Icon Time Systems RTC-1000 Firmware 2.5.7458 - Cross-Site Scripting

Icon Time Systems RTC-1000 Firmware 2.5.7458 - Cross-Site Scripting Exploit Title: Icon Time Systems RTC-1000 alert"xss"; ========================================================== PROOF OF CONCEPT - With valid credentials that has permissions to modify the employee records, access the emplo...

VX Search 10.2.14 - Proxy Local Buffer Overflow (SEH)

VX Search 10.2.14 - Proxy Local Buffer Overflow SEH !/usr/bin/env python Exploit Title : VXSearch v10.2.14 Local SEH Overflow Date : 11/16/2017 Exploit Author : wetw0rk Vendor Homepage : http://www.flexense.com/ Software link : http://www.vxsearch.com/setups/vxsearchentsetupv10.2.14.exe Version :...

Mailing List Manager Pro 3.0 - SQL Injection

Mailing List Manager Pro 3.0 - SQL Injection Exploit Title: Mailing List Manager Pro 3.0 - SQL Injection Dork: N/A Date: 30.10.2017 Vendor Homepage: http://www.vote-pro.com/ Software Link: http://www.mailing-manager.com/demo.html Demo: http://www.mailing-manager.com/demo-gold/ Version: 3.0...

Trend Micro OfficeScan 11.0XG (12.0) - Remote Code Execution (Metasploit)

Trend Micro OfficeScan 11.0XG 12.0 - Remote Code Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Trend Micro OfficeScan Remote Code Execution", 'Description' = %q This modul...

WordPress Plugin WPGYM - SQL Injection

WordPress Plugin WPGYM - SQL Injection Exploit Title: WPGYM - Wordpress Gym Management System - SQL Injection Dork: N/A Date: 26.09.2017 Vendor Homepage: http://mojoomla.com/ Software Link: https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964 Demo:...

Claydip Airbnb Clone 1.0 - Arbitrary File Upload

Claydip Airbnb Clone 1.0 - Arbitrary File Upload Exploit Title: Claydip Laravel Airbnb Clone 1.0 - Arbitrary File Upload Dork: N/A Date: 22.09.2017 Vendor Homepage: https://www.claydip.com/ Software Link: https://www.claydip.com/airbnb-clone.html Demo: https://www.claydip.com/airbnbdemo.html...

CERIO DT-100G-NDT-300NCW-300N - Multiple Vulnerabilities

CERIO DT-100G-NDT-300NCW-300N - Multiple Vulnerabilities CERIO 11nbg 2.4Ghz High Power Wireless Router pekcmd Rootshell Backdoors Vendor: CERIO Corporation Product web page: http://www.cerio.com.tw Affected version: DT-100G-N fw: Cen-WR-G2H5 v1.0.6 DT-300N fw: Cen-CPE-N2H10A v1.0.14 DT-300N fw:...

Technicolor DPC3928SL - SNMP Authentication Bypass

Technicolor DPC3928SL - SNMP Authentication Bypass !/usr/bin/python -- coding: utf-8 -- StringBleed - CVE-2017-5135 author = "Nixawk" funcs = 'generatesnmpcommunitystr', 'generatesnmpprotopayload', 'sendsnmprequest', 'readsnmpcommunitystr', 'readsnmpvarbindstr', 'snmplogin', 'snmpstringbleed'...

Apple WebKit - ComposedTreeIterator::traverseNextInShadowTree Use-After-Free

Apple WebKit - ComposedTreeIterator::traverseNextInShadowTree Use-After-Free function go d.open = false; d.innerHTML = "foo"; d.open = true; foo !-- ================================================================= ASan log: =================================================================...

PCAUSA Rawether (ASUS PCE-AC56 WLAN Card Utilities Windows 10 x64) - Local Privilege Escalation

PCAUSA Rawether ASUS PCE-AC56 WLAN Card Utilities Windows 10 x64 - Local Privilege Escalation Exploit Title: PCAUSA Rawether for Windows local privilege escalation Date: 2017-03-15 Exploit Author: ReWolf Vendor Homepage: original vendor website doesn't exist anymore Version: too many Tested on:...

APNGDis 2.8 - image width height chunk Heap Buffer Overflow

APNGDis 2.8 - image width height chunk Heap Buffer Overflow Exploit Title: APNGDis image width / height Buffer Overflow Date: 14-03-2017 Exploit Author: Alwin Peppels Vendor Homepage: http://apngdis.sourceforge.net/ Software Link: https://sourceforge.net/projects/apngdis/files/2.8/ Version: 2.8...

