56796 matches found
Kaspersky Internet Security KLIF Driver NtAdjustTokenPrivileges_HANDLER Denial of Service(CVE-2016-4305)
Summary A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call can cause a access violation in KLIF kernel driver resulting in local denial of service. An attacker can run program from user mo...
WebKit: use-after-free in WebCore::RenderObject with accessibility enabled(CVE-2017-7046)
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector simply opening the...
Windows Kernel stack memory disclosure in win32k!NtGdiGetRealizationInfo(CVE-2017-8473)
We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 7-10 through the win32k!NtGdiGetRealizationInfo system call. The concrete layout of the input/output structure is unclear symbols indicate its name is...
Android Arbitrary class loading and instantiation in protobuf parcelable "javanano" compiler
The protobuf library includes the "javanano" compiler, commonly used in many Android applications due to its tiny resource footprint. The "javanano" compiler supports a variety of Android-specific compilation flags which can be used to modify the generated message classes. One such compilation fl...
Chrome Address Bar URL Spoofing on IOS
来源链接： http://xlab.tencent.com/cn/2016/10/11/CVE-2016-1707-Chrome-Address-Bar-URL-Spoofing-on-IOS/ （英文版）http://xisigr.com/x/cve-2016-1707/ 0x00 Vulnerability Overview Chrome浏览器地址栏欺骗漏洞CVE-2016-1707，这个漏洞笔者于2016年6月报告给Google，现在把漏洞细节分享给大家。URL Spoofing漏洞可以伪造一个合法的网站地址。攻击者可以利用这个漏洞对用户发起网络钓鱼攻击。 受影响版本：Chrome...
惠普打印机设备 HP Color LaserJet 系列未授权访问漏洞
No description provided by source...
E-TILLER期刊采编系统 留言登录处/ch/guestbook/Login.aspx 参数GM_NAME POST注入漏洞
No description provided by source...
青果软件手机APP掌上校园某处XSS盲打以打到后台和cookies
简要描述： 提交的没通过，说是要完整的问题复现也是醉了。。。。。在提交一次 详细说明： 漏洞利用代码： 这是同IP的网站的确隶属于湖南青果软件有限公司： 漏洞证明： 漏洞证明 https://images.seebug.org/upload/201511/101343187fd9a31ae8eea7f5a2...
正方教务管理系统 /service.asmx SOAP无条件注入
No description provided by source...
百度 moplus SDK 后门 (WormHole 虫洞)
报告来源：趋势科技 目前，人们之所以称之为漏洞是基于 Moplus SDK 的访问权限控制以及应该如何限制这种访问的角度。因此，它虽然具有漏洞相关的概念而实际上是一个后门程序，如推送钓鱼网页，插入任意联系人，发送伪造短信，上传本地文件到远程服务器，未经用户授权安装任意应用到 Android 设备。而执行这些行为唯一的要求是该设备首先需要连接互联网。由于 Moplus SDK 已经被集成到众多的 Android 应用程序中，这就意味着有上亿的Android用户受到了影响。 图1.恶意软件使用的 Moplus SDK 来进行静默安装 通过 Moplus SDK 挖掘 Moplus...
mao10cms多个漏洞打包
简要描述： 包括多个存储型XSS，越权 详细说明： 1.首先来看存储型XSS漏洞，这个漏洞的根源在于mao10cms对于富文本的过滤函数不完善，我们来看mao10cms的过滤策略。 function mcremovehtml$text, $type = 'html' if$type=='all' $text = nl2br$text; $text = realstriptags$text; $text = addslashes$text; $text = trim$text; else // 无标签格式 $texttags = ''; //只保留链接 $linktags = '';...
猫扑OA 2014 后台登陆验证存在SQL注入漏洞
No description provided by source...
Magento <= 1.9.2 (catalogProductCreate) Autoloaded File Inclusion Vulnerability
Software Link:http://magento.com/- Affected Versions:Version 1.9.2 and prior versions.- Vulnerability Description:The vulnerability is caused by the "catalogProductCreate" SOAP API implementation,which is defined into the /app/code/core/Mage/Catalog/Model/Product/Api/V2.php script:109. public...
FineCms 免费版任意文件上传漏洞
路径：dayrui/libraries/Chart/ofcuploadimage.php $defaultpath = '../tmp-upload-images/'; if !fileexists$defaultpath mkdir$defaultpath, 0777, true; $destination = $defaultpath . basename $GET 'name' ; echo 'Saving your image to: '. $destination; $jfh = fopen$destination, 'w' or die"can't open file";...
