Microsoft Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (MS16-008) (2)

Microsoft Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux MS16-008 2 Source: https://code.google.com/p/google-security-research/issues/detail?id=589 Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux 2 Platform: Windows 8.1, not tested any other OS...

TeamSpeak Client 3.0.18.1 - Remote File Inclusion Remote Code Execution

TeamSpeak Client 3.0.18.1 - Remote File Inclusion Remote Code Execution Exploit Title: "PwnSpeak" a 0day Exploit for TeamSpeak Client / 0x6FB30B11 my pgp keyid Vendor Homepage: https://www.teamspeak.com/ Application: TeamSpeak 3 Version: TeamSpeak3 Client 3.0.0 - 3.0.18.1 Platforms: Windows, Mac ...

Beckhoff CX9020 CPU Module - Remote Code Execution

Beckhoff CX9020 CPU Module - Remote Code Execution ! /usr/bin/env python ''' Exploit Title: Beckhoff CX9020 CPU Module Web Exploit RCE Date: 2015-10-22 Exploit Author: Photubias - tijldotdeneutathowestdotbe, based on work by Frank Lycops [email protected] Vendor Homepage:...

Kaseya Virtual System Administrator (VSA) 7.0 9.1 - (Authenticated) Arbitrary File Upload

Kaseya Virtual System Administrator VSA 7.0 9.1 - Authenticated Arbitrary File Upload !/usr/bin/ruby kazPwn.rb - Kaseya VSA v7 to v9.1 authenticated arbitrary file upload CVE-2015-6589 / ZDI-15-450 =================== by Pedro Ribeiro / Agile Information Security Disclosure date: 28/09/2015 Usage...

refbase 0.9.6 - Multiple Vulnerabilities

refbase 0.9.6 - Multiple Vulnerabilities Exploit Title: Refbase 5 /rss.php?where='nonexistent'+union+allselect+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,concat'version:',@@version,'',34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50-- - /rs...

Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1)

Kaseya Virtual System Administrator VSA - Multiple Vulnerabilities 1 Multiple vulnerabilities in Kaseya Virtual System Administrator Discovered by Pedro Ribeiro [email protected], Agile Information Security http://www.agileinfosec.co.uk/...

Apport (Ubuntu 14.0414.1015.04) - Race Condition Privilege Escalation

Apport Ubuntu 14.0414.1015.04 - Race Condition Privilege Escalation / Exploit Title: apport/ubuntu local root race condition Date: 2015-05-11 Exploit Author: rebel Version: ubuntu 14.04, 14.10, 15.04 Tested on: ubuntu 14.04, 14.10, 15.04 CVE : CVE-2015-1325 ==============================...

Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting

Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting Exploit Title: Persistent XSS via Markdown on Telescope = 0.9.2 Date: Aug 22 2014 Exploit Author: shubs Vendor Homepage: http://www.telescopeapp.org/ Software Link: https://github.com/TelescopeJS/Telescope Version: = 0.9.2 CVE :...

Moodle 2.5.92.6.82.7.52.8.3 - Block Title Handler Cross-Site Scripting

Moodle 2.5.92.6.82.7.52.8.3 - Block Title Handler Cross-Site Scripting Moodle 2.5.9/2.6.8/2.7.5/2.8.3 Block Title Handler Cross-Site Scripting Vendor: Moodle Pty Ltd Product web page: https://www.moodle.org Affected version: 2.8.3, 2.7.5, 2.6.8 and 2.5.9 Summary: Moodle is a learning platform...

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery :8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newDCAuthUser...

ManageEngine Desktop Central - Create Administrator

ManageEngine Desktop Central - Create Administrator Administrator account creation in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security =================================================================================...

Windows-OLE-Package-Manager

Very quick and ugly SandWorm CVE-2014-4114 exploit builder Exploit Title: CVE-2014-4114 SandWorm builder Vendor Homepage: microsoft.com Tested on: Win7Sp1 64 bit - Microsoft Offcie 2013 Plus Demo: http://youtu.be/ljjEkhflpv import os import zipfile import sys ''' Very quick and ugly SandWorm...

Easy File Sharing FTP Server 3.5 - Remote Stack Buffer Overflow

Easy File Sharing FTP Server 3.5 - Remote Stack Buffer Overflow !/usr/bin/env python Exploit Title: Easy File Sharing FTP Server 3.5 stack buffer overflow Date: 27 May 2014 Exploit Author: superkojiman - http://www.techorganic.com Vulnerability discovered by: h07 CVE: CVE-2006-3952 OSVDB: 27646...

