OpenSSL TLS Heartbeat Extension - Heartbleed Information Leak (1)

OpenSSL TLS Heartbeat Extension - Heartbleed Information Leak 1 / CVE-2014-0160 heartbleed OpenSSL information leak exploit ========================================================= This exploit uses OpenSSL to create an encrypted connection and trigger the heartbleed leak. The leaked information...

OpenSSL TLS Heartbeat Extension - Heartbleed Memory Disclosure

OpenSSL TLS Heartbeat Extension - Heartbleed Memory Disclosure !/usr/bin/python Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford [email protected] The author disclaims copyright to this source code. import sys import struct import socket import time import select import re...

Nucleus Plugin Gallery - Remote File Inclusion SQL Injection

Nucleus Plugin Gallery - Remote File Inclusion SQL Injection ============================================================================================================= o Nucleus Plugin Gallery RFI & SQLi Vulnerability Software : NPGallery version 0.94 Download :...

TFM MMPlayer 2.0 - .m3u.ppl Universal Buffer Overflow (SEH)

TFM MMPlayer 2.0 - .m3u.ppl Universal Buffer Overflow SEH !/usr/bin/perl + Bug : TFM MMPlayer 2.0 m3u/ppl Universal Buffer Overflow Exploit SEH + Author : ThE g0bL!N Greetz to all my friends Tested on: Windows XP Pro SP2 Fr Big Thnx :His0k4 Download:http://www.tfm.ro/mmplayer/download/mmplayer.zi...

S9Y Serendipity 1.0.3 - comment.php Local File Inclusion

S9Y Serendipity 1.0.3 - comment.php Local File Inclusion DEVIL TEAM IRC: irc.milw0rm.com:6667 devilteam http://www.rahim.webd.pl/ ======== Contact: [email protected] cod3d by Kacper -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Greetings DragonHeart and all DEVIL...

Centos WebPanel 7 - term SQL Injection

Centos WebPanel 7 - term SQL Injection Exploit Title: Centos WebPanel 7 - 'term' SQL Injection Google Dork: N/A Date: 2020-03-03 Exploit Author: Berke YILMAZ Vendor Homepage: http://centos-webpanel.com/ Software Link: http://centos-webpanel.com/ Version: v6 - v7 Tested on: Kali Linux - Windows 10...

Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape

Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape Exploit Title: Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape Date: 2020-01-07 Exploit Author: Harrison Neal, PatchAdvisor Vendor Homepage: https://tomcat.apache.org/ Software Link:...

xorg-x11-server 1.20.3 (Solaris 11) - inittab Local Privilege Escalation

xorg-x11-server 1.20.3 Solaris 11 - inittab Local Privilege Escalation !/bin/sh Exploit Title: xorg-x11-server A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the...

PhpSpreadsheet 1.5.0 - XML External Entity (XXE)

PhpSpreadsheet 1.5.0 - XML External Entity XXE Product Description PhpSpreadsheet is a library written in pure PHP that provides a set of classes allowing users to read from and write to different spreadsheet file formats, such as Excel and LibreOffice Calc. Vulnerabilities List One vulnerability...

AsusWRT Router 3.0.0.4.380.7743 - LAN Remote Code Execution

AsusWRT Router 3.0.0.4.380.7743 - LAN Remote Code Execution Unauthenticated LAN remote code execution in AsusWRT Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 22/01/2018 / Last...

Cisco Catalyst 2960 IOS 12.2(55)SE11 - ROCEM Remote Code Execution

Cisco Catalyst 2960 IOS 12.255SE11 - ROCEM Remote Code Execution !/usr/bin/python Exploit Title: Cisco Catalyst 2960 - Buffer Overflow Exploit Details: https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/ Date: 04.10.2017 Exploit Author: https://twitter.com/artkond Vendor Homepage...

Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection

Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection Exploit Title: Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection Google Dork: N/A Date: 2020-03-05 Exploit Author: Daniel Monzón stark0de Vendor Homepage: https://www.codepeople.net/ Software Link:...

TrendMicro InterScan Web Security Virtual Appliance - Shellshock Remote Command Injection

TrendMicro InterScan Web Security Virtual Appliance - Shellshock Remote Command Injection !/usr/bin/env python TrendMicro InterScan Web Security Virtul Appliance ================================================== InterScan Web Security is a software virtual appliance that dynamically protects...

