56796 matches found
IBM HTTP Server mod_proxy_ftp 跨站脚本漏洞
BUGTRAQ ID: CVE ID：CVE-2008-2939 CNCVE ID：CNCVE-20082939 IBM HTTP Server是一款HTTP服务程序。 IBM HTTP Server "modproxyftp"存在输入验证问题，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 目前没有详细解决方案提供。 IBM HTTP Server 6.0.x 厂商解决方案 可参考如下安全公告获得补丁信息： http://www-01.ibm.com/support/docview.wss?uid=swg27007033...
Microsoft Windows NAT帮助程序远程拒绝服务漏洞
Microsoft Windows是微软发布的非常流行的操作系统。 Microsoft Windows NAT帮助程序模块在处理畸形DNS报文时存在漏洞，远程攻击者可能利用此漏洞执行拒绝服务攻击。 如果Windows XP用户启用了Internet连接共享的话，则远程攻击者可以通过发送Additional RRs（也被称为Additional Information）部分包含有两个空字节的DNS报文导致服务和主机进程（svchost.exe）崩溃。由于ICS服务关系到防火墙服务，因此ICS崩溃就会导致防火墙服务失效。 Microsoft Windows XP SP2 Microsoft...
Ingo Procmail驱动Shell命令执行漏洞
Ingo是一款邮件过滤规则管理器，集成于Horde和IMP Webmail客户端。 Ingo的procmail驱动没有正确地转义文件夹名称，远程攻击者可能利用此漏洞执行任意Shell命令。 Horde Ingo 1.1.1 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： ftp://ftp.horde.org/pub/ingo/ingo-h3-1.1.2.tar.gz http://ftp.horde.org/pub/ingo/ingo-h3-1.1.2.tar.gz...
Linux内核 Keyrings 引用计数溢出 UAF 漏洞
漏洞分析 Linux Kernel的这个漏洞会造成两个影响，第一个是造成信息泄露，可以bypass ASLR，另一个是UAF造成代码执行，利用的是KeyRing机制中的两个漏洞，一个是对Keyring操作控制不严谨，另一个是利用对Keyring计数变量控制不严谨，其中代码执行利用条件相对苛刻，下面对此漏洞进行详细分析。 Keyring信息泄露： Keyring和安全密钥有关，进程可以申请自己新的keyring，同时也可以通过申请新的keyring替换老的keyring，其中，调用到joinsessionkeyring函数。 long joinsessionkeyringconst cha...
NewsReactor 20070220 Article Grabbing Remote BoF Exploit (1)
No description provided by source. / NewsReactor 20070220 Article Grabbing Remote Buffer Overflow Exploit 1 &nbs...
Drupal 8 – CVE-2017-6926漏洞详解
作者：绿盟科技 来源： 近期，著名的Drupal CMS网站爆出7个漏洞，其中1个严重漏洞CVE-2017-6926，具有发表评论权限的用户可以查看他们无权访问的内容和评论，并且还可以为该内容添加评论。绿盟科技于上周发布了《Drupal下周将发布重要安全补丁威胁预警通告》。 本篇文章对Drupal 8 – CVE-2017-6926漏洞进行了详细分析。 CVE-2017-6926 漏洞详情 先看下drupal官网的通告： 有发布评论权限的用户，可以查看他们无权访问的内容和评论。 并且还可以为此内容添加评论。 想要触发这个漏洞，必须启用评论系统，并且攻击者必须有权发布评论。...
用友致远A6协同系统 /yyoa/HJ/iSignatureHtmlServer.jsp 文件 SQL注入漏洞
No description provided by source...
XTACACSD report() 缓冲区溢出漏洞
No description provided by source...
phpCodeGenie <= 3.0.2 (BEAUT_PATH) Remote File Include Vulnerability
No description provided by source. / + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - phpCodeGenie = 3.0.2 BEAUTPATH Remote File Include Vulnerability + + + - Script name: phpCodeGenie v. 3.0.2 - Script site: http://sourceforge.net/projects/phpcodegenie/ + + + - Find by: Kacper a.k.a Rahim +...
