56796 matches found
用友协作办公平台getshell(特奇葩且通杀)
简要描述： 用友协作办公平台getshell特奇葩且通杀 详细说明： 重复： WooYun: 用友某办公平台通用漏洞getshell漫游内网第一弹 1 漏洞文件 /common/uploadFile.jsp 查看源文件,如图 重点关注这里 "?action=save&savePath=/imageshttps://images.seebug.org/upload/&fileName=14051439450001.jpg" 看见了什么?没错！保存文件的路径 文件名全在这里,是不是觉得特奇葩.. 2 漏洞测试 随便上传一个文件,同时 F12...
Apache HTTP Server AllowOverride选项绕过安全限制漏洞
BUGTRAQ ID: 35115 CVECAN ID: CVE-2009-1195 Apache HTTP Server是一款流行的Web服务器。 Apache HTTP Server没有正确地处理AllowOverride指令中的Options=IncludesNOEXEC选项，本地用户可以通过在.htaccess文件中配置1 Options Includes、2 Options +Includes或3 Options +IncludesNOEXEC并在.shtml文件中注入exec元素导致绕过安全限制获得权限。 Apache 2.2.x 厂商补丁： Apache Group...
PHP-Nuke绕过SQL注入保护及多个SQL注入漏洞
PHP-Nuke是一个广为流行的网站创建和管理工具，它可以使用很多数据库软件作为后端，比如MySQL、PostgreSQL、mSQL、Interbase、Sybase等。 PHP-Nuke实现上存在多个SQL注入漏洞，远程攻击者可能利用这些漏洞非授权操作数据库。 在mainfile.php文件中435行： //Union Tap //Copyright Zhen-Xjell 2004 http://nukecops.com //Beta 3 Code to prevent UNION SQL Injections unset$matches; unset$loc;...
deV!Lz Clanportal Show参数SQL注入漏洞
deV!Lz Clanportal是一款基于Invision的一个图库模块。 deV!Lz Clanportal不充分过滤用户提交的URI输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'Index.PHP'脚本对用户提交的'show'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 deV!Lz Clanportal deV!Lz Clanportal 1.3.6 目前没有解决方案提供： http://www.dzcp.de/news/index.php...
phpwind 9.0 /res/js/dev/util_libs/jPlayer/Jplayer.swf 跨站脚本漏洞
1、漏洞文件为：http://www.phpwind.net/res/js/dev/utillibs/jPlayer/Jplayer.swf2、反编译后看代码：this.jQuery = loaderInfo.parameters.jQuery + "'" + loaderInfo.parameters.id + "'.jPlayer"; …… private function initarg1:TimerEvent:void this.myInitTimer.stop; if ExternalInterface.available ……...
金蝶旗下快递100某处任意文件读取
简要描述： RT 详细说明： http://net.kuaidi100.com/youshang-network/logined/auditInfo?method=auditInfoView 照片查看任意文件读取，通过 %00截断 GET /youshang-network/getImage?path=2015-07%2F2015-07-22%2F../../../../../../../etc/passwd%00.jpg HTTP/1.1 Host: net.kuaidi100.com Proxy-Connection: keep-alive Accept:...
HP-UX <= 10.20 newgrp Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/683/info Due to insufficient bounds checking on user supplied arguments, it is possible to overflow an internal buffer and execute arbitrary code as root. !/usr/bin/perl use FileHandle; sub h2cs local$stuff=@; local$rv;...
用友致远A6协同管理SQL注射漏洞
简要描述： 用友致远A6协同管理SQL注射漏洞，需登录账户。 详细说明： 注入发生在searchresult.jsp文件中的docTitle参数 http://xxxxxx.com/yyoa/oaSearch/searchresult.jsp?docType=协同信息&docTitle=1'and//1=2// union//all//select//user,2,3,4,5%23&goal=1&perId=0&startTime=&endTime=&keyword=&searchArea=notArc 查询表名： http:// xxxxxx.com...
Linux 2.6.x fs/pipe.c local root exploit
No description provided by source. For those who were not yet aware, there is at least 3 public exploits since 11/05/2009 for CVE-2009-3547 targeting all linux kernels from 2.6.0 to 2.6.31 included. Since spender and fotis have already release their own, there is not need for us to keep this on o...
