Operation Technology ETAP 14.1.0 - Multiple Stack Buffer Overrun Vulnerabilities

Operation Technology ETAP 14.1.0 - Multiple Stack Buffer Overrun Vulnerabilities Operation Technology ETAP 14.1.0 Multiple Stack Buffer Overrun Vulnerabilities Vendor: Operation Technology, Inc. Product web page: http://www.etap.com Affected version: 14.1.0.0 Summary: Enterprise Software Solution...

iTop 2.2.1 - Cross-Site Request Forgery

iTop 2.2.1 - Cross-Site Request Forgery Advisory ID: HTB23293 Product: iTop Vendor: Combodo Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Advisory Publication: February 10, 2016 without technical details Vendor Notification: February 10, 2016 Vendor Patch: February 11, 2016...

Chamilo LMS IDOR - messageId Delete POST Injection

Chamilo LMS IDOR - messageId Delete POST Injection Document Title: =============== Chamilo LMS IDOR - messageId Delete POST Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1720 Video: https://www.youtube.com/watch?v=3ApPhUIk12Y Relea...

Manage Engine Application Manager 12.5 - Arbitrary Command Execution

Manage Engine Application Manager 12.5 - Arbitrary Command Execution !C:/Python27/python.exe -u Applications Manager 12.5 Arbitrary Command Execution Exploit Vendor: Zoho Corporation Pvt. Ltd. Product web page: https://www.manageengine.com Affected version: 12.5 Summary: ManageEngine Applications...

Chamilo LMS 1.9.10 - Multiple Vulnerabilities

Chamilo LMS 1.9.10 - Multiple Vulnerabilities I. Overview ======================================================== Chamilo LMS 1.9.10 or prior versions are prone to a multiple Cross-Site Scripting Stored + Reflected & CSRF vulnerabilities. These vulnerabilities allows an attacker to gain control...

Citrix Nitro SDK - Command Injection

Citrix Nitro SDK - Command Injection Abstract Securify discovered a command injection vulnerability in xenhotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges nsroot. This issue can be used to compromise of the entire Citrix SDX appliance and all...

Linux Kernel 3.16.3 - Associative Array Garbage Collection Crash (PoC)

Linux Kernel 3.16.3 - Associative Array Garbage Collection Crash PoC / ---------------------------------------------------------------------------------------------------- cve-2014-3631poc.c The assocarraygc function in the associative-array implementation in lib/assocarray.c in the Linux kernel...

Wickr Desktop 2.2.1 Windows - Denial of Service

Wickr Desktop 2.2.1 Windows - Denial of Service Document Title: =============== Wickr Desktop v2.2.1 Windows - Denial of Service Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1377 Video:...

Soitec SmartEnergy 1.4 - SCADA Login SQL Injection Authentication Bypass

Soitec SmartEnergy 1.4 - SCADA Login SQL Injection Authentication Bypass Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Exploit Vendor: Soitec Product web page: http://www.soitec.com Affected version: 1.4 and 1.3 Summary: Soitec power plants are a profitable and ecological...

SHARP MX Series - Denial of Service

SHARP MX Series - Denial of Service Exploit Title: SHARP MX Series - Denial Of Service Date: 08/08/2014 Exploit Author: pws Vendor Homepage: Sharp Printers Firmware Link: Not found Tested on: Latest version Shodan d0rk: "SHARP Telnet server" 4000 devices CVE : None yet $ python -c 'print "A"200 +...

WordPress Plugin Quick PagePost Redirect 5.0.3 - Multiple Vulnerabilities

WordPress Plugin Quick PagePost Redirect 5.0.3 - Multiple Vulnerabilities Details ================ Software: Quick Page/Post Redirect Plugin Version: 5.0.3 Homepage: http://wordpress.org/plugins/quick-pagepost-redirect-plugin/ Advisory ID: dxw-1970-1091 CVE: CVE-2014-2598 CVSS: 6.8 Medium;...

NETGEAR DGN2200 N300 Wireless Router - Multiple Vulnerabilities

NETGEAR DGN2200 N300 Wireless Router - Multiple Vulnerabilities Title: Multiple vulnerabilities in NETGEAR N300 WIRELESS ADSL2+ MODEM ROUTER DGN2200 ==================================================================================== Notification Date: 11 February 2014 Affected Vendor: NetGear...

Invision Power Board 1.x?2.x3.x - Admin Takeover

Invision Power Board 1.x?2.x3.x - Admin Takeover IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13 Author: John JEAN @johnjean on twitter Affected application: Invision Power Board = 3.4.4 Type ...