WordPress Plugin Contact Form Manager - Cross-Site Request Forgery Cross-Site Scripting

WordPress Plugin Contact Form Manager - Cross-Site Request Forgery Cross-Site Scripting !-- Source: https://sumofpwn.nl/advisory/2016/crosssiterequestforgerycrosssitescriptingincontactformmanagerwordpressplugin.html Abstract It was discovered that Contact Form Manager does not protect against...

NETGEAR DGN2200v1v2v3v4 - Cross-Site Request Forgery

NETGEAR DGN2200v1v2v3v4 - Cross-Site Request Forgery Exploit Title: NETGEAR Firmware DGN2200v1/v2/v3/v4 CSRF which leads to RCE through CVE-2017-6334 Date: 2017-02-28 Exploit Author: SivertPL Vendor Homepage: http://netgear.com/ Software Link:...

Apple WebKit - Type Confusion in RenderBox with Accessibility Enabled

Apple WebKit - Type Confusion in RenderBox with Accessibility Enabled function boom m.append"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; m.setAttribute"aria-labeledby", "t"; d.open = false; foo firstChild; The function expects that the first child is going to be of type...

Apple macOS 10.12.2 iOS 10.2 - Broken Kernel Mach Port Name uref Handling Privileged Port Name Replacement Privilege Escalation

Apple macOS 10.12.2 iOS 10.2 - Broken Kernel Mach Port Name uref Handling Privileged Port Name Replacement Privilege Escalation / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=959 Proofs of Concept:...

Microsoft Internet Explorer 11 - MSHTML CPaste­Command::Convert­Bitmapto­Png Heap Buffer Overflow (MS14-056)

Microsoft Internet Explorer 11 - MSHTML CPaste­Command::Convert­Bitmapto­Png Heap Buffer Overflow MS14-056 Security Settings - Choose a zone - Scripting should prevent websites from programmatically copy/pasting an image. Disabling execution of scripts on web-pages altogether will have the same...

InfraPower PPS-02-S Q213V1 - Authentication Bypass

InfraPower PPS-02-S Q213V1 - Authentication Bypass InfraPower PPS-02-S Q213V1 Authentication Bypass Vulnerability Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Fixed version: Q216V3 Firmware: IPD-02-FW-v03 Summary:...

Microsoft Internet Explorer 11 - Garbage Collector Attribute Type Confusion (MS16-063)

Microsoft Internet Explorer 11 - Garbage Collector Attribute Type Confusion MS16-063 !-- CVE-2016-0199 / MS16-063: MSIE 11 garbage collector attribute type confusion ============================================================================ This information is available in an easier to read...

Drale DBTableViewer 100123 - Blind SQL Injection

Drale DBTableViewer 100123 - Blind SQL Injection Drale DBTableViewer v100123 - Blind SQL Injection Exploit Title: drale DBTableViewer - SQL InjectionBlind/Error Base Date: 2016-06-08 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: http://drale.com/ Software Link:...

VirIT Explorer Lite Pro 8.1.68 - Local Privilege Escalation

VirIT Explorer Lite Pro 8.1.68 - Local Privilege Escalation / Full title: VirIT Explorer Lite & Pro v.8.1.68 Local Privilege Escalation System/Arbitrary Code Execution Exploit Author: Paolo Stagno - [email protected] Vendor Homepage: http://www.tgsoft.it Version: VirIT Explorer Lite & Pro...

Electronic Arts Origin Client 9.5.5 - Multiple Privilege Escalation Vulnerabilities

Electronic Arts Origin Client 9.5.5 - Multiple Privilege Escalation Vulnerabilities Electronic Arts Origin Client 9.5.5 Multiple Privilege Escalation Vulnerabilities Vendor: Electronic Arts Inc. Product web page: https://www.origin.com Affected version: 9.5.5.2850 353317 9.5.3.636 350385...

McAfee Data Loss Prevention Endpoint - Arbitrary Write Privilege Escalation

McAfee Data Loss Prevention Endpoint - Arbitrary Write Privilege Escalation / Exploit Title - McAfee Data Loss Prevention Endpoint Arbitrary Write Privilege Escalation Date - 29th January 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.mcafee.com Tested Version -...

Adobe-Illustrator-CS5.5

ImageType AlphaChannelCount reserved bin-ascii ImageMask XI Arguments to the XI operator specify the location and size of the image, its pixel bit depth, color type, and other attributes The image matrix maps the unit square of user space, bounded by 0, 0 and 1, 1 in user space, to the boundary o...

WRT120N-1.0.0.7

WRT120N v1.0.0.7 stack overflow, ROP to 4-byte overwrite which clears the admin password. Stack filler; needs to be 4 bytes except for the last stack frame where it needs to be 1 byte to account for the trailing "\n\n" and terminating NULL byte import sys import urllib2 try: target = sys.argv1...

