56796 matches found
Coremail XT-3.0 /coremail/XT3/main/intervalCheck.jsp 跨站脚本漏洞
No description provided by source...
VxWorks WDB Agent 远程内存读取漏洞
VxWorks安全初探 404@KnownSec --- 0x00 前言 --- 关于VxWorks，这里引用44CON议题《攻击 VxWorks：从石器时代到星际》探究 一文章中的介绍： VxWorks 是世界上使用最广泛的一种在嵌入式系统中部署的实时操作系统，是由美国WindRiver公司（简称风河公司，即WRS 公司）于1983年设计开发的。其市场范围跨越所有的安全关键领域，仅举几例，包括火星好奇心流浪者、波音787梦幻客机、网络路由器。这些应用程序的安全高危性质使得VxWorks的安全被高度关注。 VxWorks操作系统是由美国Wind...
Apache 'mod_proxy_http' Interim Response Denial of Service Vulnerability
CVE: CVE-2008-2364 The Apache 'modproxyhttp' module is prone to a denial-of-service vulnerability that affects the processing of interim responses. Attackers may exploit this issue to cause denial-of-service conditions. Reportedly, the issue affects Apache 2.2.8 and 2.0.63; other versions may als...
Jax Calendar 1.34 Remote Admin Access Exploit
No description provided by source. Exploit Title: Jax Calendar 1.34 Remote Admin Access Exploit Date: December 30th, 2009 Author: Sora Software Link: http://www.jtr.de/scripting/php Version: 1.34 Tested on: Windows Vista and Linux Backtrack 3 ---------------------------- Jax Calendar 1.34 Remote...
Microsoft SharePoint Server 远程代码执行漏洞(CVE-2021-28474)
In May of 2021, Microsoft released a patch to correct CVE-2021-28474, a remote code execution bug in supported versions of Microsoft SharePoint Server. This bug was reported to ZDI by an anonymous researcher and is also known as ZDI-21-574. This blog takes a deeper look at the root cause of this...
Exim Use-After-Free(CVE-2017-16943)
On 23 November, 2017, we reported two vulnerabilities to Exim. These bugs exist in the SMTP daemon and attackers do not need to be authenticated, including CVE-2017-16943 for a use-after-free UAF vulnerability, which leads to Remote Code Execution RCE; and CVE-2017-16944 for a Denial-of-Service D...
IPS Community Suite <= 4.1.12.3 Autoloaded PHP remote code execution vulnerability
Details source: The know Chong Yu 404 security lab A vulnerability overview 1. Vulnerability information "IPS Community Suite "is a foreign of the more common cms. But in its 4. 1. 12. 3 version and the following version, there is a PHP code injection vulnerability that stems from the procedures...
wu-ftpd <= 2.6.1 - Remote Root Exploit
No description provided by source. / 7350wurm - x86/linux wuftpd remote root exploit TESO CONFIDENTIAL - SOURCE MATERIALS This is unpublished proprietary source code of TESO Security. The contents of these coded instructions, statements and computer programs may not be disclosed to third parties,...
D-LINK DIR-3040 服务组件使用默认密码（CVE-2021-21818）
The DIR-3040 is an AC3000-based wireless internet router. Zebra is an IP routing manager that provides kernel routing table updates, interface lookups, and redistribution of routes between different routing protocols. The DIR-3040 runs this service by default on TCP port 2601 and can be accessed ...
Linux ext4: out-of-bounds memcpy via non-inline system.data xattr(CVE-2018-11412)
ext4 can store data for small regular files as "inline data", meaning that the data is stored inside the corresponding inode instead of in separate blocks. Inline data is stored in two places: The first 60 bytes go in the iblock field in the inode which normally contains a list of blocks instead,...
Network Time Protocol Control Mode Unauthenticated Trap Information Disclosure and DDoS Amplification Vulnerability(CVE-2016-9310)
Summary An exploitable configuration modification vulnerability exists in the control mode mode 6 functionality of ntpd. A specially crafted control mode packet can set ntpd traps, providing information disclosure and DDoS amplification, and unset ntpd traps, preventing legitimate monitoring. A...
