WordPress Plugin Content Timeline - SQL Injection

WordPress Plugin Content Timeline - SQL Injection Exploit Title: Multiple Blind SQL Injections Wordpress Plugin: Content Timeline Google Dork: - Date: September 16, 2017 Exploit Author: Jeroen - ITNerdbox Vendor Homepage: http://www.shindiristudio.com/ Software Link:...

Joomla! Component Joomanager 2.0.0 - com_Joomanager Arbitrary File Download

Joomla! Component Joomanager 2.0.0 - comJoomanager Arbitrary File Download !/usr/bin/python2 -- coding:utf-8 -- ''' GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright C 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license...

Australian Education App - Remote Code Execution

Australian Education App - Remote Code Execution Exploit Title: Australian Education App - Remote Code Execution Date: 30/Jun/17 Exploit Author: MaXe Vendor Homepage: https://play.google.com/store/apps/details?id=a1.bestsafebrowser2.com Software Link: See APK archive websites Screenshot: Refer to...

Uniview NVR - Password Disclosure

Uniview NVR - Password Disclosure Uniview NVR remote passwords disclosure Author: B1t The Uniview NVR web application does not enforce authorizations on the main.cgi file when requesting json data. It says that you can do anything without authentication, however you must know the request structur...

Tuleap Project Wiki 8.3 9.6.99.86 - Command Injection

Tuleap Project Wiki 8.3 9.6.99.86 - Command Injection Tuleap - Command Injection in Project Wiki CVE: CVE-2017-7981 CVSSv3: 9.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C Versions affected: = 8.3 and = 9.6.99.86 Introduction Tuleap is a Libre suite to plan, track, code and...

Broadcom Wi-Fi SoC - dhd_handle_swc_evt Heap Overflow

Broadcom Wi-Fi SoC - dhdhandleswcevt Heap Overflow Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1061 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capab...

OsiriX DICOM Viewer 8.0.1 - Memory Corruption

OsiriX DICOM Viewer 8.0.1 - Memory Corruption !/usr/bin/env python -- coding: utf8 -- OsiriX DICOM Viewer 8.0.1 dulparse.cc Remote Memory Corruption Vulnerability Vendor: Pixmeo Sarl Product web page: http://www.osirix-viewer.com Affected version: OsiriX 8.0.1 Summary: With high performance and a...

Nagios 4.2.4 - Local Privilege Escalation

Nagios 4.2.4 - Local Privilege Escalation !/bin/bash Source: https://legalhackers.com/advisories/Nagios-Exploit-Root-PrivEsc-CVE-2016-9566.html Nagios Core 4.2.4 Root Privilege Escalation PoC Exploit nagios-root-privesc.sh ver. 1.0 CVE-2016-9566 Discovered and coded by: Dawid Golunski...

ADOdb 4.71 - Cross Site Scripting

ADOdb 4.71 - Cross Site Scripting ADOdb Cross Site Scripting Vendor: John Lim Product: ADOdb Version: currpage = $SESSION$currpage; The above code is taken from adodb-pager.inc.php @ lines 72-77 and ultimately set's the $this-currpage variable to unsanitized user supplied input. Later on this...

D-Link DIR-825 (vC) - Multiple Vulnerabilities

D-Link DIR-825 vC - Multiple Vulnerabilities Advisory Information Title: DIR-825 vC Buffer overflows in authentication,HNAP and ping functionalities. Also a directory traversal issue exists which can be exploited Vendors contacted: William Brown , Patrick Cline [email protected] CVE:...

TECO JN5 L510-DriveLink 1.482 - .lf5 Overwrite Buffer Overflow (SEH)

TECO JN5 L510-DriveLink 1.482 - .lf5 Overwrite Buffer Overflow SEH !/usr/bin/perl TECO JN5 L510-DriveLink 1.482 SEH Overwrite Buffer Overflow Exploit Vendor: TECO Electric and Machinery Co., Ltd. Product web page: http://www.teco-group.eu Download:...

Liferay 6.1.0 CE - Privilege Escalation

Liferay 6.1.0 CE - Privilege Escalation Exploit Title: Liferay 6.1.0 CE GA1 Privilege Escalation Date: 18/05/2015 Exploit Author: Massimo De Luca - mentat.is Vendor Homepage: https://www.liferay.com Software Link:...

Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities

Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities Exploit title: Opsview 4.6.2 - Multiple XSS Date: 07-06-2015 Vendor homepage: www.opsview.com Version: 4.6.2 CVE: CVE-2015-4420 Author: Dolev Farhi @dolevf Tested On: Kali Linux + Windows 7 Details: -------- Opsview is a monitoring...