Ettercap 0.7.5.1 - Stack Overflow

Ettercap 0.7.5.1 - Stack Overflow Title: Ettercap Stack overflow CWE-121 References: CVE-2012-0722 Discovered by: Sajjad Pourali Vendor: http://www.ettercap.sourceforge.net/ Vendor contact: 13-01-01 21:20 UTC No response Solution: Using the patch Patch:...

SIEMENS Sipass Integrated 2.6 Ethernet Bus - Arbitrary Pointer Dereference

SIEMENS Sipass Integrated 2.6 Ethernet Bus - Arbitrary Pointer Dereference IOActive Security Advisory Title: SIEMENS Sipass Integrated 2.6 Ethernet Bus Arbitrary Pointer Dereference Severity: Critical Discovered by: Lucas Apa Date Reported: 09/11/12 CVE: TBD Siemens Advisory: SSA-938777...

ManageEngine Security Manager Plus 5.5 build 5505 - Remote SYSTEM SQL Injection (Metasploit)

ManageEngine Security Manager Plus 5.5 build 5505 - Remote SYSTEM SQL Injection Metasploit This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of us...

Able2Doc and Able2Doc Professional 6.0 - Memory Corruption

Able2Doc and Able2Doc Professional 6.0 - Memory Corruption Exploit Title: Able2Doc and Able2Doc Professional v 6.0 memory corruption Date: June 24 2012 Exploit Author: Carlos Mario Penagos Hollmann Vendor Homepage: www.investintech.com Version:6.0 Tested on: Windows 7 CVE : cve-2011-4221 payload...

Open Journal Systems (OJS) 2.3.6 - Multiple Script Arbitrary File Upload

Open Journal Systems OJS 2.3.6 - Multiple Script Arbitrary File Upload source: https://www.securityfocus.com/bid/52666/info Open Journal Systems is prone to following multiple vulnerabilities because the software fails to sufficiently sanitize user-supplied input: 1. An arbitrary-file-deletion...

Mozilla Firefox 4.0.1 - Array.reduceRight() Remote Overflow

Mozilla Firefox 4.0.1 - Array.reduceRight Remote Overflow function hexx var y = x.toString16; y = "0x"+y; return y; function itoai return String.fromCharCodei; // n - length in bytes 1 unicode char = 2 bytes function puffx, n whilex.length n x += x; return x.substring0,n; function arr2hextab var ...

Tiki Wiki CMS Groupware 8.1 - show_errors HTML Injection

Tiki Wiki CMS Groupware 8.1 - showerrors HTML Injection source: https://www.securityfocus.com/bid/51128/info Tiki Wiki CMS Groupware is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied...

pkexec - Race Condition Privilege Escalation

pkexec - Race Condition Privilege Escalation / Exploit Title: pkexec Race condition CVE-2011-1485 exploit Author: xi4oyu Tested on: rhel 6 CVE : 2011-1485 Linux pkexec exploit by xi4oyu , thx [email protected] Have fun ¡Á U can reach us @ http://www.wooyun.org : / include include include include inclu...

ServersCheck Monitoring Software 8.8.x - Multiple Vulnerabilities

ServersCheck Monitoring Software 8.8.x - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/49793/info ServersCheck Monitoring Software is prone to multiple remote input-validation vulnerabilities, including: 1. Multiple HTML-injection vulnerabilities 2. Multiple cross-site...

Carel PlantVisor 2.4.4 - Directory Traversal

Carel PlantVisor 2.4.4 - Directory Traversal Luigi Auriemma Application: Carel PlantVisor http://www.carel.com/carelcom/web/eng/catalogo/prodottodett.jsp?idprodotto=310 Versions: = 2.4.4 Platforms: Windows Bug: directory traversal Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma...

Ultimate eShop - Error-Based SQL Injection

Ultimate eShop - Error-Based SQL Injection Exploit Title: Ultimate eShop Error Based SQL Injection Vulnerability Google Dork: inurl:index.cgi?aktion=shopview Date: 19/04/2011 Author: Romka Software Link: http://www.ultimate-eshop.de/ Tested on: Windows XP SP3 Exploit:...

7-Technologies IGSS 9.00.00.11059 - Multiple Vulnerabilities

7-Technologies IGSS 9.00.00.11059 - Multiple Vulnerabilities Sources: http://aluigi.org/adv/igss1-adv.txt http://aluigi.org/adv/igss2-adv.txt http://aluigi.org/adv/igss3-adv.txt http://aluigi.org/adv/igss4-adv.txt http://aluigi.org/adv/igss5-adv.txt http://aluigi.org/adv/igss6-adv.txt...

