Microsoft SharePoint 2013 (Cloud) - Persistent Exception Handling (MS13-067)

Microsoft SharePoint 2013 Cloud - Persistent Exception Handling MS13-067 Title: ====== Microsoft SharePoint 2013 Cloud - Persistent Exception Handling Web Vulnerability Date: ===== 2013-09-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=812 Security Bulletin: MS13-06...

Oracle Hyperion 11 - Directory Traversal

Oracle Hyperion 11 - Directory Traversal ======= Summary ======= Name: Oracle Hyperion 11 - Directory Traversal Release Date: 30 July 2013 Reference: NGS00434 Discoverer: Richard Warren Vendor: Oracle Vendor Reference: S0318807 Systems Affected: Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier,...

MoinMoin - Arbitrary Command Execution

MoinMoin - Arbitrary Command Execution !/usr/bin/env python -- coding: utf-8 -- ascii = '\x1b1;31m' ascii +=' \r\n' ascii +=' ██████████ ██████ ███ ███ ███ ██████████ ████████ ███ ███████ \r\n' ascii +=' ███████████ ████████ ███ ████ ███ ███████████ ████████ ███ ███████ \r\n' ascii +=' ██▒ ██▒ ██...

Remote File Manager 1.2 iOS - Multiple Vulnerabilities

Remote File Manager 1.2 iOS - Multiple Vulnerabilities Title: ====== Remote File Manager v1.2 iOS - Multiple Web Vulnerabilities Date: ===== 2013-02-23 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=882 VL-ID: ===== 882 Common Vulnerability Scoring System:...

Symantec pcAnywhere 12.5.0 - Login Password Remote Buffer Overflow

Symantec pcAnywhere 12.5.0 - Login Password Remote Buffer Overflow !/usr/bin/python Exploit Title: Symantec PcAnywhere login and password field buffer overflow Date: 2012.06.27 Author: S2 Crew Hungary Software Link: symantec.com Version: 12.5.0 Tested on: Windows XP SP2 CVE: CVE-2011-3478 EDB Not...

Airlock WAF 4.2.4 - Overlong UTF-8 Sequence Bypass

Airlock WAF 4.2.4 - Overlong UTF-8 Sequence Bypass SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Airlock WAF overlong UTF-8 sequence bypass product: Airlock vulnerable version: = 4.2.4 without hotfix HF4213 fixed...

Agora-Project 2.12.11 - Arbitrary File Upload

Agora-Project 2.12.11 - Arbitrary File Upload Exploit Title: agora-project2.12.1112-2011 Remote Shell Upload Google Dork: n0 N0obs Date: 10/06/2012 Exploit Author: Misa3l Vendor Homepage: http://sourceforge.net/projects/agora-project/ Software Link:...

FlexNet License Server Manager - Stack Overflow In lmgrd

FlexNet License Server Manager - Stack Overflow In lmgrd Luigi Auriemma Application: FlexNet License Server Manager http://www.flexerasoftware.com/products/flexnet-publisher.htm http://www.globes.com/support/fnputilitiesdownload.htm Versions: = 11.9.1 and others earlier this version number was...

Microsoft Windows - TCPIP Stack Denial of Service (MS11-064)

Microsoft Windows - TCPIP Stack Denial of Service MS11-064 Exploit Title: MS11-064 : Vulnerabilities in TCP/IP Stack Could Allow Denial of Service Date: 10/12/2011 Author: Byoungyoung Lee, http://www.cc.gatech.edu/blee303/ Version: Windows 7 32bit, fully patched until Aug 2011 Tested on: Windows ...

Multiple WordPress Plugins - timthumb.php File Upload

Multiple WordPress Plugins - timthumb.php File Upload Exploit Title: Multiple Wordpress timthumb.php reuse vulnerabilities Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing --- Description --- The following Wordpress plugins reuse a vulnerable version of the...

Sagem Router Fast 330434643504 - Telnet Authentication Bypass

Sagem Router Fast 330434643504 - Telnet Authentication Bypass !/home/bin/python Remote Exploit: SAGEM ROUTER FAST 3304/3464/3504 - Telnet Authentication bypass Date: 15-August-2011 Author: Elouafiq Ali Version: 3304-V1 / 3304-V2 / 3464 / 3504 Tested on: Linux Ubuntu 11.04, Linux Backtrack 5 Teste...

