Joomla! Component GPS Tools 4.0.1 - SQL Injection

Joomla! Component GPS Tools 4.0.1 - SQL Injection Exploit Title: Joomla! Component GPS Tools v4.0.1 - SQL Injection Google Dork: inurl:index.php?option=comgpstools Date: 24.02.2017 Vendor Homepage: http://corejoomla.com/ Software Buy:...

Palo Alto Networks Terminal Services Agent 7.0.3-13 - Integer Overflow

Palo Alto Networks Terminal Services Agent 7.0.3-13 - Integer Overflow / Exploit Title - Palo Alto Networks Terminal Services Agent Integer Overflow Date - 26th January 2017 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - https://www.paloaltonetworks.com/ Tested Version - 7.0.3-13 Drive...

Nagios 4.2.4 - Local Privilege Escalation

Nagios 4.2.4 - Local Privilege Escalation !/bin/bash Source: https://legalhackers.com/advisories/Nagios-Exploit-Root-PrivEsc-CVE-2016-9566.html Nagios Core 4.2.4 Root Privilege Escalation PoC Exploit nagios-root-privesc.sh ver. 1.0 CVE-2016-9566 Discovered and coded by: Dawid Golunski...

VBScript 5.8.7600.163855.8.9600.16384 - RegExpComp::PnodeParse Out-of-Bounds Read

VBScript 5.8.7600.163855.8.9600.16384 - RegExpComp::PnodeParse Out-of-Bounds Read !-- Source: http://blog.skylined.nl/20161108001.html Synopsis A specially crafted script can cause the VBScript engine to read data beyond a memory block for use as a regular expression. An attacker that is able to...

Subversion 1.6.61.6.12 - Code Execution

Subversion 1.6.61.6.12 - Code Execution This is an exploit for the subversion vulnerability published as CVE-2013-2088. Author: GlacierZ0ne [email protected] Exploit Type: Code Execution Access Type: Authenticated Remote Exploit Prerequisites: svn command line client available, subversion serv...

VMware Workstation - vprintproxy.exe JPEG2000 Images Multiple Memory Corruptions

VMware Workstation - vprintproxy.exe JPEG2000 Images Multiple Memory Corruptions Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=850 As already discussed in a number of reports in this tracker 285, 286, 287, 288, 289, 292, VMware Workstation current version 12.1.1 build-3770994...

MySQL 5.5.45 (x64) - Local Credentials Disclosure

MySQL 5.5.45 x64 - Local Credentials Disclosure MySQL 5.5.45 64bit Local Credentials Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://www.mysql.com Date 05/09/2016 Bug Discovered by Yakir Wizman https://www.linkedin.com/in/yakirwizman...

Operation Technology ETAP 14.1.0 - Multiple Stack Buffer Overrun Vulnerabilities

Operation Technology ETAP 14.1.0 - Multiple Stack Buffer Overrun Vulnerabilities Operation Technology ETAP 14.1.0 Multiple Stack Buffer Overrun Vulnerabilities Vendor: Operation Technology, Inc. Product web page: http://www.etap.com Affected version: 14.1.0.0 Summary: Enterprise Software Solution...

Asbru Web Content Management System 9.2.7 - Multiple Vulnerabilities

Asbru Web Content Management System 9.2.7 - Multiple Vulnerabilities Asbru Web Content Management System v9.2.7 Multiple Vulnerabilities Vendor: Asbru Ltd. Product web page: http://www.asbrusoft.com Affected version: 9.2.7 Summary: Ready to use, full-featured, database-driven web content...

CubeCart 6.0.10 - Multiple Vulnerabilities

CubeCart 6.0.10 - Multiple Vulnerabilities Advisory ID: HTB23298 Product: CubeCart Vendor: CubeCart Limited Vulnerable Versions: 6.0.10 and probably prior Tested Version: 6.0.10 Advisory Publication: March 2, 2016 without technical details Vendor Notification: March 2, 2016 Vendor Patch: March 16...

ManageEngine OPutils 8.0 - Multiple Vulnerabilities

ManageEngine OPutils 8.0 - Multiple Vulnerabilities =================================================================================== Privilege escalation Vulnerability in ManageEngine oputils =================================================================================== Overview ========...

Manage Engine Application Manager 12.5 - Arbitrary Command Execution

Manage Engine Application Manager 12.5 - Arbitrary Command Execution !C:/Python27/python.exe -u Applications Manager 12.5 Arbitrary Command Execution Exploit Vendor: Zoho Corporation Pvt. Ltd. Product web page: https://www.manageengine.com Affected version: 12.5 Summary: ManageEngine Applications...