VLC media player 2.2.8 Arbitrary Code Execution PoC(CVE-2018-11529)
Exploit Title: VLC media player 2.2.8 Arbitrary Code Execution PoC Date: 6-6-2018 Exploit Author: Eugene Ng Vendor Homepage: https://www.videolan.org/vlc/index.html Software Link: http://download.videolan.org/pub/videolan/vlc/2.2.8/win64/vlc-2.2.8-win64.exe Version: 2.2.8 Tested on: Windows 10 x6...
deV!L`z Clanportal Witze Addon 0.9 - SQL Injection Vulnerability
No description provided by source. ======================================================================================== | Title : deV!Lz Clanportal Witze Addon Versions 0.9 SQL Injection Vulnerability | Author : Easy Laster | Download : http://dzcp-zone.de/downloads/?action=show&id=97 | Scrip...
Anymacro 邮件系统最新版SQL注入漏洞
简要描述： 厂商一直回复说，不是最新版的，现在我就捅几枚最新版的菊花出来，谢谢。。。 详细说明： 0x001 anymacro是国内较流行的一家企业级邮箱系统，客户主要为教育/政府机构。 今天所发现的SQL注入影响所有Anymacro所有邮件系统。 0x002 漏洞分析 本次属于黑盒测试。。。 漏洞点在网盘处，在下载里面的附件的时候，由于参数未进行判断，导致产生SQL注入漏洞 https://mail.xxx.com/down.php?netdisk=1...
Samba 'smbcacls'命令安全绕过漏洞
Bugtraq ID:66232 CVE ID:CVE-2013-6442 Samba是一款实现SMB协议、跨平台进行文件共享和打印共享服务的程序。 当使用"-C|--chown name"或"-G|--chgrp name"选项时Samba的smbcacls工具存在错误，允许攻击者利用漏洞绕过安全限制访问受限资源。 0 Samba 4.x Samba 4.0.16或4.1.6已经修复该漏洞，建议用户下载更新： http://www.samba.org/...
UBB.threads <= 6.5.1.1 (doeditconfig.php) Code Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? // UBB.threads Multiple input validation error // Discovered By : HACKERS PAL // Copy rights : HACKERS PAL // Website : http://www.soqor.net // Email Address : [email protected] // Tested on Version 6 6.5.1.1 and other...
用友TurboCRM /ajax/getemaildata.php 任意文件读取漏洞
漏洞信息： 用友TurboCRM客户关系管理系统是一套基于B/S架构、互联网模式应用普及的信息化趋势，专为中小企业提供包括客户管理、销售管理、项目管理等应用的在线CRM。 用友TurboCRM /ajax/getemaildata.php 存在任意文件读取漏洞导致敏感信息泄漏。 漏洞分析： 漏洞存在于/ajax/getemaildata.php filePath参数未有效过滤，导致可以使用 ../../ 越权读取任意文件。 可使用以下URl测试读取系统文件：...
Windows Print Spooler权限提升漏洞（CVE-2021-1675）
...
Vigor ACS Unsafe Flex AMF Java Object Deserialization(CVE-2017-5641)
Vulnerability Summary A vulnerability in Vigor ACS allows unauthenticated users to cause the product to execute arbitrary code. VigorACS 2 “is a powerful centralized management software for Vigor Routers and VigorAPs, it is an integrated solution for configuring, monitoring, and maintenance of...
Apps industrial OT over Server: Anti-Web Remote Command Execution(CVE-2017-17888)
Exploit Title: Apps industrial OT over Server: "Anti-Web 3.x.x 3.8.x" vuln: Remote Command Execution Date: 15/05/2017 Exploit Author: Fernandez Ezequiel @capitanalfa && Bertin Jose @bertinjoseb Vendor: Multiples vendors Category: Industrial OT webapps + DESCRIPTION: vulnerability: RCE REMOTE...
用友TurboCRM管理系统swfupload.php任意文件上传漏洞
No description provided by source...