Citrix Nitro SDK - Command Injection

Citrix Nitro SDK - Command Injection Abstract Securify discovered a command injection vulnerability in xenhotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges nsroot. This issue can be used to compromise of the entire Citrix SDX appliance and all...

xRadio-0.95b-(.xrl)

xRadio is affected by stack-based buffer overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Successful exploitation of the vulnerability allows an attacker to execute arbitrary code. Other versions are also affected but have a different trigger...

Wickr Desktop 2.2.1 Windows - Denial of Service

Wickr Desktop 2.2.1 Windows - Denial of Service Document Title: =============== Wickr Desktop v2.2.1 Windows - Denial of Service Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1377 Video:...

tnftp (FreeBSD 8910) - tnftp Client Side

tnftp FreeBSD 8910 - tnftp Client Side !/usr/bin/env python2 Exploit Title: tnftp BSD exploit Date: 11/29/2014 Exploit Author: dash Vendor Homepage: www.freebsd.org Version: FreeBSD 8/9/10 Tested on: FreeBSD 9.3 CVE : CVE-2014-8517 tnftp exploit CVE-2014-8517tested against freebsd 9.3...

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor...

GetSimple CMS 3.3.1 - Cross-Site Scripting

GetSimple CMS 3.3.1 - Cross-Site Scripting PoC for XSS bugs in the admin console of GetSimple CMS 3.3.1 CVE-2014-1603 by Pedro Ribeiro [email protected] from Agile Information Security Disclosure: 12/05/2014 / Last updated: 12/10/2014 Timeline: 04/11/2013 - Found bugs, produced proof of concept...

Rejetto HTTP File Server (HFS) 2.3a2.3b2.3c - Remote Command Execution

Rejetto HTTP File Server HFS 2.3a2.3b2.3c - Remote Command Execution ========================================================== HTTP File Server 2.3a - 2.3b - 2.3c Remote Command Execution Author : Daniele Linguaglossa Date: 30/09/2014 Remote: Yes Vendor Homepage: http://rejetto.com/ Software Lin...

Microsoft Internet Explorer 8 - Fixed Col Span ID (Full ASLR + DEP + EMET 5.0 Bypass) (MS12-037)

Microsoft Internet Explorer 8 - Fixed Col Span ID Full ASLR + DEP + EMET 5.0 Bypass MS12-037 function strtointstr return str.charCodeAt10x10000 + str.charCodeAt0; var free = "EEEE"; while free.length 500 free += free; var string1 = "AAAA"; while string1.length 500 string1 += string1; var string2...

WordPress Plugin Quick PagePost Redirect 5.0.3 - Multiple Vulnerabilities

WordPress Plugin Quick PagePost Redirect 5.0.3 - Multiple Vulnerabilities Details ================ Software: Quick Page/Post Redirect Plugin Version: 5.0.3 Homepage: http://wordpress.org/plugins/quick-pagepost-redirect-plugin/ Advisory ID: dxw-1970-1091 CVE: CVE-2014-2598 CVSS: 6.8 Medium;...

Array Networks vxAG 9.2.0.34 and vAPV 8.3.2.17 - Multiple Vulnerabilities

Array Networks vxAG 9.2.0.34 and vAPV 8.3.2.17 - Multiple Vulnerabilities ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Array Networks vxAG 9.2.0.34 and vAPV 8.3.2.17 appliances ------------------------- Affected vendors:...

RealNetworks RealPlayer 16.0.3.5116.0.2.32 - .rmp Version Attribute Buffer Overflow

RealNetworks RealPlayer 16.0.3.5116.0.2.32 - .rmp Version Attribute Buffer Overflow !/usr/bin/perl ----------------------------------------------------------------------------- Exploit Title: RealNetworks RealPlayer Version Attribute Buffer Overflow Date: Dec 20 2013 Exploit Author: Gabor Seljan...

Kingsoft Office Writer 2012 8.1.0.3385 - .wps Local Buffer Overflow (SEH)

Kingsoft Office Writer 2012 8.1.0.3385 - .wps Local Buffer Overflow SEH !/usr/bin/python Exploit Title: Kingsoft Office Writer v2012 8.1.0.3385 .wps Buffer Overflow Exploit SEH Version: 2012 8.1.0.3385 Date: 2013-11-27 Author: Julien Ahrens @MrTuxracer Homepage: http://www.rcesecurity.com Softwar...