Catia V5-6R2013 - CATV5_Backbone_Bus Stack Buffer Overflow (PoC)

Catia V5-6R2013 - CATV5BackboneBus Stack Buffer Overflow PoC ''' Title: Dassault Syst�mes Catia V5-6R2013 "CATV5BackboneBus" Stack Buffer Overflow Date: 2-18-2014 Author: Mohamed Shetta Email: mshetta |at| live |dot| com Vendor Homepage:...

Daum Game 1.1.0.5 - ActiveX IconCreate Method Remote Stack Buffer Overflow

Daum Game 1.1.0.5 - ActiveX IconCreate Method Remote Stack Buffer Overflow var overwrite =...

Conceptronic Wireless Pan Tilt Network Camera - Cross-Site Request Forgery

Conceptronic Wireless Pan Tilt Network Camera - Cross-Site Request Forgery General Details Affected Product: Conceptronic camera CIPCAMPTIWL Tested Firmware: 21.37.2.49 Tested Web UI Firmware: 0.61.4.18 Assigned CVE: CVE-2013-7204 CVSSv2 Base Score: 5.8 AV:N/AC:M/AU:N/C:P/I:P/A:N Vulnerability...

XnView 1.99.1 - .JLS File Decompression Heap Overflow

XnView 1.99.1 - .JLS File Decompression Heap Overflow SUMMARY XnView Formats PlugIn is prone to an overflow condition. The JLS Plugin xjpegls.dll library fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted JLS compressed image file, a...

AV Arcade Free Edition - add_rating.php?id Blind SQL Injection

AV Arcade Free Edition - addrating.php?id Blind SQL Injection Exploit Title: AV Arcade Free Edition Blind SQL Injection Date: 31/08/2012 Author: DaOne @LibyanCA Software Link: http://www.avscripts.net/avarcade/freearcadescript/ Google Dork: intext:Powered by AV Arcade Free Edition" Exploit-DB Not...

Able2Extract and Able2Extract Server 6.0 - Memory Corruption

Able2Extract and Able2Extract Server 6.0 - Memory Corruption Exploit Title: Able2Extract and Able2Extract Server v 6.0 Memory Corruption Date: June 24 2012 Exploit Author: Carlos Mario Penagos Hollmann Vendor Homepage: www.investintech.com Version:6.0 Tested on: Windows 7 CVE : cve-2011-4222...

IBM System Storage DS Storage Manager Profiler - Multiple Vulnerabilities

IBM System Storage DS Storage Manager Profiler - Multiple Vulnerabilities IBM System Storage DS Storage Manager Profiler Multiple Vulnerabilities Vendor: IBM Corporation Product web page: http://www.ibm.com Affected version: 4.8.6 Summary: Through its extraordinary flexibility, reliability, and...

TORCS 1.3.2 - .xml File Buffer Overflow SafeSEH Evasion

TORCS 1.3.2 - .xml File Buffer Overflow SafeSEH Evasion / Exploit Title: TORCS Research Team Division Author: Andres Gomez and David Mora a.k.a Mighty-D ... Pwn and beans! Software Link: http://torcs.sourceforge.net/ Version: torcs 1.3.2 Vendor notified: 03/02/2012 Tested on: Windows XP Service...

Microsoft Windows - .fon Kernel-Mode Buffer Overrun (PoC) (MS11-077)

Microsoft Windows - .fon Kernel-Mode Buffer Overrun PoC MS11-077 Exploit Title: MS11-077 .fon buffer overrun kernel-mode drivers exploit Google Dork: if relevant �we will automatically add these to the GHDB Date: 10/12/2011 Author: Byoungyoung Lee, http://www.cc.gatech.edu/blee303/ Software Link:...

Camtron CMNC-200 IP Camera - Undocumented Default Accounts

Camtron CMNC-200 IP Camera - Undocumented Default Accounts Finding 4: Undocumented Default Accounts CVE: CVE-2010-4233 The CMNC-200 IP Camera has undocumented default accounts on its Linux operating system. These accounts can be used to login via the cameras telnet interface, which cannot be...

