WANGKONGBAO CNS-1000 UTM IPS-FW - Directory Traversal (Metasploit)

WANGKONGBAO CNS-1000 UTM IPS-FW - Directory Traversal Metasploit Exploit Title: WANGKONGBAO CNS-1000 and 1100 Network Security Platform UTM Directory Traversal Date: 7/2/2012 Exploit Author: Dillon Beresford Vendor Homepage: http://www.wangkongbao.com/products.html Version: CNS-1000 and 1100 The...

QNAP Turbo NAS 3.6.1 Build 0302T - Multiple Vulnerabilities

QNAP Turbo NAS 3.6.1 Build 0302T - Multiple Vulnerabilities Sense of Security - Security Advisory - SOS-12-006 Release Date. 13-Jun-2012 Last Update. - Vendor Notification Date. 12-Mar-2012 Product. QNAP Platform. Turbo NAS verified and possibly others Affected versions. Firmware Version: 3.6.1...

Lynx Message Server - Multiple Vulnerabilities

Lynx Message Server - Multiple Vulnerabilities 1. Summary The Micro Technology Services Inc. "Lynx Message Server 7.11.10.2" and/or "LynxTCPService version 1.1.62" web interface is vulnerable to SQL Injection, Cross-Site Scripting, and other security problems. 2. Description Lynx is a "Facility...

Hotel Booking Portal - SQL Injection

Hotel Booking Portal - SQL Injection 'Hotel Booking Portal' SQL Injection CVE-2012-1672 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in getcity.php that allows for SQL injection of the 'country' POST parameter. II. TESTED...

Adobe Photoshop 12.1 - .tiff Parsing Use-After-Free

Adobe Photoshop 12.1 - .tiff Parsing Use-After-Free Application: Adobe Photoshop 12.1 Tiff Parsing Use-After-Free Platforms: Windows PRL: 2012-07 Author: Francis Provencher Protek Research Lab's Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2 Report Timeline 3...

Network Instrument Observer - SNMP SetRequest Denial of Service

Network Instrument Observer - SNMP SetRequest Denial of Service Application: Network Instrument Observer SNMP SetRequest Denial of Service Vulnerability Platforms: Windows Secunia: SA47898 PRL: 2012-05 Author: Francis Provencher Protek Research Lab's Website: http://www.protekresearchlab.com/...

novell sentinel log manager 1.2.0.1 - Directory Traversal

novell sentinel log manager 1.2.0.1 - Directory Traversal Exploit Title: Novell Sentinel Log Manager directory traversal Date: 2011-12-18 Exploit Author: Andrea Fabrizi Vendor Homepage: http://www.novell.com/ Version: = 1.2.0.1 Tested on: Sentinel Log Manager Appliance 1.2.0.1 CVE: 2011-5028 The...

CaupoShop Pro (2.x 3.70) Classic 3.01 - Local File Inclusion

CaupoShop Pro 2.x 3.70 Classic 3.01 - Local File Inclusion CaupoShop Pro 2.x/ = 3.70 Local File Include Vulnerability ----------------------------------------------------------------------------------------- Vuln Softwares : CaupoShop Pro 2.x CaupoShop Classic 3.01 CaupoShop Pro 3.70 Discovered B...

NETGEAR Wireless Cable Modem Gateway - Authentication Bypass Cross-Site Request Forgery

NETGEAR Wireless Cable Modem Gateway - Authentication Bypass Cross-Site Request Forgery Sense of Security - Security Advisory - SOS-11-011 Release Date. 20-Sep-2011 Last Update. - Vendor Notification Date. 22-Mar-2011 Product. NETGEAR Wireless Cable Modem Gateway CG814WG Affected versions. Hardwa...

Cogent DataHub 7.1.1.63 - Integer Overflow

Cogent DataHub 7.1.1.63 - Integer Overflow Luigi Auriemma Application: Cogent DataHub http://www.cogentdatahub.com/Products/CogentDataHub.html Versions: = 7.1.1.63 Platforms: Windows Bug: integer overflow Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma e-mail: [email protected]...

