Soitec SmartEnergy 1.4 - SCADA Login SQL Injection Authentication Bypass

Soitec SmartEnergy 1.4 - SCADA Login SQL Injection Authentication Bypass Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Exploit Vendor: Soitec Product web page: http://www.soitec.com Affected version: 1.4 and 1.3 Summary: Soitec power plants are a profitable and ecological...

tnftp (FreeBSD 8910) - tnftp Client Side

tnftp FreeBSD 8910 - tnftp Client Side !/usr/bin/env python2 Exploit Title: tnftp BSD exploit Date: 11/29/2014 Exploit Author: dash Vendor Homepage: www.freebsd.org Version: FreeBSD 8/9/10 Tested on: FreeBSD 9.3 CVE : CVE-2014-8517 tnftp exploit CVE-2014-8517tested against freebsd 9.3...

Belkin N750 - jump?login Remote Buffer Overflow

Belkin N750 - jump?login Remote Buffer Overflow """ Source: https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/ A vulnerability in the guest network web interface of the Belkin N750 DB Wi-Fi Dual-Band N+ Gigabit Router with firmware...

GetSimple CMS 3.3.1 - Cross-Site Scripting

GetSimple CMS 3.3.1 - Cross-Site Scripting PoC for XSS bugs in the admin console of GetSimple CMS 3.3.1 CVE-2014-1603 by Pedro Ribeiro [email protected] from Agile Information Security Disclosure: 12/05/2014 / Last updated: 12/10/2014 Timeline: 04/11/2013 - Found bugs, produced proof of concept...

OpenVAS Manager 4.0 - Authentication Bypass

OpenVAS Manager 4.0 - Authentication Bypass !/usr/bin/python Exploit Title: OpenVAS Manager 4.0 Authentication Bypass Vulnerability PoC Date: 09/07/2014 Exploit Author: EccE Vendor Homepage: http://www.openvas.org/ Software Link: http://wald.intevation.org/frs/?groupid=29 Version: OpenVAS Manager...

Collabtive 1.2 - SQL Injection

Collabtive 1.2 - SQL Injection Vulnerability title: SQL Injection / SQL Error message in Collabtive application CVE-2014-3246 CVE: CVE-2014-3246 cordinated with Vendor: Collabtive Product: Collabtive Open Source Project Management Software Affected version: 1.12 Fixed version: 2.0 Reported by:...

Apache Struts2 2.0.0 2.3.15 - Prefixed Parameters OGNL Injection

Apache Struts2 2.0.0 2.3.15 - Prefixed Parameters OGNL Injection CVE Number: CVE-2013-2251 Title: Struts2 Prefixed Parameters OGNL Injection Vulnerability Affected Software: Apache Struts v2.0.0 - 2.3.15 Credit: Takeshi Terada of Mitsui Bussan Secure Directions, Inc. Issue Status: v2.3.15.1 was...

Kingsoft Office Writer 2012 8.1.0.3385 - .wps Local Buffer Overflow (SEH)

Kingsoft Office Writer 2012 8.1.0.3385 - .wps Local Buffer Overflow SEH !/usr/bin/python Exploit Title: Kingsoft Office Writer v2012 8.1.0.3385 .wps Buffer Overflow Exploit SEH Version: 2012 8.1.0.3385 Date: 2013-11-27 Author: Julien Ahrens @MrTuxracer Homepage: http://www.rcesecurity.com Softwar...

Apple Safari 6.0.1 for iOS 6.0 Apple Mac OSX 10.78 - Heap Buffer Overflow

Apple Safari 6.0.1 for iOS 6.0 Apple Mac OSX 10.78 - Heap Buffer Overflow -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------------+ | Packet Storm Advisory 2013-0903-1 | | http://packetstormsecurity.com/ |...

Winamp 5.63 - Stack Buffer Overflow

Winamp 5.63 - Stack Buffer Overflow Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: WinAmp Vendor URL: www.winamp.com Type: Stack-based Buffer Overflow CWE-121 Date found: 2013-06-05 Date published: 2013-07-01 CVSSv2 Score: Bug 1: 7,5...

cURL - Buffer Overflow (PoC)

cURL - Buffer Overflow PoC cURL buffer overflow Wed 06 February 2013 Volema found remotely exploitable buffer overflow vulnerability in libcurl POP3, SMTP protocol handlers which lead to code execution RCE. When negotiating SASL DIGEST-MD5 authentication, the function Curlsaslcreatedigestmd5messa...

freeSSHd 2.1.3 - Remote Authentication Bypass

freeSSHd 2.1.3 - Remote Authentication Bypass FreeSSHD all version Remote Authentication Bypass ZERODAY Discovered & Exploited by Kingcope Year 2011 Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/23080.zip Run like: ssh.exe -l valid username...