Samsung PS50C7700 TV - Denial of Service

Samsung PS50C7700 TV - Denial of Service !/usr/bin/python Exploit Title: Samsung TV Denial of Service DoS Attack Date: 07/21/2013 Exploit Author: Malik Mesellem - @MMEIT - http://www.itsecgames.com CVE Number: CVE-2013-4890 Vendor Homepage: http://www.samsung.com Description: Resets some Samsung...

Winamp 5.63 - Stack Buffer Overflow

Winamp 5.63 - Stack Buffer Overflow Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: WinAmp Vendor URL: www.winamp.com Type: Stack-based Buffer Overflow CWE-121 Date found: 2013-06-05 Date published: 2013-07-01 CVSSv2 Score: Bug 1: 7,5...

Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities

Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities Original: http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt =============================== - Advisory - =============================== Tittle: Imperva SecureSphere Operations Manager - Command...

Groovy Media Player 3.2.0 - .mp3 Buffer Overflow

Groovy Media Player 3.2.0 - .mp3 Buffer Overflow Title: ==== Groovy Media Player 3.2.0 Buffer Overflow Vulnerability Credit: ====== Name: Akshaysinh Vaghela Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ===== CVE-2013-2760 Reserved Date: ==== 21-03-2013...

TagScanner 5.1 - Stack Buffer Overflow (PoC)

TagScanner 5.1 - Stack Buffer Overflow PoC Title: ====== TagScanner v5.1 - Stack Buffer Overflow Vulnerability Date: ===== 2013-01-22 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=831 VL-ID: ===== 831 Introduction: ============= TagScanner is a multifunction program f...

Linux Kernel 2.6.32-5 (Debian 6.0.5) - devptmx Key Stroke Timing Local Disclosure

Linux Kernel 2.6.32-5 Debian 6.0.5 - devptmx Key Stroke Timing Local Disclosure !/bin/bash ptmx-su-pwdlen.sh -- This PoC determine the password length of a local user who runs "su -". Done thanks to the ptmx keystroke timing attack CVE-2013-0160. See http://vladz.devzero.fr/013ptmx-timing.php for...

Microsoft Win32k - Null Pointer De-reference (PoC) (MS11-077)

Microsoft Win32k - Null Pointer De-reference PoC MS11-077 Exploit Title: MS11-077 Win32k Null Pointer De-reference Vulnerability POC Date: 10/19/2011 Author: KiDebug Version: Windows XP SP3 32bit Tested on: Windows XP SP3 32bit CVE : CVE-2011-1985 Exploit Code. Only a single line of code can caus...

Carel PlantVisor 2.4.4 - Directory Traversal

Carel PlantVisor 2.4.4 - Directory Traversal Luigi Auriemma Application: Carel PlantVisor http://www.carel.com/carelcom/web/eng/catalogo/prodottodett.jsp?idprodotto=310 Versions: = 2.4.4 Platforms: Windows Bug: directory traversal Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma...

Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - jdeMafletClose.mafService?RENDER_MAFLET Cross-Site Scripting

Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - jdeMafletClose.mafService?RENDERMAFLET Cross-Site Scripting source: https://www.securityfocus.com/bid/47479/info Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage these...

YourTube 1.0 - Cross-Site Request Forgery (Add User)

YourTube 1.0 - Cross-Site Request Forgery Add User YourTube v1.0 CSRF Vulnerability Add User ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.ac4p.com/ .:. Dork : inurl:"Powered by YourTube v1.0" === Exploit ===...

Apache Archiva 1.0 1.3.1 - Cross-Site Request Forgery

Apache Archiva 1.0 1.3.1 - Cross-Site Request Forgery ANATOLIA SECURITY ADVISORY -------------------------------------- ADVISORY INFO + Title: Apache Archiva Cross-site Request Forgery Vulnerability + Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt + Advisory ID: 2010-001 +...

Webkit (Apple Safari 4.1.25.0.2 Google Chrome 5.0.375.125) - Memory Corruption

Webkit Apple Safari 4.1.25.0.2 Google Chrome 5.0.375.125 - Memory Corruption TITLE: WEBKIT APPLE SAFARI 4.1.2/5.0.2 & GOOGLE CHROME 5.0.375.125 MEMORY CORRUPTION VULNERABILITY TESTED OS: WINDOWS XP SP3 SEVERITY: HIGH CVE-NUMBER: CVE-2010-1813 DISCOVERED DATE: 2010-06-29 FIXED DATE: GOOGLE CHROME...

