Bash CGI - Shellshock Remote Command Injection (Metasploit)

Bash CGI - Shellshock Remote Command Injection Metasploit This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Shellshock Bashed CGI RCE', 'Description' = %q This module exploits the...

Java Web Start Launcher ActiveX Control - Memory Corruption

Java Web Start Launcher ActiveX Control - Memory Corruption SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Java ActiveX Control Memory Corruption product: JavaTM Web Start Launcher vulnerable version: Sun Java Version...

TFM MMPlayer 2.0 - .m3u.ppl Universal Buffer Overflow (SEH)

TFM MMPlayer 2.0 - .m3u.ppl Universal Buffer Overflow SEH !/usr/bin/perl + Bug : TFM MMPlayer 2.0 m3u/ppl Universal Buffer Overflow Exploit SEH + Author : ThE g0bL!N Greetz to all my friends Tested on: Windows XP Pro SP2 Fr Big Thnx :His0k4 Download:http://www.tfm.ro/mmplayer/download/mmplayer.zi...

Microsoft Windows - .LNK Shortcut File Code Execution

Microsoft Windows - .LNK Shortcut File Code Execution !/usr/bin/python -- coding: utf-8 -- Title : CVE-2017-8464 | LNK Remote Code Execution Vulnerability CVE : 2017-8464 Authors : ykoster, nixawk Notice : Only for educational purposes. Support : python2 import struct def generateSHELLLINKHEADER:...

Nuxeo 6.07.17.27.3 - Remote Code Execution (Metasploit)

Nuxeo 6.07.17.27.3 - Remote Code Execution Metasploit =begin Description Nuxeo Platform is a content management system for enterprises CMS. It embeds an Apache Tomcat server, and can be managed through a web interface. One of its features allows authenticated users to import files to the platform...

Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities

Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities Exploit Title: FiyoCMS Multiple Vulnerabilities Date: 29 March 2015 Exploit Author: Mahendra Vendor Homepage: www.fiyo.org Software Link: http://sourceforge.net/projects/fiyo-cms/ Version: 2.0.1.8, other version might be vulnerable. Tested : Kali Linux...

Microsoft Windows Server 2003 SP2 - Local Privilege Escalation (MS14-070)

Microsoft Windows Server 2003 SP2 - Local Privilege Escalation MS14-070 """ KL-001-2015-001 : Microsoft Windows Server 2003 SP2 Arbitrary Write Privilege Escalation Title: Microsoft Windows Server 2003 SP2 Arbitrary Write Privilege Escalation Advisory ID: KL-001-2015-001 Publication Date:...

MamboLaiThai ExtCalThai 0.9.1 - admin_events.php?CONFIG_EXT[LANGUAGES_DIR] Remote File Inclusion

MamboLaiThai ExtCalThai 0.9.1 - adminevents.php?CONFIGEXTLANGUAGESDIR Remote File Inclusion source: https://www.securityfocus.com/bid/20487/info ExtCalThai is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issue...

Popper 1.41-r2 - form Remote File Inclusion

Popper 1.41-r2 - form Remote File Inclusion ============================================================================================== Popper ================================================================================================ Exploit : --------------------------------...

CS-Cart 1.3.3 - classes_dir Remote File Inclusion

CS-Cart 1.3.3 - classesdir Remote File Inclusion $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$ $$ $$ CS-Cart 1.3.3 classesdir = Remote File Include Vulnerability $$ Script site: http://www.cs-cart.com $$ Dork: Powered by CS-Cart - Shopping Cart Software $$...

QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit)

QNAP - Admin Shell via Bash Environment Variable Code Injection Metasploit Exploit Title: QNAP admin shell via Bash Environment Variable Code Injection Date: 7 February 2015 Exploit Author: Patrick Pellegrino | [email protected] work /...

PHP - openssl_x509_parse() Memory Corruption

PHP - opensslx509parse Memory Corruption SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: PHP opensslx509parse Memory Corruption Vulnerability Release Date: 2013/12/13 Last Modified: 2013/12/13 Author: Stefan Esser stefan.esseratsektioneins.de Application: PHP 4.0.6 - PHP 4.4...

Cisco RV300 RV320 - Information Disclosure

Cisco RV300 RV320 - Information Disclosure Exploit Title: 6coRV Exploit Date: 01-26-2018 Exploit Author: Harom Ramos Horus Tested on: Cisco RV300/RV320 CVE : CVE-2019-1653 import requests from requests.packages.urllib3.exceptions import InsecureRequestWarning from fakeuseragent import UserAgent d...

MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities

MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities Trustwave SpiderLabs Security Advisory TWSL2013-019: Multiple Vulnerabilities in MiCasaVerde VeraLite Published: 08/01/13 Version: 1.0 Vendor: MiCasaVerde http://www.micasaverde.com/ Product: VeraLite Version affected: 1.5.408 Product...

lighttpd 1.4.31 - Denial of Service (PoC)

lighttpd 1.4.31 - Denial of Service PoC !/bin/bash Exploit Title: simple lighttpd 1.4.31 DOS POC Date: 11/21/2012 Exploit Author: [email protected] Vendor Homepage: http://www.lighttpd.net Software Link: http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.31.tar.gz Version: 1.4.31 Tested...

CA-ArcServe

CA ArcServe is prone to a remote buffer overflow because it fails to perform adequate boundary-checks on user-supplied data. Successfully exploiting will allow an attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a...

S9Y Serendipity 1.0.3 - comment.php Local File Inclusion

S9Y Serendipity 1.0.3 - comment.php Local File Inclusion DEVIL TEAM IRC: irc.milw0rm.com:6667 devilteam http://www.rahim.webd.pl/ ======== Contact: [email protected] cod3d by Kacper -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Greetings DragonHeart and all DEVIL...

Microsoft Windows Server 2000 SP1SP2 - isapi .printer Extension Overflow (2)

Microsoft Windows Server 2000 SP1SP2 - isapi .printer Extension Overflow 2 / IIS 5 remote .printer overflow. "jill.c" don't ask. by: dark spyrit respect to eeye for finding this one - nice work. shouts to halvar, neofight and the beavuh bitchez. this exploit overwrites an exception frame to contr...

Microsoft Windows - AppX Deployment Service Local Privilege Escalation (3)

Microsoft Windows - AppX Deployment Service Local Privilege Escalation 3 CVE-2019-0841 BYPASS 2 There is a second bypass for CVE-2019-0841. This can be triggered as following: Delete all files and subfolders within "c:\users%username%\appdata\local\packages\Microsoft.MicrosoftEdge8wekyb3d8bbwe"...

D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities

D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ D-Link Central WiFiManager Software Controller Multiple Vulnerabilities 1. Advisory Information Title: D-Link Central WiFiManager Software Controller...

Oracle Solaris 11.111.3 (RSH) - Stack Clash Local Privilege Escalation

Oracle Solaris 11.111.3 RSH - Stack Clash Local Privilege Escalation / Solarisrsh.c for CVE-2017-3630, CVE-2017-3629, CVE-2017-3631 Copyright C 2017 Qualys, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published ...

Linux Kernel 4.3.3 (Ubuntu 14.0415.10) - overlayfs Local Privilege Escalation (1)

Linux Kernel 4.3.3 Ubuntu 14.0415.10 - overlayfs Local Privilege Escalation 1 / just another overlayfs exploit, works on kernels before 2015-12-26 Exploit Title: overlayfs local root Date: 2016-01-05 Exploit Author: rebel Version: Ubuntu 14.04 LTS, 15.10 and more Tested on: Ubuntu 14.04 LTS, 15.1...

QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit)

QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection Metasploit Exploit Title: QNAP Web server remote code execution via Bash Environment Variable Code Injection Date: 7 February 2015 Exploit Author: Patrick Pellegrino |...

EyesOfNetwork 5.3 - Remote Code Execution

EyesOfNetwork 5.3 - Remote Code Execution Exploit Title: EyesOfNetwork 5.3 - Remote Code Execution Date: 2020-02-01 Exploit Author: Clément Billac Vendor Homepage: https://www.eyesofnetwork.com/ Software Link: http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x8664-bin.iso Version: 5.3 CVE :...

Verot 2.0.3 - Remote Code Execution

Verot 2.0.3 - Remote Code Execution Exploit Title: Verot 2.0.3 - Remote Code Execution Date: 2019-12-05 Exploit Author: Jinny Ramsmark Vendor Homepage: https://www.verot.net/phpclassupload.htm Software Link: https://github.com/verot/class.upload.php Version: '; $quality = "85"; $baseurl =...

ThinVNC 1.0b1 - Authentication Bypass

ThinVNC 1.0b1 - Authentication Bypass Exploit Title: ThinVNC 1.0b1 - Authentication Bypass Date: 2019-10-17 Exploit Author: Nikhith Tumamlapalli Contributor WarMarX Vendor Homepage: https://sourceforge.net/projects/thinvnc/ Software Link:...