Jax PHP Scripts 1.0/1.34/2.14/3.31 jax_guestbook.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/14481/info Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input. An attacker may leverage any of the...
FangMail后台SQL注射漏洞
简要描述： 1.通用漏洞 2.本案例中，很多（1900+）企业的邮件系统都托管在同一个服务器上，那么，理论上我将得到多少信息？ 详细说明： 举例说明 1.通过http://mail.aodacn.com/nmc/cgi/index.cgi登陆后台 2.注入点如下： http://mail.aodacn.com/nmc/cgi/ann.cgi?mode=editann&sid=gcipW8QUgtZsKVRpHWPKcFtjadministrator-aodacncom&annid=47&screen=editann.html 其中，annid存在注入 3. 4...
EMC Retrospect客户端retroclient.exe远程内存破坏漏洞
BUGTRAQ ID: 30306 EMC Retrospect是Windows平台下的备份和恢复软件。 Retrospect的retroclient.exe进程默认监听于TCP 497端口。如果向该端口连续发送长度为2064字节内容为0x00的报文的话，在30秒到5分钟后状态框会显示：Client networking not available, or service not running。继续发送报文会导致retroclient.exe进程终止，完全损失备份服务。 EMC Retrospect for Windows Client 7.5.116 EMC ---...
Discuz! x the use of SSRF remote command execution vulnerability
Content source: security think tank 0X01 ready to work jannock issued by Discuz conditional remote command execution,a lot of big stations affected, the online hasn't published details, in a safe public number to see on the jannock simple to say about the principle, is ssrf+redis/memcache issues,...
jact大汉网上互动管理平台 前台getshell
简要描述： jact系统为南京大汉网络有限公司开发的一套面向政府机关的网上互动管理平台。该平台在政府部门得到广泛的应用 详细说明： jact系统为南京大汉网络有限公司开发的一套面向政府机关的网上互动管理平台。该平台在政府部门得到广泛的应用 jact前台写信功能，任意文件上传导致getshell 漏洞URL： http://www.anxiang.gov.cn/jact/front/frontmailwrite.action 在上传附件部分，存在任意文件上传 该功能，仅在前端做了文件名校验 function isattachfile,ImageFileExtend,isAlert...
用友人力资源管理软件全版本XXE漏洞
简要描述： 用友人力资源管理软件全版本XXE漏洞 详细说明： i-漏洞描述 e-hr在登陆及重置密码处理时，使用xml将用户名、密码及验证码传递给后端进行解析处理，而后端对传进来的xml文件并未作严谨验证导致，可以传进构造的恶意xml文件进行查看文件及ssrf。 由于之前提交未通过，说是与一个注入重复可能是我上次的提交说的不够详细，so不管怎样请漏洞审查者对此漏洞进行再次认真考量。谢谢 ii-漏洞证明 google/baidu搜索inurl:/hrss/login.jsp 以搜索出的ehr.mc2.cn进行演示其他的有的较敏感，有的有防火墙。 主页打开效果： 登陆抓包： POST...
Coremail XT-3.0 /coremail/XT3/main/intervalCheck.jsp 跨站脚本漏洞
No description provided by source...
wu-ftpd <= 2.6.1 - Remote Root Exploit
No description provided by source. / 7350wurm - x86/linux wuftpd remote root exploit TESO CONFIDENTIAL - SOURCE MATERIALS This is unpublished proprietary source code of TESO Security. The contents of these coded instructions, statements and computer programs may not be disclosed to third parties,...
MamboLaiThai ExtCalThai 0.9.1 admin_events.php CONFIG_EXT[LANGUAGES_DIR] Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/20487/info ExtCalThai is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and...
MS Windows RRAS RASMAN Registry Stack Overflow Exploit (MS06-025)
No description provided by source. This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artisti...
wordpress 5.7 授权XXE漏洞（CVE-2021-29447）
WordPress 5.7 XXE Vulnerability BY KARIM EL OUERGHEMMI|APRIL 26, 2021 At SonarSource, we are constantly improving our code analyzers and security rules. We recently improved our PHP security engine to detect more OWASP Top 10 and CWE Top 25 issue types. When testing our new analyzers against some...
