4Images 1.7.1 - SQL Injection

4Images 1.7.1 - SQL Injection Exploit Title: 4images 1.7.1 Remote SQL Injection Vulnerability Date: 20-12-2009 Author: Master Mind Version: 1.7.1 CVE : N/A ============================================================= Script Name : 4images 1.7.1 Language : php Author : Master Mind Home :...

Avast! 4.8.1335 Professional - Kernel Local Buffer Overflow

Avast! 4.8.1335 Professional - Kernel Local Buffer Overflow include include include include include include / Program : avast! 4.8.1335 Professionnel Homepage : http://www.avast.com Discovery : 2009/07/29 Author Contacted : 2009/07/31 Found by : Heurs This Advisory : Heurs Contact :...

Wyse Rapport Hagent Fake Hserver - Command Execution (Metasploit)

Wyse Rapport Hagent Fake Hserver - Command Execution Metasploit $Id: hagentuntrustedhsdata.rb 10998 2010-11-11 22:43:22Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

ZaoCMS - user_id SQL Injection

ZaoCMS - userid SQL Injection || || | || o,7 || . o7 || q||| ow, : / / . =By: Qabandi =Email: iqaahotmail.fr From Kuwait PEACE =Vuln: ZaoCMS - SQL Injection Vulnerability =INFO: http://zaocms.com/ =BUY: http://zaocms.com/ =DORK: --...

OpenSSL 0.9.8k1.0.0-beta2 - DTLS Remote Memory Exhaustion Denial of Service

OpenSSL 0.9.8k1.0.0-beta2 - DTLS Remote Memory Exhaustion Denial of Service / cve-2009-1378.c OpenSSL http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1378 In dtls1processoutofseqmessage the check if the current message is already buffered was missing...

Easy Scripts Answer and Question Script - Multiple Vulnerabilities

Easy Scripts Answer and Question Script - Multiple Vulnerabilities || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ Kings of injection...

webSPELL 4.2.0e - page Blind SQL Injection

webSPELL 4.2.0e - page Blind SQL Injection !/usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; use Getopt::Long; '/ -.- ------------------oOO------OOo----------------- | | | / / / / | | / / / / / / / / / / / | | // // / / / // / // / // | | ///,// /./,/, // | | Security Research Division //...

XRDP 0.4.1 - Remote Buffer Overflow (PoC)

XRDP 0.4.1 - Remote Buffer Overflow PoC / XRDP = 0.4.1 pre-auth remote PoC exploit. xrdp.sourceforge.net 01:59:56 root@crateria:/xrdp gcc -w -lssl -lX11 xrdp-poc.c -o xrdp-poc 02:00:29 root@crateria:/xrdp ./xrdp-poc 10.0.0.13 = Connected to 10.0.0.13 = Hit CTRL-C if the progress bar stops. Be...

CMS Ortus 1.13 - SQL Injection

CMS Ortus 1.13 - SQL Injection Author: otmorozok428, http://forum.antichat.ru Products: CMS Ortus 1.12, CMS Ortus 1.13 Vendor: http://ortus.nirn.ru Download: http://ortus.nirn.ru/files/ortus1-12.zip, http://ortus.nirn.ru/files/ortus1-13.zip Dork for ALL Versions of CMS Ortus:...

Net-SNMP 5.1.45.2.45.4.1 Perl Module - Buffer Overflow (PoC)

Net-SNMP 5.1.45.2.45.4.1 Perl Module - Buffer Overflow PoC !usr/bin/perl -w Buffer overflow in the snprintvalue function in snmpget in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via ...

ICONICS Vessel Gauge Switch 8.02.140 - ActiveX Buffer Overflow (Metasploit)

ICONICS Vessel Gauge Switch 8.02.140 - ActiveX Buffer Overflow Metasploit $Id: iconicsdlgwrapper.rb 1 2008-09-21 22:43:00Z kf $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

Vastal I-Tech Dating Zone - fage SQL Injection

Vastal I-Tech Dating Zone - fage SQL Injection ZoRLu - - - yildirimordulari.org - - - z0rlu.blogspot.com Vastal I-Tech Dating Zone fage SQL Injection Vulnerability author: ZoRLu home: yildirimordulari.org - - - z0rlu.blogspot.com - - - r00tsecurity.org contact: [email protected] & [email protected]...

Joomla! Component DBQuery 1.4.1.1 - Remote File Inclusion

Joomla! Component DBQuery 1.4.1.1 - Remote File Inclusion @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@...

OTManager CMS 24a - Local File Inclusion Cross-Site Scripting

OTManager CMS 24a - Local File Inclusion Cross-Site Scripting =========================================================== OTManager CMS LFI/XSS Multiple Remote Vulnerabilities =========================================================== ,--^----------,--------,-----,-------^--, | ||||||||| -------...