Sunway Force Control SCADA 6.1 SP3 - httpsrv.exe Remote Overflow

Sunway Force Control SCADA 6.1 SP3 - httpsrv.exe Remote Overflow Sunway Force Control SCADA httpsvr.exe Exploit Exploitable with simple SEH Overwrite technique Tested on XP SP0 English Probably will work on XP SP3 if you find none-safeseh dll for p/p/r pointer Canberk BOLAT | @cnbrkbolat...

Citrix XenApp XenDesktop XML Service - Heap Corruption

Citrix XenApp XenDesktop XML Service - Heap Corruption n.runs AG http://www.nruns.com/ securityatnruns.com n.runs-SA-2011.002 28-Jul-2011 Vendor: Citrix, http://www.citrix.com Affected Products: XenApp and XenDesktop Affected Version: See the Citrix security bulletin 2 for a list Vulnerability:...

glfusion CMS 1.2.1 - img Persistent Cross-Site Scripting

glfusion CMS 1.2.1 - img Persistent Cross-Site Scripting Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1 Version: 1.2.1 Tested on: Firefox 3.0.15 Info: glFusion gives you the ability to easi...

SiteScape Enterprise Forum 7 - TCL Injection

SiteScape Enterprise Forum 7 - TCL Injection !/usr/bin/env python """ -- coding: utf-8 -- sitescapesploit.py Copyright 2010 Spencer McIntyre This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software...

Camtron CMNC-200 IP Camera - Directory Traversal

Camtron CMNC-200 IP Camera - Directory Traversal Finding 2: Directory Traversal in Camera Web Server CVE: CVE-2010-4231 The CMNC-200 IP Camera has a built-in web server that is enabled by default. The server is vulnerable to directory transversal attacks, allowing access to any file on the camera...

TinyMCE MCFileManager 2.1.2 - Arbitrary File Upload

TinyMCE MCFileManager 2.1.2 - Arbitrary File Upload ============================================== File Upload Vulnerability Plugins tinymce ============================================== http://tinymce.moxiecode.com/pluginsfilemanager.php Author : Hackeri-AL Contact : h-al at hotmail dot it Gree...

Barracuda Networks Spam Virus Firewall 4.1.1.021 - Remote Configuration Retrieval

Barracuda Networks Spam Virus Firewall 4.1.1.021 - Remote Configuration Retrieval !/bin/bash Exploit by ShadowHatesYou [email protected] The resulting output is an SQL dump containing the Barracuda's configuration, which includes goodies such as: The administrative password for the...

Adobe Device Central CS5 - qtcf.dll DLL Hijacking

Adobe Device Central CS5 - qtcf.dll DLL Hijacking / Exploit Title: Adobe Device Central CS5 DLL Hijacking Exploit qtcf.dll Date: August 24, 2010 Author: Glafkos Charalambous glafkos@astalavistadotcom Version: Latest CS5 v3.0.0376 Tested on: Windows 7 x64 Ultimate Vulnerable extensions: .adcp...

Joomla! Component com_qcontacts - SQL Injection

Joomla! Component comqcontacts - SQL Injection Exploit Title: Joomla Component QContacts comqcontacts - SQL Injection Vulnerability Date: 12, July 2010 Author: mlk Software Link: http://bugsec.googlecode.com/files/Joomlacomqcontacts.zip Version: 1.0.4 and previous Tested on: all OS CVE : 0 Code :...

Easy CD-DA Recorder 2007 - Local Buffer Overflow (SEH)

Easy CD-DA Recorder 2007 - Local Buffer Overflow SEH Exploit Title : Easy CD-DA Recorder 2007 SEH Buffer Overflow Date : June 7, 2010 Author : chap0 http://www.seek-truth.net Software Link : http://download.cnet.com/Easy-CD-DA-Recorder/3000-26464-10059726.html Tested on : Windows XP SP3 En Type o...

