PHP File Vault 0.9 - Directory Traversal

PHP File Vault 0.9 - Directory Traversal PHP File Vault version 0.9 , remote directory traversal and read file vulnerabilty ================================================================================== Discovered by NA, NAattutanota.com ====================================== Description...

Microsoft Internet Explorer 91011 - CDOMStringDataList::InitFromString Out-of-Bounds Read (MS15-112)

Microsoft Internet Explorer 91011 - CDOMStringDataList::InitFromString Out-of-Bounds Read MS15-112 !-- CVE-2015-6086 Out Of Bound Read Vulnerability Address Space Layout Randomization ASLR Bypass Improper handling of new line and white space character caused Out of Bound Read in...

Infor CRM 8.2.0.1136 - Multiple HTML Script Injection Vulnerabilities

Infor CRM 8.2.0.1136 - Multiple HTML Script Injection Vulnerabilities Infor CRM 8.2.0.1136 Multiple HTML Script Injection Vulnerabilities Vendor: Infor Product web page: http://www.infor.com Affected version: 8.2.0.1136 Summary: Infor® CRM, formerly Saleslogix, is an award-winning customer...

D-Link DIR-645 - Multiple UPNP Vulnerabilities

D-Link DIR-645 - Multiple UPNP Vulnerabilities Advisory Information Title: Dlink DIR-645 UPNP Buffer Overflow Vendors contacted: William Brown Dlink Release mode: Released CVE: None Note: All these security issues have been discussed with the vendor and vendor indicated that they have fixed issue...

Mango Automation 2.6.0 - Multiple Vulnerabilities

Mango Automation 2.6.0 - Multiple Vulnerabilities Mango Automation 2.6.0 CSRF File Upload And Arbitrary JSP Code Execution Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a...

NETGEAR Wireless Management System 2.1.4.15 (Build 1236) - Privilege Escalation

NETGEAR Wireless Management System 2.1.4.15 Build 1236 - Privilege Escalation NETGEAR Wireless Management System - Authentication Bypass and Privilege Escalation. WMS5316 ProSafe 16AP Wireless Management System - Firmware 2.1.4.15 Build 1236. - Vulnerability Information:...

WordPress Plugin Simple Ads Manager 2.5.94 - Arbitrary File Upload

WordPress Plugin Simple Ads Manager 2.5.94 - Arbitrary File Upload Vulnerability title: Wordpress plugin Simple Ads Manager - Arbitrary File Upload Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 Download lin...

Linux Kernel 3.15.6 - PPP-over-L2TP Socket Level Handling Crash (PoC)

Linux Kernel 3.15.6 - PPP-over-L2TP Socket Level Handling Crash PoC / ---------------------------------------------------------------------------------------------------- cve-2014-4943poc.c The PPPoL2TP feature in net/l2tp/l2tpppp.c in the Linux kernel through 3.15.6 allows local users to gain...

Pandora FMS 5.1 SP1 - SQL Injection

Pandora FMS 5.1 SP1 - SQL Injection Document Title: =============== Pandora FMS v5.1 SP1 - SQL Injection Web Vulnerability References Source: ==================== http://vulnerability-lab.com/getcontent.php?id=1355 Release Date: ============= 2015-02-09 Vulnerability Laboratory ID VL-ID:...

phpMyFAQ 2.8.x - Multiple Vulnerabilities

phpMyFAQ 2.8.x - Multiple Vulnerabilities Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is able to view information about specif...

Microsoft Windows XP SP3 - MQAC.sys Arbitrary Write Privilege Escalation

Microsoft Windows XP SP3 - MQAC.sys Arbitrary Write Privilege Escalation Title: Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation Advisory ID: KL-001-2014-003 Publication Date: 2014.07.18 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2014-003.txt 1...

Collabtive 1.2 - Persistent Cross-Site Scripting

Collabtive 1.2 - Persistent Cross-Site Scripting Vulnerability title: Stored XSS vulnerability in Collabtive application CVE-2014-3247 CVE: CVE-2014-3247coordinated with cve assigning team and vendor Vendor: Collabtive Product: Collabtive Open Source Project Management Software Affected version:...

Huawei E5331 MiFi Mobile Hotspot 21.344.11.00.414 - Multiple Vulnerabilities

Huawei E5331 MiFi Mobile Hotspot 21.344.11.00.414 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Unauthenticated access & manipulation of settings product: Huawei E5331 MiFi mobile hotspot...

TRENDnet TEW-812DRU - Cross-Site Request ForgeryCommand Injection Root

TRENDnet TEW-812DRU - Cross-Site Request ForgeryCommand Injection Root TRENDnet TEW-812DRU CSRF - Command Injection Shell Exploit. Please wait... //Request to enable port forwarding to the routers internal IP on port 23 //This exploit works without this request, but the exploit was more stable wi...

