Linux Kernel 2.6.39 3.2.2 (Gentoo Ubuntu x86x64) - Mempodipper Local Privilege Escalation (1)

Linux Kernel 2.6.39 3.2.2 Gentoo Ubuntu x86x64 - Mempodipper Local Privilege Escalation 1 / Exploit code is here: http://git.zx2c4.com/CVE-2012-0056/plain/mempodipper.c Blog post about it is here: http://blog.zx2c4.com/749 EDB-Note: Updated version can be found here:...

Open ConferenceJournalHarvester Systems 2.3.x - Multiple Remote Code Execution Vulnerabilities

Open ConferenceJournalHarvester Systems 2.3.x - Multiple Remote Code Execution Vulnerabilities !/usr/bin/python Open Conference/Journal/Harvester Systems = 2.3.X multiple remote code execution vulnerabilities vendor: Public Knowledge Project pkp -http://pkp.sfu.ca/ software link:...

CyberLink (Multiple Products) - File Project Handling Stack Buffer Overflow (PoC)

CyberLink Multiple Products - File Project Handling Stack Buffer Overflow PoC !/usr/bin/python Exploit Title: CyberLink Multiple Products File Project Handling Stack Buffer Overflow POC by: modpr0beatspenteradotcom @modpr0be Platform: Windows Tested on: Windows XP SP3, Windows 7 SP1 with: CyberLi...

Siemens SIMATIC WinCC Flexible (Runtime) - Multiple Vulnerabilities

Siemens SIMATIC WinCC Flexible Runtime - Multiple Vulnerabilities Luigi Auriemma Application: Siemens SIMATIC WinCC flexible Runtime http://www.automation.siemens.com/mcms/human-machine-interface/en/visualization-software/wincc-flexible/wincc-flexible-runtime/Pages/Default.aspx Versions: 2008 SP2...

Adobe Flash Player 10.1.53.64 - Action Script Type Confusion (ASLR + DEP Bypass)

Adobe Flash Player 10.1.53.64 - Action Script Type Confusion ASLR + DEP Bypass Source: http://www.abysssec.com/blog/2011/04/exploiting-adobe-flash-player-on-windows-7/ Adobe Flash player Action script type confusion exploit DEP+ASLR bypass advisory text : Here is another reliable windows 7 exploi...

Cisco Security Agent Management Console - st_upload Remote Code Execution

Cisco Security Agent Management Console - stupload Remote Code Execution !/usr/bin/env python Exploits Cisco Security Agent Management Console ‘stupload’ CVE-2011-0364 gerry eisenhaur import httplib import mimetools import StringIO boundary = mimetools.chooseboundary hostuid =...

gitWeb 1.7.3.3 - Cross-Site Scripting

gitWeb 1.7.3.3 - Cross-Site Scripting -8 Description 8--8 Proof Of Concept 8- " -8 Credits 8- -8 Responsible Disclosure 8- 13-12-2010 Initial contact with upstream and vendor-sec 13-12-2010 Vendor Response and CVE-2010-3906 assignation 15-12-2010 Public Disclosure...

Barracuda Networks Spam Virus Firewall 4.1.1.021 - Remote Configuration Retrieval

Barracuda Networks Spam Virus Firewall 4.1.1.021 - Remote Configuration Retrieval !/bin/bash Exploit by ShadowHatesYou [email protected] The resulting output is an SQL dump containing the Barracuda's configuration, which includes goodies such as: The administrative password for the...

Mozilla Firefox CSS - font-face Remote Code Execution

Mozilla Firefox CSS - font-face Remote Code Execution ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moabu-15-mozilla-firefox-css-font-face-remote-code-execution-vulnerability/...

Microsoft Movie Maker - Remote Code Execution (MS10-016)

Microsoft Movie Maker - Remote Code Execution MS10-016 ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | Day 4 | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/movie-maker-remote-code-execution-ms10-016/...

Foxit Reader 4.0 - .pdf Multiple Stack Based Buffer Overflow Jailbreak

Foxit Reader 4.0 - .pdf Multiple Stack Based Buffer Overflow Jailbreak import sys,zlib def getFFShellcodesc: ffsc = '' if lensc%4 != 0: sc += 4-lensc%4'\x00' for i in range0,lensc,4: ffsc += '\xff'+sci+3+sci+2+sci+1+sci return ffsc outputHeader = ''' FreeType Compact Font Format CFF Multiple Stac...

SonicWALL E-Class SSL-VPN - ActiveX Control Format String Overflow

SonicWALL E-Class SSL-VPN - ActiveX Control Format String Overflow -------------------------- NSOADV-2010-005 --------------------------- SonicWALL E-Class SSL-VPN ActiveX Control format string overflow 111101111 11111 00110 00110001111 111111 01 01 1 11111011111111 11111 0 11 01 0 11 1 1 1110110...