Excel RTD - Memory Corruption

Excel RTD - Memory Corruption ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moaub-10-excel-rtd-memory-corruption/...

Joomla! Component cinema - SQL Injection

Joomla! Component cinema - SQL Injection ========================================================= Exploit Title: joomla component cinema SQL injection Vulnerability Date: 09 juny 2010 Author: Suddendeath [email protected] Software Link: N/A Tested on: Windows XP 2 Platform / Tested on:...

e107 - Code Exection

e107 - Code Exection Exploit Title: e107 Code Exec Date: 05/22/10 Author: [email protected] Software Link: http://e107.org/edownload.php Version: e107 agent"Mozilla/5.0"; if $proxy print " Using proxy $proxy \n"; $ua-envproxy'1'; my $req = new HTTP::Request POST = $path;...

Alibaba Clone Platinum - offers_buy.php SQL Injection

Alibaba Clone Platinum - offersbuy.php SQL Injection / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...

SolarisOpen Solaris UCODE_GET_VERSION IOCTL - Denial of Service

SolarisOpen Solaris UCODEGETVERSION IOCTL - Denial of Service / cve-2010-0453.c -- Patroklos Argyroudis, argp at domain census-labs.com Denial of service kernel panic PoC exploit for the UCODEGETVERSION ioctl NULL pointer dereference vulnerability on Solaris/OpenSolaris:...

DA Mailing List System 2 - Multiple Vulnerabilities

DA Mailing List System 2 - Multiple Vulnerabilities DA Mailing List System V2 Remote Admin Login Exploit Author : Phenom Dork: DA Mailing List System V2 Powered by DigitalArakan.Net Version : 2 Exploit : 1- http://server/path/admincp.asp 2- login with "admin" as user name and 'or' as password...

Microsoft IIS - ASP Multiple Extensions Security Bypass 5.x6.x Vulnerabilities

Microsoft IIS - ASP Multiple Extensions Security Bypass 5.x6.x Vulnerabilities !/usr/bin/python Exploit Title: Exploit for Microsoft IIS ASP Multiple Extensions Security Bypass 5.x/6.x Date: 29 dec 2009 Author: Emanuele 'emgent' Gentili and Emanuele 'crossbower' Acri Software Link: N/A Version: I...

WordPress Plugin WP-Polls 2.x - Incorrect Flood Filter

WordPress Plugin WP-Polls 2.x - Incorrect Flood Filter Exploit Title: WP-Polls 2.x Incorrect Flood Filter Date: 30/11/2009 Author: Jbyte jbyte-security.blogspot.com Software Link: http://lesterchan.net/wordpress/readme/wp-polls.html Version: 2.x Tested on: Windows 7/windows xp/ ubuntu 9.04/ ubunt...

CuteNews and UTF-8 CuteNews - Multiple Vulnerabilities

CuteNews and UTF-8 CuteNews - Multiple Vulnerabilities MorningStar Security - Advisory http://www.morningstarsecurity.com/ Multiple security issues in Cute News and UTF-8 Cute News 1. Advisory Information...

DMXReady Account List Manager 1.1 - Contents Change

DMXReady Account List Manager 1.1 - Contents Change Title : DMXReady Account List Manager http://target/path//applications/AccountListManager/incaccountlistmanager.asp Edit - http://target/path//admin/AccountListManager/addcategory.asp : milw0rm.com 2009-01-13...

WebStudio eCatalogue - Blind SQL Injection

WebStudio eCatalogue - Blind SQL Injection WebStudio eCatalogue pageid Blind SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc script : http://www.bdigital.biz/index.php?pageid=218 DorK : ""Powered by WebStudio eCatalogue"" Demo :...

zeeproperty 1.0 - Arbitrary File Upload Cross-Site Scripting

zeeproperty 1.0 - Arbitrary File Upload Cross-Site Scripting ZEEPROPERTY v1.0 remote file Upload & XSS author: ZoRLu msn: [email protected] home: www.z0rlu.blogspot.com dork: "Designed & Developed by Zeeways.com" first register to site you add this code your shell to head GIF89a; example...

phpScheduleIt 1.2.10 - reserve.php Remote Code Execution

phpScheduleIt 1.2.10 - reserve.php Remote Code Execution settitletranslate"Processing $Class"; 53. $t-printHTMLHeader; 54. $t-startMain; 55. 56. processreservation$POST'fn'; 57. 58. else 59. $resinfo = getResInfo; 60. $t-settitle$resinfo'title'; 61. $t-printHTMLHeader; 62. $t-startMain; 63...