eDisplay Personal FTP Server 1.0.0 - (Authenticated) Multiple Stack Buffer Overflows (1)

eDisplay Personal FTP Server 1.0.0 - Authenticated Multiple Stack Buffer Overflows 1 Exploit Title : eDisplay Personal FTP server 1.0.0 Multiple Post-Authentication Stack BOF Type of sploit: Remote Code Execution Bug found by : loneferret march 19, 2010 Reference :...

tincan ltd - section SQL Injection

tincan ltd - section SQL Injection +/=============================================+ + Title : tincan ltd section SQL Injection Vulnerability + site s.p : www.tincan.co.uk + Author : altbta + Email : [email protected] + home : v4-team.com & tryag.cc +=============================================/+...

Microsoft IIS - ASP Multiple Extensions Security Bypass 5.x6.x Vulnerabilities

Microsoft IIS - ASP Multiple Extensions Security Bypass 5.x6.x Vulnerabilities !/usr/bin/python Exploit Title: Exploit for Microsoft IIS ASP Multiple Extensions Security Bypass 5.x/6.x Date: 29 dec 2009 Author: Emanuele 'emgent' Gentili and Emanuele 'crossbower' Acri Software Link: N/A Version: I...

BM Classifieds Ads - SQL Injection

BM Classifieds Ads - SQL Injection ALGERIAN HACKER - NORTH-AFRICA SECURITY TEAM - ! BM Classifieds ads SQL injection vulnerability ! Author : Dr.0rYX & Cr3w-DZ ! MAIL : [email protected] & [email protected] / Software Information + Vendor : http://www.bmscripts.com/ + script : powered by BM Classified...

Python 2.5.2 Imageop Module - imageop.crop() Buffer Overflow

Python 2.5.2 Imageop Module - imageop.crop Buffer Overflow Python's 'imageop' module is prone to a buffer-overflow vulnerability. Successful exploits may allow attackers to execute arbitrary code in the context of applications using the vulnerable Python module. This may result in a compromise of...

CuteNews and UTF-8 CuteNews - Multiple Vulnerabilities

CuteNews and UTF-8 CuteNews - Multiple Vulnerabilities MorningStar Security - Advisory http://www.morningstarsecurity.com/ Multiple security issues in Cute News and UTF-8 Cute News 1. Advisory Information...

Xpdf 3.01 - Local Heap Overflow Null Pointer Dereference

Xpdf 3.01 - Local Heap Overflow Null Pointer Dereference Name: Xpdf - Integer overflow which causes heap overflow and NULL pointer derefernce Author: Adam Zabrocki / HISPASEC or Date: July 06, 2009 Issue: Xpdf allows local and remote attackers to overflow buffer on heap via integer overflow...

Joomla! Component Hotel Booking System - Cross-Site Scripting SQL Injection

Joomla! Component Hotel Booking System - Cross-Site Scripting SQL Injection \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV111$2009 ----------------------------------------------------------------------------------------- ECHOADV111$2009 Joomla Hotel...

Open Auto Classifieds 1.5.9 - Multiple Vulnerabilities

Open Auto Classifieds 1.5.9 - Multiple Vulnerabilities MorningStar Security - Advisory http://www.morningstarsecurity.com/ Multiple security issues in Open Auto Classifieds 1. Advisory Information ---------------------------------------------------------------------------------------------- Title...

Joomla! Component Akobook 2.3 - gbid SQL Injection

Joomla! Component Akobook 2.3 - gbid SQL Injection Joomla Component comakobook Vulnerability ---------------------------------------------------------------------- + Author : Ab1i + Email : [email protected] + Dork : inurl:index.php?option=comakobook Example:...

Microsoft Internet Explorer - EMBED Memory Corruption (PoC) (MS09-014)

Microsoft Internet Explorer - EMBED Memory Corruption PoC MS09-014 http://skypher.com/SkyLined/Repro/MSIE/EMBED%20memory%20corruption/repro3.html http://skypher.com/index.php/2009/04/19/ms09-014-embed-element-memory-corruption -- var asMimeTypes = "x-world/x-3dmf", "x-world/x-3dmf",...

ablespace 1.0 - Cross-Site Scripting Blind SQL Injection

ablespace 1.0 - Cross-Site Scripting Blind SQL Injection riginal advisory: http://dsecrg.com/pages/vul/show.php?id=137 Digital Security Research Group DSecRG Advisory DSECRG-09-037 Application: AbleSpace Versions Affected: 1.0 Vendor URL: http://abk-soft.com/ Bugs: Multiple Blind SQL Injections,...