Microsoft ASP.NET - Padding Oracle File Download (MS10-070)

Microsoft ASP.NET - Padding Oracle File Download MS10-070 !/usr/bin/ruby -w aspxpochotextattack.rb Copyright c 2010 AmpliaSECURITY. All rights reserved http://www.ampliasecurity.com Agustin Azubel - [email protected] MS10-070 ASPX proof of concept Decrypt data using Vaudenay's...

Chipmunk Board 1.3 - index.php?forumID SQL Injection

Chipmunk Board 1.3 - index.php?forumID SQL Injection Exploit Title: Chipmunk Board index.php?forumID Remote SQL Injection Vulnerability Date: October, 01 st 2010 Author: Shamus Software Link: http://www.chipmunk-scripts.com/board/board.zip Version: Chipmunk Forums Version 1.3 Tested on: windows C...

Software Index - Arbitrary File Upload

Software Index - Arbitrary File Upload Vendor: http://www.p30vel.ir/ Date: 2010-05-27 Author : indoushka Thanks to : Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com ! Contact : [email protected] Home : Bug : Up Tested on : windows SP2 Français V.Pnx2 2.0 Dork : Copyright 2010...

HP Operations Manager 8.16 - srcvw4.dll LoadFile()SaveFile() Remote Unicode Stack Overflow (PoC)

HP Operations Manager 8.16 - srcvw4.dll LoadFileSaveFile Remote Unicode Stack Overflow PoC !-- |------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// //...

Torrent Hoster - Remount Upload

Torrent Hoster - Remount Upload ======================================================================================== | Title : Torrent Hoster Remont Upload Exploit | Author : El-Kahina | Home : www.h4kz.com | | Script : Powered by Torrent Hoster. | Tested on: windows SP2 Franais V.Pnx2 2.0 +...

Nuked-klaN 1.7.7 - Remote File Inclusion

Nuked-klaN 1.7.7 - Remote File Inclusion ======================================================================================== | Title : Nuked-Klan 1.7.7 RFI Vulnerability | | Author : indoushka | | email : [email protected] | | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria...

weenCompany - SQL Injection

weenCompany - SQL Injection weenCompany SQL Injection Vulnerability Vendor: http://www.weentech.com/ Author: Gamoscu Site: www.1923turk.biz Site: http://gamoscu.wordpress.com/ Dork:"Created by weenCompany" Exploit: http://server/index.php?moduleid=m2newsSQL-inj&articleid=1 Greetz: Manas58 Baybora...

CuteNews and UTF-8 CuteNews - Multiple Vulnerabilities

CuteNews and UTF-8 CuteNews - Multiple Vulnerabilities MorningStar Security - Advisory http://www.morningstarsecurity.com/ Multiple security issues in Cute News and UTF-8 Cute News 1. Advisory Information...

URA 3.0 - cat SQL Injection

URA 3.0 - cat SQL Injection --------------------------------------------------- URA 3.0 cat remote SQL injection Vulnerability --------------------------------------------------- + Author : Chip D3 Bi0s + Email : chipdebiosalt+64gmail.com + Group : LatinHackTeam + Vulnerability : SQL injection...

ISC DHCP dhclient 3.1.2p1 - Remote Buffer Overflow (PoC)

ISC DHCP dhclient 3.1.2p1 - Remote Buffer Overflow PoC / cve-2009-0692.c ISC DHCP dhclient http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0692 Stack-based buffer overflow in the scriptwriteparams method in client/dhclient.c in ISC DHCP dhclient 4.1...

Joomla! Component Akobook 2.3 - gbid SQL Injection

Joomla! Component Akobook 2.3 - gbid SQL Injection Joomla Component comakobook Vulnerability ---------------------------------------------------------------------- + Author : Ab1i + Email : [email protected] + Dork : inurl:index.php?option=comakobook Example:...

NOKIA Siemens FlexiISN 3.1 - Multiple Authentication Bypass Vulnerabilities

NOKIA Siemens FlexiISN 3.1 - Multiple Authentication Bypass Vulnerabilities NOKIA Siemens FlexiISN GGSN Multiple Authentication bypass Vulnerability: NOKIA Siemens FlexiISN Remote: Yes Local: No Class: Input Validation Error Critical: Moderately critical OS : FlexiISN GGSN FISN 3.1 URL 1 for...

