41207 matches found
AVM FRITZ!Box 6.30 - Remote Buffer Overflow
AVM FRITZ!Box 6.30 - Remote Buffer Overflow Advisory: AVM FRITZ!Box: Remote Code Execution via Buffer Overflow RedTeam Pentesting discovered that several models of the AVM FRITZ!Box are vulnerable to a stack-based buffer overflow, which allows attackers to execute arbitrary code on the device...
MediaAccess TG788vn - File Disclosure
MediaAccess TG788vn - File Disclosure Vulnerable hardware : MediaAccess TG788vn with Cisco http firewall Author : Ahmed Sultan 0x4148 Email : [email protected] MediaAccess TG788vn with Cisco firewall http config is vulnerable to critical unauthenticated file disclosure flaw, POC Request: POST...
Simple PHP Polling System - Multiple Vulnerabilities
Simple PHP Polling System - Multiple Vulnerabilities Exploit Title : Multiple Vulnerabilities in Simple PHP Polling System. Author : WICS Date : 05-Jan-2016 Software Link : http://sourceforge.net/projects/pollingsystem/ Overview : Simple PHP Polling System helps organizations to make polls of...
PHPIPAM 1.1.010 - Multiple Vulnerabilities
PHPIPAM 1.1.010 - Multiple Vulnerabilities Exploit Title: PHPIPAM v1.1.010 Multiple Vulnerabilities Date: 04/01/2016 Author: Mickael Dorigny @ Synetis Vendor or Software Link: http://phpipam.net/ Version: 1.1.010 Category: Multiple Vulnerabilities Tested on : 1.1.010 PHPIPAM description :...
Online Airline Booking System - Multiple Vulnerabilities
Online Airline Booking System - Multiple Vulnerabilities Exploit Title : Online Airline Booking System multiple vulnerabilities Author : WICS Date : 05/1/2016 Software Link : http://sourceforge.net/projects/oabs/ Affected Version: All Overview: The Online Airline Booking System is designed to be ...
Linux Kernel 4.3.3 (Ubuntu 14.0415.10) - overlayfs Local Privilege Escalation (1)
Linux Kernel 4.3.3 Ubuntu 14.0415.10 - overlayfs Local Privilege Escalation 1 / just another overlayfs exploit, works on kernels before 2015-12-26 Exploit Title: overlayfs local root Date: 2016-01-05 Exploit Author: rebel Version: Ubuntu 14.04 LTS, 15.10 and more Tested on: Ubuntu 14.04 LTS, 15.1...
Ganeti - Multiple Vulnerabilities
Ganeti - Multiple Vulnerabilities =begin Advisory Information Title: Ganeti Security Advisory DoS, Unauthenticated Info Leak Advisory URL: https://pierrekim.github.io/advisories/2016-ganeti-0x00.txt Blog URL: https://pierrekim.github.io/blog/2016-01-05-Ganeti-Info-Leak-DoS.html Date published:...
Atlassian Confluence 5.25.8.145.8.15 - Multiple Vulnerabilities
Atlassian Confluence 5.25.8.145.8.15 - Multiple Vulnerabilities Systems Affected Product : Confluence Company : Atlassian Versions 1 : 5.2 / 5.8.14 / 5.8.15 CVSS Score 1 : 6.1 / Medium classified by vendor Versions 2 : 5.9.1 / 5.8.14 / 5.8.15 CVSS Score 2 : 7.7 / High classified by vendor Product...
pdfium - CPDF_TextObject::CalcPositionData Heap Out-of-Bounds Read
pdfium - CPDFTextObject::CalcPositionData Heap Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=623 The following crash was encountered in pdfium the Chrome PDF renderer during PDF fuzzing: --- cut --- $ ./pdfiumtest...
Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2)
Rejetto HTTP File Server HFS 2.3.x - Remote Command Execution 2 !/usr/bin/python Exploit Title: HttpFileServer 2.3.x Remote Command Execution Google Dork: intext:"httpfileserver 2.3" Date: 04-01-2016 Remote: Yes Exploit Author: Avinash Kumar Thapa aka "-Acid" Vendor Homepage: http://rejetto.com/...
pdfium - CPDF_DIBSource::DownSampleScanline32Bit Heap Out-of-Bounds Read
pdfium - CPDFDIBSource::DownSampleScanline32Bit Heap Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=625 The following crash was encountered in pdfium the Chrome PDF renderer during PDF fuzzing: --- cut --- $ ./pdfiumtest...
pdfium - CPDF_Function::Call Stack Buffer Overflow
pdfium - CPDFFunction::Call Stack Buffer Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=612 The following crash was encountered in pdfium the Chrome PDF renderer during PDF fuzzing: --- cut --- $ ./pdfiumtest...
