XhP CMS 0.5.1 - Cross-Site Request Forgery Persistent Cross-Site Scripting

XhP CMS 0.5.1 - Cross-Site Request Forgery Persistent Cross-Site Scripting Exploit Title: XhP CMS 0.5.1 - Cross-Site Request Forgery to Persistent Cross-Site Scripting Exploit Author: Ahsan Tahir Date: 19-10-2016 Software Link: https://sourceforge.net/projects/xhp/ Vendor:...

JCraftJSch Java Secure Channel 0.1.53 - Recursive sftp-get Directory Traversal

JCraftJSch Java Secure Channel 0.1.53 - Recursive sftp-get Directory Traversal Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725 Version: 0.3 Date: Aug 31st, 2016 Complete Proof of Concept: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725...

CubeCart 3.0.12 - Multiple Vulnerabilities

CubeCart 3.0.12 - Multiple Vulnerabilities CubeCart Multiple Vulnerabilities Vendor: Devellion Limited Product: CubeCart Version: = 3.0.12 Website: http://www.cubecart.com BID: 19782 CVE: CVE-2006-4525 OSVDB: 28279 28280 28281 SECUNIA: 21659 Description: CubeCart is a very popular web application...

PHP 7.0.5 - ZipArchive::getFrom* Integer Overflow

PHP 7.0.5 - ZipArchive::getFrom Integer Overflow Details ======= An integer wrap may occur in PHP 7.x before version 7.0.6 when reading zip files with the getFromIndex and getFromName methods of ZipArchive, resulting in a heap overflow. php-7.0.5/ext/zip/phpzip.c ,---- | 2679 static void...

Panda Endpoint Administration Agent 7.50.00 - Local Privilege Escalation

Panda Endpoint Administration Agent 7.50.00 - Local Privilege Escalation CVE: CVE-2016-3943 Vendor: Panda Security Reported by: Kyriakos Economou Date of Release: 05/04/2016 Affected Products: Multiple Affected Version: Panda Endpoint Administration Agent v7.50.00 Fixed Version: Panda Endpoint...

FreeBSD 10.2 (x64) - amd64_set_ldt Heap Overflow

FreeBSD 10.2 x64 - amd64setldt Heap Overflow / 1. Advisory Information Title: FreeBSD Kernel amd64setldt Heap Overflow Advisory ID: CORE-2016-0005 Advisory URL: http://www.coresecurity.com/content/freebsd-kernel-amd64setldt-heap-overflow Date published: 2016-03-16 Date of last update: 2016-03-14...

glibc - getaddrinfo Stack Buffer Overflow (PoC)

glibc - getaddrinfo Stack Buffer Overflow PoC Sources: https://googleonlinesecurity.blogspot.sg/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html https://github.com/fjserna/CVE-2015-7547 Technical information: glibc reserves 2048 bytes in the stack through alloca for the DNS answer at...

SAP HANA 1.00.095 - hdbindexserver Memory Corruption

SAP HANA 1.00.095 - hdbindexserver Memory Corruption ERPSCAN-15-024 SAP HANA hdbindexserver - Memory corruption Application: SAP HANA Versions Affected: SAP HANA 1.00.095 Vendor URL: http://SAP.com Bugs: Memory corruption, RCE Reported: 17.07.2015 Vendor response: 18.07.2015 Date of Public...

WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting

WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link:...

WordPress Plugin GigPress 2.3.8 - SQL Injection

WordPress Plugin GigPress 2.3.8 - SQL Injection Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+ Vulnerable version: 2.3.8 Fixed version: 2.3.9...

Microsoft-Excel-Malformed-FEATHEADER

MS Excel Malformed FEATHEADER Record Exploit CVE-2009-3129, MS09-067, OSVDB-59860 Vulnerble application MS office 2003/2007 import sys import zlib Allwin WinExec cmd.exe + ExitProcess Shellcode - 195 bytes by RubberDuck = shellcode = b"\xFC\x33\xD2\xB2\x30\x64\xFF\x32\x5A\x8B"...

Elipse E3 - HTTP Denial of Service

Elipse E3 - HTTP Denial of Service // Exploit Http DoS Request for SCADA ATTACK Elipse 3 // Mauro Risonho de Paula Assumpção aka firebits // [email protected] // 29-10-2013 11:42 // Vendor Homepage: http://www.elipse.com.br/port/index.aspx // Software Link:...