MKPortal 1.2.1 - Multiple Vulnerabilities

MKPortal 1.2.1 - Multiple Vulnerabilities waraxe-2009-SA070 - Multiple Vulnerabilities in MKPortal = 1.2.1 ============================================================================== Author: Janek Vind "waraxe" Date: 15. January 2009 Location: Estonia, Tartu Web:...

PHP iCalendar 2.24 - cookie_language Local File Inclusion Arbitrary File Upload

PHP iCalendar 2.24 - cookielanguage Local File Inclusion Arbitrary File Upload '.$lang'lcalfile'.' '.$filenumber.': '.$lang'lactionsuccess'.''; 84. el...

WordPress Plugin Download Manager 0.2 - Arbitrary File Upload

WordPress Plugin Download Manager 0.2 - Arbitrary File Upload WORDPRESS PLUGIN DOWNLOAD MANAGER 0.2 REMOTE FILE UPLOAD SaO BiyoSecurityTeam || www.biyosecurity.com Plugin URI: http://giulioganci.netsons.org/downloads-manager Local File milw0rm.com 2008-07-24...

Joomla! Component DBQuery 1.4.1.1 - Remote File Inclusion

Joomla! Component DBQuery 1.4.1.1 - Remote File Inclusion @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@...

PHP-Fusion Mod Kroax 4.42 - category SQL Injection

PHP-Fusion Mod Kroax 4.42 - category SQL Injection ========================================================== The kroax phpfusion Remote SQL-injection. ========================================================== Author : boom3rang Contact : [email protected] webpage : www.khg-crew.ws ---...

Joomla! Component FacileForms 1.4.4 - Remote File Inclusion

Joomla! Component FacileForms 1.4.4 - Remote File Inclusion Title: Joomla Component ComFacileforms ================================================================ + Author : Dr.Kacak + Special Thankz : KnocKout and all my friends + System 0VerfL0verZ...

Kmita Mail 3.0 - file Remote File Inclusion

Kmita Mail 3.0 - file Remote File Inclusion \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV94$2008 ----------------------------------------------------------------------------------------- ECHOADV94$2008 Kmita Mail = 3.0 file Remote File Inclusion...

Ruby 1.8.61.9 (WEBick HTTPd 1.3.1) - Directory Traversal

Ruby 1.8.61.9 WEBick HTTPd 1.3.1 - Directory Traversal ------------------------------------------------------------------------------------ Digital Security Research Group DSecRG Advisory DSECRG-08-018 Application: Ruby 1.8.6 WEBrick Web server Toolkit and applications that used WEBrick, like...

DigitalHive 2.0 RC2 - user_id SQL Injection

DigitalHive 2.0 RC2 - userid SQL Injection body margin:3%; font-size:10px; color:FFFFFF; font-family:Verdana,Arial; background-color:1a1a1a; text-align: center; input background:303030; color:FFFFFF; font-family:Verdana,Arial; font-size:10px; vertical-align:middle; border-left:1px solid 5d5d5d;...

BadBlue 2.72 - PassThru Remote Buffer Overflow

BadBlue 2.72 - PassThru Remote Buffer Overflow !/usr/bin/perl -w http://aluigi.altervista.org/adv/badblue-adv.txt https://www.securityfocus.com/bid/26803 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6379 exploit for stack overflow in badblue 2.72 Credit to Luigi Auriemma Jacopo Cervini...

wpQuiz 2.7 - Multiple SQL Injections

wpQuiz 2.7 - Multiple SQL Injections Tytul: wpQuiz 2.7 Remote SQL Injection Vulnerability http://wireplastik.com/projects.php Autor: Kacper E-Mail: [email protected] Strona: devilteam.eu Irc: irc.myg0t.com devilteam Blad:...

RunCMS 1.6 - Local File Inclusion

RunCMS 1.6 - Local File Inclusion WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: RunCms Multiple Vulnerabilities Vendor: http://www.runcms.org/ Bugs: Local File Inclusion, Modules Authorization Weakness Vulnerable Version: RunCMS 1.6 Halloween, 1.5.x prior version...

e-Vision CMS 2.02 - SQL Injection Remote Code Execution

e-Vision CMS 2.02 - SQL Injection Remote Code Execution !/usr/bin/php -q -d shortopentag=on ...need i say more? Bug 2 admin/functions.php: if isset$COOKIE'adminlang' $languageselector = $COOKIE'adminlang'; else $languageselector = "en"; include"lang/".$languageselector.".php"; ...speaks for it se...

