IBM Notes 8.5.x9.0.x - Denial of Service (Metasploit)

IBM Notes 8.5.x9.0.x - Denial of Service Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "IBM Notes encodeURI DOS", 'Description' = %q This module exploits a vulnerability in the nati...

D-Link DIR-600 - Authentication Bypass

D-Link DIR-600 - Authentication Bypass Exploit Title: D-Link DIR-600 - Authentication Bypass Absolute Path Traversal Attack CVE - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12943 Date: 29-08-2017 Exploit Author: Jithin D Kurup Contact :...

NoMachine 5.3.9 - Local Privilege Escalation

NoMachine 5.3.9 - Local Privilege Escalation """ Exploit Title: NoMachine LPE - Local Privilege Escalation Date: 09/08/2017 Exploit Author: Daniele Linguaglossa Vendor Homepage: https://www.nomachine.com Software Link: https://www.nomachine.com Version: 5.3.9 Tested on: OSX CVE : CVE-2017-12763...

DivFix++ 0.34 - Denial of Service

DivFix++ 0.34 - Denial of Service DivFix++ denial of service vulnerability ================ Author : qflb.wu =============== Introduction: ============= DivFix++ is FREE AVI Video Fix & Preview program. Affected version: ===== v0.34 Vulnerability Description: ========================== the...

FortiOS 5.6.0 - Cross-Site Scripting

FortiOS 5.6.0 - Cross-Site Scripting Title: FortiOS = 5.6.0 Multiple XSS Vulnerabilities Vendor: Fortinet www.fortinet.com CVE: CVE-2017-3131, CVE-2017-3132, CVE-2017-3133 Date: 28.07.2016 Author: Patryk Bogdan @patrykbogdan Affected FortiNet products: CVE-2017-3131 : FortiOS versions 5.4.0 to...

WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free

WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free function go li.hidden = true; dir.setAttribute"aria-labeledby", "map"; !-- ================================================================= ASan log: =================================================================...

Robert 0.5 - Multiple Vulnerabilities

Robert 0.5 - Multiple Vulnerabilities Exploit Title: Robert 0.5 - Multiple Vulnerabilities XSS, CSRF, Directory traversal & SQLi Date: 07/06/2017 Exploit Author: Cyril Vallicari / HTTPCS - ZIWIT Vendor website :http://robert.polosson.com/ Download link :...

Apple macOS 10.12.1 iOS 10.2 - powerd Arbitrary Port Replacement

Apple macOS 10.12.1 iOS 10.2 - powerd Arbitrary Port Replacement / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=976 powerd running as root hosts the com.apple.PowerManagement.control mach service. It checks in with launchd to get a server port and then wraps that in a CFPort:...

Google Chrome 31.0.1650.48 - HTTP 1xx base::String­Tokenizer­T...::Quick­Get­Next Out-of-Bounds Read

Google Chrome 31.0.1650.48 - HTTP 1xx base::String­Tokenizer­T...::Quick­Get­Next Out-of-Bounds Read ''' Source: http://blog.skylined.nl/20161219001.html Synopsis A specially crafted HTTP response can allow a malicious web-page to trigger a out-of-bounds read vulnerability in Google Chrome. The...

GNU Wget 1.18 - Access List Bypass Race Condition

GNU Wget 1.18 - Access List Bypass Race Condition ''' ============================================= - Discovered by: Dawid Golunski - dawidatlegalhackers.com - https://legalhackers.com - https://legalhackers.com/advisories/Wget-Exploit-ACL-bypass-RaceCond-CVE-2016-7098.html - CVE-2016-7098 -...

SAP NetWeaver AS JAVA - BC-BMT-BPM-DSK XML External Entity Injection

SAP NetWeaver AS JAVA - BC-BMT-BPM-DSK XML External Entity Injection Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.5 Vendor URL: SAP Bugs: XXE Reported: 09.03.2016 Vendor response: 10.03.2016 Date of Public Advisory: 09.08.2016 Reference: SAP Security Note 2296909...

ScriptCase 8.1.053 - Multiple Vulnerabilities

ScriptCase 8.1.053 - Multiple Vulnerabilities + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SCRIPTCASE-PHP-WEB-TOOL-MULTIPLE-VULNERABILITIES.txt + ISR: ApparitionSec Vendor: ================== www.scriptcase.net Product:...

Microsoft Windows Server 20082012 - LDAP RootDSE Netlogon Denial of Service

Microsoft Windows Server 20082012 - LDAP RootDSE Netlogon Denial of Service !/usr/bin/perl MS Windows Server 2008/2008 R2/ 2012/2012 R2/ AD LDAP RootDSE Netlogon CLDAP "AD Ping" query reflection DoS PoC Copyright 2016 c Todor Donev Varna, Bulgaria [email protected]...

