FUDforum 3.0.6 - Local File Inclusion

FUDforum 3.0.6 - Local File Inclusion Security Advisory - Curesec Research Team 1. Introduction Affected Product: FUDforum 3.0.6 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://fudforum.org/forum/ Vulnerability Type: LFI Remote Exploitable: Yes Reported to vendor: 04/11/2016...

Joomla! Component com_videogallerylite 1.0.9 - SQL Injection

Joomla! Component comvideogallerylite 1.0.9 - SQL Injection Title: Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla Author: Larry W. Cashdollar, @larry0 Date: 2016-09-15 Download Site: http://huge-it.com/joomla-video-gallery/ Vendor: www.huge-it.com, fixed v1.1.0 Vendor...

Axis Communications MPQTPACS 5.20.x - Server-Side Include Daemon Remote Format String

Axis Communications MPQTPACS 5.20.x - Server-Side Include Daemon Remote Format String !/usr/bin/env python2.7 SOF Remote Format String Exploit Axis Communications MPQT/PACS Server Side Include SSI Daemon Research and development by bashis 2016 This format string vulnerability has following...

ADOdb 4.71 - Cross Site Scripting

ADOdb 4.71 - Cross Site Scripting ADOdb Cross Site Scripting Vendor: John Lim Product: ADOdb Version: currpage = $SESSION$currpage; The above code is taken from adodb-pager.inc.php @ lines 72-77 and ultimately set's the $this-currpage variable to unsanitized user supplied input. Later on this...

AlegroCart 1.2.8 - Multiple SQL Injections

AlegroCart 1.2.8 - Multiple SQL Injections Security Advisory - Curesec Research Team 1. Introduction Affected Product: AlegroCart 1.2.8 Fixed in: Patch AC128fix17102015 Path Link: http://forum.alegrocart.com/download/file.php?id=1040 Vendor Website: http://alegrocart.com/ Vulnerability Type: SQL...

TECO JN5 L510-DriveLink 1.482 - .lf5 Overwrite Buffer Overflow (SEH)

TECO JN5 L510-DriveLink 1.482 - .lf5 Overwrite Buffer Overflow SEH !/usr/bin/perl TECO JN5 L510-DriveLink 1.482 SEH Overwrite Buffer Overflow Exploit Vendor: TECO Electric and Machinery Co., Ltd. Product web page: http://www.teco-group.eu Download:...

Liferay 6.1.0 CE - Privilege Escalation

Liferay 6.1.0 CE - Privilege Escalation Exploit Title: Liferay 6.1.0 CE GA1 Privilege Escalation Date: 18/05/2015 Exploit Author: Massimo De Luca - mentat.is Vendor Homepage: https://www.liferay.com Software Link:...

Netsweeper 3.0.6 - Authentication Bypass

Netsweeper 3.0.6 - Authentication Bypass +------------------------------------------------------------------------+ + Netsweeper 3.0.6 - Authentication Bypass Account and Policy Creation + +------------------------------------------------------------------------+ Affected Product: Netsweeper Vend...

Fuse 2.9.3-15 - Local Privilege Escalation

Fuse 2.9.3-15 - Local Privilege Escalation Source: https://gist.github.com/taviso/ecb70eb12d461dd85cba Tweet: https://twitter.com/taviso/status/601370527437967360 Recommend Reading: http://seclists.org/oss-sec/2015/q2/520 YouTube: https://www.youtube.com/watch?v=V0i3uJJPJ88 Making a demo exploit...

OTRS 3.1.x 3.2.x 3.3.x - Persistent Cross-Site Scripting

OTRS 3.1.x 3.2.x 3.3.x - Persistent Cross-Site Scripting Exploit Title: Stored Cross-Site Scripting XSS in OTRS Date: 28.01.2014 Exploit Author: Adam Ziaja http://adamziaja.com Vendor Homepage: https://www.otrs.com Version: 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 CVE :...

Citrix Nitro SDK - Command Injection

Citrix Nitro SDK - Command Injection Abstract Securify discovered a command injection vulnerability in xenhotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges nsroot. This issue can be used to compromise of the entire Citrix SDX appliance and all...

Trend Micro 8.0.1133 (Multiple Products) - Local Privilege Escalation

Trend Micro 8.0.1133 Multiple Products - Local Privilege Escalation / Exploit Title - Trend Micro Multiple Products Arbitrary Write Privilege Escalation Date - 31st January 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.trendmicro.co.uk/ Tested Version - 8.0.1133 Driver...

