Microsoft Windows - CSRSS BaseSrvCheckVDM Session 0 Process Creation Privilege Escalation (MS16-048)

Microsoft Windows - CSRSS BaseSrvCheckVDM Session 0 Process Creation Privilege Escalation MS16-048 / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=692 Windows: CSRSS BaseSrvCheckVDM Session 0 Process Creation EoP Platform: Windows 8.1, not tested on Windows 10 or 7 Class:...

Chamilo LMS IDOR - messageId Delete POST Injection

Chamilo LMS IDOR - messageId Delete POST Injection Document Title: =============== Chamilo LMS IDOR - messageId Delete POST Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1720 Video: https://www.youtube.com/watch?v=3ApPhUIk12Y Relea...

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - Invalid Pointer Dereference

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - Invalid Pointer Dereference !/usr/bin/python Title: IBM Tivoli Storage Manager FastBack Server 5.5.4.2 Invalid Pointer Dereference Date: 14 December 2015 Author: Gianni Gnesa gnix Vendor Homepage: http://www.ibm.com/ Software Name: IBM Tivoli...

Ovidentia bulletindoc Module 2.9 - Multiple Remote File Inclusions

Ovidentia bulletindoc Module 2.9 - Multiple Remote File Inclusions Title: Ovidentia Module bulletindoc 2.9 Multiple Remote File Inclusion Vulnerabilities Author: bd0rk eMail: bd0rkathackermail.com Twitter: twitter.com/bd0rk Tested on: Ubuntu-Linux Download:...

TECO JN5 L510-DriveLink 1.482 - .lf5 Overwrite Buffer Overflow (SEH)

TECO JN5 L510-DriveLink 1.482 - .lf5 Overwrite Buffer Overflow SEH !/usr/bin/perl TECO JN5 L510-DriveLink 1.482 SEH Overwrite Buffer Overflow Exploit Vendor: TECO Electric and Machinery Co., Ltd. Product web page: http://www.teco-group.eu Download:...

PROLiNK H5004NK ADSL Wireless Modem - Multiple Vulnerabilities

PROLiNK H5004NK ADSL Wireless Modem - Multiple Vulnerabilities Exploit Title: PROLiNK H5004NK ADSL Wireless Modem Multiple Vulnerabilities Discovered by: Karn Ganeshen Reported on: October 13, 2015 Vendor Response: No process to handle vuln reports Vendor Homepage:...

netis RealTek Wireless Router ADSL Modem - Multiple Vulnerabilities

netis RealTek Wireless Router ADSL Modem - Multiple Vulnerabilities Exploit Title: netis RealTek wireless router / ADSL modem Multiple Vulnerabilities Discovered by: Karn Ganeshen Reported on: October 13, 2015 Vendor Response: Vulnerability? What's this? Vendor Homepage: www.netis-systems.com...

Centreon 2.6.1 - Multiple Vulnerabilities

Centreon 2.6.1 - Multiple Vulnerabilities Centreon 2.6.1 Command Injection Vulnerability Vendor: Centreon Product web page: https://www.centreon.com Affected version: 2.6.1 CES 3.2 Summary: Centreon is the choice of some of the world's largest companies and mission-critical organizations for...

h5ai 0.25.0 - Unrestricted Arbitrary File Upload

h5ai 0.25.0 - Unrestricted Arbitrary File Upload !/usr/bin/env python Exploit Title: h5ai 0.25.0 Unrestricted File Upload Date: 21 September 2015 Exploit Author: rTheory Vendor Homepage: https://larsjung.de/h5ai/ Vulnerable Software Link:...

Havij - OLE Automation Array Remote Code Execution

Havij - OLE Automation Array Remote Code Execution !/usr/bin/php ?php Title : Havij OLE Automation Array Remote Code Execution Affected Versions: All Version Founder : ITSecTeam Tested on Windows 7 / Server 2008 Author : Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail ...

HP WebInspect 10.4 - XML External Entity Injection

HP WebInspect 10.4 - XML External Entity Injection Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits...

Acunetix 9.5 - OLE Automation Array Remote Code Execution

Acunetix 9.5 - OLE Automation Array Remote Code Execution !/usr/bin/python import BaseHTTPServer, sys, socket Acunetix OLE Automation Array Remote Code Execution Author: Naser Farhadi Linkedin: http://ir.linkedin.com/pub/naser-farhadi/85/b3b/909 Date: 27 Mar 2015 Version: acunetix.exe Video:...

Chamilo LMS 1.9.10 - Multiple Vulnerabilities

Chamilo LMS 1.9.10 - Multiple Vulnerabilities I. Overview ======================================================== Chamilo LMS 1.9.10 or prior versions are prone to a multiple Cross-Site Scripting Stored + Reflected & CSRF vulnerabilities. These vulnerabilities allows an attacker to gain control...