PHPIPAM 1.1.010 - Multiple Vulnerabilities

PHPIPAM 1.1.010 - Multiple Vulnerabilities Exploit Title: PHPIPAM v1.1.010 Multiple Vulnerabilities Date: 04/01/2016 Author: Mickael Dorigny @ Synetis Vendor or Software Link: http://phpipam.net/ Version: 1.1.010 Category: Multiple Vulnerabilities Tested on : 1.1.010 PHPIPAM description :...

AlegroCart 1.2.8 - Multiple SQL Injections

AlegroCart 1.2.8 - Multiple SQL Injections Security Advisory - Curesec Research Team 1. Introduction Affected Product: AlegroCart 1.2.8 Fixed in: Patch AC128fix17102015 Path Link: http://forum.alegrocart.com/download/file.php?id=1040 Vendor Website: http://alegrocart.com/ Vulnerability Type: SQL...

SAP NetWeaver 7.01 - XML External Entity Injection

SAP NetWeaver 7.01 - XML External Entity Injection Title: SAP Netwaver - XML External Entity Injection Author: Lukasz Miedzinski GPG: Public key provided in attachment Date: 29/10/2014 CVE: CVE-2015-7241 Affected software : =================== SAP Netwear : XML Content and Actions - Import sectio...

Netsweeper 4.0.8 - Authentication Bypass (via New Profile Creation)

Netsweeper 4.0.8 - Authentication Bypass via New Profile Creation +-----------------------------------------------------------------+ + Netsweeper 4.0.8 - Authentication Bypass New Profile Creation + +-----------------------------------------------------------------+ Affected Product: Netsweeper...

OTRS 3.1.x 3.2.x 3.3.x - Persistent Cross-Site Scripting

OTRS 3.1.x 3.2.x 3.3.x - Persistent Cross-Site Scripting Exploit Title: Stored Cross-Site Scripting XSS in OTRS Date: 28.01.2014 Exploit Author: Adam Ziaja http://adamziaja.com Vendor Homepage: https://www.otrs.com Version: 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 CVE :...

Adobe Flash Player - Arbitrary Code Execution

Adobe Flash Player - Arbitrary Code Execution Source: https://github.com/SecurityObscurity/cve-2015-0313 PoC: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/36491.zip Adobe Flash vulnerability source code cve-2015-0313 from Angler Exploit Kit Reference:...

Linux Kernel 3.16.3 - Associative Array Garbage Collection Crash (PoC)

Linux Kernel 3.16.3 - Associative Array Garbage Collection Crash PoC / ---------------------------------------------------------------------------------------------------- cve-2014-3631poc.c The assocarraygc function in the associative-array implementation in lib/assocarray.c in the Linux kernel...

SolarWinds Orion Service - SQL Injection

SolarWinds Orion Service - SQL Injection I found a couple SQL injection vulnerabilities in the core Orion service used in most of the Solarwinds products SAM, IPAM, NPM, NCM, etc…. This service provides a consistent configuration and authentication layer across the products. To be exact, the...

Ansible Tower 2.0.2 - Multiple Vulnerabilities

Ansible Tower 2.0.2 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Privilege Escalation & XSS & Missing Authentication product: Ansible Tower vulnerable version: =2.0.5 impact: high homepage...

xRadio-0.95b-(.xrl)

xRadio is affected by stack-based buffer overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Successful exploitation of the vulnerability allows an attacker to execute arbitrary code. Other versions are also affected but have a different trigger...

IBM-Tivoli-Monitoring-6.2.2

Title: IBM Tivoli Monitoring V6.2.2 kbbacf1 privilege escalation exploit CVE: CVE-2013-5467 Vendor Homepage: http://www-03.ibm.com/software/products/pl/tivomoni Author: Robert Jaroszuk Tested on: RedHat 5, Centos 5 Vulnerable version: IBM Tivoli Monitoring V6.2.2 other versions not tested !/bin/s...

ZYXEL Prestig P-660HNU-T1 - ISP Credentials Disclosure

ZYXEL Prestig P-660HNU-T1 - ISP Credentials Disclosure !/usr/bin/perl Exploit Author: Sebastián Magof Hardware: ZyXEL Prestig P-660HNU-T1 Vulnerable file: wzADSL.asp location: http://gateway/cgi-bin/wzADSL.asp Bug: ISP usr+pwd disclosure Type: Local Date: 22/09/2014 Vendor Homepage:...

BulletProof FTP Client 2010 - Buffer Overflow (SEH) (Python)

BulletProof FTP Client 2010 - Buffer Overflow SEH Python !/usr/bin/python ----------------------------------------------------------------------------- Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow SEH Exploit Date: Sep 05 2014 Vulnerability Discovery: Gabor Seljan Exploit Author:...