Kolibri-Webserver-2.0

This exploit will bypass all protections in EMET 5.0 and 4.1 but DEP. Date: September 30th 2014 Author: tekwizz123 Vendor Homepage: http://www.senkas.com Software Download: http://www.senkas.com/kolibri/download.php Version: 2.0 Tested on: Windows 7 32 bit, Windows 7 64 bit, Windows XP SP3 CVE-ID...

Wickr Desktop 2.2.1 Windows - Denial of Service

Wickr Desktop 2.2.1 Windows - Denial of Service Document Title: =============== Wickr Desktop v2.2.1 Windows - Denial of Service Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1377 Video:...

Microsoft Office 20072010 - OLE Arbitrary Command Execution

Microsoft Office 20072010 - OLE Arbitrary Command Execution Full exploit: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/35216.rar CVE-2014-6352 OLE Remote Code Execution Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Advanced Hacking...

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor...

PayPal Inc BB #85 MB iOS 4.6 - Authentication Bypass

PayPal Inc BB 85 MB iOS 4.6 - Authentication Bypass Document Title: =============== PayPal Inc BB 85 MB iOS 4.6 - Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=895 PayPal Security UID: Vxda0S Video:...

Rejetto HTTP File Server (HFS) 2.3a2.3b2.3c - Remote Command Execution

Rejetto HTTP File Server HFS 2.3a2.3b2.3c - Remote Command Execution ========================================================== HTTP File Server 2.3a - 2.3b - 2.3c Remote Command Execution Author : Daniele Linguaglossa Date: 30/09/2014 Remote: Yes Vendor Homepage: http://rejetto.com/ Software Lin...

Foscam IP Camera - Predictable Credentials Security Bypass

Foscam IP Camera - Predictable Credentials Security Bypass // source: https://www.securityfocus.com/bid/67510/info Foscam IP Camera is prone to a security-bypass vulnerability. An attacker can exploit this issue to gain access to sensitive information and perform certain unauthorized actions; thi...

Array Networks vxAG 9.2.0.34 and vAPV 8.3.2.17 - Multiple Vulnerabilities

Array Networks vxAG 9.2.0.34 and vAPV 8.3.2.17 - Multiple Vulnerabilities ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Array Networks vxAG 9.2.0.34 and vAPV 8.3.2.17 appliances ------------------------- Affected vendors:...

Webuzo 2.1.3 - Multiple Vulnerabilities

Webuzo 2.1.3 - Multiple Vulnerabilities Exploit Title: Webuzo Multiple Vulnerabilities Date: 7 October 2013 Exploit Author: Mahendra Vendor Homepage: www.webuzo.com Software Link: http://downloads.webuzo.com/va.php Version: 2.1.3, other version might be vulnerable. Tested on: CentOS release 6.2...

DirectControlTM 3.1.7.0 - Multiple Vulnerabilities

DirectControlTM 3.1.7.0 - Multiple Vulnerabilities DirectControlTM Version 3.1.7.0 - Multiple Vulnerabilties ==================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home :...

davfs2 1.4.61.4.7 - Local Privilege Escalation

davfs2 1.4.61.4.7 - Local Privilege Escalation davfs2 1.4.6/1.4.7 local privilege escalation exploit Bug Description: davfs2 is a Linux utility which allows OS users to mount a remote webdav server as a local partition. The bug is well documented at...

FlashChat 6.0.2 6.0.8 - Arbitrary File Upload

FlashChat 6.0.2 6.0.8 - Arbitrary File Upload Exploit Title: FlashChat File Upload Vulnerability Google Dork: intitle:FlashChat v6.0.8 Date: 02.10.2013 Exploit Author: x-hayben21 Vendor Homepage: www.punish3r.com Software Link: http://www.tufat.com/script2.htm Version: v6.0.8, v6.0.2, v6.0.4,...

Microsoft SharePoint 2013 (Cloud) - Persistent Exception Handling (MS13-067)

Microsoft SharePoint 2013 Cloud - Persistent Exception Handling MS13-067 Title: ====== Microsoft SharePoint 2013 Cloud - Persistent Exception Handling Web Vulnerability Date: ===== 2013-09-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=812 Security Bulletin: MS13-06...

