GLPI 0.83.8 - Multiple Vulnerabilities

GLPI 0.83.8 - Multiple Vulnerabilities GLPI v0.83.8 Multiple Error-based SQL Injection Vulnerabilities Vendor: INDEPNET Development Team Product web page: http://www.glpi-project.org Affected version: 0.83.7 and 0.83.8 Summary: GLPI, an initialism for Gestionnaire libre de parc informatique Free...

Microsoft Windows NT200020032008XPVista78 - EPATHOBJ Local Ring

Microsoft Windows NT200020032008XPVista78 - EPATHOBJ Local Ring ifndef WIN32NOSTATUS define WIN32NOSTATUS endif include include include include include ifdef WIN32NOSTATUS undef WIN32NOSTATUS endif include pragma commentlib, "gdi32" pragma commentlib, "kernel32" pragma commentlib, "user32" pragma...

WordPress Plugin Spider Catalog 1.4.6 - Multiple Vulnerabilities

WordPress Plugin Spider Catalog 1.4.6 - Multiple Vulnerabilities waraxe-2013-SA105 - Multiple Vulnerabilities in Spider Catalog Wordpress Plugin =================================================================================== Author: Janek Vind "waraxe" Date: 22. May 2013 Location: Estonia,...

MoinMoin - Arbitrary Command Execution

MoinMoin - Arbitrary Command Execution !/usr/bin/env python -- coding: utf-8 -- ascii = '\x1b1;31m' ascii +=' \r\n' ascii +=' ██████████ ██████ ███ ███ ███ ██████████ ████████ ███ ███████ \r\n' ascii +=' ███████████ ████████ ███ ████ ███ ███████████ ████████ ███ ███████ \r\n' ascii +=' ██▒ ██▒ ██...

Konftel 300IP SIP-based Conference Phone 2.1.2 - Remote Bypass Reboot

Konftel 300IP SIP-based Conference Phone 2.1.2 - Remote Bypass Reboot !/bin/bash Konftel 300IP SIP-based Conference phone = 2.1.2 remote bypass reboot exploit by Todor Donev / 03.2013 / Sofia,Bulgaria email: todor dot donev at gmail com type: hardware The Konftel 300IP is a flexible SIP-based...

Vm86 - Syscall Task Switch Kernel Panic (Denial of Service) Privilege Escalation

Vm86 - Syscall Task Switch Kernel Panic Denial of Service Privilege Escalation Source: http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/ Introduction Problem description: The initial observation was, that the linux vm86 syscall, which allows to use the virtual-8086 mode from...

Novell Groupwise 8.0.2 HP3 and 2012 - Integer Overflow

Novell Groupwise 8.0.2 HP3 and 2012 - Integer Overflow Application: Novell Groupwise Platforms: Windows Version: 8.0.2 HP3 and 2012 Secunia: SA50622 PRL: 2012-28 Author: Francis Provencher Protek Research Lab's Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2...

Wireshark 1.6.01.8.2 - Buffer Overflow (PoC)

Wireshark 1.6.01.8.2 - Buffer Overflow PoC / WireShark Buffer Overflow 0day author: X-h4ck,[email protected],www.pirate.al greetz to people that i love and my girlfriend , and yes imm proud to be albanian.only the poc, no exploit available so i wont confuse the script kiddies, eax,ecx,edx,ebx...

XOOPS Cube PROJECT FileManager - xupload.php Arbitrary File Upload

XOOPS Cube PROJECT FileManager - xupload.php Arbitrary File Upload source: https://www.securityfocus.com/bid/53945/info FileManager is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An...

Samsung D6000 TV - Multiple Vulnerabilities

Samsung D6000 TV - Multiple Vulnerabilities Luigi Auriemma Application: Samsung devices with support for remote controllers http://www.samsung.com Versions: current Platforms: the vulnerable protocol is used on both TV and blue-ray devices so both of them should be vulnerable my tests were...

Hotel Booking Portal - SQL Injection

Hotel Booking Portal - SQL Injection 'Hotel Booking Portal' SQL Injection CVE-2012-1672 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in getcity.php that allows for SQL injection of the 'country' POST parameter. II. TESTED...

Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT - ActiveX Control PlayerPT.ocx sprintf Buffer Overflow (PoC)

Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT - ActiveX Control PlayerPT.ocx sprintf Buffer Overflow PoC ; msvcrt.sprintf 03238246 52 push edx 03238247 8D8C24 EC020000 lea ecx,dword ptr ss:esp+2EC 0323824E 68 48612603 push PlayerPT.03266148 ; ASCII "%s" 03238253 51 push ec...