ZTE ZXHN H108L - Authentication Bypass (2)

ZTE ZXHN H108L - Authentication Bypass 2 About the software ================== ZTE ZXHN H108L is provided by some large Greek ISPs to their subscribers. Vulnerability Details ===================== CWMP configuration is accessible only through the Administrator account. CWMP is a protocol widely...

OSSEC 2.8 - hosts.deny Local Privilege Escalation

OSSEC 2.8 - hosts.deny Local Privilege Escalation !/usr/bin/python Exploit Title: ossec 2.8 Insecure Temporary File Creation Vulnerability Privilege Escalation Date: 14-11-14 Exploit Author: skynet-13 Vendor Homepage: www.ossec.net/ Software Link:...

YourMembers Plugin - Blind SQL Injection

YourMembers Plugin - Blind SQL Injection Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin CVE: N/A Vendor: YourMembers plugin Product: https://github.com/YourMembers/yourmembers/tree/master/ymtrunk Affected version: Version 3, 29 June 2007...

TP-Link TL-WR740N TL-WR740ND 150M Wireless Lite N Router - HTTP Denial of Service

TP-Link TL-WR740N TL-WR740ND 150M Wireless Lite N Router - HTTP Denial of Service Exploit title: 150M Wireless Lite N Router HTTP DoS Date: 28.11.2013 Exploit Author: Dino Causevic Hardware Link: http://www.tp-link.com/en/products/details/?model=TL-WR740N Vendor Homepage: http://www.tp-link.com/...

Zikula CMS 1.3.5 - Multiple Vulnerabilities

Zikula CMS 1.3.5 - Multiple Vulnerabilities Document Title: =============== Zikula CMS v1.3.5 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1114 Release Date: ============= 2013-10-16 Vulnerability Laboratory ID VL-ID:...

Zabbix 2.0.8 - SQL Injection Remote Code Execution (Metasploit)

Zabbix 2.0.8 - SQL Injection Remote Code Execution Metasploit This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

MikroTik RouterOS - sshd (ROSSSH) Remote Heap Corruption

MikroTik RouterOS - sshd ROSSSH Remote Heap Corruption During an audit the Mikrotik RouterOS sshd ROSSSH has been identified to have a remote previous to authentication heap corruption in its sshd component. Exploitation of this vulnerability will allow full access to the router device. This...

Trend Micro DirectPass 1.5.0.1060 - Multiple Software Vulnerabilities

Trend Micro DirectPass 1.5.0.1060 - Multiple Software Vulnerabilities Title: ====== Trend Micro DirectPass 1.5.0.1060 - Multiple Vulnerabilities Date: ===== 2013-05-21 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=894 Article: http://www.vulnerability-lab.com/dev/?p=5...

TP-Link TL-WR740N Wireless Router - Denial of Service

TP-Link TL-WR740N Wireless Router - Denial of Service !/usr/local/bin/perl TP-Link TL-WR740N Wireless Router Remote Denial Of Service Exploit Vendor: TP-LINK Technologies Co., Ltd. Product web page: http://www.tp-link.us Affected version: - Firmware version: 3.16.4 Build 130205 Rel.63875n...

Oracle Automated Service Manager 1.3 - Installation Privilege Escalation

Oracle Automated Service Manager 1.3 - Installation Privilege Escalation Oracle Automated Service Manager 1.3 local root during install Larry W. Cashdollar 1/29/2013 @larry0 SUNWsasm-1.3.1-20110815093723 https://updates.oracle.com/Orion/Services/download?type=readme&aru=15864534 From the README:...

FirePass SSL VPN - Local File Inclusion

FirePass SSL VPN - Local File Inclusion SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Unauthenticated local file inclusion product: F5 FirePass SSL VPN vulnerable version: = 7.0.0 HF-70-6 fixed version: 7.0.0 HF-70-7...

Omnistar Mailer 7.2 - Multiple Vulnerabilities

Omnistar Mailer 7.2 - Multiple Vulnerabilities Title: ====== Omnistar Mailer v7.2 - Multiple Web Vulnerabilities Date: ===== 2012-10-01 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=711 VL-ID: ===== 711 Common Vulnerability Scoring System:...

ACDSee PRO 5.1 - .RLE Image Processing Heap Overflow

ACDSee PRO 5.1 - .RLE Image Processing Heap Overflow Application: ACDSee PRO RLE Image Processing Heap Overflow Platforms: Windows Secunia: SA48804 PRL: 2012-22 Author: Francis Provencher Protek Research Lab's Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2...

Simple PHP Agenda 2.2.8 - Cross-Site Request Forgery (Add Admin Add Event)

Simple PHP Agenda 2.2.8 - Cross-Site Request Forgery Add Admin Add Event +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Simple PHP Agenda = 2.2.8 CSRF Add Admin - Add Event Date : 29-03-2012 Author...