Samsung PS50C7700 TV - Denial of Service

Samsung PS50C7700 TV - Denial of Service !/usr/bin/python Exploit Title: Samsung TV Denial of Service DoS Attack Date: 07/21/2013 Exploit Author: Malik Mesellem - @MMEIT - http://www.itsecgames.com CVE Number: CVE-2013-4890 Vendor Homepage: http://www.samsung.com Description: Resets some Samsung...

Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities

Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities Original: http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt =============================== - Advisory - =============================== Tittle: Imperva SecureSphere Operations Manager - Command...

Groovy Media Player 3.2.0 - .mp3 Buffer Overflow

Groovy Media Player 3.2.0 - .mp3 Buffer Overflow Title: ==== Groovy Media Player 3.2.0 Buffer Overflow Vulnerability Credit: ====== Name: Akshaysinh Vaghela Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ===== CVE-2013-2760 Reserved Date: ==== 21-03-2013...

TagScanner 5.1 - Stack Buffer Overflow (PoC)

TagScanner 5.1 - Stack Buffer Overflow PoC Title: ====== TagScanner v5.1 - Stack Buffer Overflow Vulnerability Date: ===== 2013-01-22 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=831 VL-ID: ===== 831 Introduction: ============= TagScanner is a multifunction program f...

phpPaleo - Local File Inclusion

phpPaleo - Local File Inclusion 'phpPaleo' Local File Inclusion CVE-2012-1671 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in index.php for language handling that allows for local file inclusion using a null-byte attack on...

Mozilla Firefox 4.0.1 - Array.reduceRight() Remote Overflow

Mozilla Firefox 4.0.1 - Array.reduceRight Remote Overflow function hexx var y = x.toString16; y = "0x"+y; return y; function itoai return String.fromCharCodei; // n - length in bytes 1 unicode char = 2 bytes function puffx, n whilex.length n x += x; return x.substring0,n; function arr2hextab var ...

Carel PlantVisor 2.4.4 - Directory Traversal

Carel PlantVisor 2.4.4 - Directory Traversal Luigi Auriemma Application: Carel PlantVisor http://www.carel.com/carelcom/web/eng/catalogo/prodottodett.jsp?idprodotto=310 Versions: = 2.4.4 Platforms: Windows Bug: directory traversal Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma...

Linux Kernel 2.6.37 - Local Kernel Denial of Service (1)

Linux Kernel 2.6.37 - Local Kernel Denial of Service 1 / Linux Kernel include include include include include int main int optval, optlen, ret, sd, sd2, pid; char host = "localhost"; struct sockaddrin locAddr; struct sockaddrin servAddr; struct sockaddrin dstAddr; printf" Linux Kernel...

YourTube 1.0 - Cross-Site Request Forgery (Add User)

YourTube 1.0 - Cross-Site Request Forgery Add User YourTube v1.0 CSRF Vulnerability Add User ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.ac4p.com/ .:. Dork : inurl:"Powered by YourTube v1.0" === Exploit ===...

Apache Archiva 1.0 1.3.1 - Cross-Site Request Forgery

Apache Archiva 1.0 1.3.1 - Cross-Site Request Forgery ANATOLIA SECURITY ADVISORY -------------------------------------- ADVISORY INFO + Title: Apache Archiva Cross-site Request Forgery Vulnerability + Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt + Advisory ID: 2010-001 +...

e107 - Code Exection

e107 - Code Exection Exploit Title: e107 Code Exec Date: 05/22/10 Author: [email protected] Software Link: http://e107.org/edownload.php Version: e107 agent"Mozilla/5.0"; if $proxy print " Using proxy $proxy \n"; $ua-envproxy'1'; my $req = new HTTP::Request POST = $path;...

Alibaba Clone Platinum - offers_buy.php SQL Injection

Alibaba Clone Platinum - offersbuy.php SQL Injection / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...

Microsoft IIS - ASP Multiple Extensions Security Bypass 5.x6.x Vulnerabilities

Microsoft IIS - ASP Multiple Extensions Security Bypass 5.x6.x Vulnerabilities !/usr/bin/python Exploit Title: Exploit for Microsoft IIS ASP Multiple Extensions Security Bypass 5.x/6.x Date: 29 dec 2009 Author: Emanuele 'emgent' Gentili and Emanuele 'crossbower' Acri Software Link: N/A Version: I...

Jasc Paint Shop Pro 8 - Local Universal Buffer Overflow

Jasc Paint Shop Pro 8 - Local Universal Buffer Overflow / Software: Jasc Paint Shop Pro v8 Local Buffer Overflow Exploit UNIVERSAL Bug type: Local buffer overflow Exploitation method: SEH handler overwrite Description: When a crafted .PNG file is oppened a stack buffer overflow occurs because of...

