pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery

pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://192.168.0.103/diagbackup.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8";...

WordPress Plugin Simple Ads Manager 2.5.94 - Arbitrary File Upload

WordPress Plugin Simple Ads Manager 2.5.94 - Arbitrary File Upload Vulnerability title: Wordpress plugin Simple Ads Manager - Arbitrary File Upload Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 Download lin...

phpBugTracker 1.6.0 - Multiple Vulnerabilities

phpBugTracker 1.6.0 - Multiple Vulnerabilities Advisory: Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities in phpBugTracker v.1.6.0 Advisory ID: SROEADV-2015-16 Author: Steffen Rösemann Affected Software: phpBugTracker v.1.6.0 Vendor URL: https://github.com/a-v-k/phpBugTracker Vendor...

Pandora FMS 5.1 SP1 - SQL Injection

Pandora FMS 5.1 SP1 - SQL Injection Document Title: =============== Pandora FMS v5.1 SP1 - SQL Injection Web Vulnerability References Source: ==================== http://vulnerability-lab.com/getcontent.php?id=1355 Release Date: ============= 2015-02-09 Vulnerability Laboratory ID VL-ID:...

Trend Micro 8.0.1133 (Multiple Products) - Local Privilege Escalation

Trend Micro 8.0.1133 Multiple Products - Local Privilege Escalation / Exploit Title - Trend Micro Multiple Products Arbitrary Write Privilege Escalation Date - 31st January 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.trendmicro.co.uk/ Tested Version - 8.0.1133 Driver...

Belkin N750 - jump?login Remote Buffer Overflow

Belkin N750 - jump?login Remote Buffer Overflow """ Source: https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/ A vulnerability in the guest network web interface of the Belkin N750 DB Wi-Fi Dual-Band N+ Gigabit Router with firmware...

iBackup 10.0.0.32 - Local Privilege Escalation

iBackup 10.0.0.32 - Local Privilege Escalation Exploit Title: iBackup Version: 10.0.0.32 Vendor: IBackup Vendor URL: https://www.ibackup.com/ CVE-2014-5507 Vulnerability Details There are weak permissions for IBackupWindows default installation where everyone is allowed to change the ibservice.ex...

Microsoft Windows XP SP3 - BthPan.sys Arbitrary Write Privilege Escalation

Microsoft Windows XP SP3 - BthPan.sys Arbitrary Write Privilege Escalation """ Title: Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation Advisory ID: KL-001-2014-002 Publication Date: 2014-07-18 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt 1...

OpenVAS Manager 4.0 - Authentication Bypass

OpenVAS Manager 4.0 - Authentication Bypass !/usr/bin/python Exploit Title: OpenVAS Manager 4.0 Authentication Bypass Vulnerability PoC Date: 09/07/2014 Exploit Author: EccE Vendor Homepage: http://www.openvas.org/ Software Link: http://wald.intevation.org/frs/?groupid=29 Version: OpenVAS Manager...

IBM AIX 6.1.8 - libodm Arbitrary File Write

IBM AIX 6.1.8 - libodm Arbitrary File Write Vulnerability title: Privilege Escalation in IBM AIX CVE: CVE-2014-3977 Vendor: IBM Product: AIX Affected version: 6.1.8 and later Fixed version: N/A Reported by: Tim Brown Details: It has been identified that libodm allows privilege escalation via...

Catia V5-6R2013 - CATV5_Backbone_Bus Stack Buffer Overflow (PoC)

Catia V5-6R2013 - CATV5BackboneBus Stack Buffer Overflow PoC ''' Title: Dassault Syst�mes Catia V5-6R2013 "CATV5BackboneBus" Stack Buffer Overflow Date: 2-18-2014 Author: Mohamed Shetta Email: mshetta |at| live |dot| com Vendor Homepage:...

MediaWiki 1.22.1 PdfHandler - Remote Code Execution

MediaWiki 1.22.1 PdfHandler - Remote Code Execution -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MediaWiki images/xnz.php 3. access to php-backdoor! http://vulnerable-site/images/xnz.php?1=rm%20-rf%20%2f%20--no-preserve-root 4. happy pwning!! Related files: thumb.php -- extract all GET array to...

Kingsoft Office Writer 2012 8.1.0.3385 - .wps Local Buffer Overflow (SEH)

Kingsoft Office Writer 2012 8.1.0.3385 - .wps Local Buffer Overflow SEH !/usr/bin/python Exploit Title: Kingsoft Office Writer v2012 8.1.0.3385 .wps Buffer Overflow Exploit SEH Version: 2012 8.1.0.3385 Date: 2013-11-27 Author: Julien Ahrens @MrTuxracer Homepage: http://www.rcesecurity.com Softwar...