金蝶销管家逻辑缺陷重置任意用户密码(工作人员账户测试/秒改)
简要描述： 可绕过验证码直接修改用户密码。 详细说明： 0x1:先信息收集一些工作人员的账户用来测试，来证明漏洞的危害性。 13580111111 13752248075 13456231475 13456879564 15578945623 13456231245 13456231245 13648776985 13400002111 13625668852 15018517663 15915533696 13888888888 13456789123 18090700000 13165454756 13654213923 13654213923 13760368754...
某在线培训系统Base64编码后通用SQL盲注漏洞
简要描述： RT 详细说明： 接上一个洞： WooYun: 某在线培训系统通用SQL注入漏洞 厂商：上海天柏信息科技有限公司 http://www.timber2005.com/Productsy.html （客户案例及试用） 天柏在线培训系统（网校版） 漏洞地址： http://px2.timber2005.com/WebPage/kccontent.aspx?tid=NDAyMA==&cid=Mjk= 参数cid存在注入 tid和cid都采用了base64的编码，因此提交的时候需要对参数进行编码 提交： 29 and 1=1 编码后： MjkgYW5kIDE9MQ== 页面正常...
KesionCMS多个系统通用SQL注入打包 #可注入任意用户数据 demo演示
简要描述：...
万户OA未修补漏洞致多个政府&集团OA中招
简要描述： 该漏洞在7月份已经有人在wooyun报了，可修补效果几乎为0。 详细说明： 瘦蛟舞 提交的漏洞地址： WooYun: 万户OA任意文件上传导致代码执行（多处总结） 漏洞还是瘦蛟舞（http://www.wooyun.org/whitehats/%E7%98%A6%E8%9B%9F%E8%88%9E）提交的漏洞。 于是用google搜索：inurl:7001/defaultroot 有324条记录。 随便测其中一个上传： 被改名的文件名直接返回到页面： 然后访问：...
Bacula-Web 5.2.10 (joblogs.php, jobid param) - SQL Injection
谷歌搜索：joblogs.php?jobid= 案例：http://cep.treslagoas.ms.gov.br/backup/joblogs.php?jobid=23154 D:\sqlmappython sqlmap.py -u http://cep.treslagoas.ms.gov.br/backup/joblogs.php ?jobid=23154 --dbs | | 1.0-dev-nongit-20150806 | -| . | | | .'| . | || |||||,| | || || http://sqlmap.org ! legal disclaimer:...
Pidgin MSN <= 2.6.4 File Download Vulnerability
No description provided by source. !/usr/bin/env python Pidgin MSN = 2.6.4 file download vulnerability 19 January 2010 Mathieu GASPARD [email protected] Description: Pidgin is a multi-protocol Instant Messenger. This is an exploit for the vulnerability1 discovered in Pidgin by Fabian Yamaguchi. T...
Linux Kernel 2.6.x - IPV6 Local Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/15156/info Linux Kernel is reported prone to a local denial-of-service vulnerability. This issue arises from an infinite loop when binding IPv6 UDP ports. / Linux kernel IPv6 UDP port selection infinite loop local denial ...
Xpient Cash Drawer Operation Vulnerability
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Xpient Cash Drawer Operation Vulnerability 1. Advisory Information Title: Xpient Cash Drawer Operation Vulnerability Advisory ID: CORE-2013-0517 Advisory URL:...
FreePBX <= 2.8.0 Recordings Interface Allows Remote Code Execution
No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2010-005: FreePBX recordings interface allows remote code execution https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt Published: 2010-09-23 Version: 1.0 Vendor: FreePBX http://www.freepbx.org/ Product:...
Clipbucket 2.5 - Directory Traversal
No description provided by source. Author: loneferret of Offensive Security Product: ClipBucket Version: 2.5 and maybe older versions Vendor Site: http://clip-bucket.com/ Software Download: http://sourceforge.net/projects/clipbucket/ Software description: ClipBucket is an OpenSource Multimedia...
MS11-080 AfdJoinLeaf Privilege Escalation
No description provided by source. MS11-080 - CVE-2011-2005 Afd.sys Privilege Escalation Exploit Author: [email protected] - Matteo Memelli Spaghetti & Pwnsauce yuck! 0xbaadf00d Elwood@mac&cheese.com Thx to dookielifesaver2000ca, dijital1 and ronin for helping out! To my Master Shifu muts: "So...