FTPShell Client 5.24 - Add to Favorites Buffer Overflow
FTPShell Client 5.24 - Add to Favorites Buffer Overflow Exploit Title: FTPShell Client 5.24 - Add to Favorites Buffer Overflow Google Dork: N/A Date: 2015-01-04 Exploit Author: INSECT.B Twitter : @INSECT.B Facebook : https://www.facebook.com/B.INSECT00 Blog : http://binsect00.tistory.com Vendor...
pdfium IsFlagSet (v8 memory management) - SIGSEGV
pdfium IsFlagSet v8 memory management - SIGSEGV Source: https://code.google.com/p/google-security-research/issues/detail?id=622 The following crash was encountered in pdfium the Chrome PDF renderer during PDF fuzzing: --- cut --- ==31710==ERROR: AddressSanitizer: SEGV on unknown address...
Advanced Encryption Package - Buffer Overflow (Denial of Service) (PoC)
Advanced Encryption Package - Buffer Overflow Denial of Service PoC Dear List, Greetings from vishnu @dH4wk 1. Vulnerable Product - Advanced Encryption Package - Company http://www.aeppro.com/ 2. Vulnerability Information A Buffer OverFlow Impact: Attacker gains administrative access Remotely...
Open Audit - SQL Injection
Open Audit - SQL Injection Exploit Title : Open Audit SQL Injection Vulnerability Exploit Author : Rahul Pratap Singh Date : 2/Jan/2016 Home page Link : https://github.com/jonabbey/open-audit Website : 0x62626262.wordpress.com Twitter : @0x62626262 Linkedin :...
Microsoft Internet Explorer 11.0.9600.18124 EdUtil::GetCommonAncestorElement - Denial of Service
Microsoft Internet Explorer 11.0.9600.18124 EdUtil::GetCommonAncestorElement - Denial of Service EdUtil::GetCommonAncestorElement Remote Crash / Title : IE11 EdUtil::GetCommonAncestorElement Remote Crash Date : 31.12.2015 Author : Marcin Ressel https://twitter.com/mressel Vendor Hompage :...
FTPShell Client 5.24 - Local Buffer Overflow
FTPShell Client 5.24 - Local Buffer Overflow ''' + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/FTPSHELL-v5.24-BUFFER-OVERFLOW.txt Vendor: ================================ www.ftpshell.com Product: ================================...
DeleGate 9.9.13 - Local Privilege Escalation
DeleGate 9.9.13 - Local Privilege Escalation Title: Local root vulnerability in DeleGate v9.9.13 Author: Larry W. Cashdollar, @larry0 Date: 2015-12-17 Advisory: http://www.vapidlabs.com/advisory.php?v=159 Download Sites: http://delegate.hpcc.jp/delegate/ http://delegate.org/delegate/ Vendor:...
WordPress Plugin Simple Ads Manager 2.9.4.116 - SQL Injection
WordPress Plugin Simple Ads Manager 2.9.4.116 - SQL Injection / Exploit Title: Simple Ads Manager 2.9.4.116 SQL Injection Date: 30-12-2015 Software Link: https://wordpress.org/plugins/simple-ads-manager/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...
KiTTY Portable 0.65.0.2p (Windows 7) - Local kitty.ini Overflow (Wow64 Egghunter)
KiTTY Portable 0.65.0.2p Windows 7 - Local kitty.ini Overflow Wow64 Egghunter Exploit Title: KiTTY Portable = 0.65.0.2p Local kitty.ini Overflow Wow64 Egghunter Win7 Date: 28/12/2015 Exploit Author: Guillaume Kaddouch Twitter: @gkweb76 Blog: http://networkfilter.blogspot.com GitHub:...
KiTTY Portable 0.65.0.2p (Windows XP710) - Chat Remote Buffer Overflow (SEH)
KiTTY Portable 0.65.0.2p Windows XP710 - Chat Remote Buffer Overflow SEH Exploit Title: KiTTY Portable = 0.65.0.2p Chat Remote Buffer Overflow SEH WinXP/Win7/Win10 Date: 28/12/2015 Exploit Author: Guillaume Kaddouch Twitter: @gkweb76 Blog: http://networkfilter.blogspot.com GitHub:...