PTC Sites - Remote Code Execution Cross-Site Scripting

PTC Sites - Remote Code Execution Cross-Site Scripting $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ @Title: PTC Site's RCE/XSS Vulnerability @Vendor: http://www.ptcsites4sale.info & and etc...:D @Author: CrazyMember @SPC Thanks: XroGuE 4 r3p0r7 :P @Dork:"intext:Warning: passthru"...

U.S.Robotics USR5463 0.06 Firmware - setup_ddns.exe HTML Injection

U.S.Robotics USR5463 0.06 Firmware - setupddns.exe HTML Injection source: https://www.securityfocus.com/bid/40292/info U.S.Robotics USR5463 firmware is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code...

IDEAL Administration 2010 10.2 - Local Buffer Overflow

IDEAL Administration 2010 10.2 - Local Buffer Overflow !/usr/bin/env python IDEAL Administration 2010 v10.2 Local Buffer Overflow Exploit Found By: DrIDE Usage: Migrate - Open Migration Project - Bind Shell Download: www.pointdev.com Tested On: Windows XPSP3 windows/shellbindtcp - 696 bytes...

AJ Shopping Cart 1.0 (maincatid) - SQL Injection

AJ Shopping Cart 1.0 maincatid - SQL Injection / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...

Joomla! Component mv_restaurantmenumanager - SQL Injection

Joomla! Component mvrestaurantmenumanager - SQL Injection ========================================================= Joomla component mvrestaurantmenumanager SQL injection Vulnerability ========================================================= Exploit Title : joomla component mvrestaurantmenumanag...

Eros Erotik Webkatalog - start.php?id SQL Injection

Eros Erotik Webkatalog - start.php?id SQL Injection ----------------------------Information------------------------------------------------ +Name : Eros Erotik Webkatalog start.php rubrik&idSQL Injection +Autor : Easy Laster +Date : 11.03.2010 +Script : Eros Erotik Webkatalog +Price : 07,13€...

GOM Player 2.1.21.4846 - .wav Buffer Overflow

GOM Player 2.1.21.4846 - .wav Buffer Overflow !/usr/bin/perl GOM Player 2.1.21.4846 .wav Buffer Overflow Exploit Homepage: http://www.gomlab.com/ Exploit Coded by: cr4wl3r From: Gorontalo - Indonesia WARNING - WARNING - WARNING - WARNING Disclaimer: The author published the information under the...

TinyMCE WYSIWYG Editor - Multiple Vulnerabilities

TinyMCE WYSIWYG Editor - Multiple Vulnerabilities + Vurnerebility: Js tinymce/tinymce WYSIWYGjava script vurnerebility xss--popup & SQl implemented + Language : Java--,Xml + lisences : LGPL + Vendor : Moxiecode Systems AB + support : IE7J0/IE6.0/NS8.1-IE/NS8.1-G/FF2.0/O9.02; + Category : bug repo...

Microsoft Internet Explorer 6 - Aurora Memory Corruption (MS10-002)

Microsoft Internet Explorer 6 - Aurora Memory Corruption MS10-002 Author : Ahmed Obied [email protected] This program acts as a web server that generates an exploit to target a vulnerability CVE-2010-0249 in Internet Explorer. The exploit was tested using Internet Explorer 6 on Windows XP SP2...

Net Gitar Shop 1.0 - Database Disclosure

Net Gitar Shop 1.0 - Database Disclosure ======================================================================================== | Title : Net Gitar Shopv1.0 DB Download Vulnerability | Author : indoushka | email : [email protected] | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria...