DIY-CMS blog mod - SQL Injection

DIY-CMS blog mod - SQL Injection Exploit Title: DIY-CMS blog mod SQL Injection Author: snup Contact: [email protected] Site: http://e-o-u.org SQL Injection: DORK: inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS" inurl:"mod.php?mod=blog" BUG:...

Cogent DataHub 7.1.1.63 - Integer Overflow

Cogent DataHub 7.1.1.63 - Integer Overflow Luigi Auriemma Application: Cogent DataHub http://www.cogentdatahub.com/Products/CogentDataHub.html Versions: = 7.1.1.63 Platforms: Windows Bug: integer overflow Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma e-mail: [email protected]...

Sagem Router Fast 330434643504 - Telnet Authentication Bypass

Sagem Router Fast 330434643504 - Telnet Authentication Bypass !/home/bin/python Remote Exploit: SAGEM ROUTER FAST 3304/3464/3504 - Telnet Authentication bypass Date: 15-August-2011 Author: Elouafiq Ali Version: 3304-V1 / 3304-V2 / 3464 / 3504 Tested on: Linux Ubuntu 11.04, Linux Backtrack 5 Teste...

ARSC Really Simple Chat 3.3-rc2 - Cross-Site Scripting Multiple SQL Injections

ARSC Really Simple Chat 3.3-rc2 - Cross-Site Scripting Multiple SQL Injections source: https://www.securityfocus.com/bid/48083/info ARSC Really Simple Chat is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize...

tmux 1.31.4 - -S Option Incorrect SetGID Privilege Escalation

tmux 1.31.4 - -S Option Incorrect SetGID Privilege Escalation --------------------------------------- | Team ph0x90bic proudly presents | | tmux -S 1.3/1.4 local utmp exploit | --------------------------------------- Exploit Title: tmux '-S' Option Incorrect SetGID Local Privilege Escalation...

Pligg CMS 1.1.3 - Multiple Vulnerabilities

Pligg CMS 1.1.3 - Multiple Vulnerabilities Exploit title: Pligg CMS file existence exploration/shared hosting privilege escalation H.ackAck.net Found by: Jelmer de Hen 15/03/2011 I released some Pligg exploits: http://h.ackack.net/the-pligg-cms-0dayset-1.html 22/03/2011 a patch became evailable;...

WordPress Plugin PHP Speedy 0.5.2 - admin_container.php Remote Code Execution

WordPress Plugin PHP Speedy 0.5.2 - admincontainer.php Remote Code Execution -d OPTIONS host: target s...

WonderWare InBatch 9.0sp1 - Buffer Overflow

WonderWare InBatch 9.0sp1 - Buffer Overflow Source: http://aluigi.org/adv/inbatch1-adv.txt Luigi Auriemma Application: Wonderware InBatch http://global.wonderware.com/EN/Pages/WonderwareInBatchSoftware.aspx any other software that uses the lmtcp server called "Raima Database lockmgr" like Foxboro...

Native Instruments (Multiple Products) - DLL Loading Arbitrary Code Execution

Native Instruments Multiple Products - DLL Loading Arbitrary Code Execution // source: https://www.securityfocus.com/bid/44989/info Multiple products from Native Instruments are prone to multiple vulnerabilities that let attackers execute arbitrary code. An attacker can exploit these issues by...

Microsoft ASP.NET - Auto-Decryptor File Download (MS10-070)

Microsoft ASP.NET - Auto-Decryptor File Download MS10-070 !/usr/bin/ruby -w aspxadchotextattack.rb Copyright c 2010 AmpliaSECURITY. All rights reserved http://www.ampliasecurity.com Agustin Azubel - [email protected] MS10-070 ASPX proof of concept Decrypt data using an auto decryptor...

TinyMCE MCFileManager 2.1.2 - Arbitrary File Upload

TinyMCE MCFileManager 2.1.2 - Arbitrary File Upload ============================================== File Upload Vulnerability Plugins tinymce ============================================== http://tinymce.moxiecode.com/pluginsfilemanager.php Author : Hackeri-AL Contact : h-al at hotmail dot it Gree...

Adobe Device Central CS5 - qtcf.dll DLL Hijacking

Adobe Device Central CS5 - qtcf.dll DLL Hijacking / Exploit Title: Adobe Device Central CS5 DLL Hijacking Exploit qtcf.dll Date: August 24, 2010 Author: Glafkos Charalambous glafkos@astalavistadotcom Version: Latest CS5 v3.0.0376 Tested on: Windows 7 x64 Ultimate Vulnerable extensions: .adcp...

