InfraPower PPS-02-S Q213V1 - Multiple Cross-Site Scripting Vulnerabilities

InfraPower PPS-02-S Q213V1 - Multiple Cross-Site Scripting Vulnerabilities InfraPower PPS-02-S Q213V1 Multiple XSS Vulnerabilities Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Fixed version: Q216V3 Firmware:...

SAP Adaptive Server Enterprise 16 - Denial of Service

SAP Adaptive Server Enterprise 16 - Denial of Service ''' Application: SAP Adaptive Server Enterprise Versions Affected: SAP Adaptive Server Enterprise 16 Vendor URL: http://SAP.com Bugs: Denial of Service Sent: 01.02.2016 Reported: 02.02.2016 Vendor response: 02.02.2016 Date of Public Advisory:...

HikVision Security Systems - Activex Buffer Overflow

HikVision Security Systems - Activex Buffer Overflow !/usr/bin/env python The exploit is a part of EAST Framework - use only under the license agreement specified in LICENSE.txt in your EAST Framework distribution visit eastfw.com eastexploits.com for more info import sys import re import os impo...

ZKTeco ZKTime.Net 3.0.1.6 - Insecure File Permissions Privilege Escalation

ZKTeco ZKTime.Net 3.0.1.6 - Insecure File Permissions Privilege Escalation ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.0.1.6 3.0.1.5 160622 3.0.1.1...

Getsimple CMS 3.3.10 - Arbitrary File Upload

Getsimple CMS 3.3.10 - Arbitrary File Upload Exploit Title: Getsimple CMS 2. An attacker login to the admin page and uploading the backdoor 3. The uploaded file will be under the "/data/uploads/" folder Report Timeline ======================== 2016-06-23 : Vulnerability reported to...

Microsoft Windows - gdi32.dll Multiple DIB-Related EMF Record Handlers Heap Out-of-Bounds ReadsMemory Disclosure (MS16-074)

Microsoft Windows - gdi32.dll Multiple DIB-Related EMF Record Handlers Heap Out-of-Bounds ReadsMemory Disclosure MS16-074 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=757 As clearly visible in the EMF Enhanced Metafile image format specification MS-EMF, there are multiple...

Valve Steam 3.42.16.13 - Local Privilege Escalation

Valve Steam 3.42.16.13 - Local Privilege Escalation Exploit Title: Valve Steam 3.42.16.13 Local Privilege Escalation CVE-ID: CVE-2016-5237 Date: 5/11/52016 Exploit Author: gsX Contact: [email protected] Vendor Homepage: http://www.valvesoftware.com/ Software Link:...

Microsoft Windows - CSRSS BaseSrvCheckVDM Session 0 Process Creation Privilege Escalation (MS16-048)

Microsoft Windows - CSRSS BaseSrvCheckVDM Session 0 Process Creation Privilege Escalation MS16-048 / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=692 Windows: CSRSS BaseSrvCheckVDM Session 0 Process Creation EoP Platform: Windows 8.1, not tested on Windows 10 or 7 Class:...

Mess Emulator 0.154-3.1 - Local Buffer Overflow

Mess Emulator 0.154-3.1 - Local Buffer Overflow Exploit Author: Juan Sacco - http://www.exploitpack.com - [email protected] Program affected: Multi Emulator Super System MESS Version: 0.154-3.1 Tested and developed under: Kali Linux 2.0 x86 - https://www.kali.org Program description: MESS is...

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated...

McAfee VirusScan Enterprise 8.8 - Security Restrictions Bypass

McAfee VirusScan Enterprise 8.8 - Security Restrictions Bypass / Security Advisory @ Mediaservice.net Srl 01, 13/04/2016 Data Security Division Title: McAfee VirusScan Enterprise security restrictions bypass Application: McAfee VirusScan Enterprise 8.8 and prior versions Platform: Microsoft Windo...

SOLIDserver 5.0.4 - Local File Inclusion

SOLIDserver 5.0.4 - Local File Inclusion Title: SOLIDserver =5.0.4 - Local File Inclusion Vunerability Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: SOLIDserver Tested Version: : 5.0.4 and 4.0.2 Vendor: efficient IP http://www.efficientip.com Google Dork: SOLIDserver login Date:...

PHPIPAM 1.1.010 - Multiple Vulnerabilities

PHPIPAM 1.1.010 - Multiple Vulnerabilities Exploit Title: PHPIPAM v1.1.010 Multiple Vulnerabilities Date: 04/01/2016 Author: Mickael Dorigny @ Synetis Vendor or Software Link: http://phpipam.net/ Version: 1.1.010 Category: Multiple Vulnerabilities Tested on : 1.1.010 PHPIPAM description :...