XOOPS Module dictionary 2.0.18 - detail.php SQL Injection

XOOPS Module dictionary 2.0.18 - detail.php SQL Injection XOOPS Module dictionary 2.0.18 detail.php SQL Injection Vulnerability XOOPS Version: XOOPS 2.0.18 http://www.xoops.org/modules/repository/ AUTHOR : Palyo34 HOME : http://www.1923turk.biz DORK : allinurl: "modules/dictionary/detail.php?id"...

PhpLinkExchange 1.02 - Cross-Site Scripting Upload

PhpLinkExchange 1.02 - Cross-Site Scripting Upload PhpLinkExchange v1.02 - XSS/Upload Vulerability Discovered by : Stink' Date : 2009-12-16 Dork : "PhpLinkExchange v1.02" Website Publisher : http://www.idevspot.com/PhpLinkExchange.php -- XSS in URL --...

Expat 2.0.1 - UTF-8 Character XML Parsing Remote Denial of Service

Expat 2.0.1 - UTF-8 Character XML Parsing Remote Denial of Service Bugtraq ID: 36097 Class: Input Validation Error Published: Jan 17 2009 12:00AM Updated: Nov 12 2009 08:06PM Credit: Peter Valchev Vulnerable: SuSE openSUSE 11.0 SuSE openSUSE 10.3 SuSE Linux 9 SuSE Linux 11 SuSE Linux 10.0 RedHat...

Adobe Reader Acrobat - .U3D File Invalid Array Index Overflow

Adobe Reader Acrobat - .U3D File Invalid Array Index Overflow Felipe Andres Manzano [email protected] http://twitter/feliam doc=''' Title: U3D CLODProgressiveMeshContinuation Split Position Index arbitrary dereference. Product: Adobe Acrobat Reader Version: =8.1.6, =9.1.3 Product...

SharePoint 2007 - Team Services Source Code Disclosure

SharePoint 2007 - Team Services Source Code Disclosure ======= Summary ======= Name: SharePoint Team Services source code disclosure through download facility Release Date: 21 October 2009 Reference: NGS00532 Discover: Daniel Martin Vendor: Microsoft Systems Affected: SharePoint 2007 12.0.0.6219,...

Vivvo CMS 4.1.5.1 - file Disclosure

Vivvo CMS 4.1.5.1 - file Disclosure waraxe-2009-SA075 - Remote File Disclosure in Vivvo CMS 4.1.5.1 =============================================================================== Author: Janek Vind "waraxe" Date: 21. October 2009 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-75.htm...

EZRecipeZee CMS 91 - Remote File Inclusion

EZRecipeZee CMS 91 - Remote File Inclusion !/usr/bin/perl + Author : kaMtiEz [email protected] + Date : September 30, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.jdtmmsm.com/ + Download : http://www.jdtmmsm.com/downloads/index.php?setFilter=11232 + version : v91 + Meth...

MiniTwitter 0.2b - Remote User Options Changer

MiniTwitter 0.2b - Remote User Options Changer || || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O ¡PROUD TO BE SPANISH!...

ablespace 1.0 - Cross-Site Scripting Blind SQL Injection

ablespace 1.0 - Cross-Site Scripting Blind SQL Injection riginal advisory: http://dsecrg.com/pages/vul/show.php?id=137 Digital Security Research Group DSecRG Advisory DSECRG-09-037 Application: AbleSpace Versions Affected: 1.0 Vendor URL: http://abk-soft.com/ Bugs: Multiple Blind SQL Injections,...

powermovielist 0.14b - SQL Injection Cross-Site Scripting

powermovielist 0.14b - SQL Injection Cross-Site Scripting =============================================================================================== Found : brainpillow Dork : "PowerMovieList 0.14 Beta Copyright" Visit : brainpillow.cc, forum.antichat.ru, raz0r.name Mail :...