Zendesk - Multiple Vulnerabilities

Zendesk - Multiple Vulnerabilities /¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯\ :Zendesk Multiple Vulnerabilities : / /Discovered By: \ |Luis Santana | / Overview ¯¯¯¯¯¯¯¯¯¯ Luis Santana of the HackTalk Security team has found multiple vulnerabilities in Zendesk. Product Information ¯¯¯¯¯¯¯¯¯¯...

sX-Shop - view_image.php SQL Injection

sX-Shop - viewimage.php SQL Injection sX-Shop / viewimage.php SQL Injection Author : secret - [email protected] Homepage : http://swissfaking.net/ Date : 05 August, 2010 / // // // \ / // / / // \ / | / |/ / \ \ / / / / / , // / / / / / / , // | / / //// ///||// //////||// ||//|/ //...

Struts2XWork 2.2.0 - Remote Command Execution

Struts2XWork 2.2.0 - Remote Command Execution Friday, July 9, 2010 CVE-2010-1870: Struts2/XWork remote command execution Update Tue Jul 13 2010: Added proof of concept Apache Struts team has announced uploaded but has not released, due to an unreasonably prolonged voting process, the 2.2.0 releas...

Samba 3.4.73.5.1 - Denial of Service

Samba 3.4.73.5.1 - Denial of Service =============================================================================== stratsec Security Advisory: SS-2010-005 =============================================================================== Title: Samba Multiple DoS Vulnerabilities Version: 1.0 Issue...

WHMCompleteSolution (WHMCS) control (WHMCompleteSolution) - SQL Injection

WHMCompleteSolution WHMCS control WHMCompleteSolution - SQL Injection =Info======================================================================= Software: WHMCS control WHMCompleteSolution Sql Injection Vulnerability: Remote Sql Injection Google Dork: Powered by WHMCompleteSolution - or "...

Joomla! Component mv_restaurantmenumanager - SQL Injection

Joomla! Component mvrestaurantmenumanager - SQL Injection ========================================================= Joomla component mvrestaurantmenumanager SQL injection Vulnerability ========================================================= Exploit Title : joomla component mvrestaurantmenumanag...

ZipCentral - .zip File (SEH)

ZipCentral - .zip File SEH !/usr/bin/python Title: ZipCentral .zip SEH exploit Author: TecR0c - http://tecninja.net/blog & http://twitter.com/TecR0c Download: http://downloads.pcworld.com/pub/new/utilities/compression/zcsetup.exe Platform: Windows XP sp3 En VMWARE Greetz to: Corelan Security Team...

Interactivefx.ie CMS - SQL Injection

Interactivefx.ie CMS - SQL Injection ================================================ Interactivefx.ie CMS SQL Injection Vulnerability ================================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ ...

Net Gitar Shop 1.0 - Database Disclosure

Net Gitar Shop 1.0 - Database Disclosure ======================================================================================== | Title : Net Gitar Shopv1.0 DB Download Vulnerability | Author : indoushka | email : [email protected] | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria...

Diesel Job Site 1.4 - Multiple Vulnerabilities

Diesel Job Site 1.4 - Multiple Vulnerabilities ======================================================================================== | Title : Diesel Job Site 1.4 Multiple Vulnerabilities | | Author : indoushka | | email : [email protected] | | Home : Souk Naamane - 04325 - Oum El Bouaghi ...

CactuShop 6.0 - Database Disclosure

CactuShop 6.0 - Database Disclosure ============================================================================== / \ | | | | / \ | | | | / \ | | | | / \ | || | / \ | | | | / \ | | // \ || || // \ || || ============================================================================== Note : Forever...

Paypal Shopping Cart Script - index.php?cid SQL Injection

Paypal Shopping Cart Script - index.php?cid SQL Injection source: https://www.securityfocus.com/bid/43471/info Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data...

ntop 3.3.10 - HTTP Basic Authentication Null Pointer Dereference Denial of Service

ntop 3.3.10 - HTTP Basic Authentication Null Pointer Dereference Denial of Service source: https://www.securityfocus.com/bid/36074/info The 'ntop' tool is prone to a denial-of-service vulnerability because of a NULL-pointer dereference that occurs when crafted HTTP Basic Authentication credential...

Joomla! Component com_rsgallery2 1.14.x2.x - Remote Backdoor Access

Joomla! Component comrsgallery2 1.14.x2.x - Remote Backdoor Access Vulnerability: Remote code execution back doors Software: RSGallery2 - Gallery Extension for Joomla! We are currently working on a new website. All files are still available at the JoomlaCode project page. Severity: Not a big deal...