Linux Kernel 2.6.22 3.9 - Dirty COW PTRACE_POKEDATA Race Condition (Write Access Method)

Linux Kernel 2.6.22 3.9 - Dirty COW PTRACEPOKEDATA Race Condition Write Access Method // $ echo pikachu|sudo tee pokeball;ls -l pokeball;gcc -pthread pokemon.c -o d;./d pokeball miltank;cat pokeball include //// pikachu include //// -rw-r--r-- 1 root root 8 Apr 4 12:34 pokeball include ////...

SPIP 3.1.2 Template CompilerComposer - PHP Code Execution

SPIP 3.1.2 Template CompilerComposer - PHP Code Execution SPIP 3.1.2 Template Compiler/Composer PHP Code Execution CVE-2016-7998 Product Description SPIP is a publishing system for the Internet, which put importance on collaborative working, multilingual environments and ease of use. It is free...

ZKTeco ZKTime.Net 3.0.1.6 - Insecure File Permissions Privilege Escalation

ZKTeco ZKTime.Net 3.0.1.6 - Insecure File Permissions Privilege Escalation ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.0.1.6 3.0.1.5 160622 3.0.1.1...

Open Upload 0.4.2 - Cross-Site Request Forgery (Add Admin)

Open Upload 0.4.2 - Cross-Site Request Forgery Add Admin ================================================================================================================ Open Upload 0.4.2 Remote Admin Add CSRF Exploit and Changing Normal user permission...

Hitron CGNV4 ModemRouter 4.3.9.9-SIP-UPC - Multiple Vulnerabilities

Hitron CGNV4 ModemRouter 4.3.9.9-SIP-UPC - Multiple Vulnerabilities Hitron CGNV4 modem/router multiple vulnerabilities -------------------------------------------------- Platforms / Firmware confirmed affected: - Hitron CGNV4, 4.3.9.9-SIP-UPC - Product page:...

Riverbed SteelCentral NetProfiler NetExpress 10.8.7 - Multiple Vulnerabilities

Riverbed SteelCentral NetProfiler NetExpress 10.8.7 - Multiple Vulnerabilities , , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. Riverbed SteelCentral NetProfiler & NetExpress Multiple Vulnerabilities...

Merit Lilin IP Cameras - Multiple Vulnerabilities

Merit Lilin IP Cameras - Multiple Vulnerabilities / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ 0 | R | W | 3 | L | L | L | 4 | 8 | 5 / / / / / / / / / / www.orwelllabs.com securityadivisory @orwelllabs ;r By sitting in the alcove, and keeping well back, Winston was able to remain outside the...

Mess Emulator 0.154-3.1 - Local Buffer Overflow

Mess Emulator 0.154-3.1 - Local Buffer Overflow Exploit Author: Juan Sacco - http://www.exploitpack.com - [email protected] Program affected: Multi Emulator Super System MESS Version: 0.154-3.1 Tested and developed under: Kali Linux 2.0 x86 - https://www.kali.org Program description: MESS is...

McAfee VirusScan Enterprise 8.8 - Security Restrictions Bypass

McAfee VirusScan Enterprise 8.8 - Security Restrictions Bypass / Security Advisory @ Mediaservice.net Srl 01, 13/04/2016 Data Security Division Title: McAfee VirusScan Enterprise security restrictions bypass Application: McAfee VirusScan Enterprise 8.8 and prior versions Platform: Microsoft Windo...

AVM FRITZ!Box 6.30 - Remote Buffer Overflow

AVM FRITZ!Box 6.30 - Remote Buffer Overflow Advisory: AVM FRITZ!Box: Remote Code Execution via Buffer Overflow RedTeam Pentesting discovered that several models of the AVM FRITZ!Box are vulnerable to a stack-based buffer overflow, which allows attackers to execute arbitrary code on the device...

PHPIPAM 1.1.010 - Multiple Vulnerabilities

PHPIPAM 1.1.010 - Multiple Vulnerabilities Exploit Title: PHPIPAM v1.1.010 Multiple Vulnerabilities Date: 04/01/2016 Author: Mickael Dorigny @ Synetis Vendor or Software Link: http://phpipam.net/ Version: 1.1.010 Category: Multiple Vulnerabilities Tested on : 1.1.010 PHPIPAM description :...