Citrix Nitro SDK - Command Injection

Citrix Nitro SDK - Command Injection Abstract Securify discovered a command injection vulnerability in xenhotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges nsroot. This issue can be used to compromise of the entire Citrix SDX appliance and all...

Websense Appliance Manager - Command Injection

Websense Appliance Manager - Command Injection Abstract A command injection vulnerability was found in Websense Appliance Manager that allows an attacker to execute arbitrary code on the appliance. This issue can be combined with other vulnerabilities, like Cross-Site Scripting, to perform a remo...

jQuery - jui_filter_rules PHP Code Execution

jQuery - juifilterrules PHP Code Execution -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 PHP Code Execution in juifilterrules Parsing Library ====================================================== Researcher: Timo Schmid Description =========== juifilterrules1 is a jQuery plugin which allows...

NPDS CMS REvolution-13 - SQL Injection

NPDS CMS REvolution-13 - SQL Injection Title - NPDS CMS Revolution-13 - SQL Injection Vulnerability Credits & Author: Narendra Bhati R00t Sh3ll www.websecgeeks.com References Source: ==================== http://www.npds.org/viewtopic.php?topic=26233&forum=12...

e107 2 Bootstrap CMS - Cross-Site Scripting

e107 2 Bootstrap CMS - Cross-Site Scripting | | | || / | |/' | | || | / / | /| \ / /\ | / / \ |/ / alertString.fromCharCode88, 83, 83 or "alertdocument.cookie ======== Credits: ======== Vulnerability found and advisory written by Ahmet Agar. =========== References: =========== http://www.0x97.inf...

PsychoStats 2.2.4 Beta - Cross Site Scripting

PsychoStats 2.2.4 Beta - Cross Site Scripting PsychoStats Cross Site Scripting Vendor: Jason Morriss Product: PsychoStats Version: = 2.2.4 Beta Website: http://www.psychostats.com/ BID: 12089 CVE: CVE-2004-1417 OSVDB: 12560 SECUNIA: 13619 PACKETSTORM: 35502 Description: PsychoStats is a statistic...

Android WAPPushManager - SQL Injection

Android WAPPushManager - SQL Injection INTRODUCTION ================================== In Android 5.0, a SQL injection vulnerability exists in the opt module WAPPushManager, attacker can remotely send malformed WAPPush message to launch any activity or service in the victim's phone need permissio...

Cart Engine 3.0 - Multiple Vulnerabilities

Cart Engine 3.0 - Multiple Vulnerabilities === Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a specially...

Syslog LogAnalyzer 3.6.5 - Persistent Cross-Site Scripting (Python)

Syslog LogAnalyzer 3.6.5 - Persistent Cross-Site Scripting Python Vulnerability title: Syslog LogAnalyzer 3.6.5 Stored XSS Author: Dolev Farhi Contact: dolevf at yahoo dot com @dolevff Application: LogAnalyzer 3.6.5 Date: 8.2.2014 Relevant CVEs: CVE-2014-6070 Vulnerable version: alert"xss", and...

WordPress Plugin Quick PagePost Redirect 5.0.3 - Multiple Vulnerabilities

WordPress Plugin Quick PagePost Redirect 5.0.3 - Multiple Vulnerabilities Details ================ Software: Quick Page/Post Redirect Plugin Version: 5.0.3 Homepage: http://wordpress.org/plugins/quick-pagepost-redirect-plugin/ Advisory ID: dxw-1970-1091 CVE: CVE-2014-2598 CVSS: 6.8 Medium;...

Huawei E5331 MiFi Mobile Hotspot 21.344.11.00.414 - Multiple Vulnerabilities

Huawei E5331 MiFi Mobile Hotspot 21.344.11.00.414 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Unauthenticated access & manipulation of settings product: Huawei E5331 MiFi mobile hotspot...

NETGEAR DGN2200 N300 Wireless Router - Multiple Vulnerabilities

NETGEAR DGN2200 N300 Wireless Router - Multiple Vulnerabilities Title: Multiple vulnerabilities in NETGEAR N300 WIRELESS ADSL2+ MODEM ROUTER DGN2200 ==================================================================================== Notification Date: 11 February 2014 Affected Vendor: NetGear...

WordPress Plugin BuddyPress 1.9.1 - Privilege Escalation

WordPress Plugin BuddyPress 1.9.1 - Privilege Escalation Exploit Title: Wordpress plugin Buddypress 2 Visit the url http://example.com/groups/create/step/group-details/ 3 Enjoy the power...

