VideoLAN VLC Media Player 0.8.6d - httpd_FileCallBack Remote Format String

VideoLAN VLC Media Player 0.8.6d - httpdFileCallBack Remote Format String / Epibite // bite since 1442 pown meme ta mamie / / Advisory from Luigi Auriemma CVE-2007-6682 / format string in VideoLAN VLC 0.8.6d Description : Format string vulnerability in the httpdFileCallBack function network/httpd...

@lex Guestbook 4.0.5 - setup.php?language_setup Cross-Site Scripting

@lex Guestbook 4.0.5 - setup.php?languagesetup Cross-Site Scripting source: https://www.securityfocus.com/bid/28519/info @lex Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to...

VHCS 2.4.7.1 - vhcs2_daemon Remote Code Execution

VHCS 2.4.7.1 - vhcs2daemon Remote Code Execution !/usr/bin/php -q http://acid-root.new.fr/ [email protected] Exploit: + Logged in Administrator + The administrator has 2 resellers / Changing dareseller's password / Trying to connect as dareseller:thatpwnz + Login successful + The reseller...

PHP Live! 3.2.2 - questid SQL Injection (1)

PHP Live! 3.2.2 - questid SQL Injection 1 !Info! PHP Live! © OSI Codes Inc. enables live help and live customer support communication directly from your website. With PHP Live!, you can provide one-on-one chat assistance in real-time, answer visitor questions and add that extra human touch to yo...

FreeWebShop 2.2.1 - Blind SQL Injection

FreeWebShop 2.2.1 - Blind SQL Injection !/usr/bin/perl Indonesian Newhack Security Advisory ------------------------------------ FreeWebshop version 2.2.1 - Multiple Remote SQL Injection Vulnerabilities Waktu : Dec 16 2007 01:50AM Software : FreeWebshop version 2.2.1 Vendor :...

EZContents 1.4.5 - index.php?link Remote File Disclosure

EZContents 1.4.5 - index.php?link Remote File Disclosure -------------------------------------------------------------- ezContents Version 1.4.5 Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.visualshapers.com/ author :...

Wordsmith 1.1b - config.inc.php?_path Remote File Inclusion

Wordsmith 1.1b - config.inc.php?path Remote File Inclusion --==+=================== Electronic Security Team www.Yee7.com ====================+==-- --==+ WordSmith 1.0 RC1 config.inc.php Remote File Inclusion +==--...

WordPress 1.5.1.1 2.2.2 - Multiple Vulnerabilities

WordPress 1.5.1.1 2.2.2 - Multiple Vulnerabilities !/usr/bin/env ruby .---. .---. : : o : happy antiblogging, dear kids! ..-: 0 : :-.. / .-'' ' ---' ---' " -. Copyright c Lance M. Havok .' " ' " . " . ' " . : '.---.,,.,...,.,.,.,..---. ' ; . " . .' " .' ----- All rights reserved. . '. .-/|||||||-...

e-Vision CMS 2.02 - SQL Injection Remote Code Execution

e-Vision CMS 2.02 - SQL Injection Remote Code Execution !/usr/bin/php -q -d shortopentag=on ...need i say more? Bug 2 admin/functions.php: if isset$COOKIE'adminlang' $languageselector = $COOKIE'adminlang'; else $languageselector = "en"; include"lang/".$languageselector.".php"; ...speaks for it se...

MangoBery CMS 0.5.5 - quotes.php Remote File Inclusion

MangoBery CMS 0.5.5 - quotes.php Remote File Inclusion Mangobery-0.5.5 Found by kezzap66345 Script Page:http://mangobery.sourceforge.net/ Demo Site:http://mangobery.beryllium.ca/ Script Download:http://sourceforge.net/project/showfiles.php?groupid=63834&packageid=60858...

Activist Mobilization Platform (AMP) 3.2 - Remote File Inclusion

Activist Mobilization Platform AMP 3.2 - Remote File Inclusion \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV71$2007 --------------------------------------------------------------------------- ECHOADV71$2007 AMP v3.2 basepath Remote File Inclusion...

Mozilla Firefox 2.0.0.1 - location.hostname Cross-Domain

Mozilla Firefox 2.0.0.1 - location.hostname Cross-Domain Options - Privacy - Show Cookies for login.live.com Gorn, gorn.supportgmailcom 2007-02-19 16:00 -- var mydomain = '127.0.0.1'; var varcook = 'MSPPre=firefoxvulnerabilitytest'; var domcook = 'login.live.com'; if location.hostna...

@lex Guestbook 4.0.2 - Remote Command Execution

@lex Guestbook 4.0.2 - Remote Command Execution !/usr/bin/php @lex Guestbook ======================================================== | status Retrieving the administrator password | sploit AdminUsername::root | sploit AdminPassword::toor | status Trying to get logged in | sploit Done | status...