OpenMRS 2.3 (1.11.4) - Multiple Cross-Site Scripting Vulnerabilities

OpenMRS 2.3 1.11.4 - Multiple Cross-Site Scripting Vulnerabilities OpenMRS 2.3 1.11.4 Multiple Cross-Site Scripting Vulnerabilities Vendor: OpenMRS Inc. Product web page: http://www.openmrs.org Affected version: OpenMRS 2.3, 2.2, 2.1, 2.0 Platform 1.11.4 Build 6ebcaf, 1.11.2 and 1.10.0 OpenMRS-TB...

WordPress Plugin Albo Pretorio Online 3.2 - Multiple Vulnerabilities

WordPress Plugin Albo Pretorio Online 3.2 - Multiple Vulnerabilities Exploit Title: Albo Pretorio Online 3.2 Multiple Vulnerabilities Google Dork: inurl:/?action=visatto Date: 09/06/2015 Exploit Author: Alessandro Cingolani Vendor Homepage: http://plugin.sisviluppo.info/ Software Link:...

Photoshop CC2014 Bridge CC 2014 - .png Parsing Memory Corruption

Photoshop CC2014 Bridge CC 2014 - .png Parsing Memory Corruption Application: Adobe Photoshop CC 2014 & Bridge CC 2014 Platforms: Windows Versions: The vulnerability is confirmed in version Photoshop CC 2014 and Bridge CC 2014. Secunia: PRL: 2015-08 Author: Francis Provencher Protek Research Lab’...

WordPress Plugin zM Ajax Login Register 1.0.9 - Local File Inclusion

WordPress Plugin zM Ajax Login Register 1.0.9 - Local File Inclusion Exploit Title: CVE-2015-4153 - WordPress zM Ajax Login & Register Plugin Local File Inclusion Date: 2015/06/01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://zanematthew.com/...

Seagate Central 2014.0410.0026-F - Remote Facebook Access Token

Seagate Central 2014.0410.0026-F - Remote Facebook Access Token !/usr/bin/python seagatecentralfacebook.py Seagate Central Remote Facebook Access Token Exploit Jeremy Brown jbrown3264/gmail May 2015 -Synopsis- Seagate Central stores linked Facebook account access tokens in /etc/archiveaccounts.se...

Manage Engine Asset Explorer 6.1.0 Build: 6110 - Cross-Site Request Forgery

Manage Engine Asset Explorer 6.1.0 Build: 6110 - Cross-Site Request Forgery =============================================================================== CSRF/Stored XSS Vulnerability in Manage Engine Asset Explorer ===============================================================================...

Acunetix 9.5 - OLE Automation Array Remote Code Execution

Acunetix 9.5 - OLE Automation Array Remote Code Execution !/usr/bin/python import BaseHTTPServer, sys, socket Acunetix OLE Automation Array Remote Code Execution Author: Naser Farhadi Linkedin: http://ir.linkedin.com/pub/naser-farhadi/85/b3b/909 Date: 27 Mar 2015 Version: acunetix.exe Video:...

LG DVR LE6016D - Remote UsersPasswords Disclosure

LG DVR LE6016D - Remote UsersPasswords Disclosure !/usr/bin/perl LG DVR LE6016D unauthenticated remote users/passwords disclosure exploit Copyright 2015 c Todor Donev http://www.ethical-hacker.org/ Digital video recorder DVR surveillance is the use of cameras, often hidden or concealed, that use...

NPDS CMS REvolution-13 - SQL Injection

NPDS CMS REvolution-13 - SQL Injection Title - NPDS CMS Revolution-13 - SQL Injection Vulnerability Credits & Author: Narendra Bhati R00t Sh3ll www.websecgeeks.com References Source: ==================== http://www.npds.org/viewtopic.php?topic=26233&forum=12...

Microsoft Internet Explorer OLE Pre-IE11 - Automation Array Remote Code Execution PowerShell VirtualAlloc (MS14-064)

Microsoft Internet Explorer OLE Pre-IE11 - Automation Array Remote Code Execution PowerShell VirtualAlloc MS14-064 |--------------------------------------------------------------------------| | Title: OLE Automation Array Remote Code Execution = Pre IE11 | | Original Exploit: yuange -...

BulletProof FTP Client 2010 - Buffer Overflow (SEH) (PoC)

BulletProof FTP Client 2010 - Buffer Overflow SEH PoC ----------------------------------------------------------------------------- Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow SEH Date: Jul 24 2014 Exploit Author: Gabor Seljan Software Link: http://www.bpftp.com/ Version:...

Binatone DT 850W Wireless Router - Multiple Cross-Site Request Forgery Vulnerabilities

Binatone DT 850W Wireless Router - Multiple Cross-Site Request Forgery Vulnerabilities Exploit Title: Binatone DT 850W Wireless Router - Multiple CSRF Vulnerabilities Date: 05/20/2014 Author: Samandeep Singh - SaMaN @samanL33T Vendor...

Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass

Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass Document Title: =============== Mozilla Bug Bounty 5 - WireTap Remote Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=953 Mozilla Bug Tracking ID: 875818 Video:...

SonarQube Jenkins Plugin - Plain Text Password

SonarQube Jenkins Plugin - Plain Text Password 1. Advisory Information Title: SonarQube Jenkins Plugin - Plain Text Password Date published: 2013-12-05 Date of last update: 2013-12-05 Vendors contacted: SonarQube and Jenkins CI Discovered by: Christian Catalano Severity: High 2. Vulnerability...

Share KM 1.0.19 - Remote Denial of Service

Share KM 1.0.19 - Remote Denial of Service Advisory Information : ====================== Title : Share KM 1.0.19 - Remote Denial Of Service Advisory ID : Cr02013-001 Product : Share KM desktop setup file Vendor : SmartUX Vulnerable Versions : 1.0.19 and probably prior release Tested Version :...

Microsoft Windows NT200020032008XPVista78 - EPATHOBJ Local Ring

Microsoft Windows NT200020032008XPVista78 - EPATHOBJ Local Ring ifndef WIN32NOSTATUS define WIN32NOSTATUS endif include include include include include ifdef WIN32NOSTATUS undef WIN32NOSTATUS endif include pragma commentlib, "gdi32" pragma commentlib, "kernel32" pragma commentlib, "user32" pragma...

Konftel 300IP SIP-based Conference Phone 2.1.2 - Remote Bypass Reboot

Konftel 300IP SIP-based Conference Phone 2.1.2 - Remote Bypass Reboot !/bin/bash Konftel 300IP SIP-based Conference phone = 2.1.2 remote bypass reboot exploit by Todor Donev / 03.2013 / Sofia,Bulgaria email: todor dot donev at gmail com type: hardware The Konftel 300IP is a flexible SIP-based...

SynConnect Pms - index.php?loginid SQL Injection

SynConnect Pms - index.php?loginid SQL Injection Title: ==== SynConnect - SQL Injection vulnerability Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ===== Date: ==== 01-03-2013 CRD: ==== CRD-2013-01 Vendor: ======...

TP-Link - Admin Panel Multiple Cross-Site Request Forgery Vulnerabilities

TP-Link - Admin Panel Multiple Cross-Site Request Forgery Vulnerabilities Advisory Name: Multiple Cross Site Request Forgery vulnerabilities in TP-LINK Admin Panel Internal Cybsec Advisory Id: 2013-0208-Multiple CSRF vulnerabilities in TP-LINK Vulnerability Class: Cross Site Request Forgery CSRF...

Linksys WRT160N - Multiple Vulnerabilities

Linksys WRT160N - Multiple Vulnerabilities Device Name: Linksys WRT160Nv2 Vendor: Linksys/Cisco ============ Device Description: ============ Best For: Delivers plenty of speed and coverage, so large groups of users can go online, transfer large files, print, and stream stored media Features: Fas...

PrestaShop 1.5.1 - Persistent Cross-Site Scripting

PrestaShop 1.5.1 - Persistent Cross-Site Scripting PrestaShop or embed src='data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc 3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9y...

Winlog Lite SCADA HMI system - Overwrite (SEH)

Winlog Lite SCADA HMI system - Overwrite SEH Vuln Title: Winlog Lite SCADA HMI system SEH 0verwrite Vulnerability Author: FaryadR a.k.a Ciph3r tested on : winXp sp3 and Winlog Lite 2.06.17 Version Twitter : https://twitter.com/faryadR Mail : [email protected] Website : http://0c0c0c0c.com...

Useresponse 1.0.2 - Privilege Escalation Remote Code Execution

Useresponse 1.0.2 - Privilege Escalation Remote Code Execution !/usr/bin/python -------------------- | abuseresponse.py | -------------------- Useresponse = 1.0.2 privilege escalation & remote code execution exploit vendor: USWebStyle http://www.uswebstyle.com/ software: http://www.useresponse.co...

Apple iTunes 10.6.1.7 - .m3u Walking Heap Buffer Overflow (PoC)

Apple iTunes 10.6.1.7 - .m3u Walking Heap Buffer Overflow PoC !/usr/bin/perl Apple iTunes 10.6.1.7 M3U Playlist File Walking Heap Buffer Overflow Vendor: Apple Inc. Product web page: http://www.apple.com Affected version: 10.6.1.7 and 10.6.0.40 Summary: iTunes is a free application for your Mac o...