SMF 2.0.1 - SQL Injection Privilege Escalation

SMF 2.0.1 - SQL Injection Privilege Escalation !/usr/bin/python -- coding: iso-8859-15 -- Exploit Title: Smf = 2.0.1 Sql injection Vulnerability Author: The:Paradox Disclosure date: 06/12/2011 Software Link: http://download.simplemachines.org/ , http://www.php.net/releases/ Smf = 2.0.1 Sql...

Oracle DataDirect ODBC Drivers - HOST Attribute arsqls24.dll Stack Buffer Overflow (PoC)

Oracle DataDirect ODBC Drivers - HOST Attribute arsqls24.dll Stack Buffer Overflow PoC g 208.152c: Access violation - code c0000005 first chance First chance exceptions are reported before any exception ha...

Actfax FTP Server 4.27 - USER Stack Buffer Overflow (Metasploit)

Actfax FTP Server 4.27 - USER Stack Buffer Overflow Metasploit This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Spaw Editor 1.02.0 - Arbitrary File Upload

Spaw Editor 1.02.0 - Arbitrary File Upload Tilte: Spaw Editor v1.0 & 2.0 Remote File Upload . Date....................: 20-05-2010 Author..................: Ma3sTr0-Dz Location ...............: Algeria Software ...............: Spaw Editor v1 & v2 Impact..................: Remote Site Software...

Urgent Backup 3.20 ABC Backup Pro 5.20 ABC Backup 5.50 - .zip File (SEH)

Urgent Backup 3.20 ABC Backup Pro 5.20 ABC Backup 5.50 - .zip File SEH !/usr/bin/ruby Software : Urgent Backup 3.20 / ABC Backup Pro 5.20 / ABC Backup 5.50 Author : Lincoln Date : April 27, 2010 Reference : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-034 OS : Windows Tested on : XP SP...

IDEAL Administration 2010 10.2 - Local Buffer Overflow

IDEAL Administration 2010 10.2 - Local Buffer Overflow !/usr/bin/env python IDEAL Administration 2010 v10.2 Local Buffer Overflow Exploit Found By: DrIDE Usage: Migrate - Open Migration Project - Bind Shell Download: www.pointdev.com Tested On: Windows XPSP3 windows/shellbindtcp - 696 bytes...

Joomla! Component MMS Blog 2.3.0 - Local File Inclusion

Joomla! Component MMS Blog 2.3.0 - Local File Inclusion ============================================================================================================= o Joomla Component MMS Blog Local File Inclusion Vulnerability Software : commmsblog version 2.3.0 Vendor : http://mms.pipp.no/...

Apache OFBiz - Admin Creator

Apache OFBiz - Admin Creator / Apache OFBiz FULLADMIN Creator PoC Payload. CVE: CVE-2010-0432 By: Lucas Apa lucas -at- bonsai-sec.com . Bonsai Information Security http://www.bonsai-sec.com/ / var username = 'bonsaiUser'; var password = 'bonsaiPass'; var nodes =...

GOM Player 2.1.21.4846 - .wav Buffer Overflow

GOM Player 2.1.21.4846 - .wav Buffer Overflow !/usr/bin/perl GOM Player 2.1.21.4846 .wav Buffer Overflow Exploit Homepage: http://www.gomlab.com/ Exploit Coded by: cr4wl3r From: Gorontalo - Indonesia WARNING - WARNING - WARNING - WARNING Disclaimer: The author published the information under the...

Microsoft Internet Explorer 6 - Aurora Memory Corruption (MS10-002)

Microsoft Internet Explorer 6 - Aurora Memory Corruption MS10-002 Author : Ahmed Obied [email protected] This program acts as a web server that generates an exploit to target a vulnerability CVE-2010-0249 in Internet Explorer. The exploit was tested using Internet Explorer 6 on Windows XP SP2...

HP Application Recovery Manager - OmniInet.exe Remote Buffer Overflow

HP Application Recovery Manager - OmniInet.exe Remote Buffer Overflow class Metasploit3 'HP Application Recovery Manager OmniInet.exe Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow in HP Application Recovery Manager OmniInet daemon. By sending a specially...

ActiveBuyandSell 6.2 - buyersend.asp?catid Blind SQL Injection

ActiveBuyandSell 6.2 - buyersend.asp?catid Blind SQL Injection ? ?????????????????????????In The Name Of Allah The Mercifull?????????????????????? ? Tybe: buyersend.asp catid Blind SQL Injection Vulnerability Vendor: :www.activewebsoftwares.com Software: ActiveBuyandSell v 6.2 author: R3d-D3v!L...