Apple QuickTime Player 7.7.2 - Crash (PoC)

Apple QuickTime Player 7.7.2 - Crash PoC !/usr/bin/perl Title : Apple QuickTime Player 7.7.2 Division By Zero Version : 7.7.21680.56 Date : 2012-10-23 Vendor : http://www.apple.com Impact : Med/High Contact : coolkaveh at rocketmail.com Twitter : @coolkaveh tested : XP SP3 ENG Bug : ---- Don't...

Joomla! Component com_enmasse 1.2.0.4 - SQL Injection

Joomla! Component comenmasse 1.2.0.4 - SQL Injection Exploit Title: Joomla comenmasse Remote Exploit Author: Daniel Barragan "D4NB4R" Español hola, este exploit afecta sitios de ecommerce por lo cual el exploit solo dara una muestra de la extraccion posible de datos, No me hago responsable del us...

WaveSurfer 1.8.8p4 - Memory Corruption (PoC)

WaveSurfer 1.8.8p4 - Memory Corruption PoC !/usr/bin/perl WaveSurfer 1.8.8p4 This script creates a crafted WAV file which leads the application to crash DoS. my $crafted = "\x52\x49\x46\x46\x20\x12\x01\x00\x57\x41\x56\x45\x66\x6D\x74\x20"...

traq 2.3.5 - Multiple Vulnerabilities

traq 2.3.5 - Multiple Vulnerabilities ==================================================================== Vulnerable Software: traq-2.3.5 Official Site: TraqProject.org ==================================================================== About Software: Traq is a PHP powered project manager,...

WordPress Plugin Top Quark Architecture 2.10 - Arbitrary File Upload

WordPress Plugin Top Quark Architecture 2.10 - Arbitrary File Upload Exploit Title: Wordpress Top Quark Architecture Version 2.10 Arbitrary File Upload Google Dork: inurl:wp-content/plugins/topquark/lib/js/fancyupload/showcase/batch/ Date: 11/06/2012 Exploit Author: Adrien Thierry Vendor Homepage...

Symfony2 - Local File Disclosure

Symfony2 - Local File Disclosure Sense of Security - Security Advisory - SOS-12-002 Release Date. 05-Mar-2012 Last Update. - Vendor Notification Date. 24-Feb-2012 Product. Symfony2 Platform. PHP Affected versions. 2.0.x - 2.0.10 Severity Rating. Medium Impact. Exposure of sensitive information...

Microsoft Win32k - Null Pointer De-reference (PoC) (MS11-077)

Microsoft Win32k - Null Pointer De-reference PoC MS11-077 Exploit Title: MS11-077 Win32k Null Pointer De-reference Vulnerability POC Date: 10/19/2011 Author: KiDebug Version: Windows XP SP3 32bit Tested on: Windows XP SP3 32bit CVE : CVE-2011-1985 Exploit Code. Only a single line of code can caus...

Cogent DataHub 7.1.1.63 - Source Disclosure

Cogent DataHub 7.1.1.63 - Source Disclosure Luigi Auriemma Application: Cogent DataHub http://www.cogentdatahub.com/Products/CogentDataHub.html Versions: = 7.1.1.63 Platforms: Windows Bug: source disclosure Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma e-mail: [email protected]...

phpMyAdmin 3.x - Swekey Remote Code Injection

phpMyAdmin 3.x - Swekey Remote Code Injection ':'';? . , \ . . ,/ , / , \ \ // / / / \ | | \ / | |\ /| | | | | | | | / | | | | / | | | || | | | | | \ \ | | | || | \ \ | | | | | | | | | | | | / / | | | | | | | | | | | | | | | |// || || | |// || || ||| | || ||| || | ||...

Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - jdeMafletClose.mafService?RENDER_MAFLET Cross-Site Scripting

Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - jdeMafletClose.mafService?RENDERMAFLET Cross-Site Scripting source: https://www.securityfocus.com/bid/47479/info Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage these...

Webkit (Apple Safari 4.1.25.0.2 Google Chrome 5.0.375.125) - Memory Corruption

Webkit Apple Safari 4.1.25.0.2 Google Chrome 5.0.375.125 - Memory Corruption TITLE: WEBKIT APPLE SAFARI 4.1.2/5.0.2 & GOOGLE CHROME 5.0.375.125 MEMORY CORRUPTION VULNERABILITY TESTED OS: WINDOWS XP SP3 SEVERITY: HIGH CVE-NUMBER: CVE-2010-1813 DISCOVERED DATE: 2010-06-29 FIXED DATE: GOOGLE CHROME...

CubeCart PHP 4.3.x - shipkey SQL Injection

CubeCart PHP 4.3.x - shipkey SQL Injection SQL Injection in CubeCart PHP Free & Commercial Shopping Cart Application 1. Advisory Information Title: SQL Injection in CubeCart PHP Free & Commercial Shopping Cart Application Advisory Id: CORE-2010-0415 Advisory URL:...