Altova DatabaseSpy 2011 - Project File Handling Buffer Overflow (PoC)

Altova DatabaseSpy 2011 - Project File Handling Buffer Overflow PoC !/usr/bin/perl Title: Altova DatabaseSpy 2011 Project File Handling Buffer Overflow Vulnerability Vendor: Altova GmbH Product web page: http://www.altova.com Affected version: Enterprise Edition 2011 Summary: Altova DatabaseSpy®...

wpQuiz 2.7 - Authentication Bypass

wpQuiz 2.7 - Authentication Bypass Powered by wpQuiz - Auth bypass Vulnerability My + Author : KnocKout + Greatz : DaiMon Contact : [email protected] Software info Script : wpQuiz Version : 2.7 Download : http://webscripts.softpedia.com/script/Quizz/wpQuiz-41098.html Vulnerability Style : Auth...

Joomla! Component com_rwcards - Local File Inclusion

Joomla! Component comrwcards - Local File Inclusion Author : altbta [email protected] Team : Sec Attack Team Home : www.v4-team.com/cc Script : Joomla Component comrwcards Bug Type : Local File Inclusion LFI Dork : inurl:"comrwcards" === Exploit ===...

Smart Vision Script News - newsdetail.php SQL Injection (1)

Smart Vision Script News - newsdetail.php SQL Injection 1 Exploit Title: Smart Vsion Script News newsdetail SQL Injection Vulnerability Software Link: www.esmart-vision.com ============================================ | Smart Vision Script News newsdetail SQL Injection Vulnerability...

Joomla! Component com_doqment - cid SQL Injection

Joomla! Component comdoqment - cid SQL Injection Joomla Component comdoqment cid SQL Injection Vulnerability Author : Gamoscu Site : www.1923turk.biz Site : www.1923turk.com Greetz : Baybora - Manas58 - Delibey - Tiamo - Psiko - Turco - infazci - X-TRO Blog : http://gamoscu.wordpress.com/ DORK:...

Horde 3.3.5 - PHP_SELF Cross-Site Scripting

Horde 3.3.5 - PHPSELF Cross-Site Scripting ============================================= INTERNET SECURITY AUDITORS ALERT 2009-012 - Original release date: October 13th, 2009 - Last revised: December 16th, 2009 - Discovered by: Juan Galiana Lara - CVE ID: CVE-2009-3701 - Severity: 6.3/10 CVSS Bas...

SitioOnline - SQL Injection

SitioOnline - SQL Injection - cvs -vrew ! SitioOnline SQL Injection Vulnerability ! Author : 4lG3r14n0-t3r0 ! MAIL : [email protected] / Software Information + Vendor : http://www.SitioOnline.cl + script : SitioOnline + Download : + Vulnerability : php SQL injection + Dork...

BPLawyerCaseDocuments - SQL Injection

BPLawyerCaseDocuments - SQL Injection x========================================================================================================================================x | AntiSecuritydotorg |...

unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities

unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities Author girex Homepage girex.altervista.org Date 31/05/2009 CMS Unclassified NewsBoard 1.6.4 and maybe lower Dork "This board is powered by the Unclassified NewsBoard software, 1.6.4" Multiple remote vulnerabilities 1 Remote SQL Injection...

Novell Groupwise 8.0 - RCPT Off-by-One

Novell Groupwise 8.0 - RCPT Off-by-One !usr/bin/perl -w QUICK AND DIRTY EXPLOIT Off-by-one error in the SMTP daemon in GroupWise Internet Agent GWIA in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 allows remote attackers to execute arbitrary code via a long e-mail address in a...

OpenBSD 4.0 - vga Local Privilege Escalation

OpenBSD 4.0 - vga Local Privilege Escalation / A PRODUCTION OF LUL-DISLCOSURE INC. PROUDLY PRESENTS... 888 888 888 888 888 888 .d88b. 88888b. .d88b. 88888b. 88888b. .d8888b .d88888 d88""88b 888 "88b d8P Y8b 888 "88b 888 "88b 88K d88" 888 888 888 888 888 88888888 888 888 888 888 "Y8888b. 888 888...

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From...

Apple QuickTime 7.2 - SMIL Remote Integer Overflow

Apple QuickTime 7.2 - SMIL Remote Integer Overflow ---------------------------------------------------------------------- ATTACK VECTORS ---------------------------------------------------------------------- This vulnerability can be triggered by luring a target user into running a malicious SMIL...

Live for Speed S1S2Demo - .spr Local Buffer Overflow

Live for Speed S1S2Demo - .spr Local Buffer Overflow / 0day Live for speed patch x s2 /s1 and demo local .Spr File buffer over flow Spr file's are also exploitable although i had to go about it a different Way,At first it wasn't possible to do a jmp esp,But with a little more buffer i Managed to...