KiTTY Portable 0.65.0.2p (Windows 8.110) - Local kitty.ini Overflow
KiTTY Portable 0.65.0.2p Windows 8.110 - Local kitty.ini Overflow Exploit Title: KiTTY Portable = 0.65.0.2p Local kitty.ini Overflow Win8.1/Win10 Date: 28/12/2015 Exploit Author: Guillaume Kaddouch Twitter: @gkweb76 Blog: http://networkfilter.blogspot.com GitHub: https://github.com/gkweb76/exploi...
KiTTY Portable 0.65.1.1p - Local Saved Session Overflow (Egghunter XP Denial of Service 78.110)
KiTTY Portable 0.65.1.1p - Local Saved Session Overflow Egghunter XP Denial of Service 78.110 Exploit Title: KiTTY Portable Local Code Execution Win7 - Denial Of...
AccessDiver 4.301 - Buffer Overflow
AccessDiver 4.301 - Buffer Overflow + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ACCESSDIVER-BUFFER-OVERFLOW.txt Vendor: ============== M. Jean Fages www.accessdiver.com circa 1998-2006 Product: =============================...
EasyCafe Server 2.2.14 - Remote File Read
EasyCafe Server 2.2.14 - Remote File Read !/usr/bin/python -w Title : EasyCafe Server = 2.2.14 Remote File Read Date : 25/12/2015 Author : R-73eN Tested on : Windows 7 Ultimate Software Link : http://www.tinasoft.com/easycafe/ Download Link: http://www.tinasoft.com/Download/easysetup.exe Vulnerab...
Rips Scanner 0.5 - code.php Local File Inclusion
Rips Scanner 0.5 - code.php Local File Inclusion ================================================================================ Rips Scanner 0.5 - code.php Local File Inclusion ================================================================================ Vendor Homepage:...
Beezfud - Remote Code Execution
Beezfud - Remote Code Execution ================================================================================ Beezfud Remote Code Execution ================================================================================ Vendor Homepage: https://github.com/EVA-01/beezfud Date: 23/12/2015...
PHP 7.0.0 - Format String
PHP 7.0.0 - Format String Overview -------------------------------------------- A fun little format string vulnerability exists in PHP 7.0.0 due to how non-existent class names are handled. From my limited research I believe this issue is likely exploitable for full code execution see test script...
PhpSocial 2.0.0304_20222226 - Cross-Site Request Forgery
PhpSocial 2.0.030420222226 - Cross-Site Request Forgery Security Advisory - Curesec Research Team 1. Introduction Affected Product: PhpSocial v2.0.030420222226 Fixed in: not fixed Fixed Version Link: n/a Vendor Webite: http://phpsocial.net Vulnerability Type: CSRF Remote Exploitable: Yes Reported...
Arastta 1.1.5 - SQL Injection
Arastta 1.1.5 - SQL Injection Security Advisory - Curesec Research Team 1. Introduction Affected Product: Arastta 1.1.5 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://arastta.org/ Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 11/21/2015 Disclose...
Bigware Shop 2.3.01 - Multiple Local File Inclusions
Bigware Shop 2.3.01 - Multiple Local File Inclusions Title: Bigware Shop 2.3.01 Multiple Local File Inclusion Vulnerabilities Author: bd0rk eMail: bd0rkathackermail.com Twitter: twitter.com/bd0rk Tested on: Ubuntu-Linux Vendor: http://www.bigware.de Download:...
Grawlix 1.0.3 - Cross-Site Request Forgery
Grawlix 1.0.3 - Cross-Site Request Forgery Security Advisory - Curesec Research Team 1. Introduction Affected Product: Grawlix 1.0.3 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://www.getgrawlix.com/ Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 11/17/20...
Wireshark - infer_pkt_encap Heap Out-of-Bounds Read
Wireshark - inferpktencap Heap Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=658 The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...
Wireshark - AirPDcapDecryptWPABroadcastKey Heap Out-of-Bounds Read (1)
Wireshark - AirPDcapDecryptWPABroadcastKey Heap Out-of-Bounds Read 1 Source: https://code.google.com/p/google-security-research/issues/detail?id=657 The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed...