Solaris 10 libnspr - LD_PRELOAD Arbitrary File Creation Privilege Escalation (1)

Solaris 10 libnspr - LDPRELOAD Arbitrary File Creation Privilege Escalation 1 !/bin/sh $Id: raptorlibnspr,v 1.1 2006/10/13 19:12:12 raptor Exp $ raptorlibnspr - Solaris 10 libnspr oldschool local root Copyright c 2006 Marco Ivaldi Local exploitation of a design error vulnerability in version 4.6....

Exhibit Engine 1.5 RC 4 - photo_comment.php File Inclusion

Exhibit Engine 1.5 RC 4 - photocomment.php File Inclusion ' ' EXPLOIT coded by Kacper in Visual Basic ;- ' '::::::::: :::::::::: ::: ::: ::::::::::: ::: ':+: :+: :+: :+: :+: :+: :+: '+:+ +:+ +:+ +:+ +:+ +:+ +:+ '++ +:+ +++:++ ++ +:+ ++ ++ '++ ++ ++ ++ ++ ++ ++ '+ + + +++ + + ' ':::::::::::...

OpenDock Easy Blog 1.4 - doc_directory File Inclusion

OpenDock Easy Blog 1.4 - docdirectory File Inclusion ECHOADV50$2006 ----------------------------------------------------------------------------------------------- ECHOADV50$2006OpenDock Easy Blog =1.4 docdirectory Multiple Remote File Inclusion Vulnerability...

RARLAB WinRAR 3.x - LHA Filename Handling Buffer Overflow

RARLAB WinRAR 3.x - LHA Filename Handling Buffer Overflow // source: https://www.securityfocus.com/bid/19043/info WinRAR is susceptible to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffe...

Microsoft Windows - Color Management Module Overflow (MS05-036) (2)

Microsoft Windows - Color Management Module Overflow MS05-036 2 / \ MS05-036 ICC Stack Overflow Exploit / by Darkeagle \ / GreetZ: all unl0ckerz, ed, f0st, uf0, sowhat, str0ke, black, redsand \ / \ special tnx to snooq for his PoC. / \ / xploit was tested on WinXP SP1 RUS with explorer.exe \ /...

SPIP 1.81.9 - index.php3 Cross-Site Scripting

SPIP 1.81.9 - index.php3 Cross-Site Scripting source: https://www.securityfocus.com/bid/16461/info SPIP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitra...

123 Flash Chat 5.0 - Remote Code Injection

123 Flash Chat 5.0 - Remote Code Injection source: https://www.securityfocus.com/bid/16360/info 123 Flash Chat is prone to an arbitrary code injection weakness. An attacker can influence the value of a variable that is insecurely passed to an 'eval' call. Successful exploitation may allow attacke...

Microsoft Windows Plug-and-Play - Umpnpmgr.dll Denial of Service (MS05-047) (2)

Microsoft Windows Plug-and-Play - Umpnpmgr.dll Denial of Service MS05-047 2 // tested and approved /str0ke / Program: Denial of Service attack for MS UMPNPMGR PNPGetDeviceList Author: Winny Thomas Vulnerability: no length checking on passed parameter to PNPGetDeviceList in UMPNPMGR.dll Note: The...

Easy Message Board - Remote Command Execution

Easy Message Board - Remote Command Execution source: https://www.securityfocus.com/bid/13555/info Easy Message Board is prone to a remote command execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input...

Microsoft Windows - WINS Vulnerability + OSSP Scanner

Microsoft Windows - WINS Vulnerability + OSSP Scanner / HAT-SQUAD WINS VULNERABILITY/OS SCANNER ------------------------------------ ------------------------------------ Note: ---------------- By default, nothing printed on screen, 200 threads, all results in the file HSWINS.txt -v..: lite verbos...

3Com 3CDaemon FTP - Unauthorized USER Remote Buffer Overflow

3Com 3CDaemon FTP - Unauthorized USER Remote Buffer Overflow / Added " on line 86 /str0ke / / 3com 3CDaemon FTP Unauthorized "USER" Remote BOverflow The particularity of this exploit is to exploits a FTP server without the need of any authorization. Homepage: www.3com.com version: 3CDaemon v2.0...

RhinoSoft Serv-U FTPd Server 3.x4.x5.x - MDTM Remote Overflow

RhinoSoft Serv-U FTPd Server 3.x4.x5.x - MDTM Remote Overflow / exservu.c - Serv-U FTPD 3.x/4.x/5.x "MDTM" Command remote overflow exploit Copyright c SST 2004 All rights reserved. Public version BUG find by bkbll [email protected], cool! :ppPPppPPPpp :D code by Sam and 2004/01/07 Revise History...

phpGroupWare 0.9.14 - Tables_Update.Inc.php Remote File Inclusion

phpGroupWare 0.9.14 - TablesUpdate.Inc.php Remote File Inclusion source: https://www.securityfocus.com/bid/12074/info phpGroupWare is prone to a remote file include vulnerability, potentially allowing the execution of malicious PHP code. This would occur in the context of the affected web server...