MooreAdvice - productlist.asp SQL Injection

MooreAdvice - productlist.asp SQL Injection Exploit Title: MooreAdvice productlist.asp SQL injection Vulnerable Date: 1-07-2010 Author: Th3 RDX Software Link: Version: n/a Tested on: Demo Site category: webapp Code : n/a -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=...

U.S.Robotics USR5463 0.06 Firmware - setup_ddns.exe HTML Injection

U.S.Robotics USR5463 0.06 Firmware - setupddns.exe HTML Injection source: https://www.securityfocus.com/bid/40292/info U.S.Robotics USR5463 firmware is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code...

GOM Player 2.1.21.4846 - .wav Buffer Overflow

GOM Player 2.1.21.4846 - .wav Buffer Overflow !/usr/bin/perl GOM Player 2.1.21.4846 .wav Buffer Overflow Exploit Homepage: http://www.gomlab.com/ Exploit Coded by: cr4wl3r From: Gorontalo - Indonesia WARNING - WARNING - WARNING - WARNING Disclaimer: The author published the information under the...

Microsoft Internet Explorer 6 - Aurora Memory Corruption (MS10-002)

Microsoft Internet Explorer 6 - Aurora Memory Corruption MS10-002 Author : Ahmed Obied [email protected] This program acts as a web server that generates an exploit to target a vulnerability CVE-2010-0249 in Internet Explorer. The exploit was tested using Internet Explorer 6 on Windows XP SP2...

Gbook MX 4.1.0 (Arabic Version) - Remote File Inclusion

Gbook MX 4.1.0 Arabic Version - Remote File Inclusion ======================================================================================== | Title : Gbook MX v4.1.0 Arabic Version File inclusion Vulnerability | Author : indoushka | email : [email protected] | Home : Souk Naamane - 04325 -...

weenCompany - SQL Injection

weenCompany - SQL Injection weenCompany SQL Injection Vulnerability Vendor: http://www.weentech.com/ Author: Gamoscu Site: www.1923turk.biz Site: http://gamoscu.wordpress.com/ Dork:"Created by weenCompany" Exploit: http://server/index.php?moduleid=m2newsSQL-inj&articleid=1 Greetz: Manas58 Baybora...

Linux Kernel 2.6.14.6 - procfs Kernel Memory Disclosure

Linux Kernel 2.6.14.6 - procfs Kernel Memory Disclosure / cve-2005-4605.c Linux Kernel http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4605 The procfs code procmisc.c in Linux 2.6.14.3 and other versions before 2.6.15 allows attackers to read sensitive...

URA 3.0 - cat SQL Injection

URA 3.0 - cat SQL Injection --------------------------------------------------- URA 3.0 cat remote SQL injection Vulnerability --------------------------------------------------- + Author : Chip D3 Bi0s + Email : chipdebiosalt+64gmail.com + Group : LatinHackTeam + Vulnerability : SQL injection...

Java SE Runtime Environment JRE 6 Update 13 - Multiple Vulnerabilities

Java SE Runtime Environment JRE 6 Update 13 - Multiple Vulnerabilities ------------------------------------------------------------------------- Java SE Runtime Environment - JRE 6 Update 13 Multiple Vulnerabilities url: http://java.sun.com/ Author: shinnai mail: shinnaiatautisticidotorg site:...

DMXReady News Manager 1.1 - Arbitrary Category Change

DMXReady News Manager 1.1 - Arbitrary Category Change Title : DMXReady News Manager http://target/path//applications/NewsManager/incnewsmanager.asp Edit - http://target/path//dmin/NewsManager/CategoryManager/updatecategory.asp?cid=x Update Category Name : milw0rm.com 2009-01-13...

Star Articles 6.0 - Arbitrary File Upload

Star Articles 6.0 - Arbitrary File Upload Star Articles 6.0 Remote File Upload ---------------------------------------------------------- Discovered By: ZoRLu msn: [email protected] Home: www.z0rlu.blogspot.com N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : dork:...

VidiScript (Avatar) - Arbitrary File Upload

VidiScript Avatar - Arbitrary File Upload || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ Kings of injection | | // | | |...

@lex Guestbook 4.0.5 - setup.php?language_setup Cross-Site Scripting

@lex Guestbook 4.0.5 - setup.php?languagesetup Cross-Site Scripting source: https://www.securityfocus.com/bid/28519/info @lex Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to...

PHP Live! 3.2.2 - questid SQL Injection (1)

PHP Live! 3.2.2 - questid SQL Injection 1 !Info! PHP Live! © OSI Codes Inc. enables live help and live customer support communication directly from your website. With PHP Live!, you can provide one-on-one chat assistance in real-time, answer visitor questions and add that extra human touch to yo...