WordPress Plugin WP-Polls 2.x - Incorrect Flood Filter

WordPress Plugin WP-Polls 2.x - Incorrect Flood Filter Exploit Title: WP-Polls 2.x Incorrect Flood Filter Date: 30/11/2009 Author: Jbyte jbyte-security.blogspot.com Software Link: http://lesterchan.net/wordpress/readme/wp-polls.html Version: 2.x Tested on: Windows 7/windows xp/ ubuntu 9.04/ ubunt...

CuteNews and UTF-8 CuteNews - Multiple Vulnerabilities

CuteNews and UTF-8 CuteNews - Multiple Vulnerabilities MorningStar Security - Advisory http://www.morningstarsecurity.com/ Multiple security issues in Cute News and UTF-8 Cute News 1. Advisory Information...

Free Download Manager 3.0 Build 844 - .torrent Local Buffer Overflow

Free Download Manager 3.0 Build 844 - .torrent Local Buffer Overflow !/usr/bin/perl Free Download Manager = 3.0 Build 844 .torrent BOF Exploit ----------------------------------------------------------- Exploit by SkD [email protected] Vendors URL = www.freedownloadmanager.org Download FDM 3.0...

6rbScript 3.3 - section.php Local File Inclusion

6rbScript 3.3 - section.php Local File Inclusion || | | 6rbScript V3.3 Local file Vulnerability | | | | | | script : www.6rbscript.com | | DorK : inurl:"section.php?name=singers" | dorK : Powered By 6rbScript V3.3 || Author : Stack Expl need magic quote = off & open basdir = off in many server...

Joomla! 1.5.x - Token Remote Admin Change Password

Joomla! 1.5.x - Token Remote Admin Change Password Joomla 1.5.x Remote Admin Password Change Author: d3m0n [email protected] Greets: GregStar, gorion, d3d!k Polish "hackers" used this bug to deface turkish sites BUAHAHHA nice 0-day pff File : /components/comuser/controller.php Line : 379-399 function...

QT-cute QuickTalk Guestbook 1.6 - Multiple Cross-Site Scripting Vulnerabilities

QT-cute QuickTalk Guestbook 1.6 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/29013/info QT-cute QuickTalk Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may...

Joomla! Component joovideo 1.2.2 - id SQL Injection

Joomla! Component joovideo 1.2.2 - id SQL Injection Mambo Component comjoovideo SQL InjectionPowered by joovideo V1.0 AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MAÄ°L : [email protected] TODAY MY BÄ°RTDAY SOO I WROTE 5 BUGS ALL FOR HACKERS 5 EXPLOÄ°TS HAVE 100.000...

Apple Mac OSX xnu 1228.3.13 - IPv6-ipcomp Remote kernel Denial of Service (PoC)

Apple Mac OSX xnu 1228.3.13 - IPv6-ipcomp Remote kernel Denial of Service PoC / xnu-ipv6-ipcomp.c Copyright c 2008 by Apple MACOS X xnu md typo?. md = mpulldownm, off, sizeofipcomp, NULL; if !m - md = mpulldownm, off, sizeofipcomp, NULL; if !md bsd/netinet6/ipcompinput.c curiosly the same bug...

RichStrong CMS - cat SQL Injection

RichStrong CMS - cat SQL Injection --==+=================== Spanish Hackers Team www.spanish-hackers.com =================+==-- --==+ RichStrong CMS showproduct.asp?cat= Remote SQL Injection Exploit +==-- --==+====================================================================================+==...

wpQuiz 2.7 - Multiple SQL Injections

wpQuiz 2.7 - Multiple SQL Injections Tytul: wpQuiz 2.7 Remote SQL Injection Vulnerability http://wireplastik.com/projects.php Autor: Kacper E-Mail: [email protected] Strona: devilteam.eu Irc: irc.myg0t.com devilteam Blad:...

LinPHA 1.3.1 - new_images.php Blind SQL Injection

LinPHA 1.3.1 - newimages.php Blind SQL Injection order = $REQUEST'order'; 188. 189. if$defaultorder != $REQUEST'order' 190. 191. $this-linkaddress .= '&order='.$REQUEST'order'; 192. 193. 194. else 195. 196. $this-order = $defaultorder; 197. 198. 199. 200. // 201. // set sql query string 202. //...