Symantec Endpoint Protection Manager 12.1.x - SEH Overflow POC
No description provided by source. Exploit-DB mirror: http://www.exploit-db.com/sploits/33056-sepm-secars-poc-v0.3.tar.gz !/usr/bin/perl -w Exploit Title: Symantec Endpoint Protection Manager 12.1.x - SEH Overflow POC Date: 31 January 2013 Exploit Author: [email protected] a.k.a...
eWebEditorNet upload.aspx 上传漏洞
WebEditorNet 主要是一个upload.aspx文件存在上传漏洞。 form id="post" encType="server" "uploadfile" style="file" size="uploadfile" runat= "lbtnUpload" runat= "JavaScript" 只是简单的对ID进行验证,只要构造javascript:lbtnUpload.click;满足条件达到上传木马的效果。成功以后查看源代码 a "lbtnUpload" "javascript:doPostBack'lbtnUpload',''"/script 'javascript'...
Libc Realpath缓冲区下溢漏洞(CVE-2018-1000001)
Introduction The vulnerability described here is caused by Linux kernel behaviour change in the syscall API returning relative pathnames in getcwd and non-defensive function implementation in libc failing to process that pathname correctly. Other libraries are very likely to be affected as well. ...
Nitro Pro 11 PDF Handling Code Execution Vulnerability(CVE-2016-2796)
Summary An out of bound write vulnerability exists in the PDF parsing functionality of Nitro Pro 11.0.4.159. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability. Tested...
BookmarkX script 2007 (topicid) Remote SQL Injection Vulnerability
No description provided by source. BookmarkX scriptPowered by GengoliaWebStudioSQL Injection AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DorKs 1 : "2007 BookmarkX script" DORKS 2 : Powered by GengoliaWebStudio DORK 3 : allinurl :"index.php?menu=showtopic" EXPLOIT :...
MS14-058 Windows内核提权漏洞 (CVE-2014-4113)
No description provided by source...
D-link DIR-890L HNAP 未授权信息泄漏漏洞
HNAPHome Network Administration Protocol,家庭网络管理协议是一种基于SOAPSimple Object Access Protocol,简单对象管理协议的协议，和UPnP很像，通常被D-Link的”EZ”设置程序用来初始化设置路由器。 存在问题代码： / Grab a pointer to the SOAPAction header / SOAPAction = getenv"HTTPSOAPACTION"; / Skip authentication if the SOAPAction header contains...
phpmywind 5.0 后台GetShell漏洞
简要描述： 这各漏洞子前被报过，但是厂商的修复不彻底。 详细说明： admin/webcongif.php 的过滤代码如下。 //强制去掉 ' //强制去掉最后一位 / $vartmp = strreplace"'",'',$row'varvalue'; ifsubstr$vartmp, -1 == '\' $vartmp = substr$vartmp,1,-1; 只过滤了最后一位的反斜杠，只需要加两个反斜杠就可以了····· 首先修改网站配置信息 configcache.php中会变成这样 $cfgwebname = '的网站'; $cfgweburl =...
resin 3.1.1 跨站脚本漏洞
No description provided by source...
Lighttpd 'mod_userdir'大小写区分对比安全绕过漏洞
BUGTRAQ ID: 31600 CVE ID：CVE-2008-4360 CNCVE ID：CNCVE-20084360 Lighttpd是一款开放源代码的WEB服务器程序。 Lighttpd 'moduserdir'模块存在安全绕过问题，远程攻击者可以利用漏洞绕过部分安全限制，获得敏感信息。 lighttpd...
ZyXEL ZyWALL Quagga/Zebra (default pass) Remote Root Vulnerability
No description provided by source. Name: ZyXEL ZyWALL Quagga/Zebra Remote Root Vulnerability Release Date: 10 March 2008 Discover: Pranav Joshi [email protected] Vendor: ZyXEL Products Affected: ZyWALL Status on other affected products & firmwares pending from vendor’s end CVE-2008-1160 BID...
Limbo CMS <= 1.0.4.2L (com_contact) Remote Code Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? printr' ----------------------------------------------------------------------------- Limbo = 1.0.4.2L "comcontact" remote commands execution exploit by rgod [email protected] site: http://retrogod.altervista.org dorks:...
Allegro v4.34 权限提升漏洞
Allegro v4.34 权限提升漏洞 1.漏洞分析 在RomPager 4.34版之前（RomPager软件已有10多年的历史）存在一个严重的漏洞，这个漏洞被称为厄运 cookie（Misfortune Cookie），这是因为它可以让黑客通过操作cookie来控制HTTP请求的“幸运值”。 这个漏洞编号为CVE-2014-9222，如果攻击者向存在漏洞的RomPager服务器发送特定请求，会使得这类网关设备内存紊乱，攻击者获得管理权限。 这个漏洞正在影响全球1200万台路由器安全， D-Link、 TP-Link、华为、中兴等品牌均受到影响，攻击者可以利用漏洞远程控制设备及监控流量...