Vino VNC Server 3.7.3 - Persistent Denial of Service

Vino VNC Server 3.7.3 - Persistent Denial of Service Trustwave SpiderLabs Security Advisory TWSL2013-028: Persistent Denial of Service Vulnerability in Vino VNC Server Published: 09/16/13 Version: 1.0 Vendor: The GNOME Project https://wiki.gnome.org/Vino Product: Vino VNC Server Version affected:...

Winamp 5.63 - Stack Buffer Overflow

Winamp 5.63 - Stack Buffer Overflow Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: WinAmp Vendor URL: www.winamp.com Type: Stack-based Buffer Overflow CWE-121 Date found: 2013-06-05 Date published: 2013-07-01 CVSSv2 Score: Bug 1: 7,5...

GnuTLS libgnutls - Double-Free Certificate List Parsing Remote Denial of Service

GnuTLS libgnutls - Double-Free Certificate List Parsing Remote Denial of Service Sorry I forgot to write headers in previous mail. Exploit Title: possible ways to exploit CVE-2012-1663 GNUTLS-3.0.13 Google Dork: if relevant we will automatically add these to the GHDB Date: Mar 20, 2013 Exploit...

phpPaleo - Local File Inclusion

phpPaleo - Local File Inclusion 'phpPaleo' Local File Inclusion CVE-2012-1671 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in index.php for language handling that allows for local file inclusion using a null-byte attack on...

The Uploader 2.0.4 (EnglishItalian) - Arbitrary File Upload Remote Code Execution (Metasploit)

The Uploader 2.0.4 EnglishItalian - Arbitrary File Upload Remote Code Execution Metasploit require 'msf/core' class Metasploit3 'The Uploader 2.0.4 Eng/Ita Remote File Upload', 'Description'= %q This module exploits various flaws in The Uploader to upload a PHP payload to target system. When run...

HP Data Protector (Linux) - Remote Command Execution

HP Data Protector Linux - Remote Command Execution !/bin/bash Exploit Title: HP Data Protector Remote Root Shell for Linux Date: 2011-08-10 Author: SZ Software Link:http://www8.hp.com/us/en/software/software- product.html?compURI=tcm:245-936920&pageTitle=data-protector Version: 0.9 Tested on:...

Microsoft Data Access Components - Remote Overflow (MS11-002)

Microsoft Data Access Components - Remote Overflow MS11-002 .body test // This code has been released under the Q Public License by Trolltech // http://en.wikipedia.org/wiki/QPublicLicense // Source: http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/ var StartTime = new Date; var...

Camtron CMNC-200 IP Camera - Authentication Bypass

Camtron CMNC-200 IP Camera - Authentication Bypass Finding 3: Web Based Administration Interface Bypass CVE: CVE-2010-4232 The CMNC-200 IP Camera has an administrative web interface that does not handle authentication properly. Using a properly formatted request, an attacker can bypass the...

Altova DatabaseSpy 2011 - Project File Handling Buffer Overflow (PoC)

Altova DatabaseSpy 2011 - Project File Handling Buffer Overflow PoC !/usr/bin/perl Title: Altova DatabaseSpy 2011 Project File Handling Buffer Overflow Vulnerability Vendor: Altova GmbH Product web page: http://www.altova.com Affected version: Enterprise Edition 2011 Summary: Altova DatabaseSpy®...

CodeIgniter 1.0 - BASEPATH Multiple Remote File Inclusions

CodeIgniter 1.0 - BASEPATH Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/38672/info CodeIgniter is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to...

SolarisOpen Solaris UCODE_GET_VERSION IOCTL - Denial of Service

SolarisOpen Solaris UCODEGETVERSION IOCTL - Denial of Service / cve-2010-0453.c -- Patroklos Argyroudis, argp at domain census-labs.com Denial of service kernel panic PoC exploit for the UCODEGETVERSION ioctl NULL pointer dereference vulnerability on Solaris/OpenSolaris:...

Joomla! Component com_doqment - cid SQL Injection

Joomla! Component comdoqment - cid SQL Injection Joomla Component comdoqment cid SQL Injection Vulnerability Author : Gamoscu Site : www.1923turk.biz Site : www.1923turk.com Greetz : Baybora - Manas58 - Delibey - Tiamo - Psiko - Turco - infazci - X-TRO Blog : http://gamoscu.wordpress.com/ DORK:...