GOM Player 2.2.57.5189 - .ogg Crash (PoC)

GOM Player 2.2.57.5189 - .ogg Crash PoC ''' Exploit Title: Gomplayer Memory Corruption vulnerability latest Version 2.2.57.5189 Date: 2014/05/06 Exploit Author: Aryan Bayaninejad Linkedin : https://www.linkedin.com/profile/view?id=276969082 Vendor Homepage: www.gomlab.com Software Link:...

ownCloud 6.0.0a - Multiple Vulnerabilities

ownCloud 6.0.0a - Multiple Vulnerabilities Exploit Title: ownCloud 6.0.0a File Deletion XSS and CSRF Protection Bypass Vendor Homepage: www.ownCloud.org OwnCloud Version: 6.0.0a Browsers tested: Iceweasel 22.0; Internet Explorer 11; Server: Debian. Default LAMP set-up. Exploit Author: James Sible...

Apache Struts2 2.0.0 2.3.15 - Prefixed Parameters OGNL Injection

Apache Struts2 2.0.0 2.3.15 - Prefixed Parameters OGNL Injection CVE Number: CVE-2013-2251 Title: Struts2 Prefixed Parameters OGNL Injection Vulnerability Affected Software: Apache Struts v2.0.0 - 2.3.15 Credit: Takeshi Terada of Mitsui Bussan Secure Directions, Inc. Issue Status: v2.3.15.1 was...

appRain 3.0.2 - Blind SQL Injection

appRain 3.0.2 - Blind SQL Injection Advisory ID: HTB23177 Product: appRain Vendor: appRain Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: October 9, 2013 without technical details Vendor Notification: October 9, 2013 Public Disclosure: November 6, 2013...

Weathermap 0.97c - mapname Local File Inclusion

Weathermap 0.97c - mapname Local File Inclusion ============================================= WEBERA ALERT ADVISORY 01 - Discovered by: Anthony Dubuissez - Severity: high - CVE Request - 03/06/2013 - CVE Assign - 03/06/2013 - CVE Number - CVE-2013-3739 - Vendor notification - 03/06/2013 - Vendor...

Linux Kernel 3.8.9 (x86-64) - perf_swevent_init Local Privilege Escalation (2)

Linux Kernel 3.8.9 x86-64 - perfsweventinit Local Privilege Escalation 2 / CVE-2013-2094 exploit x8664 Linux include include include include include include include include include define BASE 0x380000000 define BASEJUMP 0x1780000000 define SIZE 0x10000000 define KSIZE 0x2000000 define TMPx...

TagScanner 5.1 - Stack Buffer Overflow (PoC)

TagScanner 5.1 - Stack Buffer Overflow PoC Title: ====== TagScanner v5.1 - Stack Buffer Overflow Vulnerability Date: ===== 2013-01-22 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=831 VL-ID: ===== 831 Introduction: ============= TagScanner is a multifunction program f...

vBulletin Yet Another Awards System 4.0.2 - SQL Injection

vBulletin Yet Another Awards System 4.0.2 - SQL Injection Exploit Title: vBulletin Yet Another Awards System 4.0.2 Time Based SQL Injection 0day Google Dork: inurl:awards.php intext:"powered by vbulletin" Date: 29/08/12 Exploit Author: Backsl@sh/Dan Software Link:...

Apple Mac OSX 10.6.7 - Kernel Panic (Denial of Service)

Apple Mac OSX 10.6.7 - Kernel Panic Denial of Service / Mac OS X include include include include include void dummyfunc void asm volatile ".byte 0xff" ; int main void int ret; union ldtentry cgate, cgate2; char dummy128 = 0x00,; cgate.callgate.offset00 = unsigned intdummyfunc & 0xffff;...

SOOP Portal Raven 1.0b - SQL Injection

SOOP Portal Raven 1.0b - SQL Injection Exploit Title: SOOP Portal Raven 1.0b sql injection Google Dork: Powered by SOOP Portal Raven 1.0b Date: date Author: Evil-Thinker Version: Raven 1.0b Tested on: Windows Soft Technologie : ASP.net Exploit Details :...

EzPub Simple Classic ASP CMS - SQL Injection

EzPub Simple Classic ASP CMS - SQL Injection Title: EzPub - Simple Classic ASP CMS Vulnerable to SQL Injection Vendor: http://www.soft4web.ro Found by: p0pc0rn 08/03/2011 Dork: intext:"Powered by EZPub" SQL - Microsoft JET Database Engine error ------------------------------------------...

Apache Archiva 1.0 1.3.1 - Cross-Site Request Forgery

Apache Archiva 1.0 1.3.1 - Cross-Site Request Forgery ANATOLIA SECURITY ADVISORY -------------------------------------- ADVISORY INFO + Title: Apache Archiva Cross-site Request Forgery Vulnerability + Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt + Advisory ID: 2010-001 +...