Joomla! Component JoomlaDate 1.2 - user SQL Injection

Joomla! Component JoomlaDate 1.2 - user SQL Injection /---------------------------------------------------------------\ \ / / Joomla Component joomladate Remote SQL injection \ \ / ---------------------------------------------------------------/ Author : His0k4 ALGERIAN HaCkEr Dork :...

Kmita Mail 3.0 - file Remote File Inclusion

Kmita Mail 3.0 - file Remote File Inclusion \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV94$2008 ----------------------------------------------------------------------------------------- ECHOADV94$2008 Kmita Mail = 3.0 file Remote File Inclusion...

Dovecot IMAP 1.0.10 1.1rc2 - Remote Email Disclosure

Dovecot IMAP 1.0.10 1.1rc2 - Remote Email Disclosure lame Dovecot IMAP 1.0.10 - 1.1rc3 Exploit Here's an exploit for the recent TAB vulnerability in Dovecot. It's nothing special since in the wild there are few to none targets because of the special option which has to be set. see CVE Entry...

Joomla! Component Rapid Recipe 1.6.5 - SQL Injection

Joomla! Component Rapid Recipe 1.6.5 - SQL Injection joomla SQL Injectioncomrapidrecipe AUTHOR : S@BUN HOME : http://www.hackturkiye.com MAÄ°L : [email protected] DORK 1 : allinurl: "comrapidrecipe"userid DORK 2 : allinurl: "comrapidrecipe" categoryid EXPLOIT : after userid or...

Mambo Component Sermon 0.2 - gid SQL Injection

Mambo Component Sermon 0.2 - gid SQL Injection netadvantist@copyright 2006 SQL Injectioncomnaxxx AUTHOR : S@BUN HOME : http://www.hackturkiye.com DORKS 1 : allinurl:"comnacontent" DORK 2 : allinurl:"comnabible" DORKS 3 : allinurl:"comnaevents" DORKS 4 : allinurl:"comnacontent" DORKS 5 :...

Move Networks Quantum Streaming Player - Remote Overflow (SEH)

Move Networks Quantum Streaming Player - Remote Overflow SEH Move Networks Quantum Streaming Player SEH Overwrite Exploit function Check var buf = 'A'; while buf.length = 1027 buf = buf + 'A'; // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.c...

OpenSSL 0.9.7l0.9.8d - SSLv2 Client Crash

OpenSSL 0.9.7l0.9.8d - SSLv2 Client Crash !/usr/bin/perl Copyrightc Beyond Security Written by Noam Rathaus - based on beSTORM's SSL Server module Exploits vulnerability CVE-2006-4343 - where the SSL client can be crashed by special SSL serverhello response use strict; use IO::Socket; my $sock =...

Viewpoint Media Player for IE 3.2 - Remote Stack Overflow (PoC)

Viewpoint Media Player for IE 3.2 - Remote Stack Overflow PoC ----------------------------------------------------------------------------- Viewpoint Media Player for IE 3.2 AxMetaStream.dll Remote Stack Overflow url: http://www.viewpoint.com Author: shinnai mail: shinnaiatautisticidotorg site:...

Apple Mac OSX 2007-005 - vpnd Local Privilege Escalation

Apple Mac OSX 2007-005 - vpnd Local Privilege Escalation Copyright c 2007 Kevin Finisterre CVE-ID: CVE-2007-0753 - http://docs.info.apple.com/article.html?artnum=305530 https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/4013.tar.gz 05302007-vpenis.tar.gz milw0rm.co...

Man Command - -H Flag Local Buffer Overflow

Man Command - -H Flag Local Buffer Overflow // source: https://www.securityfocus.com/bid/23355/info The 'man' command is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using it in a memory copy operation. NOTE: Presumably, this...

XOOPS Module Zmagazine 1.0 - print.php SQL Injection

XOOPS Module Zmagazine 1.0 - print.php SQL Injection !/usr/bin/perl Script Name: XOOPS Module Zmagazine 1.0 print.php Remote BLIND SQL Injection Exploit Coded by : ajann Author : ajann Contact : : Dork : "inurl:/modules/zmagazine/" Result:20.800 Example S. :...

TikiWiki 1.9.5 Sirius - sort_mode Information Disclosure

TikiWiki 1.9.5 Sirius - sortmode Information Disclosure /==========================================/ //tikiwiki version 1.9.5 CVS -Sirius- PoC // Product: Tikiwiki // URL: http://tikiwiki.org/ // RISK: critical /==========================================/ there's a critical security bug in tikiwi...

