56796 matches found
Ruby Psych::Emitter start_document Heap Overflow Vulnerability(CVE-2016-2338)
DESCRIPTION An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase...
Ruby WIN32OLE ole_invoke and ole_query_interface Type Confusion Vulnerabilities(CVE-2016-2336)
DESCRIPTION Type Confusion exists in two methods of Ruby's WIN32OLE class, oleinvoke and olequeryinterface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution. TESTED VERSIONS Ruby 2.3.0 dev Ruby 2.2.2 PRODUCT URLs https://www.ruby-lang.or...
Kaspersky Internet Security KLIF Driver NtAdjustTokenPrivileges_HANDLER Denial of Service(CVE-2016-4305)
Summary A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call can cause a access violation in KLIF kernel driver resulting in local denial of service. An attacker can run program from user mo...
Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution
Description: The remote code execution is a combination of 4 different vulnerabilities: CVE-2017-11151 allows remote attackers to upload arbitrary files to the specified directories. CVE-2017-11152 allows remote attackers to log in with a fake authentication mechanism. CVE-2017-11153 allows remot...
Oracle Outside In Technology RTF Parsing Code Execution Vulnerability(CVE-2017-3293)
Summary An exploitable Use After Free vulnerability exists in the RTF parser functionality of Oracle Outside In Technology SDK. A specially crafted RTF document can cause a reuse of a reference to the previously freed memory which can be manipulated into achieving arbitrary code execution. Tested...
Foscam IP Video Camera CGIProxy.fcgi SMTP Test User Parameter Configuration Command Injection Vulnerability(CVE-2017-2842)
Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...
Foscam IP Video Camera CGIProxy.fcgi Account Password Command Injection Vulnerability(CVE-2017-2828)
Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resultin...
OnePlus 3/3T OxygenOS Unauthorized Flash Dumping via fastboot(CVE-2017-5625)
Products OnePlus 3T OnePlus 3 Vulnerable Version OxygenOS 4.0.2 and earlier Mitigation Install OxygenOS 4.0.3 or later Summary A physical attacker, PC malware / malicious charger having ADB or fastboot access to the device can cause a locked bootloader to partially dump the content of an arbitrar...
WordPress Core before 4.7 Stored XSS
As you might remember, we recently blogged about a critical Content Injection Vulnerability in WordPress which allowed attackers to deface vulnerable websites. While our original disclosure only described one vulnerability, we actually reported two to the WordPress team. As it turns out, it was...
AVTECH monitoring products information disclosure vulnerability
Due to/cgi-bin/nobody directory of the CGI script file run permissions set unreasonable, resulting in not certified the case directly to run this type of vulnerability has been in the plurality of devices appears, FEI news K1 is because the cgi file to perform the access restrictions unreasonable...
Chrome Address Bar URL Spoofing on IOS
来源链接： http://xlab.tencent.com/cn/2016/10/11/CVE-2016-1707-Chrome-Address-Bar-URL-Spoofing-on-IOS/ （英文版）http://xisigr.com/x/cve-2016-1707/ 0x00 Vulnerability Overview Chrome浏览器地址栏欺骗漏洞CVE-2016-1707，这个漏洞笔者于2016年6月报告给Google，现在把漏洞细节分享给大家。URL Spoofing漏洞可以伪造一个合法的网站地址。攻击者可以利用这个漏洞对用户发起网络钓鱼攻击。 受影响版本：Chrome...
FSMCMS jspdownload. jsp download vulnerability
No description provided by source...
Wordpress Formcraft 插件upload.php文件上传漏洞
No description provided by source...
wordpress Begin Themes go.php 参数url URL重定向漏洞
No description provided by source...
Redmine 未授权访问漏洞
No description provided by source...
cmseasy官网无条件getshell
简要描述： CMS官网 无条件getshell 想走个大场商 求20rank 详细说明： 首先先看webshell 要不直接把我的webshell给覆盖掉了 菜刀地址 http://www.cmseasy.cn/post/list.php?list=@eval%28$POST%27a%27%29; 密码a 漏洞证明： view-source:http://www.cmseasy.cn/post/list.php?list=echo%20filegetcontents%27list.php%27; http://www.cmseasy.cn/post/list.php?list=phpin...