Gnew 2013.1 - Multiple Vulnerabilities (2)

Gnew 2013.1 - Multiple Vulnerabilities 2 Advisory ID: HTB23171 Product: Gnew Vendor: Raoul Proença Vulnerable Versions: 2013.1 and probably prior Tested Version: 2013.1 Advisory Publication: August 28, 2013 without technical details Vendor Notification: August 28, 2013 Public Disclosure: October...

Tube Ace (Adult PHP Tube Script) - SQL Injection

Tube Ace Adult PHP Tube Script - SQL Injection Exploit Title: Tube AceAdult PHP Tube Script SQL Injection Date: 05/02/2012 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software: Tube Ace http://www.tubeace.com Tested on: Linux Dork...

Popper 1.41-r2 - form Remote File Inclusion

Popper 1.41-r2 - form Remote File Inclusion ============================================================================================== Popper ================================================================================================ Exploit : --------------------------------...

CS-Cart 1.3.3 - classes_dir Remote File Inclusion

CS-Cart 1.3.3 - classesdir Remote File Inclusion $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$ $$ $$ CS-Cart 1.3.3 classesdir = Remote File Include Vulnerability $$ Script site: http://www.cs-cart.com $$ Dork: Powered by CS-Cart - Shopping Cart Software $$...

Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation

Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Exploit Title: Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group Exploit Author: Nolan B. Kennedy nxkennedy Discovery date: 2019-09-20 Vendor Homepage:...

Spidermonkey - IonMonkey Type Inference is Incorrect for Constructors Entered via OSR

Spidermonkey - IonMonkey Type Inference is Incorrect for Constructors Entered via OSR / A bug in IonMonkeys type inference system when JIT compiling and entering a constructor function via on-stack replacement OSR allows the compilation of JITed functions that cause type confusions between...

Dnsmasq 2.50 - Heap Overflow Null Pointer Dereference

Dnsmasq 2.50 - Heap Overflow Null Pointer Dereference -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Dnsmasq Heap Overflow and Null-pointer Dereference on TFTP Server 1. Advisory Information Title: Dnsmasq Heap...

Odin Secure FTP Expert 7.6.3 - Site Info Denial of Service (PoC)

Odin Secure FTP Expert 7.6.3 - Site Info Denial of Service PoC Exploit Title: Odin Secure FTP Expert 7.6.3 - 'Site Info' Denial of Service PoC Discovery by: Ivan Marmolejo Discovery Date: 2020-03-27 Vendor Homepage: https://odin-secure-ftp-expert.jaleco.com/ Software Link Download :...

AVAST SecureLine 5.5.522.0 - SecureLine Unquoted Service Path

AVAST SecureLine 5.5.522.0 - SecureLine Unquoted Service Path Exploit Title: AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path Discovery by: Roberto Piña Discovery Date: 2020-03-24 Vendor Homepage:https://www.avast.com/ Software Link...

Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution

Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution !/usr/bin/python3 Exploits the Citrix Directory Traversal Bug: CVE-2019-19781 You only need a listener like netcat to catch the shell. Shout out to the team: Rob Simon, Justin Elze, Logan Sampson, Geoff Walton,...

Pulse Secure 8.1R15.18.28.39.0 SSL VPN - Remote Code Execution

Pulse Secure 8.1R15.18.28.39.0 SSL VPN - Remote Code Execution !/usr/bin/python Exploit Title: Pulse Secure Post-Auth Remote Code Execution Google Dork: inurl:/dana-na/ filetype:cgi Date: 09/05/2019 Exploit Author: Justin Wagner 0xDezzy, Alyssa Herrera @AlyssaHerrera Vendor Homepage:...

Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection

Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection Unauthenticated XML External Entity XXE in Ahsay Backup v7.x - v8.1.0.50. Date: 26-6-2019 Exploit Author: Wietse Boonstra Vendor Homepage: https://ahsay.com Software Link: http://ahsay-dn.ahsay.com/v8/81050/cbs-win.exe Version: 7.x...

QNAP Netatalk 3.1.12 - Authentication Bypass

QNAP Netatalk 3.1.12 - Authentication Bypass Exploit Title: QNAP Netatalk Authentication Bypass Date: 12/20/2018 Original Exploit Author: Jacob Baines Modifications for QNAP devices: Mati Aharoni Vendor Homepage: http://netatalk.sourceforge.net/ Software Link:...