Invision Gallery 2.0.7 - readfile() SQL Injection

Invision Gallery 2.0.7 - readfile SQL Injection / | || || | | |/ / | || | | / - | | ' 2.0.7 ReadFile & SQL injection exploit +-------------+ | Uzage: | +-------------+ + ReadFile: - syntax: readfile 1 readfile 2 // try it if readfile1 failed ; - params: - path to local file ../file, for example:...

Buzlas 2006-1 Full - Archive_Topic.php Remote File Inclusion

Buzlas 2006-1 Full - ArchiveTopic.php Remote File Inclusion source: https://www.securityfocus.com/bid/20511/info Buzlas is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the...

vBulletin ImpEx 1.74 - Remote Command Execution

vBulletin ImpEx 1.74 - Remote Command Execution " ."turl:" ."hurl:" ."cmd:" ."" .""; if !isset$POST'submit' echo $form; else $file = fopen "test.txt", "w+"; fwrite$file, ""; fclose$file; $file = fopen $turl.$hurl, "r"; if !$file echo "Unable to get output.\n"; exit; echo $form; while !feof $file...

MyBloggie 2.1.22.1.3 - trackback_url Cross-Site Scripting

MyBloggie 2.1.22.1.3 - trackbackurl Cross-Site Scripting source: https://www.securityfocus.com/bid/17048/info MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverag...

CPGNuke Dragonfly 9.0.6.1 - Remote Command Execution

CPGNuke Dragonfly 9.0.6.1 - Remote Command Execution this works regardless of magicquotesgpc settings Sun-Tzu: "Thus it may be known that the leader of armies is the arbiter of the people's fate, the man on whom it depends whether the nation shall be in peace or in peril." / a short explaination:...

Mambo 4.5.2 - Globals Overwrite Remote Command Execution

Mambo 4.5.2 - Globals Overwrite Remote Command Execution Mambo body background-color:111111; SCROLLBAR-ARROW-COLOR: ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: 1CB081; img background-color: F...

IPSwitch IMAP Server - LOGON Remote Stack Overflow

IPSwitch IMAP Server - LOGON Remote Stack Overflow / IpSwitch IMAP Server LOGON stack overflow. Software Hole discovered by iDEFENSE POC written by nolimit and BuzzDee First, some information for the few of you that know how this stuff works. The reason you see no SP2 or 2003 offsets is because o...

Multiple OS (Win32AixCisco) - Crafted ICMP Messages Denial of Service (MS05-019)

Multiple OS Win32AixCisco - Crafted ICMP Messages Denial of Service MS05-019 / HOD-icmp-attacks-poc.c: 2005-04-15: PUBLIC v.0.2 Copyright c 2004-2005 houseofdabus. MS05-019 CISCO:20050412 ICMP attacks against TCP Proof-of-Concept .:: houseofdabus ::. for more details:...

Invision Power Board (IP.Board) 1.3.1 - Design Error

Invision Power Board IP.Board 1.3.1 - Design Error IP.Board Design Error Vendor: Invision Power Services Product: IP.Board Version: = 1.3.1 Website: http://www.invisionpower.com/ BID: 10559 Description: Invision Power Board IPB is a professional forum system that has been built from the ground up...

Valve Software Half-Life Server 1.1.1.03.1.1.1c14.1.1.1a - Multiplayer Request Buffer Overflow

Valve Software Half-Life Server 1.1.1.03.1.1.1c14.1.1.1a - Multiplayer Request Buffer Overflow // source: https://www.securityfocus.com/bid/8300/info // Half-Life servers are prone to a buffer overflow that may be exploited by a malicious remote client. The vulnerability occurs because the softwa...

Trend Micro Interscan VirusWall 3.53.6 - Content-Length Scan Bypass

Trend Micro Interscan VirusWall 3.53.6 - Content-Length Scan Bypass // source: https://www.securityfocus.com/bid/4265/info Trend Micro InterScan VirusWall is a high performance internet gateway virus scanning package. It is capable of scanning incoming content over HTTP, SMTP and FTP for viruses...

Tridia DoubleVision 3.0 7.00 - Local Privilege Escalation

Tridia DoubleVision 3.0 7.00 - Local Privilege Escalation // source: https://www.securityfocus.com/bid/1697/info A utility integral to Tridia DoubleVision for SCO UnixWare 7.x has been found to be vulnerable to a buffer overflow attack. dvtermtype, which is setuid root, is run by a user at login...

Yamaha MidiPlug 1.1 b-j MidiPlug - Local Buffer Overflow

Yamaha MidiPlug 1.1 b-j MidiPlug - Local Buffer Overflow // source: https://www.securityfocus.com/bid/760/info There is a buffer overflow in the MidiPlug that may allow arbitrary code to be executed on the local host. This overflow occurs if a long "Text" variable is specified within an EMBED tag...