Nokia Phoenix 2008.4.7 Service Software - ActiveX Controls Multiple Buffer Overflow Vulnerabilities

Nokia Phoenix 2008.4.7 Service Software - ActiveX Controls Multiple Buffer Overflow Vulnerabilities source: https://www.securityfocus.com/bid/33726/info Nokia Phoenix Service Software ActiveX controls are prone to multiple buffer-overflow vulnerabilities because they fail to properly bounds-check...

YourFreeWorld Forced Matrix Script - SQL Injection

YourFreeWorld Forced Matrix Script - SQL Injection Forced Matrix Script id Remote SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc script : http://www.yourfreeworld.com/script/subscriptionforcedmatrix.php DorK : inurl:"tr1.php?id=" Forced Matrix Exploit :...

Joomla! Component Ignite Gallery 0.8.3 - SQL Injection

Joomla! Component Ignite Gallery 0.8.3 - SQL Injection Joomla Component Ignite Gallery SQL Injection Vulnerability Vulnerability found by: H!tm@N Contact: hitmanatkhg-crewdotws Site: www.khg-crew.ws Greetz: boom3rang, KHG, urtan, chs, redc00de - -=Kosova Hackers Group=- ScriptName: "Joomla"...

PHP iCalendar 2.24 - cookie_language Local File Inclusion Arbitrary File Upload

PHP iCalendar 2.24 - cookielanguage Local File Inclusion Arbitrary File Upload '.$lang'lcalfile'.' '.$filenumber.': '.$lang'lactionsuccess'.''; 84. el...

Acoustica Beatcraft 1.02 Build 19 - .bcproj Local Buffer Overflow

Acoustica Beatcraft 1.02 Build 19 - .bcproj Local Buffer Overflow !/usr/bin/perl Acoustica Beatcraft bcproj file Local BOF Exploit Author: Koshi Date: 08-30-08 0day Application: Acoustica Beatcraft Versions: v1.02 Build 19 Site: http://acoustica.com/beatcraft/index.htm Tested On: Windows XP SP3...

Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection

Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection GulfTech Security Research July 30, 2008 Vendor : Pligg LLC URL : http://www.pligg.com/ Version : Pligg alertdocument.cookie; The above example link would display the end users cookie to them. Of course this can also be use...

1024 CMS 1.4.4 - Multiple LocalRemote File Inclusions

1024 CMS 1.4.4 - Multiple LocalRemote File Inclusions Digital Security Research Group DSecRG Advisory DSECRG-08-027 Application: 1024 CMS Versions Affected: 1.4.3, 1.4.4 RFC Vendor URL: http://www.1024cms.com/ Bug: Multiple Remote/Local File Include Exploits: YES Reported: 18.06.2008 Second repor...

PHP-Nuke Platinium 7.6.b.5 - Remote Code Execution

PHP-Nuke Platinium 7.6.b.5 - Remote Code Execution Date: 02/07/08 Note I modified a bit phpsploit for this exploit, because PHP Nuke plays with REQUESTURI var ... Requirements registerglobals=On phpreter phpreter is really easy to use: You can change mode using "mode=", with = sql, php or cmd If...

Joomla! Component EasyBook 1.1 - gbid SQL Injection

Joomla! Component EasyBook 1.1 - gbid SQL Injection !/usr/bin/perl use IO::Socket; use strict; INFO Example: Host: xxx.lu &md: 0f8ab366793a0d1da85c6f5a8d4fb576 print "-+-- Joomla Component EasyBook 1.1 SQL Injection Exploit--+-\n"; print "-+-- --+-\n"; print "-+-- Author: ZAMUT --+-\n"; print "-+...

Panda Internet SecurityAntiVirus+Firewall 2008 - CPoint.sys Memory Corruption

Panda Internet SecurityAntiVirus+Firewall 2008 - CPoint.sys Memory Corruption source: https://www.securityfocus.com/bid/28150/info Panda Internet Security/Antivirus+Firewall 2008 is prone to a vulnerability that allows local attackers to corrupt kernel memory. This vulnerability occurs because th...