Windows ATMFD.DLL CFF table (ATMFD+0x3440b / ATMFD+0x3440e) Invalid Memory Access
CVE-2015-2460We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: ---PAGEFAULTINNONPAGEDAREA 50Invalid system memory was referenced. This cannot be protected by try-except,it must be protected by a Probe...
Magento <= 1.9.2 (catalogProductCreate) Autoloaded File Inclusion Vulnerability
Software Link:http://magento.com/- Affected Versions:Version 1.9.2 and prior versions.- Vulnerability Description:The vulnerability is caused by the "catalogProductCreate" SOAP API implementation,which is defined into the /app/code/core/Mage/Catalog/Model/Product/Api/V2.php script:109. public...
FineCms 免费版任意文件上传漏洞
路径：dayrui/libraries/Chart/ofcuploadimage.php $defaultpath = '../tmp-upload-images/'; if !fileexists$defaultpath mkdir$defaultpath, 0777, true; $destination = $defaultpath . basename $GET 'name' ; echo 'Saving your image to: '. $destination; $jfh = fopen$destination, 'w' or die"can't open file";...
蝉知企业门户系统 v3.3csrf修改管理员密码
简要描述： 蝉知企业门户系统 v3.3csrf修改管理员密码 详细说明： 蝉知企业门户系统 v3.3最新版本 存在csrf漏洞 而且我测试的时候发现，即使修改了密码，管理员也不会马上需要重新登陆，所以配合我的回旋镖，可以达到神不知鬼不觉的修改其管理密码 接下来，我就来详细的演示漏洞过程 漏洞证明： 1、我们进入后台，发现没有添加管理员，那么我们来尝试一下修改管理员密码 很有意思，我们发现修改管理员的密码，不需要验证原密码好危险撒！ 那我们再来抓包截断看看有没有token之类的验证 2、用burpsuite截断 我的小伙伴们都惊呆了 有木有？？ 没有验证，就两个password...
汇文Libsys图书管理系统全版本权限绕过+Getshell
简要描述： RT 详细说明： 由于一个很低级的代码错误，导致可以登录Libsys任意图书系统后台，并且由于代码未做过滤可直接getshell。 漏洞证明： 该图书管理系统的用户量很大，全国很大一部分院校都在使用此系统。经测试3.5-5.0版本都存在此漏洞，因为存在getshell 和脱裤的风险，因此危害比较大。 官网部分用户列表： 我这里以最新的5.0版简单的作下分析,： 先看看存在漏洞的文件：admin/login.php sessionstart ; if isset $REQUEST'username' $strUser = trim $REQUEST'username' ;...
Centreon SQL and Command Injection
Merethis Centreon 2.5.1版本和Centreon Enterprise Server 2.2版本中存在SQL注入漏洞，该漏洞源于以下脚本没有充分过滤参数： views/graphs/common/makeXMLListMetrics.php脚本没有充分过滤‘indexid’参数； views/graphs/GetXmlTree.php脚本没有充分过滤‘sid’参数；...
Maccms V8 储存型xss（绕过360防护）
简要描述： rt 详细说明： 自带的360防护脚本对于xss过滤太弱， 留言处没有 对html代码进行实体转义，造成xss。 如，提交 "onerror="eval'\141\154\145\162\164\50\61\51'" 后台查看留言即可触发 加载远程js可偷cookie 漏洞证明：...
Wordpress Top Quark Architecture 2.10 - Arbitrary File Upload Vulnerability
No description provided by source. Exploit Title: Wordpress Top Quark Architecture Version 2.10 Arbitrary File Upload Google Dork: inurl:wp-content/plugins/topquark/lib/js/fancyupload/showcase/batch/ Date: 11/06/2012 Exploit Author: Adrien Thierry Vendor Homepage: http://topquark.com/ Software...