XOOPS Cube PROJECT FileManager - xupload.php Arbitrary File Upload

XOOPS Cube PROJECT FileManager - xupload.php Arbitrary File Upload source: https://www.securityfocus.com/bid/53945/info FileManager is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An...

Genium CMS 2012Q2 - Multiple Vulnerabilities

Genium CMS 2012Q2 - Multiple Vulnerabilities Title: ====== Genium CMS 2012|Q2 - Multiple Web Vulnerabilities Date: ===== 2012-05-02 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=517 VL-ID: ===== 517 Introduction: ============= Durch den Einsatz von Genium CMS können S...

Sony Bravia - Remote Denial of Service

Sony Bravia - Remote Denial of Service Exploit Title: Sony Bravia Remote Denial of Service Date: 04/04/2012 Author: Gabriel Menezes Nunes Version: Sony Bravia TV Tested on: Sony Bravia TV KDL-32CX525 CVE: CVE-2012-2210 Playing with my TV, I found a bug that can crash the device. Running a hping...

Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT - ActiveX Control PlayerPT.ocx sprintf Buffer Overflow (PoC)

Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT - ActiveX Control PlayerPT.ocx sprintf Buffer Overflow PoC ; msvcrt.sprintf 03238246 52 push edx 03238247 8D8C24 EC020000 lea ecx,dword ptr ss:esp+2EC 0323824E 68 48612603 push PlayerPT.03266148 ; ASCII "%s" 03238253 51 push ec...

Adobe Photoshop 12.1 - .tiff Parsing Use-After-Free

Adobe Photoshop 12.1 - .tiff Parsing Use-After-Free Application: Adobe Photoshop 12.1 Tiff Parsing Use-After-Free Platforms: Windows PRL: 2012-07 Author: Francis Provencher Protek Research Lab's Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2 Report Timeline 3...

novell sentinel log manager 1.2.0.1 - Directory Traversal

novell sentinel log manager 1.2.0.1 - Directory Traversal Exploit Title: Novell Sentinel Log Manager directory traversal Date: 2011-12-18 Exploit Author: Andrea Fabrizi Vendor Homepage: http://www.novell.com/ Version: = 1.2.0.1 Tested on: Sentinel Log Manager Appliance 1.2.0.1 CVE: 2011-5028 The...

CoDeSys SCADA 2.3 - Remote Buffer Overflow

CoDeSys SCADA 2.3 - Remote Buffer Overflow / See Also: http://aluigi.altervista.org/adv/codesys1-adv.txt CoDeSys v2.3 Industrial Control System Development Software Remote Buffer Overflow Exploit for CoDeSys Scada webserver Author : Celil UNUVER, SignalSEC Labs www.signalsec.com Tested on WinXP S...

Cogent DataHub 7.1.1.63 - Integer Overflow

Cogent DataHub 7.1.1.63 - Integer Overflow Luigi Auriemma Application: Cogent DataHub http://www.cogentdatahub.com/Products/CogentDataHub.html Versions: = 7.1.1.63 Platforms: Windows Bug: integer overflow Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma e-mail: [email protected]...

HP Data Protector (Linux) - Remote Command Execution

HP Data Protector Linux - Remote Command Execution !/bin/bash Exploit Title: HP Data Protector Remote Root Shell for Linux Date: 2011-08-10 Author: SZ Software Link:http://www8.hp.com/us/en/software/software- product.html?compURI=tcm:245-936920&pageTitle=data-protector Version: 0.9 Tested on:...

HP Data Protector (HP-UX) - Remote Shell

HP Data Protector HP-UX - Remote Shell !/bin/bash Exploit Title: HP Data Protector Remote Shell for HPUX Date: 2011-08-02 Author: Adrian Puente Z. Software Link:http://www8.hp.com/us/en/software/software- product.html?compURI=tcm:245-936920&pageTitle=data-protector Version: 0.9 Tested on: HPUX CV...

Nibbleblog 3 - Multiple SQL Injections

Nibbleblog 3 - Multiple SQL Injections source: https://www.securityfocus.com/bid/48339/info Nibbleblog is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit may allow an...

ARSC Really Simple Chat 3.3-rc2 - Cross-Site Scripting Multiple SQL Injections

ARSC Really Simple Chat 3.3-rc2 - Cross-Site Scripting Multiple SQL Injections source: https://www.securityfocus.com/bid/48083/info ARSC Really Simple Chat is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize...

4Images 1.7.9 - Multiple Vulnerabilities

4Images 1.7.9 - Multiple Vulnerabilities ================================ Vulnerability ID: HTB22950 Reference: http://www.htbridge.ch/advisory/sqlinjectionin4images.html Product: 4images Vendor: http://www.4homepages.de/ http://www.4homepages.de/ Vulnerable Version: 1.7.9 Vendor Notification: 07...