Zervit Web Server 0.3 - sockets++ crash Remote Denial of Service

Zervit Web Server 0.3 - sockets++ crash Remote Denial of Service !/usr/bin/perl Zervit HTTP Server \n"; print "- Exemple: file.pl 127.0.0.1 80\n"; exit; $ip = $ARGV0; $port = $ARGV1; print "+ Sending request...\n"; for$i=0;$i=4;$i++ $socket = IO::Socket::INET-new Proto = "tcp", PeerAddr = "$ip",...

Joomla! Component rsmonials - Cross-Site Scripting

Joomla! Component rsmonials - Cross-Site Scripting / RSMonials XSS Exploit http://www.rswebsols.com/downloads/category/14-download-rsmonials-all?download=23%3Adownload-rsmonials-component Google Dork: allinurl:option=comrsmonials Anything entered into the form gets rendered as HTML, so you can ad...

IBM Director 5.20.3su2 CIM Server - Remote Denial of Service

IBM Director 5.20.3su2 CIM Server - Remote Denial of Service SEC-CONSULT Security Advisory ========================================================================================= title: IBM Director CIM Server Remote Denial of Service Vulnerability program: IBM Director for Windows vulnerable...

GNUBoard 4.31.04 (09.01.30) - Multiple LocalRemote Vulnerabilities

GNUBoard 4.31.04 09.01.30 - Multiple LocalRemote Vulnerabilities GNUBoard V4.31.04 09.01.30 Multiple Local/Remote Vulnerability bY [email protected] / SIR GNUBoard VERSION 4.31.04 09.01.30is a widely used bulletin board system of Korea. It is freely available for all platforms that supports PHP...

Joomla! Component gigCalendar 1.0 - SQL Injection

Joomla! Component gigCalendar 1.0 - SQL Injection Joomla Component comgigcalgigcalgigsid SQL-injection Author : boom3rang Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1. Vulnerability : SQL injection Google Dork : inurl:comgigcal...

Vinagre 2.24.2 - show_error() Remote Format String (PoC)

Vinagre 2.24.2 - showerror Remote Format String PoC -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Vinagre showerror format string vulnerability 1. Advisory Information Title: Vinagre showerror format string...

Web Calendar System 3.40 - Cross-Site Scripting SQL Injection

Web Calendar System 3.40 - Cross-Site Scripting SQL Injection 000000 00000 0000 0000 000 00 000000 0000000 0000 000000 00000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00000 0 0 0 0 0 0 0 0 00000 0000 0 0 0 0 00000 0 0...

Joomla! Component Ignite Gallery 0.8.3 - SQL Injection

Joomla! Component Ignite Gallery 0.8.3 - SQL Injection Joomla Component Ignite Gallery SQL Injection Vulnerability Vulnerability found by: H!tm@N Contact: hitmanatkhg-crewdotws Site: www.khg-crew.ws Greetz: boom3rang, KHG, urtan, chs, redc00de - -=Kosova Hackers Group=- ScriptName: "Joomla"...

6rbScript 3.3 - singerid SQL Injection

6rbScript 3.3 - singerid SQL Injection || | | 6rbScript V3.3 singerid Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | WwW.TrYaG.CC | | email: darkangelg85atYahooDoTcom | | | | | | | | script :...

Reciprocal Links Manager 1.1 - site SQL Injection

Reciprocal Links Manager 1.1 - site SQL Injection || | | Reciprocal Links Manager 1.1 site Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : WwW.Hussin-X.CoM | www.tryag.cc/cc | | email: darkangelg85atYahooDoTcom | | | | |...

Acoustica Beatcraft 1.02 Build 19 - .bcproj Local Buffer Overflow

Acoustica Beatcraft 1.02 Build 19 - .bcproj Local Buffer Overflow !/usr/bin/perl Acoustica Beatcraft bcproj file Local BOF Exploit Author: Koshi Date: 08-30-08 0day Application: Acoustica Beatcraft Versions: v1.02 Build 19 Site: http://acoustica.com/beatcraft/index.htm Tested On: Windows XP SP3...

Aprox CMS Engine 5.1.0.4 - index.php SQL Injection

Aprox CMS Engine 5.1.0.4 - index.php SQL Injection Viva IslaM Viva IslaM Remote SQL injection Vulnerability Aprox CMS Engine V5.1.0.4 index.php page AuTh0r : Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM && WwW.AtsDp.CoM/f Email : [email protected] SYRIAN Arab HACkErS -: Exploite :-...