UniSharp Laravel File Manager 2.0.0-alpha7 - Arbitrary File Upload

UniSharp Laravel File Manager 2.0.0-alpha7 - Arbitrary File Upload Exploit Title: UniSharp Laravel File Manager - Arbitrary File Upload Google Dork: inurl:"laravel-filemanager?type=Files" -site:github.com -site:github.io Exploit Author: Mohammad Danish Vendor Homepage:...

SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution

SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution !/usr/bin/env python import argparse import urllib import requests, random from bs4 import BeautifulSoup from requests.packages.urllib3.exceptions import InsecureRequestWarning...

OpenBSD HTTPd 6.0 - Memory Exhaustion Denial of Service

OpenBSD HTTPd 6.0 - Memory Exhaustion Denial of Service Advisory Information Title: Remote DoS against OpenBSD http server up to 6.0 Advisory URL: https://pierrekim.github.io/advisories/CVE-2017-5850-openbsd.txt Blog URL: https://pierrekim.github.io/blog/2017-02-07-openbsd-httpd-CVE-2017-5850.htm...

HP Laser Jet - JavaScript Persistent Cross-Site Scripting via PJL Directory Traversal

HP Laser Jet - JavaScript Persistent Cross-Site Scripting via PJL Directory Traversal !/usr/bin/perl use strict; use warnings; use IO::Socket::INET; my $host = $ARGV0; Exploit Title: HP Laser Jet Persistent Javascript Cross Site Scripting via PJL Google Dork: n/a Date: 4/22/14 Exploit Author:...

Cisco Data Center Network Manager 11.2.1 - LanFabricImpl Command Injection

Cisco Data Center Network Manager 11.2.1 - LanFabricImpl Command Injection !/usr/bin/python """ Cisco Data Center Network Manager LanFabricImpl createLanFabric Command Injection Remote Code Execution Vulnerability Tested on: Cisco DCNM 11.2.1 ISO Virtual Appliance for VMWare, KVM and Bare-metal...

Ricoh Printer Drivers - Local Privilege Escalation

Ricoh Printer Drivers - Local Privilege Escalation / This proof of concept code monitors file changes on Ricoh's driver DLL files and overwrites a DLL file before the library is loaded CVE-2019-19363. Written by Pentagrid AG, 2019. Cf...

Online Book Store 1.0 - Unauthenticated Remote Code Execution

Online Book Store 1.0 - Unauthenticated Remote Code Execution Exploit Title: Online Book Store 1.0 - Unauthenticated Remote Code Execution Google Dork: N/A Date: 2020-01-07 Exploit Author: Tib3rius Vendor Homepage:...

Advanced Comment System 1.0 - SQL Injection

Advanced Comment System 1.0 - SQL Injection Exploit Title: SQL injection in Advanced comment system v1.0 Date: 29-10-2018 Exploit Author: Rafael Pedrero Vendor Homepage: http://www.plohni.com Software Link: http://www.plohni.com/wb/content/php/download/Advancedcommentsystem1-0.zip,...

Redis 5.0 - Denial of Service

Redis 5.0 - Denial of Service Exploit Title: Redis 5.0 Denial of Service Date: 2018-06-13 Exploit Author: Fakhri Zulkifli @d0lph1n98 Vendor Homepage: https://redis.io/ Software Link: https://redis.io/download Version: 5.0 Fixed on: 5.0 CVE : CVE-2018-12453 Type confusion in the xgroupCommand...

System Shield 5.0.0.136 - Privilege Escalation

System Shield 5.0.0.136 - Privilege Escalation / Exploit Title - System Shield AntiVirus & AntiSpyware Arbitrary Write Privilege Escalation Date - 29th January 2018 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.iolo.com/ Tested Version - 5.0.0.136 Driver Version - 5.4.11.1 ...

WSO2 Carbon 4.4.5 - Persistent Cross-Site Scripting

WSO2 Carbon 4.4.5 - Persistent Cross-Site Scripting + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-PERSISTENT-XSS-COOKIE-THEFT.txt + ISR: ApparitionSec Vendor: ============= www.wso2.com Product:...

jetty 6.x 7.x - Cross-Site Scripting Information Disclosure Injection

jetty 6.x 7.x - Cross-Site Scripting Information Disclosure Injection Jetty 6.x and 7.x Multiple Vulnerabilities Name Multiple Vulnerabilities in Jetty Systems Affected Jetty 7.0.0 and earlier versions Severity Medium Impact CVSSv2 Medium 5/10, vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Vendor...