Linux Kernel 4.3.3 (Ubuntu 14.0415.10) - overlayfs Local Privilege Escalation (1)

Linux Kernel 4.3.3 Ubuntu 14.0415.10 - overlayfs Local Privilege Escalation 1 / just another overlayfs exploit, works on kernels before 2015-12-26 Exploit Title: overlayfs local root Date: 2016-01-05 Exploit Author: rebel Version: Ubuntu 14.04 LTS, 15.10 and more Tested on: Ubuntu 14.04 LTS, 15.1...

S9Y Serendipity 1.5.4 - Arbitrary File Upload

S9Y Serendipity 1.5.4 - Arbitrary File Upload In The Name Of GOD + Exploit Title:remote 0day file upload + Date: 2010 + script:Serendipity 1.5.4 + Software Link: http://www.s9y.org/12.html + Author : pentesters.ir +discovered by:ahmadbady + Contact : [email protected] + Website :...

My_eGallery Module 3.1.1 - Remote File Inclusion Command Injection

MyeGallery Module 3.1.1 - Remote File Inclusion Command Injection source: https://www.securityfocus.com/bid/9113/info A problem has been identified in the handling of input by MyeGallery. Because of this, it may be possible for a remote user to gain unauthorized access to a system using the...

10-Strike Network Inventory Explorer - srvInventoryWebServer Unquoted Service Path

10-Strike Network Inventory Explorer - srvInventoryWebServer Unquoted Service Path Exploit Title: 10-Strike Network Inventory Explorer - 'srvInventoryWebServer' Unquoted Service Path Date: 2020-03-24 Author: Felipe Winsnes Vendor Homepage: https://www.10-strike.com/ Software Link:...

Oracle Solaris 11.111.3 (RSH) - Stack Clash Local Privilege Escalation

Oracle Solaris 11.111.3 RSH - Stack Clash Local Privilege Escalation / Solarisrsh.c for CVE-2017-3630, CVE-2017-3629, CVE-2017-3631 Copyright C 2017 Qualys, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published ...

OpenBSD HTTPd 6.0 - Memory Exhaustion Denial of Service

OpenBSD HTTPd 6.0 - Memory Exhaustion Denial of Service Advisory Information Title: Remote DoS against OpenBSD http server up to 6.0 Advisory URL: https://pierrekim.github.io/advisories/CVE-2017-5850-openbsd.txt Blog URL: https://pierrekim.github.io/blog/2017-02-07-openbsd-httpd-CVE-2017-5850.htm...

Microsoft Windows 8.1 (x64) - RGNOBJ Integer Overflow (MS16-098)

Microsoft Windows 8.1 x64 - RGNOBJ Integer Overflow MS16-098 // Source: https://github.com/sensepost/ms16-098/tree/b85b8dfdd20a50fc7bc6c40337b8de99d6c4db80 // Binary: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41020.exe include include include include inclu...

Joomla! Component JComments 2.1 - ComntrNam Cross-Site Scripting

Joomla! Component JComments 2.1 - ComntrNam Cross-Site Scripting source: https://www.securityfocus.com/bid/40230/info The JComments component for Joomla! is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue...

Microsoft Windows 7 (x86) - BlueKeep Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Free

Microsoft Windows 7 x86 - BlueKeep Remote Desktop Protocol RDP Remote Windows Kernel Use After Free EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47683.zip import rdp import socket import binascii import time def poolsprays, crypter, payload...

System Shield 5.0.0.136 - Privilege Escalation

System Shield 5.0.0.136 - Privilege Escalation / Exploit Title - System Shield AntiVirus & AntiSpyware Arbitrary Write Privilege Escalation Date - 29th January 2018 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.iolo.com/ Tested Version - 5.0.0.136 Driver Version - 5.4.11.1 ...

Microsoft Windows - .LNK Shortcut File Code Execution

Microsoft Windows - .LNK Shortcut File Code Execution !/usr/bin/python -- coding: utf-8 -- Title : CVE-2017-8464 | LNK Remote Code Execution Vulnerability CVE : 2017-8464 Authors : ykoster, nixawk Notice : Only for educational purposes. Support : python2 import struct def generateSHELLLINKHEADER:...

WSO2 Carbon 4.4.5 - Persistent Cross-Site Scripting

WSO2 Carbon 4.4.5 - Persistent Cross-Site Scripting + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-PERSISTENT-XSS-COOKIE-THEFT.txt + ISR: ApparitionSec Vendor: ============= www.wso2.com Product:...