Realmarketing CMS - Multiple SQL Injections

Realmarketing CMS - Multiple SQL Injections +Exploit Title: Realmarketing CMS System Sensitive Database Disclosure Vulnerability +Author : ^Xecuti0n3r + Date : 22.04.2011 + Hour : 13:37 PM + E-mail : xecuti0n3ryahoo.com + dork : intext:realweb.de inurl:default.php + Category : Web Apps SQli Choos...

Cisco Security Agent Management Console - st_upload Remote Code Execution

Cisco Security Agent Management Console - stupload Remote Code Execution !/usr/bin/env python Exploits Cisco Security Agent Management Console ‘stupload’ CVE-2011-0364 gerry eisenhaur import httplib import mimetools import StringIO boundary = mimetools.chooseboundary hostuid =...

KingView 6.5.3 SCADA - ActiveX

KingView 6.5.3 SCADA - ActiveX Exploit Title: KingView 6.5.3 SCADA ActiveX Date: March 07 2011 Author: Carlos Mario Penagos Hollmann Software Link: http://download.kingview.com/software/kingview%20English%20Version/kingview6.53EN.rar Version: 6.53 English Tested on: Windows xp sp3 running on VMwa...

Linux Kernel 2.6.37 - Local Kernel Denial of Service (1)

Linux Kernel 2.6.37 - Local Kernel Denial of Service 1 / Linux Kernel include include include include include int main int optval, optlen, ret, sd, sd2, pid; char host = "localhost"; struct sockaddrin locAddr; struct sockaddrin servAddr; struct sockaddrin dstAddr; printf" Linux Kernel...

UMI CMS 2.8.1.2 - Multiple Cross-Site Scripting Vulnerabilities

UMI CMS 2.8.1.2 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/46280/info UMI CMS is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

YourTube 1.0 - Cross-Site Request Forgery (Add User)

YourTube 1.0 - Cross-Site Request Forgery Add User YourTube v1.0 CSRF Vulnerability Add User ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.ac4p.com/ .:. Dork : inurl:"Powered by YourTube v1.0" === Exploit ===...

TYPSoft FTP Server 1.10 - RETR Denial of Service (2)

TYPSoft FTP Server 1.10 - RETR Denial of Service 2 !/usr/bin/python TYPSoft FTP Server v 1.10 RETR CMD Denial Of Service CVE-2005-3294 OSVDB 19992 12/23/2010 C Emanuele Gentili Notes: I have wrote this exploit because the code published here 1 do not work correctly. 1...

Elcom CommunityManager.NET - Authentication Bypass

Elcom CommunityManager.NET - Authentication Bypass Elcom CommunityManager.NET Auth Bypass Vulnerability - Security Advisory - SOS-10-004 Release Date. 20-Dec-2010 Last Update. - Vendor Notification Date. 22-Jan-2010 Product. Elcom Technology's CommunityManager.NET Platform. IIS with ASP.NET...

J-Integra 2.11 - ActiveX SetIdentity() Buffer Overflow

J-Integra 2.11 - ActiveX SetIdentity Buffer Overflow //payload is windows/exec cmd=calc.exe shellcode = unescape '%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+ '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+...

dompdf 0.6.0 beta1 - Remote File Inclusion

dompdf 0.6.0 beta1 - Remote File Inclusion ================================== apps dompdf RFI Vulnerability ================================== ==================================================== x ExpL0it TitLe : apps dompdf RFI Vulnerability x DatE : 01 September 2010 x AutH0r : AndreCorleone x...

UFO: Alien Invasion 2.2.1 - Arbitrary Code Execution

UFO: Alien Invasion 2.2.1 - Arbitrary Code Execution Remote Arbitrary Code Execution Vulnerability in UFO: Alien Invasion -------------------------------------------------------------------- June 18th, 2010 ======= Summary ======= Name: Remote Arbitrary Code Execution Vulnerability in UFO: Alien...

Nginx 0.7.650.8.39 (dev) - Source Disclosure Download

Nginx 0.7.650.8.39 dev - Source Disclosure Download TITLE: NGINX ENGINE X SERVER http://nginx.org/en/ ref-1 ======TESTED VERSIONS===== Unix versions are not vulnerable it only affects to NTFS file system Windows Stable versions: nginx/0.7.66 -- Not vulnerable nginx/0.7.65 -- Vulnerable nginx/0.7....

e107 - Code Exection

e107 - Code Exection Exploit Title: e107 Code Exec Date: 05/22/10 Author: [email protected] Software Link: http://e107.org/edownload.php Version: e107 agent"Mozilla/5.0"; if $proxy print " Using proxy $proxy \n"; $ua-envproxy'1'; my $req = new HTTP::Request POST = $path;...