Vibro-School-CMS - nID SQL Injection

Vibro-School-CMS - nID SQL Injection ! ! ! OOOO O OOOOOOOOO ! !O O O O O ! !O O O ! !O OOOO OOOO OOOOOO OOOO OOO OO O OOOO OO OO OOOO ! !O OOO OOO O O O O OO O O O O OO O O O ! !O OO OO O O OOOOOO O O O O O O OOOOOO ! !O O OOOO O O O O O O O O O O O ! ! OOOO OO OOOOOO OOOO OOOOOO OOOOOOOOO OOOO O...

6rbScript 3.3 - section.php Local File Inclusion

6rbScript 3.3 - section.php Local File Inclusion || | | 6rbScript V3.3 Local file Vulnerability | | | | | | script : www.6rbscript.com | | DorK : inurl:"section.php?name=singers" | dorK : Powered By 6rbScript V3.3 || Author : Stack Expl need magic quote = off & open basdir = off in many server...

PHPWebGallery 1.3.4 - Cross-Site Scripting Local File Inclusion

PHPWebGallery 1.3.4 - Cross-Site Scripting Local File Inclusion ---------------------------------------------------------------- Script : PhpWebGallery 1.3.4 Type : Multiple Vulnerabilities XSS/LFI Rist : High Google Dork : inurl:"picture.php?cat=" "Powered by PhpWebGallery 1.3.4"...

Joomla! Component DBQuery 1.4.1.1 - Remote File Inclusion

Joomla! Component DBQuery 1.4.1.1 - Remote File Inclusion @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@...

AcmlmBoard 1.A2 - pow SQL Injection

AcmlmBoard 1.A2 - pow SQL Injection AcmlmBoard v1.A2 SQL Injection Vulnerability Bug by: h0yt3r Dork: "AcmlmBoard v1.A2" This Board Software suffers from some not correctly verified variables which are used in SQL Querys. An Attacker can easily get sensitive information from the database by...

Joomla! Component Rapid Recipe 1.6.5 - SQL Injection

Joomla! Component Rapid Recipe 1.6.5 - SQL Injection joomla SQL Injectioncomrapidrecipe AUTHOR : S@BUN HOME : http://www.hackturkiye.com MAÄ°L : [email protected] DORK 1 : allinurl: "comrapidrecipe"userid DORK 2 : allinurl: "comrapidrecipe" categoryid EXPLOIT : after userid or...

xeCMS 1.x - view.php Remote File Disclosure

xeCMS 1.x - view.php Remote File Disclosure -------------------------------------------------------------- xeCMS 1.x.x Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://xecms.sunsite.dk/ author : p4imi0 contact : [email protected]...

wpQuiz 2.7 - Multiple SQL Injections

wpQuiz 2.7 - Multiple SQL Injections Tytul: wpQuiz 2.7 Remote SQL Injection Vulnerability http://wireplastik.com/projects.php Autor: Kacper E-Mail: [email protected] Strona: devilteam.eu Irc: irc.myg0t.com devilteam Blad:...

RunCMS 1.6 - Local File Inclusion

RunCMS 1.6 - Local File Inclusion WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: RunCms Multiple Vulnerabilities Vendor: http://www.runcms.org/ Bugs: Local File Inclusion, Modules Authorization Weakness Vulnerable Version: RunCMS 1.6 Halloween, 1.5.x prior version...

Vortex Portal 1.0.42 - Remote File Inclusion

Vortex Portal 1.0.42 - Remote File Inclusion Vortex Portal 1.0.42 RFI ---------- Author : ShAy6oOoN ---------- Group : PitBull Crew ---------- Script : Vortex Portal 1.0.42 ---------- Download : http://www.igamingcms.com/legacy-software/VortexPortal1.0.42.zip ---------- Vuln Type: RFI ----------...

LinPHA 1.3.1 - new_images.php Blind SQL Injection

LinPHA 1.3.1 - newimages.php Blind SQL Injection order = $REQUEST'order'; 188. 189. if$defaultorder != $REQUEST'order' 190. 191. $this-linkaddress .= '&order='.$REQUEST'order'; 192. 193. 194. else 195. 196. $this-order = $defaultorder; 197. 198. 199. 200. // 201. // set sql query string 202. //...

XOOPS Module Lykos Reviews 1.00 - index.php SQL Injection

XOOPS Module Lykos Reviews 1.00 - index.php SQL Injection XOOPS Module Lykos Reviews 1.00 index.php BLIND SQL Injection Exploit //'=============================================================================================== //'Script Name: XOOPS Module Lykos Reviews 1.00 index.php BLIND SQL...

Ipswitch WS_FTP Server 5.05 - XMD5 Remote Buffer Overflow (Metasploit)

Ipswitch WSFTP Server 5.05 - XMD5 Remote Buffer Overflow Metasploit This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core...