KiTTY Portable 0.65.0.2p (Windows 8.110) - Local kitty.ini Overflow

KiTTY Portable 0.65.0.2p Windows 8.110 - Local kitty.ini Overflow Exploit Title: KiTTY Portable = 0.65.0.2p Local kitty.ini Overflow Win8.1/Win10 Date: 28/12/2015 Exploit Author: Guillaume Kaddouch Twitter: @gkweb76 Blog: http://networkfilter.blogspot.com GitHub: https://github.com/gkweb76/exploi...

Ovidentia bulletindoc Module 2.9 - Multiple Remote File Inclusions

Ovidentia bulletindoc Module 2.9 - Multiple Remote File Inclusions Title: Ovidentia Module bulletindoc 2.9 Multiple Remote File Inclusion Vulnerabilities Author: bd0rk eMail: bd0rkathackermail.com Twitter: twitter.com/bd0rk Tested on: Ubuntu-Linux Download:...

Endian Firewall 3.0.0 - OS Command Injection (Metasploit)

Endian Firewall 3.0.0 - OS Command Injection Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Endian Firewall %q This module exploits an OS command injection vulnerabilit...

Seagate Central 2014.0410.0026-F - Remote Facebook Access Token

Seagate Central 2014.0410.0026-F - Remote Facebook Access Token !/usr/bin/python seagatecentralfacebook.py Seagate Central Remote Facebook Access Token Exploit Jeremy Brown jbrown3264/gmail May 2015 -Synopsis- Seagate Central stores linked Facebook account access tokens in /etc/archiveaccounts.se...

WebGate WinRDS 2.0.8 - StopSiteAllChannel Stack Overflow

WebGate WinRDS 2.0.8 - StopSiteAllChannel Stack Overflow WebGate WinRDS WESPPlayback.WESPPlaybackCtrl.1 StopSiteAllChannel Stack Buffer Overflow Vulnerability 0Day var buff1 = ""; var nops = ""; var buff2 = ""; for i=0;i128; i++ buff1 += "B"; nseh = "\xeb\x08PD"; //pop pop ret = 1007f2a0 0x1007f2...

Websense Appliance Manager - Command Injection

Websense Appliance Manager - Command Injection Abstract A command injection vulnerability was found in Websense Appliance Manager that allows an attacker to execute arbitrary code on the appliance. This issue can be combined with other vulnerabilities, like Cross-Site Scripting, to perform a remo...

CoolPlayer-2.18-DEP-Bypass

Tested on: Windows XP SP3 running in Virtualbox Uses SetProcessDEPPolicy to disable DEP for the process Thanks to mrme for the encouragement Exploit-DB Notes: May not work on all Win XP SP3 machines windows/exec calc.exe 227 bytes - 240 bytes of shellcode space available shellcode =...

Postfix-SMTP---Shellshock

Date: 10/3/2014 Exploit Author: fattymcwopr Vendor Homepage: gnu.org Software Link: http://ftp.gnu.org/gnu/bash/ Version: 4.2.x 4.2.48 !/bin/python Exploit Title: Shellshock SMTP Exploit Date: 10/3/2014 Exploit Author: fattymcwopr Vendor Homepage: gnu.org Software Link: http://ftp.gnu.org/gnu/bas...

PHPMyRecipes 1.2.2 - browse.php?category SQL Injection

PHPMyRecipes 1.2.2 - browse.php?category SQL Injection Exploit Title : phpMyRecipes 1.2.2 SQL injectionpage browse.php, parameter category Author : Manish Kishan Tanwar Download Link : http://prdownloads.sourceforge.net/php-myrecipes/phpMyRecipes-1.2.2.tar.gz?download Date : 23/12/2014 Discovered...

PsychoStats 2.2.4 Beta - Cross Site Scripting

PsychoStats 2.2.4 Beta - Cross Site Scripting PsychoStats Cross Site Scripting Vendor: Jason Morriss Product: PsychoStats Version: = 2.2.4 Beta Website: http://www.psychostats.com/ BID: 12089 CVE: CVE-2004-1417 OSVDB: 12560 SECUNIA: 13619 PACKETSTORM: 35502 Description: PsychoStats is a statistic...

OSSEC 2.8 - hosts.deny Local Privilege Escalation

OSSEC 2.8 - hosts.deny Local Privilege Escalation !/usr/bin/python Exploit Title: ossec 2.8 Insecure Temporary File Creation Vulnerability Privilege Escalation Date: 14-11-14 Exploit Author: skynet-13 Vendor Homepage: www.ossec.net/ Software Link:...

Dell EqualLogic Storage - Directory Traversal

Dell EqualLogic Storage - Directory Traversal Exploit Title: Remote Directory Traversal exploit for Dell EqualLogic 6.0 Storage Date: 09/2013 Exploit Author: Mauricio Pampim Corr�a Vendor Homepage: www.dell.com Version: 6.0 Tested on: Equipment Model Dell EqualLogic PS4000 CVE : CVE-2013-3304 The...