DigitalHive 2.0 RC2 - user_id SQL Injection

DigitalHive 2.0 RC2 - userid SQL Injection body margin:3%; font-size:10px; color:FFFFFF; font-family:Verdana,Arial; background-color:1a1a1a; text-align: center; input background:303030; color:FFFFFF; font-family:Verdana,Arial; font-size:10px; vertical-align:middle; border-left:1px solid 5d5d5d;...

FreeWebShop 2.2.1 - Blind SQL Injection

FreeWebShop 2.2.1 - Blind SQL Injection !/usr/bin/perl Indonesian Newhack Security Advisory ------------------------------------ FreeWebshop version 2.2.1 - Multiple Remote SQL Injection Vulnerabilities Waktu : Dec 16 2007 01:50AM Software : FreeWebshop version 2.2.1 Vendor :...

RunCMS 1.6 - Local File Inclusion

RunCMS 1.6 - Local File Inclusion WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: RunCms Multiple Vulnerabilities Vendor: http://www.runcms.org/ Bugs: Local File Inclusion, Modules Authorization Weakness Vulnerable Version: RunCMS 1.6 Halloween, 1.5.x prior version...

WordPress 1.5.1.1 2.2.2 - Multiple Vulnerabilities

WordPress 1.5.1.1 2.2.2 - Multiple Vulnerabilities !/usr/bin/env ruby .---. .---. : : o : happy antiblogging, dear kids! ..-: 0 : :-.. / .-'' ' ---' ---' " -. Copyright c Lance M. Havok .' " ' " . " . ' " . : '.---.,,.,...,.,.,.,..---. ' ; . " . .' " .' ----- All rights reserved. . '. .-/|||||||-...

TotalCalendar 2.402 - view_event.php SQL Injection

TotalCalendar 2.402 - viewevent.php SQL Injection --==+================================================================================+==-- --==+ TotalCalendar 2.402 SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHO...

SunShop Shopping Cart 3.5 - abs_path Remote File Inclusion

SunShop Shopping Cart 3.5 - abspath Remote File Inclusion sunshop 4 index.php Remote File Include Vulnerability ----------------------------------------------------------------------------------------- scripts : SunShop v3.5 Discovered By : irvian scripts site :...

MangoBery CMS 0.5.5 - quotes.php Remote File Inclusion

MangoBery CMS 0.5.5 - quotes.php Remote File Inclusion Mangobery-0.5.5 Found by kezzap66345 Script Page:http://mangobery.sourceforge.net/ Demo Site:http://mangobery.beryllium.ca/ Script Download:http://sourceforge.net/project/showfiles.php?groupid=63834&packageid=60858...

Mozilla Firefox 2.0.0.1 - location.hostname Cross-Domain

Mozilla Firefox 2.0.0.1 - location.hostname Cross-Domain Options - Privacy - Show Cookies for login.live.com Gorn, gorn.supportgmailcom 2007-02-19 16:00 -- var mydomain = '127.0.0.1'; var varcook = 'MSPPre=firefoxvulnerabilitytest'; var domcook = 'login.live.com'; if location.hostna...

Sun Microsystems Java - .GIF File Parsing Memory Corruption

Sun Microsystems Java - .GIF File Parsing Memory Corruption / FileName: JvmGifVulPoc.java Date: 2007-01-21 Description: Sun Microsystems Java GIF File Parsing Memory Corruption Vulnerability Prove Of Concept Exploit Environment: Only successfully tested on Sun Jre 1.5 Author: luoluo Contact:...

Solaris 10 libnspr - LD_PRELOAD Arbitrary File Creation Privilege Escalation (1)

Solaris 10 libnspr - LDPRELOAD Arbitrary File Creation Privilege Escalation 1 !/bin/sh $Id: raptorlibnspr,v 1.1 2006/10/13 19:12:12 raptor Exp $ raptorlibnspr - Solaris 10 libnspr oldschool local root Copyright c 2006 Marco Ivaldi Local exploitation of a design error vulnerability in version 4.6....

Exhibit Engine 1.5 RC 4 - photo_comment.php File Inclusion

Exhibit Engine 1.5 RC 4 - photocomment.php File Inclusion ' ' EXPLOIT coded by Kacper in Visual Basic ;- ' '::::::::: :::::::::: ::: ::: ::::::::::: ::: ':+: :+: :+: :+: :+: :+: :+: '+:+ +:+ +:+ +:+ +:+ +:+ +:+ '++ +:+ +++:++ ++ +:+ ++ ++ '++ ++ ++ ++ ++ ++ ++ '+ + + +++ + + ' ':::::::::::...