Subdreamer Pro 3.0.4 - CMS Upload

Subdreamer Pro 3.0.4 - CMS Upload . \\ \\ / |/ | || | | /\\ \\\\ \\ \\/ \\| | \\/ /\\ \\ | | | | \\ / \\| | | | | /\\ \\ / \\| | | / /| || \\/|// /| \\/ \\/ \\/ \\/ Exploit Title: Subdreamer Pro v3.0.4 CMS upload Vulnerability Author: Battousai Home:...

ProWeb Design - SQL Injection

ProWeb Design - SQL Injection .----..--.--.| |--..-----..----.| |.-----..-----. | || | || || -|| || || || | ||| ||||||| ||||| | || || ProWeb Design SQL Injection Vulnerability Vendor: http://www.prowebassociates.com/ Discovered by : cyberlog Site : Sekuritionline.net Channel : SekuritiOnline Now...

NX Web CMS (NX WCMS 4.5) - Multiple Vulnerabilities

NX Web CMS NX WCMS 4.5 - Multiple Vulnerabilities N/X - Web CMS N/X WCMS 4.5 Multiple Vulnerability =================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /'...

DA Mailing List System 2 - Multiple Vulnerabilities

DA Mailing List System 2 - Multiple Vulnerabilities DA Mailing List System V2 Remote Admin Login Exploit Author : Phenom Dork: DA Mailing List System V2 Powered by DigitalArakan.Net Version : 2 Exploit : 1- http://server/path/admincp.asp 2- login with "admin" as user name and 'or' as password...

SolarisOpen Solaris UCODE_GET_VERSION IOCTL - Denial of Service

SolarisOpen Solaris UCODEGETVERSION IOCTL - Denial of Service / cve-2010-0453.c -- Patroklos Argyroudis, argp at domain census-labs.com Denial of service kernel panic PoC exploit for the UCODEGETVERSION ioctl NULL pointer dereference vulnerability on Solaris/OpenSolaris:...

RealAdmin - detail.php Blind SQL Injection

RealAdmin - detail.php Blind SQL Injection RealAdmin detail.php Blind Sql Injection Vulnerability ======================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Team : Sec Attack Team .:. Home : www.sec-attack.com/vb .:. Script : RealAdmin .:. Download...

PHP Live! 3.3 - deptid SQL Injection

PHP Live! 3.3 - deptid SQL Injection , . | | o | | |,---.,---., .,---.,---.,---.,---.,---|,---.,---.| .,---.|/ ---'| || || |,---|| ,---|| | ||---'| | || || \ | ---'---|---|---^---'---^ ---'---' ---' ' ---'---' o PHP Live! 3.3 deptid Remote SQL Injection --== Author ==-- + Author : v3n0m + Contact...

OpenSSL 0.9.8i - DTLS ChangeCipherSpec Remote Denial of Service

OpenSSL 0.9.8i - DTLS ChangeCipherSpec Remote Denial of Service / cve-2009-1386.c OpenSSL http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1386 OpenSSL would SegFault if the DTLS server receives a ChangeCipherSpec as the first record instead of...

Fantastico - index.php Local File Inclusion

Fantastico - index.php Local File Inclusion source: https://www.securityfocus.com/bid/32578/info Fantastico is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to view files and execute local scripts ...

WebStudio eCatalogue - Blind SQL Injection

WebStudio eCatalogue - Blind SQL Injection WebStudio eCatalogue pageid Blind SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc script : http://www.bdigital.biz/index.php?pageid=218 DorK : ""Powered by WebStudio eCatalogue"" Demo :...

hMAilServer 4.4.2 - PHPWebAdmin File Inclusion

hMAilServer 4.4.2 - PHPWebAdmin File Inclusion hMAilServer 4.4.2 PHPWebAdmin local & remote file inclusion poc by Nine:Situations:Group::strawdog -------------------------------------------------------------------------------- our site: http://retrogod.altervista.org software site:...

AlsaPlayer 0.99.80-rc3 - Vorbis Input Local Buffer Overflow

AlsaPlayer 0.99.80-rc3 - Vorbis Input Local Buffer Overflow I have released this exploit for the alsaplayer bug CVE-2007-5301. You can find all the needed files at http://www.wekk.net/research/CVE-2007-5301/ With my modified version of vorbiscomment, you can generate a ogg exploit like this:...

Easy-Clanpage 2.2 - id SQL Injection

Easy-Clanpage 2.2 - id SQL Injection .-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-. Easy-Clanpage v2.2 gallery Remote SQL Injection Vulnerability .-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-. + Author: n3w7u + Mail: [email protected] + Source:...

IBM Domino Web Access Upload Module - Overwrite (SEH)

IBM Domino Web Access Upload Module - Overwrite SEH IBM Domino Web Access Upload Module Universal BoF Exploit function Check // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 =...