Major Vulnerabilities in Foscam Cameras
For the past several months, VDOO’s security research teams have been undertaking broad-scale security research of leading IoT products, from the fields of safety and security. In most cases, the research was carried out together with the device vendors for the sake of efficiency and transparency...
metinfo 5.3.1 任意文件创建漏洞(后台)
No description provided by source...
Siemens SIMATIC WinCC Sm@rtClient和SIMATIC WinCC Sm@rtClient Lite 信息泄露漏洞
No description provided by source...
Edgewall Software Trac 0.9 Ticket Query Module SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/15676/info Trac is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result ...
IlohaMail Webmail Stored XSS
No description provided by source. !/usr/bin/python ''' Exploit Title: IlohaMail Webmail Stored XSS. Date: 18/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://sourceforge.net/projects/ilohamail/ Software Link:...
Remository Admin.remository.PHP远程文件包含漏洞
Remository是一款基于PHP的WEB应用程序。 Remository不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'admin.remository.php'脚本对用户提交的'mosConfigabsolutepath'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Matt Smith ReMOSitory for Mambo 3.25 http://www.remository.com/...
Newswriter SW <= 1.42 (editfunc.inc.php) File Include Vulnerability
No description provided by source. ============================================================================================== Newswriter SW = 1.42 NWCONFSYSTEMserverpath Remote File Inclusion Vulnerability...
Hikvision IP Camera Access Bypass
Access control bypass in Hikvision IP Cameras Full disclosure Sep 12, 2017 Synopsis: --------------- Many Hikvision IP cameras contain a backdoor that allows unauthenticated impersonation of any configured user account. The vulnerability has been present in Hikvision products since at least 2014...
IPS Community Suite <= 4.1.12.3 Autoloaded PHP remote code execution vulnerability
Details source: The know Chong Yu 404 security lab A vulnerability overview 1. Vulnerability information "IPS Community Suite "is a foreign of the more common cms. But in its 4. 1. 12. 3 version and the following version, there is a PHP code injection vulnerability that stems from the procedures...
IBOS协同办公系统misc.php SQL注入
No description provided by source...
海康威视（hikvision） /config/user.xml 信息泄漏
No description provided by source...
feifeicms myaction.class.php 本地文件包含漏洞
No description provided by source...
大华网络视频监控设备弱口令漏洞
No description provided by source...
Shop7z admin/lipinadd.asp越权访问
No description provided by source...
EuseTMS plancommentlist.aspx type SQL注射
No description provided by source...
Apache Tomcat 拒绝服务漏洞(CVE-2012-5568)
Bugtraq ID:56686 CVE ID:CVE-2012-5568 Apache Tomcat是一款开放源码的JSP应用服务器程序。 Apache Tomcat存在一个安全漏洞，攻击者缓慢的连续发送头字段接着头字段请求，可导致服务器消耗系统资源，如线程资源，造成拒绝服务攻击。 Slowloris拒绝服务攻击工具可触发此漏洞。 0 Apache Software Foundation Tomcat 7.0.x Apache Software Foundation Tomcat 6.0.x Apache Software Foundation Tomcat 5.x Apache...
Apache Tomcat多个远程信息泄露漏洞
BUGTRAQ ID: 25316 CVECAN ID: CVE-2007-3385,CVE-2007-3382 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat处理用户请求数据时存在输入验证漏洞，远程攻击者可能利用此漏洞获取会话相关的敏感信息。 Apache Tomcat没有正确的处理Cookie值中的“" ”字符序列，且错误地将Cookie值中的单引号处理为分隔符，在某些情况下，这可能导致泄露敏感信息，如会话ID。 Apache Group Tomcat 6.0.0 - 6.0.13 Apache Group Tomcat 5.5.0...
Linux kernel local privilege escalation flaw in n_hdlc（CVE-2017-2636）
This article discloses the exploitation of CVE-2017-2636, which is a race condition in the nhdlc Linux kernel driver drivers/tty/nhdlc.c. The described exploit gains root privileges bypassing Supervisor Mode Execution Protection SMEP. This driver provides HDLC serial line discipline and comes as ...