SoapUI 4.6.3 - Remote Code Execution

SoapUI 4.6.3 - Remote Code Execution Exploit Title: SoapUI Remote Code Execution Date: 25.12.13 Exploit Author: Barak Tawily Vendor Homepage: http://www.soapui.org/ Software Link: http://www.soapui.org/Downloads/download-soapui-pro-trial.html Version: vulnerable before 4.6.4 Tested on: Windows,...

Microsoft Windows - NDPROXY SYSTEM Privilege Escalation (MS14-002)

Microsoft Windows - NDPROXY SYSTEM Privilege Escalation MS14-002 NDPROXY Local SYSTEM privilege escalation http://www.offensive-security.com Tested on Windows XP SP3 http://www.offensive-security.com/vulndev/ndproxy-local-system-exploit-cve-2013-5065/ Original crash ... null pointer dereference...

Microsoft SharePoint 2013 (Cloud) - Persistent Exception Handling (MS13-067)

Microsoft SharePoint 2013 Cloud - Persistent Exception Handling MS13-067 Title: ====== Microsoft SharePoint 2013 Cloud - Persistent Exception Handling Web Vulnerability Date: ===== 2013-09-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=812 Security Bulletin: MS13-06...

Loftek Nexus 543 IP Cameras - Multiple Vulnerabilities

Loftek Nexus 543 IP Cameras - Multiple Vulnerabilities CSRF: Loftek Nexus 543 CSRF PoC Memory Dump: !/bin/sh This script exploits CVE-2013-3311 to retrieve kernel memory from a Loftek Nexus 543 IP camera The file which is downloaded can be analyzed strings to recover passwords and other goodies i...

MobileIron Virtual Smartphone Platform - Privilege Escalation

MobileIron Virtual Smartphone Platform - Privilege Escalation MobileIron Virtual Smartphone Platform Privilege Escalation Exploit 0day ======================================================================== The MobileIron Virtual Smartphone Platform is the first solution to combine data-driven...

Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities

Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities Original: http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt =============================== - Advisory - =============================== Tittle: Imperva SecureSphere Operations Manager - Command...

Invision Power Board 1.x?2.x3.x - Admin Takeover

Invision Power Board 1.x?2.x3.x - Admin Takeover IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13 Author: John JEAN @johnjean on twitter Affected application: Invision Power Board = 3.4.4 Type ...

Linksys WRT160N - Multiple Vulnerabilities

Linksys WRT160N - Multiple Vulnerabilities Device Name: Linksys WRT160Nv2 Vendor: Linksys/Cisco ============ Device Description: ============ Best For: Delivers plenty of speed and coverage, so large groups of users can go online, transfer large files, print, and stream stored media Features: Fas...

Air Disk Wireless 1.9 iPad iPhone - Multiple Vulnerabilities

Air Disk Wireless 1.9 iPad iPhone - Multiple Vulnerabilities Title: ====== Air Disk Wireless 1.9 iPad iPhone - Multiple Vulnerabilities Date: ===== 2013-02-08 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=850 VL-ID: ===== 850 Common Vulnerability Scoring System:...

freeSSHd 2.1.3 - Remote Authentication Bypass

freeSSHd 2.1.3 - Remote Authentication Bypass FreeSSHD all version Remote Authentication Bypass ZERODAY Discovered & Exploited by Kingcope Year 2011 Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/23080.zip Run like: ssh.exe -l valid username...

IBM System Director Agent - Remote System Level

IBM System Director Agent - Remote System Level IBM System Director Remote System Level Exploit CVE-2009-0880 extended zeroday Copyright C 2012 Kingcope IBM System Director has the port 6988 open. By using a special request to a vulnerable server, the attacker can force to load a dll remotely fro...

Sophos Products - Multiple Vulnerabilities

Sophos Products - Multiple Vulnerabilities List, I've completed the second paper in my series analyzing Sophos Antivirus internals, titled "Practical Attacks against Sophos Antivirus". As the name suggests, this paper describes realistic attacks against networks using Sophos products. The paper...

SIEMENS Sipass Integrated 2.6 Ethernet Bus - Arbitrary Pointer Dereference

SIEMENS Sipass Integrated 2.6 Ethernet Bus - Arbitrary Pointer Dereference IOActive Security Advisory Title: SIEMENS Sipass Integrated 2.6 Ethernet Bus Arbitrary Pointer Dereference Severity: Critical Discovered by: Lucas Apa Date Reported: 09/11/12 CVE: TBD Siemens Advisory: SSA-938777...