Remository Admin.remository.PHP远程文件包含漏洞
Remository是一款基于PHP的WEB应用程序。 Remository不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'admin.remository.php'脚本对用户提交的'mosConfigabsolutepath'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Matt Smith ReMOSitory for Mambo 3.25 http://www.remository.com/...
wordpress 5.7 授权XXE漏洞（CVE-2021-29447）
WordPress 5.7 XXE Vulnerability BY KARIM EL OUERGHEMMI|APRIL 26, 2021 At SonarSource, we are constantly improving our code analyzers and security rules. We recently improved our PHP security engine to detect more OWASP Top 10 and CWE Top 25 issue types. When testing our new analyzers against some...
极通 EWEBS 应用虚拟化系统 任意文件读取漏洞
No description provided by source...
MS Windows RRAS RASMAN Registry Stack Overflow Exploit (MS06-025)
No description provided by source. This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artisti...
Plogger <= Beta 2.1 Administrative Credentials Disclosure Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "Plogger = Beta 2.1 SQL injection / administrative credentials disclosure\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "- works with magicquotesgpc = Off\r\n\r\n...
Vigor ACS Unsafe Flex AMF Java Object Deserialization(CVE-2017-5641)
Vulnerability Summary A vulnerability in Vigor ACS allows unauthenticated users to cause the product to execute arbitrary code. VigorACS 2 “is a powerful centralized management software for Vigor Routers and VigorAPs, it is an integrated solution for configuring, monitoring, and maintenance of...
IBOS协同办公系统misc.php SQL注入
No description provided by source...
Discuz! x the use of SSRF remote command execution vulnerability
Content source: security think tank 0X01 ready to work jannock issued by Discuz conditional remote command execution,a lot of big stations affected, the online hasn't published details, in a safe public number to see on the jannock simple to say about the principle, is ssrf+redis/memcache issues,...
Shop7z /show.asp pkid参数SQL注入漏洞
漏洞出现在show.asp 358行开始 dim pkid,model,productname,smallpicpath,price1,price2,pipai pkid=request"pkid" sql="select from viewproduct where pkid = "&pkid set rs=server.createobject"adodb.recordset" rs.open sql,conn,1,1 if rs.bof or rs.eof then pkid直接通过request获取 并拼接到sql语句中 没有任何过滤 poc:...
CSDN Blog XSS Bug
CSDN是中国最大的IT技术社区，CSDN blog是面向中文地区IT专业技术人员的Blog门户，有不少IT牛人在上面开博。 在CSDN博客发表文章的时候，如果用“设计视图”模式编辑正文，不会产生跨站，测试代码scriptalert'zerosoul'/script会被转义成scriptalert'zerosoul'/script转义了左尖括号。 但是如果我们点击“源视图”模式进行编辑正文并发帖的话，就不会再对左尖括号转义，造成跨站漏洞。 测试链接:http://blog.csdn.net/zerosoul/ http://hi.csdn.net 等待官方修补...
VMware vCenter Server远程代码执行漏洞（CVE-2021-21985）
Rapid7 May 26, 2021 5:34pm UTC 1 day ago• Last updated May 27, 2021 6:39pm UTC 7 hours ago Technical Analysis Threat status: Impending threat Attacker utility: Network infrastructure compromise Description On Tuesday, May 25, 2021, VMware published security advisory VMSA-2021-0010, which includes...
coremail任意文件读取漏洞
简要描述： coremail在实现上存在缺陷，利用80sec发布的xml解析漏洞可以读取服务器上任意文件，包括服务器配置文件和敏感的数据库文件，结合上下文逻辑可能可以获得更高权限，影响所有使用coremail的用户 详细说明： coremail服务在接受和传递参数时使用的是xml的格式进行数据传递，但是根据80sec的安全公告，如果服务端在处理xml数据时格式不对就会导致安全漏洞，使用应用上下文的权限来获取任意文件内容，结合逻辑可能可以得到更多的权限 漏洞证明： 神奇的代码哦，就是简单的在xml头部附加我们的恶意就可以了 POST...