OpenDock Easy Blog 1.4 - doc_directory File Inclusion

OpenDock Easy Blog 1.4 - docdirectory File Inclusion ECHOADV50$2006 ----------------------------------------------------------------------------------------------- ECHOADV50$2006OpenDock Easy Blog =1.4 docdirectory Multiple Remote File Inclusion Vulnerability...

RARLAB WinRAR 3.x - LHA Filename Handling Buffer Overflow

RARLAB WinRAR 3.x - LHA Filename Handling Buffer Overflow // source: https://www.securityfocus.com/bid/19043/info WinRAR is susceptible to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffe...

vBulletin ImpEx 1.74 - Remote Command Execution

vBulletin ImpEx 1.74 - Remote Command Execution " ."turl:" ."hurl:" ."cmd:" ."" .""; if !isset$POST'submit' echo $form; else $file = fopen "test.txt", "w+"; fwrite$file, ""; fclose$file; $file = fopen $turl.$hurl, "r"; if !$file echo "Unable to get output.\n"; exit; echo $form; while !feof $file...

Microsoft Windows - Color Management Module Overflow (MS05-036) (2)

Microsoft Windows - Color Management Module Overflow MS05-036 2 / \ MS05-036 ICC Stack Overflow Exploit / by Darkeagle \ / GreetZ: all unl0ckerz, ed, f0st, uf0, sowhat, str0ke, black, redsand \ / \ special tnx to snooq for his PoC. / \ / xploit was tested on WinXP SP1 RUS with explorer.exe \ /...

SPIP 1.81.9 - index.php3 Cross-Site Scripting

SPIP 1.81.9 - index.php3 Cross-Site Scripting source: https://www.securityfocus.com/bid/16461/info SPIP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitra...

Easy Message Board - Remote Command Execution

Easy Message Board - Remote Command Execution source: https://www.securityfocus.com/bid/13555/info Easy Message Board is prone to a remote command execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input...

Microsoft Windows - WINS Vulnerability + OSSP Scanner

Microsoft Windows - WINS Vulnerability + OSSP Scanner / HAT-SQUAD WINS VULNERABILITY/OS SCANNER ------------------------------------ ------------------------------------ Note: ---------------- By default, nothing printed on screen, 200 threads, all results in the file HSWINS.txt -v..: lite verbos...

OpenFTPd 0.30.1 - message system Remote Shell

OpenFTPd 0.30.1 - message system Remote Shell / shouts to mitakeet :D exploit for openftpd format string bug. tested on most current version only. -infamous42md AT hotpop DOT com is real email only tricky part is find a place to stick the shell, as there isn't enough room to send it with the form...

Invision Power Board (IP.Board) 1.3.1 - Design Error

Invision Power Board IP.Board 1.3.1 - Design Error IP.Board Design Error Vendor: Invision Power Services Product: IP.Board Version: = 1.3.1 Website: http://www.invisionpower.com/ BID: 10559 Description: Invision Power Board IPB is a professional forum system that has been built from the ground up...

RhinoSoft Serv-U FTPd Server 3.x4.x5.x - MDTM Remote Overflow

RhinoSoft Serv-U FTPd Server 3.x4.x5.x - MDTM Remote Overflow / exservu.c - Serv-U FTPD 3.x/4.x/5.x "MDTM" Command remote overflow exploit Copyright c SST 2004 All rights reserved. Public version BUG find by bkbll [email protected], cool! :ppPPppPPPpp :D code by Sam and 2004/01/07 Revise History...

Apache mod_ssl OpenSSL 0.9.6d 0.9.7-beta2 - openssl-too-open.c SSL2 KEY_ARG Overflow

Apache modssl OpenSSL 0.9.6d 0.9.7-beta2 - openssl-too-open.c SSL2 KEYARG Overflow / openssl-too-open.c - OpenSSL remote exploit Spawns a nobody/apache shell on Apache, root on other servers. by Solar Eclipse Thanks to Core, HD Moore, Zillion, Dvorak and Black Berry for their help. This code or a...

IBM Informix SE 7.25 sqlexec - Local Buffer Overflow (2)

IBM Informix SE 7.25 sqlexec - Local Buffer Overflow 2 source: https://www.securityfocus.com/bid/4891/info Informix is an enterprise database distributed and maintained by IBM. A buffer overflow vulnerability has been reported for Informix-SE for Linux. The overflow is due to an unbounded string...

Microsoft IIS 4.05.0 and PWS - Extended Unicode Directory Traversal (5)

Microsoft IIS 4.05.0 and PWS - Extended Unicode Directory Traversal 5 source: https://www.securityfocus.com/bid/1806/info Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot "../" directory traversal exploitation if extended UNICODE character representations are used in substitution for "...