CartWIZ 1.10 ProductDetails.ASP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13332/info CartWIZ is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to utilizing the data in an SQL query. Successful exploitatio...
TSEP <= 0.942 (colorswitch.php) Remote Inclusion Vulnerability
No description provided by source. Script: TSEP = 0.942 URL: www.tsep.info Discovered: beford xbefordx gmail com Comments: registerglobals must be enabled duh. document.this != http://www.milw0rm.com/exploits/2098 Vulnerable Files/Code:...
PHP "php_register_variable_ex()"函数任意代码执行漏洞(CVE-2012-0830)
CVE-2012-0830 Php是一款流行的编程语言 PHP在12月为哈希碰撞拒绝服务CVE-2011-4885http://sebug.net/vuldb/ssvid-30001提供的补丁引出了另一个严重的安全漏洞。 防止哈希碰撞的补丁在php.ini中引入了新的配置属性： maxinputvars 此配置元素限制用于请求中使用的变量数量如http://request.com/foo.php?a=1&b=2&c=3，默认设置为1000。...
Vermillion FTP Deamon v1.31 Remote BOF Exploit
No description provided by source. Exploit Title: Vermillion FTP Deamon Remote BOF Exploit Date: 29/01/2010 Author: Dzattacker Software Link: http://www.softsea.com/download/Vermillion-FTP-Daemon.html Version: 1.31 Tested on: Windows xp sp3 Code : !/usr/bin/python + Original :...
dedecms最新版本后台getshell
官方下载最新安装包http://updatenew.dedecms.com/base-v57/package/DedeCMS-V5.7-UTF8-SP2.tar.gz 环境：Linux+phpstudy 上传图片抓包 POST /dedecms/include/dialog/selectimagespost.php?CKEditor=body&CKEditorFuncNum=2&langCode=zh-cn HTTP/1.1 Host: Content-Length: 42080 Cache-Control: max-age=0 Origin: http://...
Weaver E-cology wui/theme/ecology7/page/login. jsp parameter templateId time blind
No description provided by source...
金蝶AES系统Java web配置文件敏感信息泄露漏洞
0x01 漏洞框架 金蝶软件始创于1993年，是一家ERP、财务等企业管理软件厂商，拥有官网kigndee.com、友商网（youshang.com）、快递100（kuaidi100.com）、云之家（kdweibo.com）等互联网业务应用 官方主页：www.kingdee.com 客户案例： 0x02 漏洞利用 金蝶AES系统Java web配置文件可任意下载。 portal下的配置文件： http://58.63.253.42/portal/WEB-INF/web.xml...
Android Browser应用程序拒绝服务漏洞
Android 4.0.3浏览器应用不正确处理特殊的URI，允许攻击者在IFRAME元素SRC属性中使用特制的market: URI并诱使应用程序解析，可使应用程序崩溃。 测试方法 var mframe = ""; forvar i = 0; i...
Webfroot Shoutbox < 2.32 (Apache) Remote Exploit
No description provided by source. !/usr/bin/perl Webfroot Shoutbox 2.32 on apache exploit use IO::Socket; my $host = 127.0.0.1; my $port = 80; my $shoutbox = shoutbox.php?conf=; my $shoutboxpath = /shoutbox; my $cmd = ls -l; my $conn; my $type; my @logs = /etc/httpd/logs/acceslog,...
Pre-Auth MySQL remote DOS (Integer Overflow)（CVE-2017-3599）
MySQL server is affected by a remote DoS attack, which could be exploited by a remote unauthenticated attacker to cause a loss of availability on the targeted service. The issue has been verified to affect 5.6.X branch up to 5.6.35 and 5.7.X branch up to 5.7.17. It is strongly recommended that...
Bouncy Castle Java library信息泄漏漏洞
No description provided by source...
FileSeek CGI Script Remote Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6783/info FileSeek is an example cgi-script from The CGI/Perl Cookbook from John Wiley & Sons. The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web server. It has...
duomicms前台全局变量覆盖导致getshell
...
盈世Coremail XT3.0 附件处存储型XSS
No description provided by source...
xpshop商城管理系统储存型XSS，可盲打后台
简要描述： 这个是商城管理系统，你们懂得哈 详细说明： demo演示哈 官网：http://xpshop.cn demo地址http://hzp.xpshop.cn demo后台：http://etp.xpshop.cn/admin 用户名：admin 密码：888888 先注册个会员账号，然后存在XSS的地址在会员中心--地址管理--收货人姓名那里我先插入 然后保存可以看到成功弹窗 然后查看源码可以看到是储存型XSS 接下来先去随便选个东西 然后购买，地址那里是我们之前插入的XSS语句...
