.1b index.php Sql Injection Vulnerability ====================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.dew-code.com/ .:. Dork : "Powered By Dew-NewPHPLinks...

DUware DUclassmate 1.x - edit.asp?iPro SQL Injection

DUware DUclassmate 1.x - edit.asp?iPro SQL Injection source: https://www.securityfocus.com/bid/14036/info DUclassmate is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit coul...

FileSeek - CGI Script File Disclosure

FileSeek - CGI Script File Disclosure source: https://www.securityfocus.com/bid/6784/info FileSeek is an example cgi-script from "The CGI/Perl Cookbook from John Wiley & Sons". The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web server...

PHPKB Multi-Language 9 - image-upload.php Authenticated Remote Code Execution

PHPKB Multi-Language 9 - image-upload.php Authenticated Remote Code Execution Exploit Title: PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution Google Dork: N/A Date: 2020-03-15 Exploit Author: Antonio Cannito Vendor Homepage: https://www.knowledgebase-script.com/...

Alienvault OSSIMUSM 5.3.1 - SQL Injection

Alienvault OSSIMUSM 5.3.1 - SQL Injection Details ======= Product: Alienvault OSSIM/USM Vulnerability: SQL Injection Author: Peter Lapp, lappsec gmail com CVE: CVE-2016-8582 Vulnerable Versions: =5.3.1 Fixed Version: 5.3.2 Vulnerability Details ===================== A SQL injection vulnerability...

Exim - GHOST glibc gethostbyname Buffer Overflow (Metasploit)

Exim - GHOST glibc gethostbyname Buffer Overflow Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Exim GHOST glibc gethostbyname Buffer Overflow', 'Description' = %q This...

OpenSSL 1.0.1f TLS Heartbeat Extension - Heartbleed Memory Disclosure (Multiple SSLTLS Versions)

OpenSSL 1.0.1f TLS Heartbeat Extension - Heartbleed Memory Disclosure Multiple SSLTLS Versions Exploit Title: OpenSSL TLS Heartbeat Extension - Memory Disclosure - Multiple SSL/TLS versions Date: 2014-04-09 Exploit Author: Csaba Fitzl Vendor Homepage: http://www.openssl.org/ Software Link:...

Pligg CMS 1.0.4 - story.php SQL Injection

Pligg CMS 1.0.4 - story.php SQL Injection / ! Pligg CMS story.php?id SQL Injection Vulnerability ! Author : Don Tukulesto [email protected] ! Homepage: http://indonesiancoder.com ! Date : Tue, April 27, 2010 ! Tune in : http://antisecradio.fm choose your weapon / Software Information Vendo...

Everest 5.50.2100 - Open File Denial of Service (PoC)

Everest 5.50.2100 - Open File Denial of Service PoC Exploit Title: Everest 5.50.2100 - 'Open File' Denial of Service PoC Discovery by: Ivan Marmolejo Discovery Date: 2020-03-24 Software Link : http://www.lavalys.com/ Tested Version: 5.50.2100 Vulnerability Type: Denial of Service DoS Local Tested...

eFront 3.6.15 - PHP Object Injection

eFront 3.6.15 - PHP Object Injection eFront 3.6.15 PHP Object Injection Vulnerability + Author: Filippo Roncari + Target: eFront + Version: 3.6.15 and probably lower + Vendor: www.efrontlearning.net + Accessibility: Remote + Severity: High + CVE: + Full Advisory:...

Joomla! com_hdwplayer 4.2 - search.php SQL Injection

Joomla! comhdwplayer 4.2 - search.php SQL Injection Exploit Title: Joomla! comhdwplayer 4.2 - 'search.php' SQL Injection Dork: inurl:"index.php?option=comhdwplayer" Date: 2020-03-23 Exploit Author: qw3rTyTy Vendor Homepage: https://www.hdwplayer.com/ Software Link:...

MikroTik RouterOS 6.45.6 - DNS Cache Poisoning

MikroTik RouterOS 6.45.6 - DNS Cache Poisoning Exploit Title: MikroTik RouterOS 6.45.6 - DNS Cache Poisoning Date: 2019-10-30 Exploit Author: Jacob Baines Vendor Homepage: https://mikrotik.com/ Software Link: https://mikrotik.com/download Version: 6.45.6 Stable and below or 6.44.5 Long-term and...

Logitech Webcam Software 1.1 - eReg.exe Local Buffer Overflow (SEH Unicode)

Logitech Webcam Software 1.1 - eReg.exe Local Buffer Overflow SEH Unicode Title: Logitech Webcam Software 1.1 eReg.exe SEH/Unicode Buffer Overflow Date: 9-10-2015 Target tested: Windows 7 x64 Software Link: http://www.logitech.com/pub/techsupport/quickcam/lws110x64.exe Author: Robbie Corley...

Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal

Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Exploit Title: Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Date: 2020-03-26 Exploit Author: hongphukt Vendor Homepage: https://www.jinfonet.com/ Software Link: https://www.jinfonet.com/product/download-jreport/ Version:...

XiongMai uc-httpd 1.0.0 - Buffer Overflow

XiongMai uc-httpd 1.0.0 - Buffer Overflow Exploit Title: XiongMai uc-httpd 1.0.0 - Buffer Overflow Date: 2018-06-08 Exploit Author: Andrew Watson Software Version: XiongMai uc-httpd 1.0.0 Vendor Homepage: http://www.xiongmaitech.com/en/ Tested on: KKMoon DVR running XiongMai uc-httpd 1.0.0 on...

WordPress 4.6 - Remote Code Execution

WordPress 4.6 - Remote Code Execution !/bin/bash / / / / / / / / / / / / / / / / / / // / / / /// / / / / // / // / // / / / / // / // , / / / ///, /,// // //,///||// // // WordPress 4.6 - Remote Code Execution RCE PoC Exploit CVE-2016-10033 wordpress-rce-exploit.sh ver. 1.0 Discovered and...

Web Wiz Guestbook 8.21 - Database Disclosure

Web Wiz Guestbook 8.21 - Database Disclosure ============= Web Wiz Guestbook v8.21 WWGguestbook.mdb Remote Database Disclosure Vulnerability auther : Cold z3ro, www.hackteach.org http://site.com/Path/database/WWGguestbook.mdb Dork : webwizguestbooklicense.asp ============= milw0rm.com 2008-12-16...

Mambo Component Peoplebook 1.0 - Remote File Inclusion

Mambo Component Peoplebook 1.0 - Remote File Inclusion --------------------------------------------------------------------------- Peoplebook Mambo Component = v1.0 Remote File Include Vulnerabilities --------------------------------------------------------------------------- Author : Matdhule Da...

FIBARO System Home Center 5.021 - Remote File Include

FIBARO System Home Center 5.021 - Remote File Include Exploit Title: FIBARO System Home Center 5.021 - Remote File Include Date: 2020-03-22 Author: LiquidWorm Vendor: https://www.fibaro.com CVE: N/A Vendor: FIBAR GROUP S.A. Product web page: https://www.fibaro.com Affected version: Home Center 3,...

UniSharp Laravel File Manager 2.0.0 - Arbitrary File Read

UniSharp Laravel File Manager 2.0.0 - Arbitrary File Read Exploit Title: UniSharp Laravel File Manager 2.0.0 - Arbitrary File Read Google Dork: inurl:"laravel-filemanager?type=Files" -site:github.com -site:github.io Date: 2020-02-04 Exploit Author: NgoAnhDuc Vendor Homepage:...

OpenVPN Connect 3.0.0.272 - agent_ovpnconnect Unquoted Service Path

OpenVPN Connect 3.0.0.272 - agentovpnconnect Unquoted Service Path Exploit Title: OpenVPN Connect 3.0.0.272 - 'ovpnagent' Unquoted Service Path Discovery by: Luis Martinez Discovery Date: 2019-11-03 Vendor Homepage: https://openvpn.net Software Link :...

PRTG Network Monitor 18.2.38 - (Authenticated) Remote Code Execution

PRTG Network Monitor 18.2.38 - Authenticated Remote Code Execution !/bin/bash echo -e "\n\e00;33m++ \e00m" echo -e "\e00;32m Authenticated PRTG network Monitor remote code execution \e00m" echo -e "\e00;33m++ \e00m" echo -e "\e00;32m Date: 11/03/2019 \e00m" echo -e "\e00;33m++ \e00m" echo -e...

Git Submodule - Arbitrary Code Execution

Git Submodule - Arbitrary Code Execution CVE-2018-17456 I've gotten a couple of questions about exploitation for the recent RCE in Git. So here we go with some technical details. TL;DR Here is a PoC repository. EDB Note: Mirror...

Portable OpenSSH 3.6.1p-PAM4.1-SuSE - Timing Attack

Portable OpenSSH 3.6.1p-PAM4.1-SuSE - Timing Attack !/bin/bash $Id: raptorsshtime,v 1.1 2007/02/13 16:38:57 raptor Exp $ raptorsshtime - OpenSSH remote timing attack exploit Copyright c 2006 Marco Ivaldi OpenSSH-portable 3.6.1p1 and earlier with PAM support enabled immediately sends an error...

mail2forum phpBB Mod 1.2 - m2f_root_path Remote File Inclusion

mail2forum phpBB Mod 1.2 - m2frootpath Remote File Inclusion Title : mail2forum = 1.2 Multiple Remote File Include Vulnerabilities Discovered By OLiBekaS ----------------------------------------------------------------------------- Affected software description : Application : mail for phpbb...