Netvidade engine 1.0 - Multiple Vulnerabilities

Netvidade engine 1.0 - Multiple Vulnerabilities !/usr/bin/perl -w use strict; use LWP::UserAgent; use Getopt::Long; use MIME::Base64; '/ -.- ----------------------oOO------OOo---------------------- | | | / / / / | | / / / / / / / / / / / | | // // / / / // / // / // | | ///,// /./,/, // | |...

eDisplay Personal FTP Server 1.0.0 - (Authenticated) Multiple Stack Buffer Overflows (1)

eDisplay Personal FTP Server 1.0.0 - Authenticated Multiple Stack Buffer Overflows 1 Exploit Title : eDisplay Personal FTP server 1.0.0 Multiple Post-Authentication Stack BOF Type of sploit: Remote Code Execution Bug found by : loneferret march 19, 2010 Reference :...

MobPartner Counter - Arbitrary File Upload

MobPartner Counter - Arbitrary File Upload MobPartner Counter Remote File Upload Vulnerability + Author : wlhaan hacker + Email : [email protected] + Site : www.sa-hacker.com/vb + team wlhaan Hacker + Dork : "MobPartner Counter" "upload files" The exploit : http://localhost/path/upload.php edit she...

Jasc Paint Shop Pro 8 - Local Universal Buffer Overflow

Jasc Paint Shop Pro 8 - Local Universal Buffer Overflow / Software: Jasc Paint Shop Pro v8 Local Buffer Overflow Exploit UNIVERSAL Bug type: Local buffer overflow Exploitation method: SEH handler overwrite Description: When a crafted .PNG file is oppened a stack buffer overflow occurs because of...

Python 2.5.2 Imageop Module - imageop.crop() Buffer Overflow

Python 2.5.2 Imageop Module - imageop.crop Buffer Overflow Python's 'imageop' module is prone to a buffer-overflow vulnerability. Successful exploits may allow attackers to execute arbitrary code in the context of applications using the vulnerable Python module. This may result in a compromise of...

OpenSSL 0.9.8i - DTLS ChangeCipherSpec Remote Denial of Service

OpenSSL 0.9.8i - DTLS ChangeCipherSpec Remote Denial of Service / cve-2009-1386.c OpenSSL http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1386 OpenSSL would SegFault if the DTLS server receives a ChangeCipherSpec as the first record instead of...

Easy Scripts Answer and Question Script - Multiple Vulnerabilities

Easy Scripts Answer and Question Script - Multiple Vulnerabilities || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ Kings of injection...

Microsoft Internet Explorer - EMBED Memory Corruption (PoC) (MS09-014)

Microsoft Internet Explorer - EMBED Memory Corruption PoC MS09-014 http://skypher.com/SkyLined/Repro/MSIE/EMBED%20memory%20corruption/repro3.html http://skypher.com/index.php/2009/04/19/ms09-014-embed-element-memory-corruption -- var asMimeTypes = "x-world/x-3dmf", "x-world/x-3dmf",...

pam-krb5 3.13 - Local Privilege Escalation

pam-krb5 3.13 - Local Privilege Escalation / cve-2009-0360.c pam-krb5 http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0360 pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which...

PHPstore Wholesale - id SQL Injection

PHPstore Wholesale - id SQL Injection | | | Wholesale track.php id Remote SQL Injection Vulnerability | | | | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | | email: [email protected] | | | | script : http://www.phpstore.info/productinfo.php?cPath=3653&productsid=162 | | DorK :...

ZEEMATRI 3.0 - adid SQL Injection

ZEEMATRI 3.0 - adid SQL Injection || | | ZEEMATRI v3.0 bannerclick.php adid Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : www.IQ-TY.com & www.TrYaG.cc | | email: [email protected] | | | | | | | script:...

Arcadem Pro - articlecat SQL Injection

Arcadem Pro - articlecat SQL Injection || | | Arcadem Pro articlecat Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | WwW.TrYaG.CC | | email: darkangelg85atYahooDoTcom | | | | | | | | script :...

deeemm CMS (dmcms) 0.7.4 - Multiple Vulnerabilities

deeemm CMS dmcms 0.7.4 - Multiple Vulnerabilities DeeEmm CMS Sql Injection/Rfi AUTHOR : IRCRASH R3d.W0rm Sina Yazdanmehr Discovered by : IRCRASH R3d.W0rm Sina Yazdanmehr Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Sina Yazdanmehr Script Download :...

phpAuction GPL Enhanced 2.51 - profile.php SQL Injection

phpAuction GPL Enhanced 2.51 - profile.php SQL Injection || | | PHPAuction GPL Enhanced V2.51 profile.php id Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : www.tryag.cc/cc | | email: darkangelg85atYahooDoTcom | | | | | ...