Notepad++ NPPFtp Plugin 0.26.3 - Buffer Overflow
Notepad++ NPPFtp Plugin 0.26.3 - Buffer Overflow Title : Notepad ++ NPPFtp Plugin Buffer Overflow Date : 19/12/2015 Author : R-73eN Tested on : NPPFtp 0.26.3 Latest Version Software : http://sourceforge.net/projects/nppftp/ Vendor : https://notepad-plus-plus.org/ | | / | / | / \ | | | || ' | | /...
Ovidentia online Module 2.8 - GLOBALS[babAddonPhpPath] Remote File Inclusion
Ovidentia online Module 2.8 - GLOBALSbabAddonPhpPath Remote File Inclusion Title: Ovidentia Module online 2.8 GLOBALSbabAddonPhpPath Remote File Include Vulnerability Author: bd0rk eMail: bd0rkathackermail.com Twitter: twitter.com/bd0rk Download:...
Adobe Flash Sound.setTransform - Use-After-Free
Adobe Flash Sound.setTransform - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=568 There is a use-after-free in Sound.setTransform. If a transform value is set to an object with valueOf defined, it can free the transform before the values are set. A...
Base64 Decoder 1.1.2 - Overwrite (SEH) (PoC)
Base64 Decoder 1.1.2 - Overwrite SEH PoC Exploit: b64dec SEH OverWrite. Date: 12/18/2015 Exploit Author: UnN0n Vendor: Tim Rohlfs Software Link: http://4mhz.de/b64dec.html Version: 1.1.2 Tested on: Windows 7 x6464bit Dump SEH chain of thread 00000EC0 Address SE handler 024CFC50 b64dec.00458140...
Ovidentia Widgets 1.0.61 - Remote Command Execution
Ovidentia Widgets 1.0.61 - Remote Command Execution Title: Ovidentia Widgets 1.0.61 Remote Command Execution Exploit Author: bd0rk eMail: bd0rkathackermail.com Twitter: twitter.com/bd0rk Tested on: Ubuntu-Linux Download:...
Adobe Flash - TextField.Variable Setter Use-After-Free
Adobe Flash - TextField.Variable Setter Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=579 There is a use-after-free in the TextField.variable setter. If the variable name that is added is an object with toString defined, the toString function can free...
Adobe Flash TextField.sharpness Setter - Use-After-Free
Adobe Flash TextField.sharpness Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=588 There is a use-after-free in the TextField sharpness setter. If the sharpness parameter is an object with valueOf set to a function which frees the TextField...
Adobe Flash Selection.SetSelection - Use-After-Free
Adobe Flash Selection.SetSelection - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=590 There is a use-after-free in Selection.SetSelection. If it is called with a number parameter, which is an object with valueOf defined, and this function frees the...
Adobe Flash TextField.type Setter - Use-After-Free
Adobe Flash TextField.type Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=577 There is a use-after-free in the TextField.type setter. If the type the field is set to is an object with toString defined, the toString function can free the field's...
Adobe Flash MovieClip.attachBitmap - Use-After-Free
Adobe Flash MovieClip.attachBitmap - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=593 There is a use-after-free in MovieClip.attachBitmap. If the depth parameter is an object with valueOf defined, this method can free the MovieClip, which is then used...
Adobe Flash TextField.tabIndex Setter - Use-After-Free
Adobe Flash TextField.tabIndex Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=574 There is a use-after-free in the TextField.tabIndex setter. If the integer parameter is an object with valueOf defined, then it can free the TextField's parent,...
Adobe Flash TextField.replaceText - Use-After-Free
Adobe Flash TextField.replaceText - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=584 There is a use-after-free in the TextField.replaceText function. If the function is called with a string parameter with toString defined, or an integer parameter with...
Adobe Flash MovieClip.duplicateMovieClip - Use-After-Free
Adobe Flash MovieClip.duplicateMovieClip - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=591 There is a use-after-free in MovieClip.duplicateMovieClip. If the depth or movie name parameter provided is an object with toString or valueOf defined, this...
Adobe Flash MovieClip.localToGlobal - Use-After-Free
Adobe Flash MovieClip.localToGlobal - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=570 There is a use-after-free issue in MovieClip.localToGlobal. If the Number constructor is overwritten with a new constructor and MovieClip.localToGlobal is called wi...