MuPDF 1.3 - xps_parse_color() Stack Buffer Overflow

MuPDF 1.3 - xpsparsecolor Stack Buffer Overflow ============================================================= 0day - MuPDF Stack-based Buffer Overflow in xpsparsecolor ============================================================= Date of discovery: 2013-01-26 Software Links: http://www.mupdf.com/...

IcoFX 2.5.0.0 - .ico Buffer Overflow (PoC)

IcoFX 2.5.0.0 - .ico Buffer Overflow PoC Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ IcoFX Buffer Overflow Vulnerability PoC: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/30208.zip 1. Advisory Information Title: IcoFX Buffer Overflow...

Apple Safari 6.0.1 for iOS 6.0 Apple Mac OSX 10.78 - Heap Buffer Overflow

Apple Safari 6.0.1 for iOS 6.0 Apple Mac OSX 10.78 - Heap Buffer Overflow -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------------+ | Packet Storm Advisory 2013-0903-1 | | http://packetstormsecurity.com/ |...

MoinMoin - Arbitrary Command Execution

MoinMoin - Arbitrary Command Execution !/usr/bin/env python -- coding: utf-8 -- ascii = '\x1b1;31m' ascii +=' \r\n' ascii +=' ██████████ ██████ ███ ███ ███ ██████████ ████████ ███ ███████ \r\n' ascii +=' ███████████ ████████ ███ ████ ███ ███████████ ████████ ███ ███████ \r\n' ascii +=' ██▒ ██▒ ██...

Grep 2.11 - Integer Overflow Crash (PoC)

Grep 2.11 - Integer Overflow Crash PoC Grep /dev/null Segmentation fault core dumped Method two: $ perl -e 'print "\nx"x231' | grep -c x /dev/null Twitter: https://twitter.com/MegaManSec CVE: CVE-2012-5667 -- Joshua Rogers - Retro Game Collector && IT Security Specialist gpg pubkey...

Siemens Simatic S7-1200 - CPU STARTSTOP Module (Metasploit)

Siemens Simatic S7-1200 - CPU STARTSTOP Module Metasploit Exploit Title: Siemens Simatic S7 1200 CPU command module Date: 7-13-2012 Exploit Author: Dillon Beresford Vendor Homepage: http://www.siemens.com/ Tested on: Siemens Simatic S7-1200 PLC CVE : None require 'msf/core' class Metasploit3...

traq 2.3.5 - Multiple Vulnerabilities

traq 2.3.5 - Multiple Vulnerabilities ==================================================================== Vulnerable Software: traq-2.3.5 Official Site: TraqProject.org ==================================================================== About Software: Traq is a PHP powered project manager,...

Joomla! Component com_jobprofile - SQL Injection

Joomla! Component comjobprofile - SQL Injection Joomla Component Jobprofile comjobprofile SQL Injection Vulnerability Author : kaMtiEz [email protected] Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id Date : 2 Dec , 2011 Software Information +...

Microsoft Windows - TCPIP Stack Denial of Service (MS11-064)

Microsoft Windows - TCPIP Stack Denial of Service MS11-064 Exploit Title: MS11-064 : Vulnerabilities in TCP/IP Stack Could Allow Denial of Service Date: 10/12/2011 Author: Byoungyoung Lee, http://www.cc.gatech.edu/blee303/ Version: Windows 7 32bit, fully patched until Aug 2011 Tested on: Windows ...

DoceboLms 4.0.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities

DoceboLms 4.0.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities DoceboLMS 4.0.4 Multiple Stored XSS Vulnerabilities function xss1document.forms"xss1".submit; function xss2document.forms"xss2".submit; input type="hidden" name="authentic...

ABBS Audio Media Player 3.0 - .lst Local Buffer Overflow (SEH)

ABBS Audio Media Player 3.0 - .lst Local Buffer Overflow SEH Exploit Title: ABBS Audio Media Player Buffer Overflow Exploit SEH Software Link: http://abbs.qsnx.net/downloads/abbs-amp.zip Version: 3.0 Tested on: Win XP SP3 French Date: 14/03/2011 Author: h1ch4m Email: [email protected] Home:...

KingView 6.5.3 SCADA - ActiveX

KingView 6.5.3 SCADA - ActiveX Exploit Title: KingView 6.5.3 SCADA ActiveX Date: March 07 2011 Author: Carlos Mario Penagos Hollmann Software Link: http://download.kingview.com/software/kingview%20English%20Version/kingview6.53EN.rar Version: 6.53 English Tested on: Windows xp sp3 running on VMwa...