Croogo 2.0.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities

Croogo 2.0.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities ------------------------ XSS 1 -------- POST parameters: - dataContacttitle ------------------------ input type="hidden" name="dataTokenkey" value="...

BulletProof FTP Client 2010 - Buffer Overflow (SEH) (PoC)

BulletProof FTP Client 2010 - Buffer Overflow SEH PoC ----------------------------------------------------------------------------- Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow SEH Date: Jul 24 2014 Exploit Author: Gabor Seljan Software Link: http://www.bpftp.com/ Version:...

EagleGet 1.1.8.1 - Denial of Service

EagleGet 1.1.8.1 - Denial of Service Exploit Title: EagleGet 1.1.8.1 DoS Exploit Date: 03 April 2014 Exploit Author: Interference Security Vendor Homepage: http://www.eagleget.com/ Software Link: http://www.eagleget.com/download/ Version: 1.1.8.1 Tested on: Microsoft Windows XP SP3 print " Crash...

Oracle Demantra 12.2.1 - SQL Injection

Oracle Demantra 12.2.1 - SQL Injection Details: Application is vulnerable to SQL injection. Impact: An attacker with access to the vulnerable pages could manipulate the queries being sent to the database, potentially enabling them to: - Extract sensitive information, including but not limited to...

NETGEAR DGN2200 N300 Wireless Router - Multiple Vulnerabilities

NETGEAR DGN2200 N300 Wireless Router - Multiple Vulnerabilities Title: Multiple vulnerabilities in NETGEAR N300 WIRELESS ADSL2+ MODEM ROUTER DGN2200 ==================================================================================== Notification Date: 11 February 2014 Affected Vendor: NetGear...

WordPress Plugin BuddyPress 1.9.1 - Privilege Escalation

WordPress Plugin BuddyPress 1.9.1 - Privilege Escalation Exploit Title: Wordpress plugin Buddypress 2 Visit the url http://example.com/groups/create/step/group-details/ 3 Enjoy the power...

Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass

Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass Document Title: =============== Mozilla Bug Bounty 5 - WireTap Remote Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=953 Mozilla Bug Tracking ID: 875818 Video:...

MuPDF 1.3 - xps_parse_color() Stack Buffer Overflow

MuPDF 1.3 - xpsparsecolor Stack Buffer Overflow ============================================================= 0day - MuPDF Stack-based Buffer Overflow in xpsparsecolor ============================================================= Date of discovery: 2013-01-26 Software Links: http://www.mupdf.com/...

Zikula CMS 1.3.5 - Multiple Vulnerabilities

Zikula CMS 1.3.5 - Multiple Vulnerabilities Document Title: =============== Zikula CMS v1.3.5 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1114 Release Date: ============= 2013-10-16 Vulnerability Laboratory ID VL-ID:...

mod_accounting Module 0.5 - Blind SQL Injection

modaccounting Module 0.5 - Blind SQL Injection - Affected Vendor: http://sourceforge.net/projects/mod-acct/files/ - Affected Software: modaccounting - Affected Version: 0.5. Other earlier versions may be affected. - Issue type: Blind SQL injection - Release Date: 20 Sep 2013 - Discovered by: Elda...

Share KM 1.0.19 - Remote Denial of Service

Share KM 1.0.19 - Remote Denial of Service Advisory Information : ====================== Title : Share KM 1.0.19 - Remote Denial Of Service Advisory ID : Cr02013-001 Product : Share KM desktop setup file Vendor : SmartUX Vulnerable Versions : 1.0.19 and probably prior release Tested Version :...

D-Link DIR-615 Rev D3 DIR-300 Rev A - Multiple Vulnerabilities

D-Link DIR-615 Rev D3 DIR-300 Rev A - Multiple Vulnerabilities Device Name: DIR-615 - Hardware revision D3 / DIR-300 - Hardware revision A Vendor: D-Link ============ Device Description: ============ DIR-300: http://www.dlink.com/de/de/home-solutions/connect/routers/dir-300-wirele... DIR-615:...

KindEditor - Multiple Arbitrary File Upload Vulnerabilities

KindEditor - Multiple Arbitrary File Upload Vulnerabilities source: https://www.securityfocus.com/bid/58431/info KindEditor is prone to multiple remote file-upload vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attackers can exploit these issues to upload arbitrary...

BlazeDVD 6.1 - .PLF File (ASLR + DEP Bypass) (Metasploit)

BlazeDVD 6.1 - .PLF File ASLR + DEP Bypass Metasploit This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...