GnuTLS libgnutls - Double-Free Certificate List Parsing Remote Denial of Service

GnuTLS libgnutls - Double-Free Certificate List Parsing Remote Denial of Service Sorry I forgot to write headers in previous mail. Exploit Title: possible ways to exploit CVE-2012-1663 GNUTLS-3.0.13 Google Dork: if relevant we will automatically add these to the GHDB Date: Mar 20, 2013 Exploit...

SumatraPDF 2.1.1MuPDF 1.0 - Integer Overflow

SumatraPDF 2.1.1MuPDF 1.0 - Integer Overflow Sumatra 2.1.1/MuPDF 1.0 Integer Overflow ======================================= There is an integer overflow on the MuPDF in the lexnumber function which can be triggered using a corrupt PDF file with ObjStm. I'm attaching a file that reproduces the...

Apple iTunes 10.6.1.7 - Extended m3u Stack Buffer Overflow (Metasploit)

Apple iTunes 10.6.1.7 - Extended m3u Stack Buffer Overflow Metasploit ============================================================================================ Apple iTunes 'iTunes Extended M3U Stack Buffer Overflow', 'Description' = %q This module exploits a stack buffer overflow in iTunes...

Brim 2.0.0 - SQL Injection

Brim 2.0.0 - SQL Injection BRIM 2.0.0 SQL InjectionExploit information - Exploit Title: BRIM 2.0.0 SQL Injection - Google Dork: "Brim project" intitle:"Brim - login" - Date: 2012-02-20 - Author: ifnull - Tested on: Apache/2.2.3, PHP/5.1.6, MySQL 5.0.45 � although it should work on any environment...

Java 6.19 CMM readMabCurveData - Remote Stack Overflow

Java 6.19 CMM readMabCurveData - Remote Stack Overflow ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | You have exploited!!! ''' fHTML = open'index.html', 'w' fHTML.writestrHTML fHTML.close fdR = open'kodak.icm', 'rb+' strTotal = fdR.read str1 = strTotal:9154...

PreProject Multi-Vendor Shopping Malls - SQL Injection

PreProject Multi-Vendor Shopping Malls - SQL Injection Source: Pre Multi-Vendor Shopping Malls SQL Injection Vulnerability Download: http://preproject.com/products.asp Dork: inurl:Powered by: PreProjects + detail.php?prodid=694 Author: [email protected] Exploit :...

Adobe Shockwave Player 11.5.6.606 - DIR Multiple Memory Vulnerabilities

Adobe Shockwave Player 11.5.6.606 - DIR Multiple Memory Vulnerabilities / Title: Adobe Shockwave Player 11.5.6.606 DIR Multiple Memory Vulnerabilities Vendor: Adobe Systems Incorporated Product web page: http://www.adobe.com Summary: Over 450 million Internet-enabled desktops have installed Adobe...

Portable AVS DVD Authoring 1.3.3.51 - Local Crash (PoC)

Portable AVS DVD Authoring 1.3.3.51 - Local Crash PoC C:\perl\bin Exploit Title: Portable AVS DVD Authoring Date: 2010/4pr/05 Author: R3d-D3v!L Version: v1.3.3.51 Tested on: windows XP sp3 Coded by x$file"; print $FILE "$boom"; close$FILE; print "Done..!\n";...

Ingres Database 9.3 - Heap Buffer Overflow

Ingres Database 9.3 - Heap Buffer Overflow source: https://www.securityfocus.com/bid/38001/info Ingres Database is prone to a heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Attackers can exploit this issue to execu...

BM Classifieds Ads - SQL Injection

BM Classifieds Ads - SQL Injection ALGERIAN HACKER - NORTH-AFRICA SECURITY TEAM - ! BM Classifieds ads SQL injection vulnerability ! Author : Dr.0rYX & Cr3w-DZ ! MAIL : [email protected] & [email protected] / Software Information + Vendor : http://www.bmscripts.com/ + script : powered by BM Classified...

Asterisk IAX2 - Attacked IAX Fuzzer Resource Exhaustion (Denial of Service)

Asterisk IAX2 - Attacked IAX Fuzzer Resource Exhaustion Denial of Service !/usr/bin/perl -w udp IAX protocol fuzzer Created: Blake Cornell Exploits found with this code can be found at http://www.securityscraper.com/ Released under the VoIPER project Do not hesitate to show enthusiasm and support...