Native Instruments Kontakt 4 Player - .NKI File Syntactic Analysis Buffer Overflow (PoC)

Native Instruments Kontakt 4 Player - .NKI File Syntactic Analysis Buffer Overflow PoC / Title: Native Instruments Kontakt 4 Player NKI File Syntactic Analysis Buffer Overflow PoC Vendor: Native Instruments GmbH Product web page: http://www.native-instruments.com Affected version: 4.1.3.4125...

RealPlayer - FLV Parsing Integer Overflow

RealPlayer - FLV Parsing Integer Overflow ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | = 0x7507508 -- crash flvBody2 = "\x00\x00\x09\x00\x00\x00\x20" flv = open'poc.flv', 'wb+' flv.writeflvHeader flv.writeflvBody1 flv.writeHXFLVMETAAMFTYPEMIXEDARRAYValue...

ClanSphere 2010 - Multiple Vulnerabilities

ClanSphere 2010 - Multiple Vulnerabilities Exploit Title: Clansphere Multiple vulnerabilities Date: 24/08/2010 Author: Sweet Contact : [email protected] Software Link: Download:http: http://sourceforge.net/projects/clansphere/ Version: all Tested on: WinXp sp3 Risk : HIGHT...

Adobe Flash Reader - Live Malware

Adobe Flash Reader - Live Malware Exploit-DB Note - Live POC originally found at http://qoop.org/security/poc/cve-2010-1297/ File is malicious! Taken from the wild! Beware! To decrypt the file: openssl aes-256-cbc -d -a -in adobe-0day-2010-1297.tar.enc -out adobe-0day-2010-1297.tar Password is...

CubeCart 4 - Session Management Bypass

CubeCart 4 - Session Management Bypass CubeCart 4 Session Management Bypass Release Date: 2009/10/29 Author: Bogdan Calin bogdan at acunetix dot com Severity: Critical Vendor Status: Vendor has released an updated version I. Background From Wikipedia: CubeCart is a free-to-use eCommerce software...

ClanWeb 1.4.2 - Remote Change Password Add Admin

ClanWeb 1.4.2 - Remote Change Password Add Admin =-=-remote change password and add admin xpl-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script:ClanWeb 1.4.2 ------------------------------------------------- Author: ahmadbady my site :Coming Soon...

PHP-Fusion Mod Book Panel - bookid SQL Injection

PHP-Fusion Mod Book Panel - bookid SQL Injection /+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\ + + + |----------------------------------------------------------------| + + | PHP-Fusion Mod - Book Panel Remote SQL Injectio...

DMXReady PayPal Store Manager 1.1 - Contents Change

DMXReady PayPal Store Manager 1.1 - Contents Change Title : DMXReady PayPal Store Manager http://target/path//applications/PayPalStoreManager/incpaypalstoremanager.asp Edit - http://target/path//admin/PayPalStoreManager/CategoryManager/list.asp : milw0rm.com 2009-01-14...

TugZip 3.00 Archiver - .zip Local Buffer Overflow

TugZip 3.00 Archiver - .zip Local Buffer Overflow /0day TUGzip 3.00 archiver .ZIP File Local Buffer Overflow "If you change things ,forever,there's no going back,you see for them you're just a freak, like me ..Mhaaaahaaaaaaaaaaaaaaaaaaaa"JK Well hello there ,greetz from Romania,here is a exploit...

X.Org xorg-server 1.1.1-48.13 - Probe for Files (PoC)

X.Org xorg-server 1.1.1-48.13 - Probe for Files PoC !/bin/sh Xorg file disclosure vulnerability CVE-2007-5958 Lame xploit by vl4dZ : sh-3.1$ whoami uid=1001kecos gid=1001user groups=1001user sh-3.1$ ./Xorg-File-Existence-PoC.sh /root/.ssh/iddsa ... FILE /root/.ssh/iddsa EXIST !! Vulnerable:...

DRBGuestbook 1.1.13 - index.php Cross-Site Scripting

DRBGuestbook 1.1.13 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/25911/info DRBGuestbook is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute...

EVA-Web 1.1 2.2 - index.php3 Remote File Inclusion

EVA-Web 1.1 2.2 - index.php3 Remote File Inclusion / \ / \ | | | | | | | | | | | / | | | | | | | ' / | | ' \ / \ | | | | || | || | | | \ | | | | / | , |/ /|| ||| |||| / | |/ Program Title EVA-Web 1.1=2.2 Remote File Inclusion Note A patch was released some time ago..but there was never an...

NavBoard 2.6.0 - Remote Code Execution

NavBoard 2.6.0 - Remote Code Execution "; print ""; print ""; print "Main forum settings"; print ""; print "Board Title"; print ""; print ""; print ""; print "Admin email address blank will not display"; print ""; print "input type=tex...