Mambo Component Remository 3.25 - Remote File Inclusion

Mambo Component Remository 3.25 - Remote File Inclusion .: insecurity research team :. ....:...:. . .:. | |/ :/ // :/ .:. : | | | \\ /\ / :. . ..: ||| / \ \ .: .:.. .. ./ .:/:. ./. .:/: . ...:. .advisory. .:... :..................: o9.o8.2oo6 .. Affected Application: Remository v3.25...

Kayako eSupport 2.3.1 - subd Remote File Inclusion

Kayako eSupport 2.3.1 - subd Remote File Inclusion Script: Kayako eSupport Comments: It seems like the vendor silently fixed the issue in the current version more like since v2.3.5 withouth warning users of previous versions, noobs. Requires that "registerglobals" is enabled. Vulnerable File:...

Microsoft Windows - Color Management Module Overflow (MS05-036) (1)

Microsoft Windows - Color Management Module Overflow MS05-036 1 / Author: snooq http://www.redpuffer.net/snooq/web/ Date: 21 July 2005 When I looked at the PoC posted on bugtraq.... I was basically quite disappointed. The 'PoC' fixed 'tag count' to a large number.. but this code path does not see...

Berlios GPSD 1.91-1 2.7-2 - Format String

Berlios GPSD 1.91-1 2.7-2 - Format String require 'msf/core' class Metasploit3 'Berlios GPSD Format String Vulnerability', 'Description' = %q This module exploits a format string vulnerability in the Berlios GPSD server. This vulnerability was discovered by Kevin Finisterre. , 'Author' = 'Yann...

Invision Power Board (IP.Board) 1.3.1 - Design Error

Invision Power Board IP.Board 1.3.1 - Design Error IP.Board Design Error Vendor: Invision Power Services Product: IP.Board Version: = 1.3.1 Website: http://www.invisionpower.com/ BID: 10559 Description: Invision Power Board IPB is a professional forum system that has been built from the ground up...

Virtual Programming VP-ASP 4.005.00 - shopdisplayproducts.asp SQL Injection

Virtual Programming VP-ASP 4.005.00 - shopdisplayproducts.asp SQL Injection source: https://www.securityfocus.com/bid/9134/info It has been reported that VP-ASP may be prone to a SQL injection vulnerability that may allow an attacker to disclose sensitive information by supplying malicious SQL co...

ProFTPd 1.2.9 rc2 - .ASCII File Remote Code Execution (1)

ProFTPd 1.2.9 rc2 - .ASCII File Remote Code Execution 1 / proftpd 1.2.7/1.2.9rc2 remote root exploit by bkbll bkbllcnhonker.net, 2003/10/1 for FTPProFTPDTranslateOverflow found by X-force happy birthday, China. this code is dirty, there are more beautiful exploits of proftpd for this vuln in the...

ISC BIND 8.2.x - TSIG Remote Stack Overflow (1)

ISC BIND 8.2.x - TSIG Remote Stack Overflow 1 / tsig0wn.c Copyright Field Marshal August Wilhelm Anton Count Neithardt von Gneisenau [email protected] The author is not and will not be held responsible for the action of other people using this code. provided for informational purposes only sin...

University of Washington - imap LSUB Buffer Overflow (Metasploit)

University of Washington - imap LSUB Buffer Overflow Metasploit $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

S.u.S.E Linux 5.2 - gnuplot Local Overflow Local Privilege Escalation

S.u.S.E Linux 5.2 - gnuplot Local Overflow Local Privilege Escalation / source: https://www.securityfocus.com/bid/319/info Linux gnuplot 3.5 is shipped with S.u.S.E. Linux 5.2 and installed suid root by default. There is a buffer overflow vulnerability present in gnuplot which allows for users to...

FreeBSD 2.x HP-UX 91011 Kernel 2.0.3 Windows NT 4.0Server 2003 NetBSD 1 - land.c loopback Denial of Service (1)

FreeBSD 2.x HP-UX 91011 Kernel 2.0.3 Windows NT 4.0Server 2003 NetBSD 1 - land.c loopback Denial of Service 1 / source: https://www.securityfocus.com/bid/2666/info A number of TCP/IP stacks are vulnerable to a "loopback" condition initiated by sending a TCP SYN packet with the source address and...

Apache Tomcat - AJP Ghostcat File ReadInclusion

Apache Tomcat - AJP Ghostcat File ReadInclusion !/usr/bin/env python CNVD-2020-10487 Tomcat-Ajp lfi by ydhcui import struct Some references: https://tomcat.apache.org/connectors-doc/ajp/ajpv13a.html def packstrings: if s is None: return struct.pack"h", -1 l = lens return struct.pack"H%dsb" % l, l...