DigitalHive 2.0 RC2 - user_id SQL Injection

DigitalHive 2.0 RC2 - userid SQL Injection body margin:3%; font-size:10px; color:FFFFFF; font-family:Verdana,Arial; background-color:1a1a1a; text-align: center; input background:303030; color:FFFFFF; font-family:Verdana,Arial; font-size:10px; vertical-align:middle; border-left:1px solid 5d5d5d;...

Vivotek Motion Jpeg Control - MjpegDecoder.dll 2.0.0.13 Remote Overflow

Vivotek Motion Jpeg Control - MjpegDecoder.dll 2.0.0.13 Remote Overflow ' metasploit one, alpha2... add a user 'sun' with pass 'tzu' FRAGMENT =...

MGB 0.5.4.5 - email.php?id SQL Injection

MGB 0.5.4.5 - email.php?id SQL Injection !/usr/bin/perl MGB Google dork: intext:mgb.0.5.. & intext:mopzz | intext:mgb.0.5.4.. use IO::Socket::INET; usage unless @ARGV == 2; $host = $ARGV0; $dir = $ARGV1; $dir = "/$dir" if $dir ! /^//; $dir = "$dir/" if $dir ! //$/; $host = s/http:////g; $path...

OpenBSD 3.x 4.0 - vga_ioctl() Local Privilege Escalation

OpenBSD 3.x 4.0 - vgaioctl Local Privilege Escalation / Critical Security OpenBSD 3.x-4.0 vgaioctl root exploit Bug had been discovered by allmighty Ilja van Sprundel ilja.netric.org Some code had been stolen from noir's openbsd exploit sources Fix is available:...

Computer Associates Products Message Engine RPC Server - Multiple Buffer Overflow Vulnerabilities (2)

Computer Associates Products Message Engine RPC Server - Multiple Buffer Overflow Vulnerabilities 2 source: https://www.securityfocus.com/bid/20365/info Multiple Computer Associates products are prone to multiple buffer-overflow vulnerabilities because the applications using an affected library...

Mambo Component Remository 3.25 - Remote File Inclusion

Mambo Component Remository 3.25 - Remote File Inclusion .: insecurity research team :. ....:...:. . .:. | |/ :/ // :/ .:. : | | | \\ /\ / :. . ..: ||| / \ \ .: .:.. .. ./ .:/:. ./. .:/: . ...:. .advisory. .:... :..................: o9.o8.2oo6 .. Affected Application: Remository v3.25...

Jax PHP Scripts 1.01.342.143.31 - Guestbook File Client IP Disclosure

Jax PHP Scripts 1.01.342.143.31 - Guestbook File Client IP Disclosure source: https://www.securityfocus.com/bid/14482/info Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input...

PhotoPost 4.6 - Multiple Vulnerabilities

PhotoPost 4.6 - Multiple Vulnerabilities PhotoPost Multiple Vulnerabilities Vendor: All Enthusiast, Inc Product: PhotoPost Version: = 4.6 Website: http://www.photopost.com/ BID: 9994 CVE: CVE-2004-1870 CVE-2004-1871 OSVDB: 10261 10262 10263 10264 10265 10266 10267 4771 SECUNIA: 11241 Description:...

Aardvark Topsites 4.1.0 - Multiple Vulnerabilities

Aardvark Topsites 4.1.0 - Multiple Vulnerabilities Aardvark Topsites Multiple Vulnerabilities Vendor: Aardvark Industries Product: Aardvark Topsites Version: = 4.1.0 Website: http://www.aardvarkind.com/ BID: 9231 Description: Aardvark Topsites is a popular free PHP topsites script. See URL for...

Samba 2.2.x - call_trans2open Remote Buffer Overflow (1)

Samba 2.2.x - calltrans2open Remote Buffer Overflow 1 // source: https://www.securityfocus.com/bid/7294/info A buffer overflow vulnerability has been reported for Samba. The problem occurs when copying user-supplied data into a static buffer. By passing excessive data to an affected Samba server,...

DCForum 6.0 - Remote Admin Privilege Arbitrary Commands

DCForum 6.0 - Remote Admin Privilege Arbitrary Commands source: https://www.securityfocus.com/bid/2728/info DCForum is a commercial cgi script from DCScripts which is designed to facilitate web-based threaded discussion forums. Versions of DCForum are vulnerable to attacks which can yield an...

ISC BIND 8.2.x - TSIG Remote Stack Overflow (1)

ISC BIND 8.2.x - TSIG Remote Stack Overflow 1 / tsig0wn.c Copyright Field Marshal August Wilhelm Anton Count Neithardt von Gneisenau [email protected] The author is not and will not be held responsible for the action of other people using this code. provided for informational purposes only sin...