Linux Kernel 2.6 (Gentoo Ubuntu 8.109.04) UDEV 1.4.1 - Local Privilege Escalation (2)

Linux Kernel 2.6 Gentoo Ubuntu 8.109.04 UDEV 1.4.1 - Local Privilege Escalation 2 / cve-2009-1185.c udev http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185 udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, whic...

Qwerty CMS - id SQL Injection

Qwerty CMS - id SQL Injection QWERTY CMS lite - SQL INJ Found: b3 from GraBBerZ.com = Injection in index.php variable: id http://site/index.php?act=publ&id=-3+UNION+SELECT+1,2,3,4,5 = Administrator Table: rkh8t5po Columns: secret873ktlW,pass459khyf Column with pass: pass459khyf Admin CP:...

Joomla! Component beamospetition 1.0.12 - SQL Injection Cross-Site Scripting

Joomla! Component beamospetition 1.0.12 - SQL Injection Cross-Site Scripting Joomla component beamospetition 1.0.12 Sql Injection / Xss Author : vdss Dork : "Powered by beamospetition 1.0.12" Dl : http://joomlacode.org/gf/project/beamospetition/ Xss :...

MKPortal 1.2.1 - Multiple Vulnerabilities

MKPortal 1.2.1 - Multiple Vulnerabilities waraxe-2009-SA070 - Multiple Vulnerabilities in MKPortal = 1.2.1 ============================================================================== Author: Janek Vind "waraxe" Date: 15. January 2009 Location: Estonia, Tartu Web:...

DMXReady Account List Manager 1.1 - Contents Change

DMXReady Account List Manager 1.1 - Contents Change Title : DMXReady Account List Manager http://target/path//applications/AccountListManager/incaccountlistmanager.asp Edit - http://target/path//admin/AccountListManager/addcategory.asp : milw0rm.com 2009-01-13...

WebStudio eHotel - Blind SQL Injection

WebStudio eHotel - Blind SQL Injection WebStudio eHotel pageid Blind SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc script : http://www.bdigital.biz/index.php?pageid=216 DorK : "Powered by WebStudio eHotel" Demo :...

phpScheduleIt 1.2.10 - reserve.php Remote Code Execution

phpScheduleIt 1.2.10 - reserve.php Remote Code Execution settitletranslate"Processing $Class"; 53. $t-printHTMLHeader; 54. $t-startMain; 55. 56. processreservation$POST'fn'; 57. 58. else 59. $resinfo = getResInfo; 60. $t-settitle$resinfo'title'; 61. $t-printHTMLHeader; 62. $t-startMain; 63...

jPORTAL 2 - humor.php SQL Injection

jPORTAL 2 - humor.php SQL Injection . . | / | | \ \ | / / |\ \ \ |/ // / /\ \ / |/ \ / // | / | | / \ /|\ / / / / \ / \ / / / \ | | /\ /\ / \ | \ // est.2007 / / forum.darkc0de.com --d3hydr8 -rsauron-baltazar -sinner01 -C1c4Tr1Z - beenu -QKrun1x-P47tr1ck - FeDeReR -MAGE...

Joomla! Component FacileForms 1.4.4 - Remote File Inclusion

Joomla! Component FacileForms 1.4.4 - Remote File Inclusion Title: Joomla Component ComFacileforms ================================================================ + Author : Dr.Kacak + Special Thankz : KnocKout and all my friends + System 0VerfL0verZ...

Cezanne Software 6.5.17 - CFLogon.asp Cross-Site Scripting

Cezanne Software 6.5.17 - CFLogon.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/28774/info Cezanne Software is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute...

X.Org xorg-server 1.1.1-48.13 - Probe for Files (PoC)

X.Org xorg-server 1.1.1-48.13 - Probe for Files PoC !/bin/sh Xorg file disclosure vulnerability CVE-2007-5958 Lame xploit by vl4dZ : sh-3.1$ whoami uid=1001kecos gid=1001user groups=1001user sh-3.1$ ./Xorg-File-Existence-PoC.sh /root/.ssh/iddsa ... FILE /root/.ssh/iddsa EXIST !! Vulnerable:...

BookmarkX script 2007 - topicid SQL Injection

BookmarkX script 2007 - topicid SQL Injection BookmarkX scriptPowered by GengoliaWebStudioSQL Injection AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DorKs 1 : "2007 BookmarkX script" DORKS 2 : Powered by GengoliaWebStudio DORK 3 : allinurl :"index.php?menu=showtopic" EXPLOIT :...

PHP Webquest 2.6 - Get Database Credentials

PHP Webquest 2.6 - Get Database Credentials --==+================================================================================+==-- --==+ PHP Webquest 2.6 Get Database's Credential +==-- --==+================================================================================+==-- Author: MhZ91...