HP System Event 1.2.9.0 - HPWMISVC Unquoted Service Path

HP System Event 1.2.9.0 - HPWMISVC Unquoted Service Path Exploit Title: HP System Event 1.2.9.0 - 'HPWMISVC' Unquoted Service Path Discovery by: Roberto Piña Discovery Date: 2020-02-14 Vendor Homepage:https://www8.hp.com/mx/es/home.html Software...

HomeGuard Pro 9.3.1 - Insecure Folder Permissions

HomeGuard Pro 9.3.1 - Insecure Folder Permissions Exploit Title: HomeGuard Pro 9.3.1 - Insecure Folder Permissions Exploit Author: boku Date: 2020-02-13 Vendor Homepage: https://veridium.net Software Link: https://veridium.net/filesu/hg-pro/exe/HomeGuardPro-Setup.exe Version 9.3.1 Tested On:...

iOSmacOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand()

iOSmacOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand While investigating possible shared memory issues in AGXCommandQueue::processSegmentKernelCommand, I noticed that the size checks used to parse the IOAccelKernelCommand in...

Online Job Portal 1.0 - user_email SQL Injection

Online Job Portal 1.0 - useremail SQL Injection Exploit Title: Online Job Portal 1.0 - 'useremail' SQL Injection Dork: N/A Date: 2020-02-06 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/php/13850/online-job-portal-phppdo.html Software Link:...

ASTPP VoIP 4.0.1 - Remote Code Execution

ASTPP VoIP 4.0.1 - Remote Code Execution Exploit Title: ASTPP VoIP 4.0.1 - Remote Code Execution Date: 2019-11-18 Exploit Author: Fabien AUNAY Vendor Homepage: https://www.astppbilling.org/ Software Link: https://github.com/iNextrix/ASTPP/tree/v4.0.1 Version: 4.0.1 vendor default setup script...

Inim Electronics Smartliving SmartLAN 6.x - Hard-coded Credentials

Inim Electronics Smartliving SmartLAN 6.x - Hard-coded Credentials Exploit Title: Inim Electronics Smartliving SmartLAN 6.x - Hard-coded Credentials Exploit Author: LiquidWorm Date: 2019-12-09 Product web page: https://www.inim.biz Link:...

Ubuntu 19.10 - Refcount Underflow and Type Confusion in shiftfs

Ubuntu 19.10 - Refcount Underflow and Type Confusion in shiftfs Tested on Ubuntu 19.10, kernel "5.3.0-19-generic 20-Ubuntu". Ubuntu ships a filesystem "shiftfs" in fs/shiftfs.c in the kernel tree that doesn't exist upstream. This filesystem can be mounted from user namespaces, meaning that this i...

Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass

Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass Exploit Title: Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass Author: LiquidWorm Date: 2019-11-05 Vendor: Smartwares Product web page: https://www.smartwares.eu Affected version: =1.0.9 Advisory ID: ZSL-2019-5540...

QNAP NetBak Replicator 4.5.6.0607 - QVssService Unquoted Service Path

QNAP NetBak Replicator 4.5.6.0607 - QVssService Unquoted Service Path Exploit Title: QNAP NetBak Replicator 4.5.6.0607 - 'QVssService' Unquoted Service Path Discovery Date: 2019-11-05 Exploit Author: Ivan Marmolejo Vendor Homepage: https://www.qnap.com/en/ Software Link:...

DESKTOP-NQLQSKD

A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...

macOS 18.7.0 Kernel - Local Privilege Escalation

macOS 18.7.0 Kernel - Local Privilege Escalation macOS-Kernel-Exploit DISCLAIMER You need to know the KASLR slide to use the exploit. Also SMAP needs to be disabled which means that it's not exploitable on Macs after 2015. These limitations make the exploit pretty much unusable for in-the-wild...

QEMU - Denial of Service

QEMU - Denial of Service include include include include include include include include include include include include include include include include include define diex do \ perrorx; \ exitEXITFAILURE; \ while0; // Constans define SRCADDR "10.0.2.15" define DSTADDR "10.0.2.2" define INTERFACE...

Sar2HTML 3.2.1 - Remote Command Execution

Sar2HTML 3.2.1 - Remote Command Execution Exploit Title: sar2html Remote Code Execution Date: 01/08/2019 Exploit Author: Furkan KAYAPINAR Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Centos 7 In web...