Microsoft Windows - RPC DCOM Scanner (MS03-039)

Microsoft Windows - RPC DCOM Scanner MS03-039 / dcom2scanner.c scan for second dcom vulnerability MS03-039 by Doke Scott, doke at udel.edu, 10 Sep 2003 based on work by: buildtheb0x presents : dcom/rpc scanner --------------------------------------- by: kid and farp and on packet sniffs of MS's...

phpBB2 Gender Mod 1.1.3 - SQL Injection

phpBB2 Gender Mod 1.1.3 - SQL Injection source: https://www.securityfocus.com/bid/5342/info phpBB2 is an open-source web forum application that is written in PHP and backended by a number of database products. It will run on most Unix and Linux variants, as well as Microsoft Windows operating...

Microsoft SQL Server 7.02000 Data Engine 1.02000 - xp_displayparamstmt Buffer Overflow

Microsoft SQL Server 7.02000 Data Engine 1.02000 - xpdisplayparamstmt Buffer Overflow // source: https://www.securityfocus.com/bid/2030/info The API Srvparaminfo, which is implemented by Extended Stored Procedures XPs in Microsoft SQL Server and Data Engine, is susceptible to a buffer overflow...

Microsoft IIS 4.05.0 and PWS - Extended Unicode Directory Traversal (5)

Microsoft IIS 4.05.0 and PWS - Extended Unicode Directory Traversal 5 source: https://www.securityfocus.com/bid/1806/info Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot "../" directory traversal exploitation if extended UNICODE character representations are used in substitution for "...

RedHat Linux 6.1 i386 - Tmpwatch Recursive Write Denial of Service

RedHat Linux 6.1 i386 - Tmpwatch Recursive Write Denial of Service source: https://www.securityfocus.com/bid/1664/info Any user with write access to /tmp or /var/tmp, can induce tmpwatch to cause Red Hat and others runnng tmpwatch from cron to stop responding, and possibly require a hard reboot...

Internet Security Systems ICECap Manager 2.0.23 - Default Username and Password

Internet Security Systems ICECap Manager 2.0.23 - Default Username and Password source: https://www.securityfocus.com/bid/1216/info ICECap Manager is a management console for BlackICE IDS Agents and Sentries. By default, ICECap Manager listens on port 8081, transmits alert messages to another...

Cisco IOS 11.x12.x - HTTP %%

Cisco IOS 11.x12.x - HTTP %% source: https://www.securityfocus.com/bid/1154/info A denial of service attack exists in versions of Cisco IOS, running on a variety of different router hardware. If the router is configured to have a web server running for configuration and other information a user c...

AMD K6 Processor - Denial of Service

AMD K6 Processor - Denial of Service source: https://www.securityfocus.com/bid/105/info A bug in Advance Micro Devices K6 processor allows non-privileged code to crash the machine. Under Linux 2.1.x a bug stops this vulnerability. $ cat a.s .text .align 4096 / r1 / .globl start start: movl start,...

Deutsche Bahn Ticket Vending Machine Local Kiosk - Privilege Escalation

Deutsche Bahn Ticket Vending Machine Local Kiosk - Privilege Escalation Exploit Title: Deutsche Bahn Ticket Vending Machine Local Kiosk - Privilege Escalation Date: 2019-12-18 Exploit Author: Vulnerability-Lab Vendor Homepage:...

SpotAuditor 5.3.2 - Base64 Local Buffer Overflow (SEH)

SpotAuditor 5.3.2 - Base64 Local Buffer Overflow SEH Exploit Title: SpotAuditor 5.3.2 - 'Base64' Local Buffer Overflow SEH Exploit Author: Kirill Nikolaev Date: 2019-12-06 Vulnerable Software: SpotAuditor Vendor Homepage: http://www.nsauditor.com/ Version: 5.3.2 Software Link:...

Oracle Siebel Sales 8.1 - Persistent Cross-Site Scripting

Oracle Siebel Sales 8.1 - Persistent Cross-Site Scripting Exploit Title : Oracle Siebel Sales 8.1 - Persistent Cross-Site Scripting Exploit Author : omurugur Software link: https://www.oracle.com/tr/applications/siebel/ Effective version : Oracle Siebel Sales 8.1 CVE: N/A Examples Request; POST...