PHP-Nuke platinum 7.6.b.5 - Remote File Inclusion

PHP-Nuke platinum 7.6.b.5 - Remote File Inclusion ---------------------------------------------- GrEeTs To -=sHaDoW sEcUrItY TeAm=- GrEaTs To ---------------------------------------------- A2J, Chucks, The Pitbull, ICQBomber, str0ke ---------------------------------------------- BiG sHoUt OuT tO...

FlashGameScript 1.7 - user SQL Injection

FlashGameScript 1.7 - user SQL Injection FlashGameScript = 1.7 member.php$user SQL-Injection Exploit Vulnrability Discovered By: Xenduer77 ---July 7th, 2007 $user Is passed straight to the query without being filtered. SQL-INJECTION: For Version 1.7: -------...

Scallywag - template.php?path Remote File Inclusion

Scallywag - template.php?path Remote File Inclusion Scallywag = Remote File Inclusion Vulnerability Dork:"Powered by Scallywag" Vuln Code ERROR1:skin/dark/template.php ?php include"$path/source/top.txt"; RFI CODE BUG1:...

EncapsCMS 0.3.6 - corecore.php Remote File Inclusion

EncapsCMS 0.3.6 - corecore.php Remote File Inclusion Firewall encapscms 0.3.6 - Remote File Include by Firewall BuG FounD by Firewall Application Affect: encapscms 0.3.6 Sorce Code: http://scripts.ringsworld.com/content-management/encapscms-0.3.6.zip Code: includeonce$root."core/Config.php";...

X11R6 6.4 XKEYBOARD (SolarisSPARC) - Local Buffer Overflow (2)

X11R6 6.4 XKEYBOARD SolarisSPARC - Local Buffer Overflow 2 / $Id: raptorxkb.c,v 1.1 2006/09/13 16:18:36 raptor Exp $ raptorxkb.c - XKEYBOARD Strcmp, Solaris/SPARC 8/9/10 Copyright c 2006 Marco Ivaldi Buffer overflow in the Strcmp function in the XKEYBOARD extension in X Window System X11R6.4 and...

Kayako eSupport 2.3.1 - subd Remote File Inclusion

Kayako eSupport 2.3.1 - subd Remote File Inclusion Script: Kayako eSupport Comments: It seems like the vendor silently fixed the issue in the current version more like since v2.3.5 withouth warning users of previous versions, noobs. Requires that "registerglobals" is enabled. Vulnerable File:...

Limbo CMS 1.0.4.2 - catid SQL Injection

Limbo CMS 1.0.4.2 - catid SQL Injection i Limbo CMS option=weblinks sql injection exploit i coded by Oo Usage: ?host=hostname&path=limbopath&id=userid Exemple: ?host=127.0.0.1&path=/limbo&id=1 g Google: inurl:"index2.php?option=rss" OR "powered By Limbo CMS" /",$f && pregmatch"/login/",$f echo...

SoftiaCom wMailServer 1.0 - SMTP Remote Buffer Overflow (Metasploit)

SoftiaCom wMailServer 1.0 - SMTP Remote Buffer Overflow Metasploit This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core...

Linux Kernel 2.4.29-rc2 - uselib() Local Privilege Escalation (1)

Linux Kernel 2.4.29-rc2 - uselib Local Privilege Escalation 1 / EDB Note: There's is an updated version https://www.exploit-db.com/exploits/895/ / / binfmtelf uselib VMA insert race vulnerability v1.08 gcc -O2 -fomit-frame-pointer elflbl.c -o elflbl Copyright c 2004 iSEC Security Research. All...

AllMyLinks 0.x - footer.inc.php Arbitrary Code Execution

AllMyLinks 0.x - footer.inc.php Arbitrary Code Execution source: https://www.securityfocus.com/bid/9664/info Reportedly the AllMyPHP applications AllMyGuests, AllMyLinks and AllMyVisitors are prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed...

Laurent Adda Les Commentaires 2.0 - PHP Script derniers_commentaires.php Remote File Inclusion

Laurent Adda Les Commentaires 2.0 - PHP Script dernierscommentaires.php Remote File Inclusion source: https://www.securityfocus.com/bid/9536/info It has been reported that Les Commentaires may be prone to a file include vulnerability in various modules, that may allow an attacker to include...

Phorum 3.0.7 - admin.php3 Unverified Administrative Password Change

Phorum 3.0.7 - admin.php3 Unverified Administrative Password Change source: https://www.securityfocus.com/bid/2271/info Phorum is a popular, free, open source software package originally written by Brian Moon. The package is designed to add chat/bulletin board style interaction between visitors o...