Asterisk IAX2 - Attacked IAX Fuzzer Resource Exhaustion (Denial of Service)

Asterisk IAX2 - Attacked IAX Fuzzer Resource Exhaustion Denial of Service !/usr/bin/perl -w udp IAX protocol fuzzer Created: Blake Cornell Exploits found with this code can be found at http://www.securityscraper.com/ Released under the VoIPER project Do not hesitate to show enthusiasm and support...

PHPizabi 0.8 - notepad_body SQL Injection

PHPizabi 0.8 - notepadbody SQL Injection source: https://www.securityfocus.com/bid/34223/info PHPizabi is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromi...

Cezanne Software 6.5.17 - CFLogon.asp Cross-Site Scripting

Cezanne Software 6.5.17 - CFLogon.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/28774/info Cezanne Software is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute...

Live for Speed S1S2Demo - .spr Local Buffer Overflow

Live for Speed S1S2Demo - .spr Local Buffer Overflow / 0day Live for speed patch x s2 /s1 and demo local .Spr File buffer over flow Spr file's are also exploitable although i had to go about it a different Way,At first it wasn't possible to do a jmp esp,But with a little more buffer i Managed to...

Scallywag - template.php?path Remote File Inclusion

Scallywag - template.php?path Remote File Inclusion Scallywag = Remote File Inclusion Vulnerability Dork:"Powered by Scallywag" Vuln Code ERROR1:skin/dark/template.php ?php include"$path/source/top.txt"; RFI CODE BUG1:...

CodeBB 1.0 Beta 2 - phpbb_root_path Remote File Inclusion

CodeBB 1.0 Beta 2 - phpbbrootpath Remote File Inclusion codebb 1.1b3 phpbbrootpath Remote File Include Vulnerability D.Script: http://rd.cycnus.de/download/codebb-1.1b3.tar.bz2 Discovered by: Alkomandoz Hacker Homepage: http://www.asb-may.net V.Code includeonce$phpbbrootpath...

Madwifi 0.9.2.1 - WPARSN IE Remote Kernel Buffer Overflow

Madwifi 0.9.2.1 - WPARSN IE Remote Kernel Buffer Overflow / ---- madwifi WPA/RSN IE remote kernel buffer overflow ------ expoit code by: sgrakkyu antifork.org -- 10/1/2007 CVE: 2006-6332 Laurent BUTTI, Jerome RAZNIEWSKI, Julien TINNES for wpa .... memcpybuf, se-sewpaie, se-sewpaie1 + 2...

Apache 1.3.341.3.33 (Ubuntu Debian) - CGI TTY Privilege Escalation

Apache 1.3.341.3.33 Ubuntu Debian - CGI TTY Privilege Escalation / :: Kristian Hermansen :: Date: 20070229 Description: Local attacker can influence Apache to direct commands into an open tty owned by user who started apache process, usually root. This results in arbitrary command execution...

STWC-Counter 3.4.0 - downloadcounter.php Remote File Inclusion

STWC-Counter 3.4.0 - downloadcounter.php Remote File Inclusion ?php //File Inclusion Exploit for STWC-Counter = 3.4.0.0 //Found and Exploit Coded by burncycle - burncycleatrobert-berandotde //| //Vendor: http://www.stwc-counter.de/ //Dork: www.stwc-counter.de //| //Bug in "downloadcounter.php":...

nabopoll 1.2 - survey.inc.php?path Remote File Inclusion

nabopoll 1.2 - survey.inc.php?path Remote File Inclusion By Cr@zyKing [email protected] Thakns : ApAci & Erne & Uyussman & Eno7 & Thehacker & CrackersChild & Liz0zim Script : nabopoll 1.x Risk : Remote File .nclude | High Site : http://nabocorp.com/ Google Dork : inurl:"nabopoll/" Exploit :...

PHPWind 5.0.1 - AdminUser Blind SQL Injection

PHPWind 5.0.1 - AdminUser Blind SQL Injection...

EncapsCMS 0.3.6 - corecore.php Remote File Inclusion

EncapsCMS 0.3.6 - corecore.php Remote File Inclusion Firewall encapscms 0.3.6 - Remote File Include by Firewall BuG FounD by Firewall Application Affect: encapscms 0.3.6 Sorce Code: http://scripts.ringsworld.com/content-management/encapscms-0.3.6.zip Code: includeonce$root."core/Config.php";...