ASPapp Knowledge Base - CatId SQL Injection (1)

ASPapp Knowledge Base - CatId SQL Injection 1 ....... ...... ..... .....CoRPITX ..... ..... ...... ....... -----------------Turkey-------------------------------------- --------- www.Hayalet-hack.com------------------------------- ----------www.xcorpitx-hack.com------------------------------ Iate...

Iskysoft Application Framework Service 2.4.3.241 - IsAppService Unquoted Service Path

Iskysoft Application Framework Service 2.4.3.241 - IsAppService Unquoted Service Path Exploit Title: Iskysoft Application Framework Service 2.4.3.241 - 'IsAppService' Unquoted Service Path Discovery by: Alejandro Reyes Discovery Date: 2020-03-05 Vendor Homepage: https://www.iskysoft.us Software...

Citrix Application Delivery Controller and Gateway 10.5 - Remote Code Execution (Metasploit)

Citrix Application Delivery Controller and Gateway 10.5 - Remote Code Execution Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Citrix ADC Remote Code Execution', 'Description' = %q ...

Online Book Store 1.0 - Unauthenticated Remote Code Execution

Online Book Store 1.0 - Unauthenticated Remote Code Execution Exploit Title: Online Book Store 1.0 - Unauthenticated Remote Code Execution Google Dork: N/A Date: 2020-01-07 Exploit Author: Tib3rius Vendor Homepage:...

McAfee ePO 5.9.1 - Registered Executable Local Access Bypass

McAfee ePO 5.9.1 - Registered Executable Local Access Bypass Exploit Title: McAfee ePO 5.9.1 Registered Executable Local Access Bypass Date: 2019-03-07 Exploit Author: @leonjza Vendor Homepage: https://www.mcafee.com/ Software Link:...

UniSharp Laravel File Manager 2.0.0-alpha7 - Arbitrary File Upload

UniSharp Laravel File Manager 2.0.0-alpha7 - Arbitrary File Upload Exploit Title: UniSharp Laravel File Manager - Arbitrary File Upload Google Dork: inurl:"laravel-filemanager?type=Files" -site:github.com -site:github.io Exploit Author: Mohammad Danish Vendor Homepage:...

Linux Kernel 4.15.x 4.19.2 - map_write() CAP_SYS_ADMIN Local Privilege Escalation (polkit Method)

Linux Kernel 4.15.x 4.19.2 - mapwrite CAPSYSADMIN Local Privilege Escalation polkit Method !/bin/sh EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47167.zip wrapper for Jann Horn's exploit for CVE-2018-18955 uses polkit technique ---...

Microsoft Windows Server 2003 SP2 - Local Privilege Escalation (MS14-070)

Microsoft Windows Server 2003 SP2 - Local Privilege Escalation MS14-070 """ KL-001-2015-001 : Microsoft Windows Server 2003 SP2 Arbitrary Write Privilege Escalation Title: Microsoft Windows Server 2003 SP2 Arbitrary Write Privilege Escalation Advisory ID: KL-001-2015-001 Publication Date:...

MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities

MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities Trustwave SpiderLabs Security Advisory TWSL2013-019: Multiple Vulnerabilities in MiCasaVerde VeraLite Published: 08/01/13 Version: 1.0 Vendor: MiCasaVerde http://www.micasaverde.com/ Product: VeraLite Version affected: 1.5.408 Product...

ThWboard 3.0 - index.php Cross-Site Scripting

ThWboard 3.0 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/17627/info ThWboard is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have...

PHP - openssl_x509_parse() Memory Corruption

PHP - opensslx509parse Memory Corruption SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: PHP opensslx509parse Memory Corruption Vulnerability Release Date: 2013/12/13 Last Modified: 2013/12/13 Author: Stefan Esser stefan.esseratsektioneins.de Application: PHP 4.0.6 - PHP 4.4...

Konqueror 4.7.3 - Memory Corruption

Konqueror 4.7.3 - Memory Corruption -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Nth Dimension Security Advisory NDSA20121010 Date: 10th October 2012 Author: Tim Brown URL: / Product: Konqueror 4.7.3 Vendor: KDE Risk: Medium Summary The Konqueror web browser is vulnerable to a number of memory...