Nextcloud 17 - Cross-Site Request Forgery

Nextcloud 17 - Cross-Site Request Forgery Exploit Title: Nextcloud 17 - Cross-Site Request Forgery Date: 08.11.2019 Exploit Author: Ozer Goker Vendor Homepage: https://nextcloud.com Software Link: https://nextcloud.com/install/instructions-server Version: 17 CVE: N/A Nextcloud offers the...

Apache Httpd mod_rewrite - Open Redirects

Apache Httpd modrewrite - Open Redirects Normal URLs like http://redirect.local/test will be forwared to https://redirect.local/test. But by using newlines CVE 2019-10098, we can redirect somewhere else i.e. to https://redirect.local.evilwebsite.com: curl -Ik...

SQLiteManager 1.2.0 1.2.4 - Blind SQL Injection

SQLiteManager 1.2.0 1.2.4 - Blind SQL Injection !-- Exploit Title: Blind SQL injection in SQLiteManager 1.2.0 and 1.2.4 Date: 17-02-2019 Exploit Author: Rafael Pedrero Vendor Homepage: http://www.sqlitemanager.org/ Software Link: http://www.sqlitemanager.org/ Version: SQLiteManager 1.2.0 and 1.2....

Sar2HTML 3.2.1 - Remote Command Execution

Sar2HTML 3.2.1 - Remote Command Execution Exploit Title: sar2html Remote Code Execution Date: 01/08/2019 Exploit Author: Furkan KAYAPINAR Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Centos 7 In web...

Microsoft Compiled HTML Help Uncompiled .chm File - XML External Entity Injection

Microsoft Compiled HTML Help Uncompiled .chm File - XML External Entity Injection + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-HTML-HELP-UNCOMPILED-CHM-FILE-XML-EXTERNAL-ENTITY-INJECTION.txt + ISR:...

Firefox 67.0.4 - Denial of Service

Firefox 67.0.4 - Denial of Service Loading please wait function MyFun var text = ; forvar i=0 ;i"+ ""+ ""+ ""+ ""+ ""+ "\x70...

Microsoft Exchange 2003 - base64-MIME Remote Code Execution

Microsoft Exchange 2003 - base64-MIME Remote Code Execution Python 2.7 included with ImmunityDBG Exchange 2003 SP0 base64-MIME memory corruption NSA's ENGLISHMANSDENTIST Platform: Windows Server 2003 R2 Shout out to the Equation Group, NSA Tailored Access Operations Author: Charles Truscott...

Solaris 789 (SPARC) - dtprintinfo Local Privilege Escalation (2)

Solaris 789 SPARC - dtprintinfo Local Privilege Escalation 2 / raptordtprintnamesparc2.c - dtprintinfo 0day, Solaris/SPARC Copyright c 2004-2019 Marco Ivaldi 0day buffer overflow in the dtprintinfo1 CDE Print Viewer, leading to local root. Many thanks to Dave Aitel for discovering this...

SOCA Access Control System 180612 - Cross-Site Request Forgery (Add Admin)

SOCA Access Control System 180612 - Cross-Site Request Forgery Add Admin SOCA Access Control System 180612 CSRF Add Admin Exploit Vendor: SOCA Technology Co., Ltd Product web page: http://www.socatech.com Affected version: 180612, 170000 and 141007 Summary: The company's products include Proximit...

Ross Video DashBoard 8.5.1 - Insecure Permissions

Ross Video DashBoard 8.5.1 - Insecure Permissions Ross Video DashBoard 8.5.1 Insecure Permissions Vendor: Ross Video Ltd. Product web page: https://www.rossvideo.com Affected version: 8.5.1 Summary: DashBoard is a free and open platform from Ross Video for facility control and monitoring that...

AIDA64 Engineer 5.99.4900 - Load from file Field Buffer Overflow (SEH)

AIDA64 Engineer 5.99.4900 - Load from file Field Buffer Overflow SEH !/usr/bin/python Exploit Title: AIDA64 Engineer 5.99.4900 - 'Load from file' Field Buffer Overflow SEH Date: 04-04-2019 Exploit Author: Anurag Srivastava and Vardan Bansal Website: www.theanuragsrivastava.in Vulnerable Software:...

DVD X Player 5.5.3 - .plf Buffer Overflow

DVD X Player 5.5.3 - .plf Buffer Overflow !/usr/bin/env python Exploit Title: DVD X Player 5.5.3 Buffer Overflow Date: 20.03.2019 Exploit Author: Paolo Perego - [email protected] Vendor Homepage: http://www.dvd-x-player.com Software Link:...

Netartmedia PHP Car Dealer - SQL Injection

Netartmedia PHP Car Dealer - SQL Injection Exploit Title: Netartmedia PHP Car Dealer- SQL Injection Date: 19.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.netartmedia.net/autodealer/ Demo Site: https://www.phpscriptdemos.com/autodealer/ Version: Lastest Tested on: Kali...