EZContents 2.0.3 - showpoll.php?GLOBALS[admin_home] Remote File Inclusion

EZContents 2.0.3 - showpoll.php?GLOBALSadminhome Remote File Inclusion source: https://www.securityfocus.com/bid/19776/info ezContents is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these...

Mambo Component com_forum 1.2.4RC3 - Remote File Inclusion

Mambo Component comforum 1.2.4RC3 - Remote File Inclusion Bug Found by h4ntu http://h4ntu.com batamhacker crew Another Mambo component remote inclusion vulneribility download : http://mamboxchange.com/frs/download.php/6873/phpbbcomponent1.2.4RC3.zip bug found in file : download.php define'INPHPBB...

RhinoSoft Serv-U FTP Server 3.x 5.x - Local Privilege Escalation

RhinoSoft Serv-U FTP Server 3.x 5.x - Local Privilege Escalation / Hax0rcitos proudly presents Serv-u Local Exploit v3.x. tested also against last version 5.1.0.0 All Serv-u Versions have default Login/password for local Administration. This account is only available to connect in the loopback...

SSH (x2) - Remote Command Execution

SSH x2 - Remote Command Execution https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/349.tgz x2.tgz milw0rm.com 2002-05-01...

Trend Micro Interscan VirusWall 3.53.6 - Content-Length Scan Bypass

Trend Micro Interscan VirusWall 3.53.6 - Content-Length Scan Bypass // source: https://www.securityfocus.com/bid/4265/info Trend Micro InterScan VirusWall is a high performance internet gateway virus scanning package. It is capable of scanning incoming content over HTTP, SMTP and FTP for viruses...

DCForum 6.0 - Remote Admin Privilege Arbitrary Commands

DCForum 6.0 - Remote Admin Privilege Arbitrary Commands source: https://www.securityfocus.com/bid/2728/info DCForum is a commercial cgi script from DCScripts which is designed to facilitate web-based threaded discussion forums. Versions of DCForum are vulnerable to attacks which can yield an...

Yamaha MidiPlug 1.1 b-j MidiPlug - Local Buffer Overflow

Yamaha MidiPlug 1.1 b-j MidiPlug - Local Buffer Overflow // source: https://www.securityfocus.com/bid/760/info There is a buffer overflow in the MidiPlug that may allow arbitrary code to be executed on the local host. This overflow occurs if a long "Text" variable is specified within an EMBED tag...

DotNetNuke 9.5 - File Upload Restrictions Bypass

DotNetNuke 9.5 - File Upload Restrictions Bypass Exploit Title: DotNetNuke 9.5 - File Upload Restrictions Bypass Date: 2020-02-23 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link:...

WordPress Theme Fruitful 3.8 - Persistent Cross-Site Scripting

WordPress Theme Fruitful 3.8 - Persistent Cross-Site Scripting Exploit Title: WordPress Theme Fruitful 3.8 - Persistent Cross-Site Scripting Dork: intext:"Fruitful theme by fruitfulcode Powered by: WordPress" intext:"Comment" intext:"Leave a Reply" Date: 2020-02-14 Category : Webapps Software Lin...

SprintWork 2.3.1 - Local Privilege Escalation

SprintWork 2.3.1 - Local Privilege Escalation Exploit Title: SprintWork 2.3.1 - Local Privilege Escalation Exploit Author: boku Date: 2020-02-13 Vendor Homepage: https://veridium.net Software Link: https://veridium.net/filesu/spx/exe/SprintWork-Setup.exe Version: 2.3.1 Tested On: Windows 10 32-bi...

Centreon 19.10.5 - centreontrapd Remote Command Execution

Centreon 19.10.5 - centreontrapd Remote Command Execution Exploit Title: Centreon 19.10.5 - 'centreontrapd' Remote Command Execution Date: 2020-01-29 Exploit Author: Fabien AUNAY, Omri Baso Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version:...

Centreon 19.10.5 - Database Credentials Disclosure

Centreon 19.10.5 - Database Credentials Disclosure Exploit Title: Centreon 19.10.5 - Database Credentials Disclosure Date: 2020-01-27 Exploit Author: Fabien AUNAY, Omri Baso Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on:...

Rukovoditel Project Management CRM 2.5.2 - filters SQL Injection

Rukovoditel Project Management CRM 2.5.2 - filters SQL Injection Exploit Title: Rukovoditel Project Management CRM 2.5.2 - 'filters' SQL Injection Google Dork: N/A Date: 2020-01-15 Blog: https://fatihhcelik.blogspot.com/ Exploit Author: Fatih Çelik Vendor Homepage: https://www.rukovoditel.net/...