FreePBX <= 2.8.0 Recordings Interface Allows Remote Code Execution
No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2010-005: FreePBX recordings interface allows remote code execution https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt Published: 2010-09-23 Version: 1.0 Vendor: FreePBX http://www.freepbx.org/ Product:...
Fake Hit Generator <= 2.2 Shell Upload Vulnerability
No description provided by source. Exploit Title: Fake Hit Generator Shell Upload Vulnerability Date: 25.12.2009 Author: DigitALL Greetz: Zombie KroNickq HackSpy and All 1923turk.biz Members Version: 2.1 Dork: Upload unique IP List: and The Ultimate Fake Hit Generator - BOOST YOUR ALEXA RANK...
Adobe Flash Player ActionScript Launch Command Execution Vulnerability
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
Free Mp3 Player 1.0 - Local Denial of Service Vulnerability
No description provided by source. !/usr/bin/perl Exploit Title: Free Mp3 Player 1.0 Local Denial of Service Date: 19-12-2011 Author: JaMbA Download: http://www.softpedia.com/get/Multimedia/Audio/Audio-Players/Free-Mp3-Player.shtml Version: 1.0 Tested on: Windows 7 my $file= Crash.mp3; my $junk=...
Apache + PHP 5.x (< 5.3.12 & < 5.4.2) - Remote Code Execution
No description provided by source. !/usr/bin/env python ap-unlock-v2.py - apache + php 5. rem0te c0de execution 0day better version NOTE: - quick'n'dirty VERY UGLYY C=000DEEE IZ N0T MY STYLE : - for connect back shell start netcat/nc and bind port on given host:port - is ip-range scanner not is...
Joomla Component NeoRecruit <= 1.4 (id) SQL Injection Vulnerability
No description provided by source. Title : Joomla Component NeoRecruit = 1.4 id Remote Blind SQL Injection Vulnerability Author : ajann Contact : : S.Page : http://www.neojoomla.com/ $$ : 54,90 € Dork : inurl:index.php?option=comNeoRecruit DorkEx :...
CuteNews 0.88 comments.php Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6935/info CuteNews is prone to an issue that may allow remote attackers to include files located on remote servers. Under some circumstances, it is possible for remote attackers to influence the include path for several...
WeBid 1.0.2 persistent XSS via SQL Injection
No description provided by source. Exploit Title: presistent XSS through SQLi WeBid 1.0.2 Google Dork: powered by WeBid Date: 15-06-2011 Author: Saif El-Sherei Software Link: http://sourceforge.net/projects/simpleauction/ Version: 1.0.2 Tested on: Firefox 4, XAMPP Info: Open source php/mysql full...
OpenOffice OLE Importer DocumentSummaryInformation Stream Handling Overflow
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
galleria Mambo Module <= 1.0b Remote File Include Vulnerability
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register class TestPOCPOCBase: vulID = '63674' ssvid version = '1.0' author = '皮皮' vulDate = '2006-07-03' createDate = '2015-12-24...
Pc4Uploader 9.0 - Remote Blind SQL Injection Vulnerability
No description provided by source. || || | || o,7 || . o7 || q||| ow, : / / . =By: Qabandi =Email: iqaahotmail.fr From Kuwait PEACE =Vuln: pc4arb - pc4 Uploader = 9.0 Blind SQL injection =INFO: http://pc4arb.com/product-13.html =BUY: http://pc4arb.com/deal-13.html =DORK: intext:Powered by...
Max's Image Uploader Shell Upload Vulnerability
PHP F1 Max's Image Uploader 1.0版本的maxImageUpload/index.php中存在无限制文件上传漏洞。 当Apache未被设置来处理具有pjpeg或jpeg扩展名的拟态文件时，远程攻击者可以通过上传具有一个pjpeg或jpeg扩展名的文件，执行任意代码，并借助对original/的一个直接请求来访问该文件。 问题在maxImageUpload.class.php中的 function uploadImage $result = true; if !isset$POST'submitBtn' $this-showUploadForm; else $m...
joomla component mp3 allopass 1.0 - Remote File Inclusion Vulnerability
No description provided by source. commp3allopass joomla component Remote File Include Vulnerability Component : commp3allopass Download file : http://www.joomlaratings.com Dicovered by : NoGe Contact : [email protected]...