OTManager CMS 24a - Local File Inclusion Cross-Site Scripting

OTManager CMS 24a - Local File Inclusion Cross-Site Scripting =========================================================== OTManager CMS LFI/XSS Multiple Remote Vulnerabilities =========================================================== ,--^----------,--------,-----,-------^--, | ||||||||| -------...

PHP-Fusion Mod Kroax 4.42 - category SQL Injection

PHP-Fusion Mod Kroax 4.42 - category SQL Injection ========================================================== The kroax phpfusion Remote SQL-injection. ========================================================== Author : boom3rang Contact : [email protected] webpage : www.khg-crew.ws ---...

Mambo 4.6.4 - Cache Lite Output Remote File Inclusion (Metasploit)

Mambo 4.6.4 - Cache Lite Output Remote File Inclusion Metasploit This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

SNMPv3 - HMAC Validation error Remote Authentication Bypass

SNMPv3 - HMAC Validation error Remote Authentication Bypass snmpv3exp.sh exploit the vulnerability described in CVE-2008-0960, the HMAC check problem on multiple vendor Copyright c 2008 @ Mediaservice.net Srl. All rights reserved Wrote by Maurizio Agazzini http://lab.mediaservice.net/...

Easy-Clanpage 2.2 - id SQL Injection

Easy-Clanpage 2.2 - id SQL Injection .-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-. Easy-Clanpage v2.2 gallery Remote SQL Injection Vulnerability .-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-. + Author: n3w7u + Mail: [email protected] + Source:...

X.Org xorg-x11-xfs 1.0.2-3.1 - Local Race Condition

X.Org xorg-x11-xfs 1.0.2-3.1 - Local Race Condition !/bin/sh Xorg-x11-xfs Race Condition Vuln local root exploit CVE-2007-3103 Another lame xploit by vl4dZ : works on redhat el5 and before $ id uid=1001kecos gid=1001user groups=1001user $ sh xfs-RaceCondition-root-exploit.sh Generate large data...

DigitalHive 2.0 RC2 - user_id SQL Injection

DigitalHive 2.0 RC2 - userid SQL Injection body margin:3%; font-size:10px; color:FFFFFF; font-family:Verdana,Arial; background-color:1a1a1a; text-align: center; input background:303030; color:FFFFFF; font-family:Verdana,Arial; font-size:10px; vertical-align:middle; border-left:1px solid 5d5d5d;...

nuseo PHP enterprise 1.6 - Remote File Inclusion

nuseo PHP enterprise 1.6 - Remote File Inclusion Vulnerability Type: Remote File Inclusion Vulnerable file: /NuSEO PHP Enterprise.v1.6 Nulled by DGT/NuSEO.PHP.Enterprise.v1.6.PHP.NULL-DGT/nuseo/admin/nuseoadmind.php Exploit URL:...

Sendmail 8.13.5 - Remote Signal Handling (PoC)

Sendmail 8.13.5 - Remote Signal Handling PoC !/usr/bin/env python [email protected] Sendmail 8.13.5 and below Remote Signal Handling exploit usage: rbl4ck-sendmail.py 127.0.0.1 0 25 this exploit was leaked to the PHC Phrack High Council so instead of only letting them have a copy, we figu...

RealNetworks (Multiple Products) - Multiple Buffer Overflow Vulnerabilities

RealNetworks Multiple Products - Multiple Buffer Overflow Vulnerabilities source: https://www.securityfocus.com/bid/17202/info Various RealNetworks products are prone to multiple buffer-overflow vulnerabilities. These issues can result in memory corruption and facilitate arbitrary code execution....

PHPKIT 1.6.1R2 - filecheck Remote Command Execution

PHPKIT 1.6.1R2 - filecheck Remote Command Execution works with allowurlfopen = On usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: "All men can see the tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." also if magicquotesgpc =...

Microsoft Windows - Color Management Module Overflow (MS05-036) (1)

Microsoft Windows - Color Management Module Overflow MS05-036 1 / Author: snooq http://www.redpuffer.net/snooq/web/ Date: 21 July 2005 When I looked at the PoC posted on bugtraq.... I was basically quite disappointed. The 'PoC' fixed 'tag count' to a large number.. but this code path does not see...