Linux Kernel 2.6.37 - Local Kernel Denial of Service (1)

Linux Kernel 2.6.37 - Local Kernel Denial of Service 1 / Linux Kernel include include include include include int main int optval, optlen, ret, sd, sd2, pid; char host = "localhost"; struct sockaddrin locAddr; struct sockaddrin servAddr; struct sockaddrin dstAddr; printf" Linux Kernel...

ObjectivityDB - Lack of Authentication

ObjectivityDB - Lack of Authentication !/usr/bin/python obj.py Objectivity/DB Lack of Authentication Remote Exploit Jeremy Brown 0xjbrown41-gmail-com Jan 2011 "Objectivity, Inc. is a leader in distributed, scalable database technology. Our patented data management engine and persistent object sto...

Microsoft Win32k - Keyboard Layout (MS10-073)

Microsoft Win32k - Keyboard Layout MS10-073 // My koala is staring at you CºgºD // Source: http://reversemode.com/index.php?option=comcontent&task=view&id=71&Itemid=1 include include include define MAGICOFFSET 0x6261 define InitializeUnicodeStrp,s \ p-Length= wcslens2; \ p-MaximumLength =...

YourTube 1.0 - Cross-Site Request Forgery (Add User)

YourTube 1.0 - Cross-Site Request Forgery Add User YourTube v1.0 CSRF Vulnerability Add User ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.ac4p.com/ .:. Dork : inurl:"Powered by YourTube v1.0" === Exploit ===...

Camtron CMNC-200 IP Camera - Directory Traversal

Camtron CMNC-200 IP Camera - Directory Traversal Finding 2: Directory Traversal in Camera Web Server CVE: CVE-2010-4231 The CMNC-200 IP Camera has a built-in web server that is enabled by default. The server is vulnerable to directory transversal attacks, allowing access to any file on the camera...

Microsoft ASP.NET - Padding Oracle File Download (MS10-070)

Microsoft ASP.NET - Padding Oracle File Download MS10-070 !/usr/bin/ruby -w aspxpochotextattack.rb Copyright c 2010 AmpliaSECURITY. All rights reserved http://www.ampliasecurity.com Agustin Azubel - [email protected] MS10-070 ASPX proof of concept Decrypt data using Vaudenay's...

Chipmunk Board 1.3 - index.php?forumID SQL Injection

Chipmunk Board 1.3 - index.php?forumID SQL Injection Exploit Title: Chipmunk Board index.php?forumID Remote SQL Injection Vulnerability Date: October, 01 st 2010 Author: Shamus Software Link: http://www.chipmunk-scripts.com/board/board.zip Version: Chipmunk Forums Version 1.3 Tested on: windows C...

Adobe Acrobat and Reader - pushstring Memory Corruption

Adobe Acrobat and Reader - pushstring Memory Corruption ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | ' + self.eol else: self.content += self.eol + data + self.eol self.content += 'endobj' + self.eol def objSWFStreamself, objnum, data, stream:...

textpattern CMS 4.2.0 - Remote File Inclusion

textpattern CMS 4.2.0 - Remote File Inclusion Remote File Inclusion Vulnerability ------------------------------------------------------------------------------ Textpattern index.php -------------------------------------------------------------- + Author : Sn!pEr.S!Te Hacker + Email :...

Subdreamer Pro 3.0.4 - CMS Upload

Subdreamer Pro 3.0.4 - CMS Upload . \\ \\ / |/ | || | | /\\ \\\\ \\ \\/ \\| | \\/ /\\ \\ | | | | \\ / \\| | | | | /\\ \\ / \\| | | / /| || \\/|// /| \\/ \\/ \\/ \\/ Exploit Title: Subdreamer Pro v3.0.4 CMS upload Vulnerability Author: Battousai Home:...

NX Web CMS (NX WCMS 4.5) - Multiple Vulnerabilities

NX Web CMS NX WCMS 4.5 - Multiple Vulnerabilities N/X - Web CMS N/X WCMS 4.5 Multiple Vulnerability =================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /'...

Virata EmWeb R6.0.1 - Remote Crash

Virata EmWeb R6.0.1 - Remote Crash Exploit Title: Virata EmWeb R6.0.1 Remote Crash Vulnerability Date: 06/04/10 Author: Jobert Abma Online 24 Email: j.abmaatonline24dotnl Version: R6.0.1 Tested on: linux CVE : Code : This was written for educational purpose. Use it at your own risk. Author will b...

Portable AVS DVD Authoring 1.3.3.51 - Local Crash (PoC)

Portable AVS DVD Authoring 1.3.3.51 - Local Crash PoC C:\perl\bin Exploit Title: Portable AVS DVD Authoring Date: 2010/4pr/05 Author: R3d-D3v!L Version: v1.3.3.51 Tested on: windows XP sp3 Coded by x$file"; print $FILE "$boom"; close$FILE; print "Done..!\n";...