Active Link Engine - default.asp?catid SQL Injection

Active Link Engine - default.asp?catid SQL Injection Title : Active Link Engine Remote SQL Injection Vulnerability Author : CyberGhost My Web Site : http://aspspider.org/cgsecurity Demo Page : http://www.activewebsoftwares.com/demoactivelinkengine Script Page :...

Simple Machines Forum (SMF) 1.1 rc2 - Lock Topics

Simple Machines Forum SMF 1.1 rc2 - Lock Topics !/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i;...

Mambo Component Pearl 1.6 - Multiple Remote File Inclusions

Mambo Component Pearl 1.6 - Multiple Remote File Inclusions --------------------------------------------------------------------------- Pearl For Mambo = 1.6 GlobalSettingstemplatesDirectory Remote File Include Vulnerabilities...

BlueCoat WinProxy 6.0 R1c - GET Denial of Service

BlueCoat WinProxy 6.0 R1c - GET Denial of Service !perl "WinProxy 6.0 R1c" Remote DoS Exploit Author: FistFucker e-Mail: [email protected] Advisory: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=363 CVE info: CAN-2005-3187 use IO::Socket; destination IP address $ip =...

Multiple Vendor BIOS - Keyboard Buffer Password Persistence (2)

Multiple Vendor BIOS - Keyboard Buffer Password Persistence 2 // source: https://www.securityfocus.com/bid/15751/info Multiple vendors fail to clear the BIOS Basic Input-Output System keyboard buffer after reading the preboot authentication password during the system startup process. Depending on...

Early Impact ProductCart 2.62.7 - viewPrd.asp?idcategory SQL Injection

Early Impact ProductCart 2.62.7 - viewPrd.asp?idcategory SQL Injection source: https://www.securityfocus.com/bid/13881/info ProductCart is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it...

Multiple Vendor ICMP Message Handling - Denial of Service

Multiple Vendor ICMP Message Handling - Denial of Service source: https://www.securityfocus.com/bid/13124/info Multiple vendor implementations of TCP/IP Internet Control Message Protocol ICMP are reported prone to several denial-of-service attacks. ICMP is employed by network nodes to determine...

cPanel 5.0 - Guestbook.cgi Remote Command Execution (2)

cPanel 5.0 - Guestbook.cgi Remote Command Execution 2 source: https://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cg...

DotBr 0.1 - System.php3 Remote Command Execution

DotBr 0.1 - System.php3 Remote Command Execution source: https://www.securityfocus.com/bid/6866/info The DotBr 'system.php3' script is prone to a remote command execution vulnerability. This is due to insufficient sanitization of user-supplied data. Exploitation may result in execution of arbitra...

Hassan Consulting Shopping Cart 1.18 - Directory Traversal

Hassan Consulting Shopping Cart 1.18 - Directory Traversal source: https://www.securityfocus.com/bid/1777/info The $page variable in Hassan Consulting Shopping Cart does not properly check for insecure relative paths such as the double dot "..". Therefore, requesting the following URL will displa...

HP-UX 1011 IRIX 3456 OpenSolaris build snv Solaris 8910 SunOS 4.1 - rpc.ypupdated Command Execution (1)

HP-UX 1011 IRIX 3456 OpenSolaris build snv Solaris 8910 SunOS 4.1 - rpc.ypupdated Command Execution 1 / source: https://www.securityfocus.com/bid/1749/info HP-UX 10.x/11.x,IRIX 3.x/4.x/5.x/6.x,OpenSolaris build snv,Solaris 8/9/10,SunOS 4.1.x RPC.YPUpdated Command Execution 1 The 'rpc.ypupdated'...

Torrent iPod Video Converter 1.51 - Stack Overflow

Torrent iPod Video Converter 1.51 - Stack Overflow Exploit Title: Torrent iPod Video Converter 1.51 - Stack Overflow Exploit Author: boku Date: 2020-02-10 Software Vendor: torrentrockyou Vendor Homepage: http://www.torrentrockyou.com Software Link:...

Omron PLC 1.0.0 - Denial of Service (PoC)

Omron PLC 1.0.0 - Denial of Service PoC Exploit Title: Omron PLC 1.0.0 - Denial of Service PoC Google Dork: n/a Date: 2019-12-06 Exploit Author: n0b0dy Vendor Homepage: https://automation.omron.com, ia.omron.com Software Link: n/a Version: 1.0.0 Tested on: PLC f/w rev.: CJ2M v2.01 CWE-412 :...