Java Applet JAX-WS Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class...
frontaccounting 1.12 build 31 - Remote File Inclusion Vulnerability
0x01漏洞简介 FrontAccounting 1.12 Build 31的config.php中存在PHP远程文件包含漏洞。远程攻击者可以借助pathtoroot参数中的一个URL，执行任意PHP代码。 0x02漏洞分析 漏洞代码位于config.php文件中，如下所示： includeonce$pathtoroot . "/configdb.php"; includeonce$pathtoroot . "/includes/lang/language.php"; 参数$pathtoroot没有进行正确的处理，导致了文件包含漏洞的产生。 0x03漏洞利用...
amoeba cms 1.01 - Multiple Vulnerabilities
No description provided by source. !/usr/bin/python Amoeba CMS v1.01 multiple remote vulnerabilities: Vendor: http://www.amoebacms.com/ Found by: mrme Contact date: 20/12/2010 2:37pm EST SQL Injection: ============= There is quite a few instances of pre/post auth SQL Injection in the web...
Joomla Mosets Tree <= 1.0 - Remote File Include Vulnerability
No description provided by source. !!!!!!!!!WWW.SiBERSAVASCiLAR.COM!!!!!!!!! -------------------------------------------------------------------------------- Title : Joomla Mosets Tree = 1.0 Remote File Include Vulnerability...
bitweaver 2.8.1 - Multiple Vulnerabilities
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2012-016: Multiple Vulnerabilities in Bitweaver Published: 10/23/2012 Version: 1.0 Vendor: Bitweaver http://www.bitweaver.org/ Product: Bitweaver Version affected: 2.8.1 and earlier versions Product description: Bitweav...
Wordpress Spider Catalog Plugin 1.4.6 - Multiple Vulnerabilities
No description provided by source. waraxe-2013-SA105 - Multiple Vulnerabilities in Spider Catalog Wordpress Plugin =================================================================================== Author: Janek Vind waraxe Date: 22. May 2013 Location: Estonia, Tartu Web:...
UBBCentral 6.0 UBB.threads Printthread.PHP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13253/info It is reported that UBB.threads is prone to an SQL injection vulnerability. The SQL injection vulnerability is reported to affect the 'printthread.php' script. UBB.threads 6.0 is reported prone to this issue. I...
Ruby <= 1.9.1 WEBrick Terminal Escape Sequence in Logs Command Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/37710/info Ruby WEBrick is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in log files. Attackers can exploit this issue to execute arbitrary commands in a terminal...
FotoWeb 6.0 Login.fwx s Parameter XSS
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register from urlparse import urljoin class TestPOCPOCBase: vulID = 'SSV-86055' vul ID version = '1' author = 'hhxx' vulDate =...
Openfire <= 3.6.0a Admin Console Authentication Bypass
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
FreePBX Framework模块admin/libraries/view.functions.php远程代码执行漏洞
CVE ID:CVE-2014-1903 FreePBX是开源Web PBX解决方案。 FreePBX admin/libraries/view.functions.php没有限制API处理程序可访问的函数集，这可使远程攻击者通过 admin/config.php 的函数和参数，利用此漏洞执行任意PHP代码。 0 FreePBX 2.9 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice...
Nagios 3.x Remote Command Execution(CVE-2012-6096)
No description provided by source. !/usr/bin/python CVE-2012-6096 - Nagios history.cgi Remote Command Execution =========================================================== Another year, another reincarnation of classic and trivial bugs to exploit. This time we attack Nagios.. or more specifically...
Linux kernel 2.6.x write本地权限提升漏洞(CVE-2012-0056)
BUGTRAQ ID: 51625 CVE ID: CVE-2012-0056 Linux是自由电脑操作系统内核。 Linux Kernel在SUID /proc/pid/mem write的实现上存在本地权限提升漏洞，攻击者可利用此漏洞获取提升的权限，以内核级别执行任意代码 0 Linux kernel 2.6.x http://www.kb.cert.org/vuls/id/470151 http://blog.zx2c4.com/749 / Mempodipper by zx2c4 Linux Local Root Exploit Rather than put my write ...
Windows CSRSS子系统SrvWriteConsoleOutputString权限提升漏洞(CVE-2011-1870)(MS11-056)
BUGTRAQ ID: 48605 CVE ID: CVE-2011-1870 Microsoft Windows是微软发布的非常流行的操作系统。 Microsoft Windows CSRSS子系统SrvWriteConsoleOutputString实现上存在漏洞，本地攻击者可利用此漏洞在内核模式中执行任意代码。 此漏洞源于CSRSS子系统中的SrvWriteConsoleOutputString存在整数溢出漏洞，可造成内存破坏。 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2008...
Linux Kernel I/O-Warrior USB设备栈溢出漏洞
BUGTRAQ ID: 46069 CVE ID: CVE-2010-4656 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel在实现上存在USB设备栈溢出漏洞，攻击者可利用此漏洞以超级用户的权限执行任意代码，完全控制受影响计算机，使内核崩溃，拒绝服务合法用户。 如果在case语句中iowarrior设备支持每个报告中多于8个字节，就可能在内核堆分配外写入。 index bc88c79..8ed8d05 100644 file --- a/drivers/usb/misc/iowarrior.c +++...
MySQL MyISAM表符号链接本地权限提升漏洞
BUGTRAQ ID: 37075 CVE ID: CVE-2009-4030 MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。 MySQL允许本地用户通过对MyISAM表调用CREATE TABLE绕过某些权限检查。在通过以下方式创建MyISAM表时： CREATE TABLE DATA DIRECTORY ... INDEX DIRECTORY ... 由于没有特别的检查确保已有的表格不会被符号链接覆盖，用户可以在test数据库中创建user表格，DATA...
Linux Kernel perf_counter_open()函数本地溢出漏洞
BUGTRAQ ID: 36423 CVECAN ID: CVE-2009-3234 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的kernel/perfcounter.c文件中的perfcopyattr函数存在缓冲区溢出漏洞。本地攻击者可以通过向perfcounteropen系统调用传送特制数据触发这个溢出，导致内核崩溃。 Linux kernel 2.6.31 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Linux Kernel ptrace_start()和do_coredump()死锁拒绝服务漏洞
BUGTRAQ ID: 35559 CVECAN ID: CVE-2009-1388 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的kernel/ptrace.c文件中的ptracestart函数没有正确地处理与docoredump函数同时执行的情况，本地用户可以通过ptrace系统调用并coredump线程导致系统死锁的拒绝服务情况。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Online Grades & Attendance 3.2.6 Credentials Changer SQL Exploit
No description provided by source. !/usr/bin/perl || || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O ¡PROUD TO BE SPANISH!...
Linux Kernel hfs_cat_find_brec()本地拒绝服务漏洞
BUGTRAQ ID: 32289 CVECAN ID: CVE-2008-5025 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的hfscatfindbrec函数中存在栈溢出漏洞。如果用户受骗加载了特制的hfs镜像并传送了超长的目录名称长度的话，就可以触发这个溢出，导致拒绝服务。 Linux kernel 2.6.x Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://kernel.org/pub/linux/kernel/v2.6/patch-2.6.27.6.bz2...
Apple iPod Touch 2.1版本之前多个远程漏洞
BUGTRAQ ID: 31092 CVE ID：CVE-2008-3631 CVE-2008-3612 CVE-2008-3632 CNCVE ID：CNCVE-20083631 CNCVE-20083612 CNCVE-20083632 Apple iPod Touch是一款苹果公司发布的MP4播放器。 Apple iPod Touch存在多个安全问题，远程攻击者可以利用漏洞允许用户伪造WEB站点，获得敏感信息及任意代码执行等攻击。 CVE-ID: CVE-2008-3631：...
OpenSSL < 0.9.7l / 0.9.8d SSLv2 Client Crash Exploit
No description provided by source. !/usr/bin/perl Copyrightc Beyond Security Written by Noam Rathaus - based on beSTORM's SSL Server module Exploits vulnerability CVE-2006-4343 - where the SSL client can be crashed by special SSL serverhello response use strict; use IO::Socket;...
CA BrightStor ARCserve Backup Tape Engine服务远程缓冲区溢出漏洞
BrightStor ARCserve Backup可为各种平台的服务器提供备份和恢复保护功能。 BrightStor ARCserver Backup的Tape Engine服务（tapeeng.exe）没有正确处理RPC请求，远程攻击者可以通过向该服务（默认端口6502/TCP）发送特制报文触发缓冲区溢出，导致执行任意代码。 Computer Associates BrightStor ARCserve Backup 11.5 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.cai.com/...
ViRobot Advanced Server 2.0 (addschup) Remote Cookie Exploit
!/usr/bin/perl ViRobot 2.0 remote cookie exploit - ala addschup copyright Kevin Finisterre kflistsatdigitalmunitiondotcom jdam:/home/kfinisterre ls -al /var/spool/cron/root ls: /var/spool/cron/root: No such file or directory jdam:/home/kfinisterre ls -al /var/spool/cron/root -rw-r--r-- 1 root sta...
MS Internet Explorer Object Data Remote Exploit (M03-032)
CVE-ID：CVE-2003-0701CNNVD-ID：CNNVD-200308-125漏洞影响范围：•Microsoft Internet Explorer 5.01 •Microsoft Internet Explorer 5.5 •Microsoft Internet Explorer 6.0 •Microsoft Internet Explorer 6.0 for Windows Server 2003 解决方案：官方已发布升级补丁，请立即升级到最新版本。 titleby malware M03-032 Exploit/title script language=vbs...