Yellow Swordfish Simple Forum 1.x 'topic' Parameter SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/27825/info Simple Forum is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise...
nginx 1.3.9-1.4.0 DoS PoC
No description provided by source. !/usr/bin/env python Exploit Title: nginx v1.3.9-1.4.0 DOS POC CVE-2013-2070 Google Dork: CVE-2013-2070 Date: 16.05.2013 Exploit Author: Mert SARICA - mert . sarica @ gmail . com - http://www.mertsarica.com Vendor Homepage: http://nginx.org/ Software Link:...
杰奇小说连载系统(JieqiCMS) V1.7 /modules/article/packdown.php 文件 cid 参数任意文件下载漏洞
No description provided by source...
极通 EWEBS 应用虚拟化系统信息泄露漏洞
No description provided by source...
easysite内容管理系统某简单粗暴的SQL注入
简要描述： web services是不会骗人的！ 大量gov站点采用了easysite内容管理系统。 详细说明： 1.soap注入 easysite webservice 文件： http://www.py.gov.cn/DesktopModules/CInfo/WebService/CInfoService.asmx 2.ArticleIDs参数存在SQL注入漏洞 随便找个放sqlmap里跑吧 POST /DesktopModules/CInfo/WebService/CInfoService.asmx HTTP/1.1 Host: dynamic.xmedu.gov.cn...
Lazarus Guestbook 1.6 codes-english.php show Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/18956/info Lazarus Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute...
Zorum 3.5 DBProperty.PHP Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/20606/info Zorum is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. A successful exploit of this issue allows an attacker to execute arbitrary server-side script cod...
Mambo MGM Component <= 0.95r2 Remote Inclusion Vulnerability
No description provided by source. ---------------------------------------------------- Mambo Gallery Manager v095.r3 Remote File Inclusion Vulnerabilities ---------------------------------------------------- Discovered By A-S-T TEAM WE ARE CrAsHoVeRrIdE & BLACK-CODE & MR-HCR...
lighttpd 1.4.31 Denial of Service PoC
No description provided by source. !/bin/bash Exploit Title: simple lighttpd 1.4.31 DOS POC Date: 11/21/2012 Exploit Author: [email protected] Vendor Homepage: http://www.lighttpd.net Software Link: http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.31.tar.gz Version: 1.4.31 Tested on:...
TotalCalendar 2.4 (inc_dir) Remote File Inclusion Vulnerability
No description provided by source. //// //1 9 2 3 T U R K - G R U P// //// //-----------------------------------------------------------------------// --+-- Home Page : "http://www.simpoe.com/" Download : "http://www.simpoe.com/calendre/TotalCalendar2.4.zip" ScriptName: "Simpoe Event Calendar"...
Sudo <= 1.6.9p18 (Defaults setenv) Local Privilege Escalation Exploit
No description provided by source. !/bin/sh Sudo = 1.6.9p18 local r00t exploit by Kingcope/2008/www.com-winner.com Most lame exploit EVER! Needs a special configuration in the sudoers file: --- "Defaults setenv" so environ vars are preserved : --- May also need the current users password to be...
PHP-Nuke Advertising Module Modules.PHP SQL注入漏洞
PHP-Nuke Advertising Module是一款基于PHP的WEB应用程序。 PHP-Nuke Advertising Module不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'Modules.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或可能操作数据库。 PHP-Nuke Advertising Module 0.9 升级到最新的PHP-Nuke Advertising Module 0.9...
Apache Mod_Rewrite单字节缓冲区溢出漏洞
Apache是一款流行的开放源代码的HTTPD服务程序。 Apache modrewrite模块中LDAP机制处理存在单字节溢出错误，远程攻击者可以利用漏洞以WEB进程权限执行任意指令。 Apache modrewrite模块提供了一个基于规则的使用正则表达式分析器的实时转向URL请求的引擎。modrewrite模块在转义绝对URI机制时存在单字节错误，当分离LDAP URL的数据时escapeabsoluteuri 函数中会触发此漏洞。触发此漏洞可导致指向用户提供数据的指针写入字符指针数组边界之外，可用于控制程序，以WEB权限执行任意指令。...