Apache HTTP Server AllowOverride选项绕过安全限制漏洞
BUGTRAQ ID: 35115 CVECAN ID: CVE-2009-1195 Apache HTTP Server是一款流行的Web服务器。 Apache HTTP Server没有正确地处理AllowOverride指令中的Options=IncludesNOEXEC选项，本地用户可以通过在.htaccess文件中配置1 Options Includes、2 Options +Includes或3 Options +IncludesNOEXEC并在.shtml文件中注入exec元素导致绕过安全限制获得权限。 Apache 2.2.x 厂商补丁： Apache Group...
RichStrong CMS (showproduct.asp cat) Remote SQL Injection Exploit
No description provided by source. --==+=================== Spanish Hackers Team www.spanish-hackers.com =================+==-- --==+ RichStrong CMS showproduct.asp?cat= Remote SQL Injection Exploit +==-- --==+====================================================================================+==...
FdWeB Espace Membre Admin_Menu.PHP远程文件包含漏洞
FdWeB Espace Membre是一款基于PHP的WEB应用程序。 FdWeB Espace Membre不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'AdminMenu.PHP'脚本对用户提交的'phpbbrootpath'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 FdWeB Espace Membre 2.01 FdWeB Espace Membre 2.0 目前没有解决方案提供： http://www.fdweb.org/ html head meta...
Major Vulnerabilities in Foscam Cameras
For the past several months, VDOO’s security research teams have been undertaking broad-scale security research of leading IoT products, from the fields of safety and security. In most cases, the research was carried out together with the device vendors for the sake of efficiency and transparency...
大华网络视频监控设备弱口令漏洞
No description provided by source...
Easy7视频监控平台默认弱口令漏洞
漏洞信息： Easy7视频监控平台是天地伟业数码科技有限公司出品的一套视频监控系统，用于管理硬盘录像机的监控录像和设备设置。 该系统存在默认管理口令admin/1111,可被攻击者恶意利用。 解决方案： 建议关注官官网更新，及时升级最新版本： http://www.tiandy.com/...
douphp /cache 目录物理路径泄漏
漏洞分析 漏洞文件 cache目录下的所有文件 如：admin/backup.htm.php php tplvars'lang''home'; ?//会引起报错 2. 漏洞利用 直接访问 http://www.douco.com/cache/admin/backup.htm.php 然后查看网页源码，泄漏物理路径 3. 漏洞修复 关闭错误信息显示...
FCKeditor 2.6 /fckeditor/editor/filemanager/connectors/uploadtest.html 文件上传漏洞
No description provided by source...
YXcms后台csrf添加管理员+getshell
简要描述： YXcms后台csrf添加管理员+getshell 详细说明： 没有任何验证，加上他又一个模版功能可建立php文件，导致getshell 漏洞证明： 1、后台添加管理然后用burp截断 我们发现没有验证，然后就构造表单 None 接下来用菜刀连接试试 连接成功...
Linux 2.6.x fs/pipe.c local root exploit
No description provided by source. For those who were not yet aware, there is at least 3 public exploits since 11/05/2009 for CVE-2009-3547 targeting all linux kernels from 2.6.0 to 2.6.31 included. Since spender and fotis have already release their own, there is not need for us to keep this on o...
XStream远程代码执行漏洞（CVE-2021-29505）
CVE-2021-29505 Vulnerability CVE-2021-29505: XStream is vulnerable to a Remote Command Execution attack. Affected Versions All versions until and including version 1.4.16 are affected, if using the version out of the box. No user is affected, who followed the recommendation to setup XStream's...
Shop7z admin/lipinadd.asp越权访问
No description provided by source...