Apple QuickTime Player 7.7.2 - Crash (PoC)

Apple QuickTime Player 7.7.2 - Crash PoC !/usr/bin/perl Title : Apple QuickTime Player 7.7.2 Division By Zero Version : 7.7.21680.56 Date : 2012-10-23 Vendor : http://www.apple.com Impact : Med/High Contact : coolkaveh at rocketmail.com Twitter : @coolkaveh tested : XP SP3 ENG Bug : ---- Don't...

Joomla! Component com_enmasse 1.2.0.4 - SQL Injection

Joomla! Component comenmasse 1.2.0.4 - SQL Injection Exploit Title: Joomla comenmasse Remote Exploit Author: Daniel Barragan "D4NB4R" Español hola, este exploit afecta sitios de ecommerce por lo cual el exploit solo dara una muestra de la extraccion posible de datos, No me hago responsable del us...

Able2Doc and Able2Doc Professional 6.0 - Memory Corruption

Able2Doc and Able2Doc Professional 6.0 - Memory Corruption Exploit Title: Able2Doc and Able2Doc Professional v 6.0 memory corruption Date: June 24 2012 Exploit Author: Carlos Mario Penagos Hollmann Vendor Homepage: www.investintech.com Version:6.0 Tested on: Windows 7 CVE : cve-2011-4221 payload...

WordPress Plugin Top Quark Architecture 2.10 - Arbitrary File Upload

WordPress Plugin Top Quark Architecture 2.10 - Arbitrary File Upload Exploit Title: Wordpress Top Quark Architecture Version 2.10 Arbitrary File Upload Google Dork: inurl:wp-content/plugins/topquark/lib/js/fancyupload/showcase/batch/ Date: 11/06/2012 Exploit Author: Adrien Thierry Vendor Homepage...

Agora-Project 2.12.11 - Arbitrary File Upload

Agora-Project 2.12.11 - Arbitrary File Upload Exploit Title: agora-project2.12.1112-2011 Remote Shell Upload Google Dork: n0 N0obs Date: 10/06/2012 Exploit Author: Misa3l Vendor Homepage: http://sourceforge.net/projects/agora-project/ Software Link:...

WordPress Plugin Omni Secure Files 0.1.13 - Arbitrary File Upload

WordPress Plugin Omni Secure Files 0.1.13 - Arbitrary File Upload Exploit Title: Wordpress Omni-secure-files 0.1.13 Arbitrary File Upload Google Dork: inurl:wp-content/plugins/omni-secure-files/ Date: 07/06/2012 Exploit Author: Adrien Thierry Vendor Homepage: http://omni-secure.com/ Software Link...

SkinCrafter ActiveX Control 3.0 - Local Buffer Overflow

SkinCrafter ActiveX Control 3.0 - Local Buffer Overflow Software : SkinCrafter from NMSoft Technologies Version : SkinCrafter version 3.0 Title : Buffer overflow in skincrafter3vs2005.dll of skinCrafter vs3.0 Link : http://www.skincrafter.com/downloads/SkinCrafterDemo20052008x86.zip Date : May 17...

FlexNet License Server Manager - Stack Overflow In lmgrd

FlexNet License Server Manager - Stack Overflow In lmgrd Luigi Auriemma Application: FlexNet License Server Manager http://www.flexerasoftware.com/products/flexnet-publisher.htm http://www.globes.com/support/fnputilitiesdownload.htm Versions: = 11.9.1 and others earlier this version number was...

Siemens SIMATIC WinCC Flexible (Runtime) - Multiple Vulnerabilities

Siemens SIMATIC WinCC Flexible Runtime - Multiple Vulnerabilities Luigi Auriemma Application: Siemens SIMATIC WinCC flexible Runtime http://www.automation.siemens.com/mcms/human-machine-interface/en/visualization-software/wincc-flexible/wincc-flexible-runtime/Pages/Default.aspx Versions: 2008 SP2...

pkexec - Race Condition Privilege Escalation

pkexec - Race Condition Privilege Escalation / Exploit Title: pkexec Race condition CVE-2011-1485 exploit Author: xi4oyu Tested on: rhel 6 CVE : 2011-1485 Linux pkexec exploit by xi4oyu , thx [email protected] Have fun ¡Á U can reach us @ http://www.wooyun.org : / include include include include inclu...

PolicyKit polkit-1 0.101 - Local Privilege Escalation

PolicyKit polkit-1 0.101 - Local Privilege Escalation / polkit-pwnage.c ============================== = PolicyKit Pwnage = = by zx2c4 = = Sept 2, 2011 = ============================== Howdy folks, This exploits CVE-2011-1485, a race condition in PolicyKit. davidz25 explains: --begin-- Briefly, t...