Active Link Engine - default.asp?catid SQL Injection

Active Link Engine - default.asp?catid SQL Injection Title : Active Link Engine Remote SQL Injection Vulnerability Author : CyberGhost My Web Site : http://aspspider.org/cgsecurity Demo Page : http://www.activewebsoftwares.com/demoactivelinkengine Script Page :...

F3Site 2.1 - Remote Code Execution

F3Site 2.1 - Remote Code Execution ? // //Kacper & str0ke Settings $exploitname = "F3Site = 2.1 Remote Code Execution Exploit"; $scriptname = "F3Site 2.1"; $scriptsite = "http://dhost.info/compmaster/"; $dork = '"Powered by F3Site"'; //to work exploit you need admin session, and cookies prefix //...

TikiWiki 1.9 Sirius - jhot.php Remote Command Execution

TikiWiki 1.9 Sirius - jhot.php Remote Command Execution !/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++...

ZipCentral 4.01 - .ZIP File Handling Local Buffer Overflow

ZipCentral 4.01 - .ZIP File Handling Local Buffer Overflow / ZipCentral 4.01 Exploit by bratax http://www.bratax.be/ Soooooo many thanks to BuzzDee and c0rrupt for helping me with all the problems I encountered : Wouldn't have finished this without you guys! Greetz to everyone I like... no, that...

ScozNews 1.2.1 - mainpath Remote File Inclusion

ScozNews 1.2.1 - mainpath Remote File Inclusion DEVIL TEAM THE BEST POLISH TEAM ScozNews v1.2.1 - Remote File Include Find by Kacper Rahim. Greetings For ALL DEVIL TEAM members, Special DragonHeart : Contact: [email protected] or http://www.devilteam.yum.pl dork: "Powered By ScozNews"...

BlueCoat WinProxy 6.0 R1c - GET Denial of Service

BlueCoat WinProxy 6.0 R1c - GET Denial of Service !perl "WinProxy 6.0 R1c" Remote DoS Exploit Author: FistFucker e-Mail: [email protected] Advisory: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=363 CVE info: CAN-2005-3187 use IO::Socket; destination IP address $ip =...

PPA 0.5.6 - ppa_root_path File Inclusion

PPA 0.5.6 - pparootpath File Inclusion source: https://www.securityfocus.com/bid/14209/info PPA is susceptible to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitra...

Multiple Vendor ICMP Implementation - Malformed Path MTU Denial of Service

Multiple Vendor ICMP Implementation - Malformed Path MTU Denial of Service source: https://www.securityfocus.com/bid/13124/info Multiple vendor implementations of TCP/IP Internet Control Message Protocol ICMP are reported prone to several denial-of-service attacks. ICMP is employed by network nod...

AWStats 5.7 6.2 - Multiple Remote

AWStats 5.7 6.2 - Multiple Remote / AWStats v5.7 - v6.2 sileAWSxpl This exploit utilize three methods for exploiter the vulnerability found on AWStats software. an user can execute remote code on vulnerable machine, with httpd privileges. References: www.securityfocus.org/bid/12543 coded by:...

Microsoft Windows SQL Server - Remote Denial of Service (MS03-031)

Microsoft Windows SQL Server - Remote Denial of Service MS03-031 //////////////////////////////////////////////////////////////// // // Microsoft SQL Server DoS Remote Exploit MS03-031 // By refdom of xfocus // //////////////////////////////////////////////////////////////// include include inclu...

Apache 1.x2.0.x - Chunked-Encoding Memory Corruption (1)

Apache 1.x2.0.x - Chunked-Encoding Memory Corruption 1 // source: https://www.securityfocus.com/bid/5033/info When processing requests coded with the 'Chunked Encoding' mechanism, Apache fails to properly calculate required buffer sizes. This is believed to be due to improper signed interpretatio...

Microsoft IIS 4.0 Microsoft JET 3.53.5.1 Database Engine - VBA

Microsoft IIS 4.0 Microsoft JET 3.53.5.1 Database Engine - VBA source: https://www.securityfocus.com/bid/286/info Microsoft's JET database engine feature allows the embedding of Visual Basic for Application in SQL string expressions and the lack of metacharacter filtering by many web applications...

F-Secure Internet Gatekeeper 5.40 - Heap Overflow (PoC)

F-Secure Internet Gatekeeper 5.40 - Heap Overflow PoC Title: F-Secure Internet Gatekeeper 5.40 - Heap Overflow PoC Date: 2020-01-30 Author: Kevin Joensen Vendor: F-Secure Software: https://www.f-secure.com/en/business/downloads/internet-gatekeeper CVE: N/A Reference:...