Microsoft IIS 4.0 - Remote Buffer Overflow (2)

Microsoft IIS 4.0 - Remote Buffer Overflow 2 source: https://www.securityfocus.com/bid/307/info Microsoft IIS reported prone to a buffer overflow vulnerability in the way IIS handles requests for several file types that require server side processing. This vulnerability may allow a remote attacke...

Compaq Client Management Agents 3.704.0 Insight Management Agents 4.21 A4.22 A4.30 A Intelligent Cluster Administrator 1.0 Management Agents for Workstations 4.20 A Server Management Agents 4.23 Survey Utility 2.0 - Web File Access

Compaq Client Management Agents 3.704.0 Insight Management Agents 4.21 A4.22 A4.30 A Intelligent Cluster Administrator 1.0 Management Agents for Workstations 4.20 A Server Management Agents 4.23 Survey Utility 2.0 - Web File Access source: https://www.securityfocus.com/bid/282/info A vulnerabilit...

FreeBSD 2.x HP-UX 91011 Kernel 2.0.3 Windows NT 4.0Server 2003 NetBSD 1 - land.c loopback Denial of Service (1)

FreeBSD 2.x HP-UX 91011 Kernel 2.0.3 Windows NT 4.0Server 2003 NetBSD 1 - land.c loopback Denial of Service 1 / source: https://www.securityfocus.com/bid/2666/info A number of TCP/IP stacks are vulnerable to a "loopback" condition initiated by sending a TCP SYN packet with the source address and...

HP-UX 10.20 newgrp - Local Privilege Escalation

HP-UX 10.20 newgrp - Local Privilege Escalation source: https://www.securityfocus.com/bid/683/info Due to insufficient bounds checking on user supplied arguments, it is possible to overflow an internal buffer and execute arbitrary code as root. !/usr/bin/perl use FileHandle; sub h2cs local$stuff=...

HP System Event 1.2.9.0 - HPWMISVC Unquoted Service Path

HP System Event 1.2.9.0 - HPWMISVC Unquoted Service Path Exploit Title: HP System Event 1.2.9.0 - 'HPWMISVC' Unquoted Service Path Discovery by: Roberto Piña Discovery Date: 2020-02-14 Vendor Homepage:https://www8.hp.com/mx/es/home.html Software...

MyVideoConverter Pro 3.14 - Output Folder Buffer Overflow

MyVideoConverter Pro 3.14 - Output Folder Buffer Overflow Exploit Title: MyVideoConverter Pro 3.14 - 'Output Folder' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-11 Vendor Homepage : http://www.ivideogo.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce...

AVE DOMINAplus 1.10.x - Credential Disclosure

AVE DOMINAplus 1.10.x - Credential Disclosure Exploit: AVE DOMINAplus 1.10.x - Credential Disclosure Date: 2019-12-30 Author: LiquidWorm Vendor: AVE S.p.A. Product web page: https://www.ave.it | https://www.domoticaplus.it Affected version: Web Server Code 53AB-WBS - 1.10.62 Advisory ID:...

AVE DOMINAplus 1.10.x - Unauthenticated Remote Reboot

AVE DOMINAplus 1.10.x - Unauthenticated Remote Reboot Exploit: AVE DOMINAplus 1.10.x - Unauthenticated Remote Reboot Date: 2019-12-30 Author: LiquidWorm Vendor: AVE S.p.A. Product web page: https://www.ave.it | https://www.domoticaplus.it Affected version: Web Server Code 53AB-WBS - 1.10.62...

macOS 10.14.6 - root-kernel Privilege Escalation via update_dyld_shared_cache

macOS 10.14.6 - root-kernel Privilege Escalation via updatedyldsharedcache Tested on macOS Mojave 10.14.6, 18G87 and Catalina Beta 10.15 Beta 19A536g. On macOS, the dyld shared cache in /private/var/db/dyld/ is generated locally on the system and therefore doesn't have a real code signature;...

Ubuntu 19.10 - ubuntu-aufs-modified mmap_region() Breaks Refcounting in overlayfsshiftfs Error Path

Ubuntu 19.10 - ubuntu-aufs-modified mmapregion Breaks Refcounting in overlayfsshiftfs Error Path Tested on 19.10. Ubuntu's aufs kernel patch includes the following change which I interestingly can't see in the AUFS code at https://github.com/sfjro/aufs5-linux/blob/master/mm/mmap.c:...

Foscam Video Management System 1.1.6.6 - UID Denial of Service (PoC)

Foscam Video Management System 1.1.6.6 - UID Denial of Service PoC Exploit Title: Foscam Video Management System 1.1.6.6 - 'UID' Denial of Service PoC Author: Alessandro Magnosi Date: 2019-10-09 Vendor Homepage: https://www.foscam.com/ Software Link :...