CyberArk PSMP 10.9.1 - Policy Restriction Bypass

CyberArk PSMP 10.9.1 - Policy Restriction Bypass Exploit Title: CyberArk PSMP 10.9.1 - Policy Restriction Bypass Google Dork: NA Date: 2020-02-25 Exploit Author: LAHBAL Said Vendor Homepage: https://www.cyberark.com/ Software Link: https://www.cyberark.com/ Version: PSMP = 11.1 Prerequisites Poli...

Microtik SSH Daemon 6.44.3 - Denial of Service (PoC)

Microtik SSH Daemon 6.44.3 - Denial of Service PoC Excploit Title: Microtik SSH Daemon 6.44.3 - Denial of Service PoC Author: Hosein Askari Date: 2020-03-18 Vendor Homepage: https://mikrotik.com/ Model: hAP lite Processor architecture: smips Affected Version: through 6.44.3 CVE: N/A Description: ...

Microsoft VSCode Python Extension - Code Execution

Microsoft VSCode Python Extension - Code Execution VSCode Python Extension Code Execution This repository contains the Proof-of-Concept of a code execution vulnerability discovered in the Visual Studio Code Python extension. TL;DR: VScode may use code from a virtualenv found in the project folder...

Microsoft Windows 7 (x86) - BlueKeep Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Free

Microsoft Windows 7 x86 - BlueKeep Remote Desktop Protocol RDP Remote Windows Kernel Use After Free EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47683.zip import rdp import socket import binascii import time def poolsprays, crypter, payload...

Liferay Portal 7.1 CE GA3 SimpleCaptcha API - Cross-Site Scripting

Liferay Portal 7.1 CE GA3 SimpleCaptcha API - Cross-Site Scripting Exploit Title: Liferay Portal ” / or ” /. A customized Liferay portlet which directly calls the Simple Captcha API without sanitizing the input could be susceptible to this vulnerability. Poc In a sample scenario of custom code...

Exim 4.86.2 - Local Privilege Escalation

Exim 4.86.2 - Local Privilege Escalation ============================================= - Advisory release date: 10.03.2016 - Created by: Dawid Golunski - Severity: High/Critical ============================================= I. VULNERABILITY ------------------------- Exim 4.86.2 Local Root Privile...

Enhanced Multimedia Router 3.0.4.27 - Cross-Site Request Forgery (Add Admin)

Enhanced Multimedia Router 3.0.4.27 - Cross-Site Request Forgery Add Admin Exploit Title: Enhanced Multimedia Router 3.0.4.27 - Cross-Site Request Forgery Add Admin Date: 2020-03-05 Exploit Author: Miguel Mendez Z. Vendor Homepage: www.sumavision.com Software Link:...

NEOWISE CARBONFTP 1.4 - Weak Password Encryption

NEOWISE CARBONFTP 1.4 - Weak Password Encryption Exploit Title: NEOWISE CARBONFTP 1.4 - Weak Password Encryption discovery Date: 2019-01-24 published : 2020-01-20 Exploit Author: hyp3rlinx Vendor Homepage: https://www.neowise.com Software Link: https://www.neowise.com/freeware/ Version: 1.4 +...

GNU Mailutils 3.7 - Privilege Escalation

GNU Mailutils 3.7 - Privilege Escalation Exploit Title: GNU Mailutils 3.7 - Local Privilege Escalation Date: 2019-11-06 Exploit Author: Mike Gualtieri Vendor Homepage: https://mailutils.org/ Software Link: https://ftp.gnu.org/gnu/mailutils/mailutils-3.7.tar.gz Version: 2.0 = 3.7 Tested on: Gentoo...

Freepbx 2.11.1.5 - Remote Code Execution

Freepbx 2.11.1.5 - Remote Code Execution Exploit Title: Freepbx coockie recordings injection Google Dork: Ask Santa Date: 23/12/2016 Exploit Author: inj3ctor3 Vendor Homepage: https://www.freepbx.org/ Software Link: ISO LINKS IN SITE https://www.freepbx.org/ Version: ALL && unpatched/...

S9Y Serendipity 1.5.4 - Arbitrary File Upload

S9Y Serendipity 1.5.4 - Arbitrary File Upload In The Name Of GOD + Exploit Title:remote 0day file upload + Date: 2010 + script:Serendipity 1.5.4 + Software Link: http://www.s9y.org/12.html + Author : pentesters.ir +discovered by:ahmadbady + Contact : [email protected] + Website :...

Joomla! Component JComments 2.1 - ComntrNam Cross-Site Scripting

Joomla! Component JComments 2.1 - ComntrNam Cross-Site Scripting source: https://www.securityfocus.com/bid/40230/info The JComments component for Joomla! is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue...