Microsoft Hyper-V 远程代码执行漏洞（CVE-2021-28476）

CVE-2021-28476: a guest-to-host "Microsoft Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys. This is a proof of concept for CVE-2021-28476 "Hyper-V Remote Code Execution Vulnerability", an arbitrary memory read in vmswitch.sys Network virtualization service provider patched by Microso...

深澜安全认证网络管理计费系统(Srun 3000) /srun3/srun/services/modules/login/controller/login_controller.php任意文件下载漏

0x01 漏洞框架 Srun3000深澜校园宽带客户端是深澜软件面向校园网推出的安全认证网络管理计费产品。 /srun3/srun/services/modules/login/controller/logincontroller.php存在任意文件下载漏洞。 影响厂商：深澜软件 官方主页：http://www.srun.com/ 深澜软件的Srun 3000 安全认证网络管理计费产品家族由Srun 3000 Gateway System和 Srun 3000 Radius System组成。获得众多用户好评的Srun 3000 Gateway 认证计费系统在...

KindEditor 4.1.7 /php/file_manager_json.php 路径泄漏

/php/filemanagerjson.php文件代码第48行打印出了绝对路径，导致路径泄漏漏洞产生。 KindEditor 4.1.7...

FLDS 1.2a (redir.php id) Remote SQL Injection Vulnerability

No description provided by source. Free Links Directory Script id SQL Injection Vulnerability Author: nuclear site: http://flds-script.com vuln: http://localhost/path/redir.php?id=-1%20UNION%20SELECT%201,2,@@version,4,5,6,7,8,9,10,11/ vulnerable code: $ida = $GET'id'; $link =...

os-x/PPC/x86 execve(""/bin/sh"" {""/bin/sh"" NULL} NULL) 121 bytes

No description provided by source. / - dual.c - by [email protected] execve"/bin/sh","/bin/sh",NULL,NULL shellcode for osx both the ppc and x86 version. Sample output: -nemo@squee:/shellcode$ file dual-ppc dual-ppc: Mach-O executable ppc -nemo@squee:/shellcode$ ./dual-ppc sh-2.05b$ exit...

VMware vCenter Server远程代码执行漏洞（CVE-2021-21985）

Rapid7 May 26, 2021 5:34pm UTC 1 day ago• Last updated May 27, 2021 6:39pm UTC 7 hours ago Technical Analysis Threat status: Impending threat Attacker utility: Network infrastructure compromise Description On Tuesday, May 25, 2021, VMware published security advisory VMSA-2021-0010, which includes...

Exim Use-After-Free(CVE-2017-16943)

On 23 November, 2017, we reported two vulnerabilities to Exim. These bugs exist in the SMTP daemon and attackers do not need to be authenticated, including CVE-2017-16943 for a use-after-free UAF vulnerability, which leads to Remote Code Execution RCE; and CVE-2017-16944 for a Denial-of-Service D...

Discuz X3.2的milu_seotool插件存在本地文件包涵漏洞

0x01漏洞简介 Discuz X3.2的miluseotool插件存在本地文件包涵漏洞。 看见木有有个微信登陆功能，漏洞也出现在这里。无截断所以不鸡肋。 0x02漏洞分析 接下来看代码，文件在source\plugin\wechat\wechat.class.php： static public function redirect$type global $G; $hook = unserialize$G'setting''wechatredirect'; if !$hook || !inarray$hook'plugin', $G'setting''plugins''availabl...

SiteFactory CMS 5.5.9 任意文件下载漏洞

漏洞详情：SiteFactory CMS 5.5.9 存在任意文件下载漏洞。问题链接：sitefactory/assets/download.aspx?file=测试链接：/sitefactory/assets/download.aspx?file=c%3a\windows\win.ini影响版本：SiteFactory CMS 5.5.9...

AWStats 5.7 - 6.2 - Multiple Remote Exploit (extra)

No description provided by source. / Awstats exploit shell code by omin0us omin0us208 at gmail dot com dtors security group .: http://dtors.ath.cx :. Vulnerability reported by iDEFENSE pluginmode bug has been found by GHC team. The awstats exploit that was discovered allows a user to execute...

phpMyAdmin setup.php脚本PHP代码注入漏洞

BUGTRAQ ID: 34236 CVECAN ID: CVE-2009-1151 phpMyAdmin是用PHP编写的工具，用于通过WEB管理MySQL。 phpMyAdmin的Setup脚本用于生成配置。如果远程攻击者向该脚本提交了特制的POST请求的话，就可能在生成的config.inc.php 配置文件中包含任意PHP代码。由于配置文件被保存到了服务器上，未经认证的远程攻击者可以利用这个漏洞执行任意PHP代码。 phpMyAdmin phpMyAdmin 3.x phpMyAdmin phpMyAdmin 2.11.x 厂商补丁： phpMyAdmin ----------...

PHP-Fusion submit.php文件SQL注入漏洞

BUGTRAQ ID: 28855 PHP-Fusion是一款基于PHP的内容管理系统。 PHP-Fusion的submit.php文件没有正确地过滤对submitinfo参数的输入便在SQL查询中使用，远程攻击者可能利用此漏洞执行SQL注入攻击。 相关代码： 1. if $stype == "l" 2. 3. if isset$POST'submitlink' 4. 5. if $POST'linkname' != "" && $POST'linkurl' != "" && $POST'linkdescription' != "" 6. $submitinfo'linkcategory...

Dnsmasq Information Leak(CVE-2017-14494)

Sadly, there are no easy docker setup instructions available. Setup a simple network with dnsmasq as dhcpv6 server. Run any dhcpv6 client on the clients machine and obtain the network packets. Look for the server identifier inside the dhcpv6 packets. Then, run the poc on the client: python /poc.p...

Easy Message Board Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13555/info Easy Message Board is prone to a remote command execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input...

Serendipity 0.x Exit.PHP HTTP Response Splitting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11497/info Serendipity is reported prone to an HTTP response splitting vulnerability. A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This...

webSPELL 4.1.2 - 'index.php' Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28294/info webSPELL is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

Linux Kernel DCCP报文处理内存破坏漏洞

BUGTRAQ ID: 66279 CVE ID: CVE-2014-2523 Linux Kernel是Linux操作系统的内核。 Linux Kernel 2.6.32.61, 3.2.55, 3.4.83, 3.10.33, 3.12.14, 3.13.6版本在 "dccpnew", "dccppacket", , "dccperror"函数net/netfilter/nfconntrackprotodccp.c的实现上存在安全漏洞，恶意用户通过特制的DCCP数据包，利用此漏洞可破坏内核栈，然后以内核权限执行任意代码。 0 Linux kernel 3.4.x Linux kern...

Win32k Elevation of Privilege Vulnerability(CVE-2017-0263)

May has been a busy month for vulnerabilities in the world's most popular desktop operating system. Hackers have made headlines with massive infections by WannaCry ransomware, which exploits an SMB security flaw and the ETERNALBLUE tool. Shortly prior, on May 9, Microsoft fixed CVE-2017-0263, whi...

XStream 反序列化漏洞

Xstream 的反序列化漏洞的根源就是 Groovy 组件的问题参考 Apache Groovy MethodClosure 远程代码执行漏洞（CVE-2015-3253），只不过在 Xstream 中进行反序列化时恰好有触发存在缺陷函数的点，也就是 Xstream 在反序列化时调用了 Mapput 函数将构造好的 Expando 实例作为 key 添加到集合中时触发了代码执行，如下图: 这里的 key 就是我们构造的 Expando 的实例对象。 在构造 EXP 时，首先我们要构造一个 Expando 的一个对象实例，同时设置 hashCode 的实现为 MethodClosure...

DouPHP轻量级企业建站系统CSRF添加管理员

简要描述： 版本:官网最新版本 详细说明： http://douco.com/ 官网的demo测试。http://demo.douco.com/ 没有验证token，也没有验证referer,所以造成了csrf 漏洞文件 admin/manage.php 第84行-121行 None...

泛微E-office OA管理系统存在任意文件下载及文件上传导致任意代码执行（已getshell）

简要描述： 继续 applychen 的脚步，因为之前我遇到过这个系统，最新官方demo中也确实存在问题。 感谢 applychen 提供的测试账号。 @cncert国家互联网应急中心 有什么问题，可以私信我。 详细说明： 继续 WooYun: 泛微E-office OA管理系统存在SQL注射漏洞可查库 的挖掘 官方demo http://eoffice8.weaver.cn:8028/login.php 测试账号还是那个 xj 存在两个问题： 0x01:任意文件下载漏洞 测试链接...

FreeBSD 'telnetd'守护进程远程缓冲区溢出漏洞

Bugtraq ID: 51182 CVE ID：CVE-2011-4862 FreeBSD是一款基于BSD的操作系统。 FreeBSD Telnet协议有一个对数据流进行加密的机制但其加密性不强，不能在任何关键性安全应用上使用 当通过TELNET协议提供加密密钥时，在拷贝密钥到固定缓冲区时没有对其长度进行校验，可触发缓冲区溢出。能连接telnetd守护程序的攻击者可以以守护进程上下文执行任意代码 0 Freebsd 9.0-STABLE Freebsd 9.0-RELEASE Freebsd 9.0-RC3 Freebsd 9.0-RC1 Freebsd 8.2-STABLE...

Foxit Reader command injection(CVE-2017-10951)and file writing Vulnerability(CVE-2017-10952)

A tale about Foxit Reader - Safe Reading mode and other vulnerabilities Some days ago someone send me the following link, which describes two vulnerabilities in Foxit Reader: http://thehackernews.com/2017/08/two-critical-zero-day-flaws-disclosed.html These two vulnerabilities are similar to the...

zkfingerd 0.9.1 say() Format String Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6404/info zkfingerd is prone to a format string vulnerability. The affected function does not perform sufficient checks when displaying user-supplied input. It is possible to corrupt memory by passing format strings throu...

Microsoft IE HTML对象脚本错误远程代码执行漏洞（MS07-027）

Internet Explorer是微软发布的非常流行的操作系统。 IE在处理内存访问的方式上存在漏洞，远程攻击者可能利用此漏洞控制用户机器。 Internet Explorer尝试访问未初始化的内存。因此，内存可能以一种攻击者可以在登录用户的上下文中执行任意代码的方式受到破坏。攻击者者可以通过构建特制的网页来利用这些漏洞。 如果用户查看网页，这些漏洞可能允许远程执行代码。成功利用这些漏洞的攻击者可以完全控制受影响的系统。 Microsoft Internet Explorer 7.0 - Microsoft Windows XP SP2 - Microsoft Windows Vist...

exchange proxyshell 远程代码执行利用链

...

NETGEAR GS110TPV3未认证命令注入漏洞(CVE-2021-33514)

Summary: Affected Model: NETGEAR GS110TPV3 Smart Managed Pro Switch Firmware Version: V7.0.5.2 from 2021-01-11 NETGEAR GS110TPV3 Smart Managed Pro Switch is vulnerable to a pre-auth shell injection due to incorrect input handling in setup.cgi query parameters. This allows an attacker in the same...

金蝶K3财务软件系统 kdfile文件 任意文件上传漏洞

No description provided by source...

PostgreSQL 'make check' 本地权限提升漏洞

BUGTRAQ ID: 65721 CVECAN ID: CVE-2014-0067 PostgreSQL是一款高级对象－关系型数据库管理系统，支持扩展的SQL标准子集。 PostgreSQL 9.3.3, 9.2.7, 9.1.12, 9.0.16, 8.4.20之前版本通过"make check"在构造树内运行回归测试时，服务器进程允许同一台机器上的用户作为超级用户登录，另外一个本地用户也可以获取操作系统用户的权限。 0 PostgreSQL PostgreSQL 8.x 厂商补丁： PostgreSQL ----------...

ISC BIND 9 DNS64 REQUIRE断言失败拒绝服务漏洞

BUGTRAQ ID: 56817 CVECAN ID: CVE-2012-5688 BIND是一个应用非常广泛的DNS协议的实现。 ISC BIND 9.8.0及更高版本支持 DNS64 IPv6转换机制，如果启用了dns64配置状态，BIND 9域名服务器在解析特制的请求时，会触发REQUIRE断言失败，造成服务器崩溃。此漏洞可被远程利用，9.8.0之前版本、不启用DNS64时不受此漏洞的影响。 0 ISC BIND 9.9.0-9.9.2 ISC BIND 9.8.0-9.8.4 临时解决方法： 对于启用了DNS64的BIND...

Mambo A6MamboCredits远程文件包含漏洞

Mambo A6MamboCredits是一款基于Mambo的应用模块。 Mambo A6MamboCredits不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'admin.a6mambocredits.php'脚本对用户提交的'mosConfiglivesite'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 active6 a6MamboCredits 1.0...

e-cology 泛微协同商务系统在/weaver/weaver.email.FileDownloadLocation存在盲注漏洞

No description provided by source...

phpems在线考试模拟系统sql注入

简要描述： 擦 详细说明： 没学过面向对象，看不懂代码，完全黑盒出来的 漏洞证明： demo测试...

PmWiki 2.1 - Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/16421/info PmWiki is prone to multiple input-validation vulnerabilities. These issues are due to failures in the application to properly sanitize user-supplied input. - Arbitrary remote file-include vulnerability...

Lighttpd 1.4.30 / 1.5 Denial Of Service

No description provided by source. / Lighttpd versions before 1.4.30 and 1.5 before SVN revision 2806 out-of-bounds read segmentation fault denial of service exploit. Primitive Lighttpd Proof of Concept code for CVE-2011-4362 vulnerability discovered by Xi Wang Here the vulnerable code...

DVBBS <= 7.1.0 sp1 (BokeManage.asp) Remote SQL Injection

DVBBS是由海口动网先锋网络科技有限公司开发的网络社区软件。因为在论坛附带的博客模块当中存在着远程注入漏洞，导致恶意用户借此入侵网站 因博客模块当中的关键词处没有进行严格的处理导致注入漏洞的产生 DVBBS 7.1.0 SP1 关闭博客功能或安装的补丁 http://www.cnbct.org/BokeManage.rar...

Linux ext4: out-of-bounds memcpy via non-inline system.data xattr(CVE-2018-11412)

ext4 can store data for small regular files as "inline data", meaning that the data is stored inside the corresponding inode instead of in separate blocks. Inline data is stored in two places: The first 60 bytes go in the iblock field in the inode which normally contains a list of blocks instead,...

Apache Tomcat information disclosure Vulnerability, CVE-2016-6816）

Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M11 Apache Tomcat 8.5.0 to 8.5.6 Apache Tomcat 8.0.0.RC1 to 8.0.38 Apache Tomcat 7.0.0 to 7.0.72 Apache Tomcat 6.0.0 to 6.0.47 Earlier, unsupported versions may also be affected...

TRS(ids新老版本)设计缺陷(xxe/用户信息泄露包括密码等)

简要描述： TRSids设计缺陷xxe/用户信息泄露包括密码，好久没有发过漏洞了，突然上来看了看，发现漏洞提交页面都变了 详细说明： 首先我们看看web.xml配置文件: ServiceServlet com.trs.idm.admin.service.ServiceServlet ServiceServlet /service 跟进ServiceServlet protected void serviceHttpServletRequest request, HttpServletResponse response throws ServletException, IOExceptio...

CubeCart <= 3.0.6 - Remote Command Execution Exploit

No description provided by source. !/usr/bin/perl cijfer-ccxpl - CubeCart =3.0.6 Remote Command Execution Exploit Copyright c 2005 cijfer [email protected] All rights reserved. 1. example cijfer@kalma:/research$ perl ./cijfer-ccxpl.pl -h www.xxx.com -d [email protected] /$ id;uname -a uid=48apache...

Microsoft Windows远程桌面协议RDP远程代码执行漏洞(MS12-020)

BUGTRAQ ID: 52353 CVE ID: CVE-2012-0002 远程桌面协议（RDP, Remote Desktop Protocol）是一个多通道（multi-channel）的协议，让用户（客户端或称“本地电脑”）连上提供微软终端机服务的电脑（服务器端或称“远程电脑”）。 Windows在处理某些对象时存在错误，可通过特制的RDP报文访问未初始化的或已经删除的对象，导致任意代码执行，然后控制系统。 0 Microsoft Windows XP Professional Microsoft Windows XP Home Microsoft Windows Server...

Tru64 UNIX 4.0g /usr/bin/at Local Root Exploit

No description provided by source. / Tru64 UNIX 4.0g JAVA /usr/bin/at local root exploit. ALPHA Author: Cody Tubbs loophole of hhp. Site: www.hhp-programming.net Email: [email protected] Date: 2/1/2000. I made this without access to gdb, It's untested... may require modification, may require...

NETGEAR WAC104身份验证绕过漏洞(CVE-2021-35973)

Summary: Affected Model: NETGEAR WAC104 Dual Band 802.11ac Wireless Access Point Firmware Version: V1.0.4.13 from 2020-09-14 NETGEAR WAC104 Access Point has multiple vulnerabilities which - chained together - allow an attacker in LAN to both change device admin's password, and gain root shell on...

Apache ActiveMQ Fileserver remote code execution vulnerability(CVE-2016-3088)

Author: The know Chong Yu 404 laboratory 1. Background overview ActiveMQ is an Apache Software Foundation under an open source message-driven middleware software. Jetty is an open source servlet container, it is based on Java web container such as JSP and servlet to provide the running...

java代码审计基础教程之V2会议系统多个漏洞集合/无需登录

简要描述： 包括 sql注入 任意文件下载 越权 getshell xml实体注入 感谢@loopx9大牛帮助 详细说明： 因为学习java并不是很长时间，也没有做深入的研究。但是在学习之后，发现可以审计出一些简单的javaweb漏洞，所以想这这里和大家分享一下。 0x01审计之初 首先，我拿到了源码之后，大概看了一下这个系统的架构，发现是通过Struts写的。在具体看代码之前，我们先看一下这个会议系统有什么功能，在代码审计的时候，不能一股脑的先跑过去就看代码，我们要学会通过功能去找问题的缺陷。现在以...:8288/Conf/jsp/main/mainAction.do...

Multiple Vendors libc:fts_*() - Local Denial of Service Exploit

No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 libc:fts:multiple vendors, Denial-of-service Author: Maksymilian Arciemowicz SecurityReason.com Date: - - Dis.: 21.10.2008 - - Pub.: 04.03.2009 CVE: CVE-2009-0537 We are going informing all vendors, about this proble...

Tplink Diagnostic Authenticated RCE

Vulnerability: Command Injection in diagnostic.lua ------------------------------------------ Exploitation: Can remote command execution on the root shell. ------------------------------------------ Vendor of Product: Tp-Link router ------------------------------------------ Affected Products and...

A Look at --- SharePoint's Follow Feature XSS(CVE-2017-8514 )

A Look at CVE-2017-8514 --- SharePoint's Follow Feature XSS TL;DR: All your SharePoint installations are belong to us. The XSS worth $2500 affecting both on-premises and online version looks like ... http|https://?FollowSite=0&SiteName='-confirmdocument.domain-' SharePoint needs no more marketing...

Redmine跨站脚本漏洞

No description provided by source...

用友NC-IUFO报表系统部分安全问题（影响多个大客户）

简要描述： 用友NC-IUFO报表系统存在用户信息泄漏，存在暴力破解的风险，另登录的验证码形同虚设，弱口令，登录之后利用系统功能获取webshell； 详细说明： 我们这里以wooyun厂商的忽略大王，中粮集团的报表平台为例； link： http://iufo.cofco.com/service/iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.login.LoginAction 1. 用户信息泄漏 link：...