Multiple Wordpress Plugin timthumb.php Vulnerabilites
No description provided by source. Exploit Title: Multiple Wordpress timthumb.php reuse vulnerabilities Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing --- Description --- The following Wordpress plugins reuse a vulnerable version of the timthumb.php librar...
HP Data Protector 6.20 - Multiple Vulnerabilities
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - Corelabs Advisory http://corelabs.coresecurity.com/ Multiple vulnerabilities in HP Data Protector 1. Advisory Information Title: Multiple vulnerabilities in HP Data Protector Advisory ID:...
Jack (tR) Jax LinkLists 1.00 - 'jax_linklists.php' Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/28518/info Jax LinkLists is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of a...
Linux Local Root => 2.6.39 (32-bit & 64-bit) - Mempodipper
No description provided by source. /Exploit code is here: http://git.zx2c4.com/CVE-2012-0056/plain/mempodipper.c Blog post about it is here: http://blog.zx2c4.com/749 Exploit Title: Mempodipper - Linux Local Root for =2.6.39, 32-bit and 64-bit Date: Jan 21, 2012 Author: zx2c4 Tested on: Gentoo,...
Java Statement.invoke() Trusted Method Chain Exploit
No description provided by source. $Id: javatrustedchain.rb 11345 2010-12-15 22:46:22Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms o...
Gnuboard <= 4.33.02 tp.php PATH_INFO SQL Injection
No description provided by source. Exploit Title: Gnuboard = 4.33.02 PATHINFO SQL INJECTION Vulnerability Google Dork: inurl:gnuboard4/bbs/board.php Date: 2011-2-14 Author: flyh4t Software Link: http://sir.co.kr/main/gnuboard4/ Version: Gnuboard = 4.33.02 Tested on: linux+apache CVE : CVE-2011-40...
Solaris/SPARC 2.5.1/2.6/7/8 Derived 'login' Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3681/info The 'login' program is used in UNIX systems to authenticate users with a username and password. The utility is typically invoked at the console, by 'telnetd', 'rlogind', and if configured to do so, SSH. Versions...
PhotoStore view_photog.php photogid Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/20172/info Photostore is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage these issues to have arbitrary script code execu...
E-Mail Security Virtual Appliance (ESVA) Remote Execution
No description provided by source. Exploit Title: E-Mail Security Virtual Appliance ESVA Remote Execution. Date: 10 Aug 2012 Exploit Author: iJoo Vendor Homepage: http://www.esvacommunity.com/ Software Link: http://sourceforge.net/projects/esva-project/ Version: 2.0.6 ESVA E-Mail Security Virtual...
Vino VNC Server 3.7.3 - Persistent Denial of Service
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2013-028: Persistent Denial of Service Vulnerability in Vino VNC Server Published: 09/16/13 Version: 1.0 Vendor: The GNOME Project https://wiki.gnome.org/Vino Product: Vino VNC Server Version affected: Vino VNC Server...
linux 3.4+ - Local Root (CONFIG_X86_X32=y)
No description provided by source. / ============================== recvmmsg.c - linux 3.4+ local root CONFIGX86X32=y CVE-2014-0038 / x32 ABI with recvmmsg by rebel @ irc.smashthestack.org ----------------------------------- takes about 13 minutes to run because timeout-tvsec is decremented once...
I-Vision CMS XSS, SQL injection vulnerability
No description provided by source. Title: XSS, SQL injection vulnerability in I-Vision CMS Date: 17.05.2010 Author: Ariko-Security Software Link: http://international-vision.com/inner.php?id=14&type=2 Version: ALL ============ Ariko-Security - Advisory 2/5/2010 ============= XSS, SQL injection...
zenphoto 0.9/1.0 index.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/17779/info Zenphoto is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...