FangMail后台SQL注射漏洞
简要描述： 1.通用漏洞 2.本案例中，很多（1900+）企业的邮件系统都托管在同一个服务器上，那么，理论上我将得到多少信息？ 详细说明： 举例说明 1.通过http://mail.aodacn.com/nmc/cgi/index.cgi登陆后台 2.注入点如下： http://mail.aodacn.com/nmc/cgi/ann.cgi?mode=editann&sid=gcipW8QUgtZsKVRpHWPKcFtjadministrator-aodacncom&annid=47&screen=editann.html 其中，annid存在注入 3. 4...
FreeType2 PFB和TTF字体解析单字节堆溢出漏洞
BUGTRAQ ID: 29637,29639 CVECAN ID: CVE-2008-1808 FreeType是一个流行的字体函数库。 FreeType中负责解析PFB和TTF字体文件的代码中存在多个堆溢出漏洞。 PFB文件中包含有各种数据结构，其中的一些储存为tabular格式。在解析表格时，有漏洞的代码段没有正确地验证用作堆缓冲区数组索引的值。计算中存在单字节错误，可能导致堆溢出。...
ubuntu特权提升漏洞（CVE-2021-3493）
...
Tipask 2.5 /control/question.php SQL注入漏洞
No description provided by source...
WordPress 利用 XMLRPC 爆破
Author: RickGray 知道创宇404安全实验室 Date: 2015-10-09 xmlrpc 是 WordPress 中进行远程调用的接口，而使用 xmlrpc 调用接口进行账号爆破在很早之前就被提出并加以利用。近日 SUCURI 发布文章介绍了如何利用 xmlrpc 调用接口中的 system.multicall 来提高爆破效率，使得成千上万次的帐号密码组合尝试能在一次请求完成，极大的压缩请求次数，在一定程度上能够躲避日志的检测。 原理分析 WordPress 中关于 xmlrpc 服务的定义代码主要位于 wp-includes/class-IXR.php 和...
PhpHostBot Login.PHP远程文件包含漏洞
PhpHostBot是一款基于PHP的WEB应用程序。 PhpHostBot不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以应用程序进程权限执行任意命令。 问题是由于'Login.PHP'脚本对用户提交的'svrrootscript'参数缺少过滤，提交远程服务器上的任意PHP文件作为包含对象，可导致以WEB权限执行任意PHP代码。 PhpHostBot 1.06 目前没有解决方案提供： http://www.idevspot.com/PhpHostBot.php...
Apache HTTPD suEXEC本地特权提升漏洞
Apache HTTP server是一款流行的WEB服务程序。 Apache HTTP server包含的suexec应用程序存在设计问题，本地攻击者可以利用漏洞提升特权。 问题一是路径检查竞争条件漏洞 在获得当前目录和更改目录中存在竞争条件问题。另一个存在于更改目录和检查目录是否为链接也存在竞争条件问题。目录结构在这些操作中更换，会导致可以在攻击者选择的任意目录中执行lstat。通过使用符号链接或重命名父目录来利用。第三个竞争条件存在于最后符号链接检查和执行目标两进制程序中。 问题二是路径检查错误 suexec工具使用strncmp检查是否当前目录是DOCU...
Hikvision IP Camera Access Bypass
Access control bypass in Hikvision IP Cameras Full disclosure Sep 12, 2017 Synopsis: --------------- Many Hikvision IP cameras contain a backdoor that allows unauthenticated impersonation of any configured user account. The vulnerability has been present in Hikvision products since at least 2014...
Ruby on Rails 'implicit render' functionality Directory Traversal Vulnerability (CVE-2014-0130)
Impact ------ The implicit render functionality allows controllers to render a template, even if there is no explicit action with the corresponding name. This module does not perform adequate input sanitization which could allow an attacker to use a specially crafted request to retrieve arbitrary...
逐浪CMS v2.4 UploadHandler.ashx 任意文件上传漏洞
No description provided by source...