56796 matches found
Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5/SP6 Services.exe Denial of Service (2)
No description provided by source. source: http://www.securityfocus.com/bid/754/info A specially crafted packet can cause a denial of service on an NT 4.0 host, rendering local administration and network communication nearly unusable. This attack will crash the services executable, which in turn,...
Gemitel 3.50 Affich.PHP Remote File Include Command Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10156/info A vulnerability has been identified in the handling of input by Gemitel. Because of this, it may be possible for a remote user to gain unauthorized access to a system using the vulnerable software. It is possib...
AV Arcade Search Field XSS/HTML Injection
No description provided by source. Exploit Title: AV Arcade Search Field XSS/HTML Injection Date: 6/5/2010 Author: Vadim Toptunov, http://www.twitter.com/pentesting Software Link: http://www.avscripts.net/avarcade/ Version: 5.1.4 Free and Pro latest and prior Tested on: Any NIX CVE : N/a Code :...
Adobe Acrobat ActiveX Control 1.3.188 ActiveX Buffer Overflow
No description provided by source. source: http://www.securityfocus.com/bid/666/info There is a buffer overflow in the 1.3.188 version of the Adobe Acrobat ActiveX control pdf.ocx that ships with Acrobat Viewer 4.0. This ActiveX control is marked 'Safe for Scripting' within Internet Explorer 4.X...
Microsoft .NET Framework 用户验证权限提升漏洞(CVE-2011-3416)
BUGTRAQ ID: 51201 CVE ID: CVE-2011-3416 ASP.NET是一套由Microsoft分发的帮助开发者构建基于WEB应用的系统。 Microsoft .NET Framework在用户验证的实现上存在权限提升漏洞，攻击者可利用此漏洞非法访问另一个用户账户，以其权限执行任意命令。要利用此漏洞，非法攻击者需要在ASP.NET应用上注册一个帐户并了解目标用户的现有帐户名，然后使用之前注册的账目名访问该帐户来构造特制的Web请求。 0 Microsoft .NET Framework 4.x Microsoft .NET Framework 3.x...
Kide Shoutbox v0.4.6 XSS & AXFR
No description provided by source. andresg888 Web: : www.ilegalintrusion.nethttp://www.ilegalintrusion.net & www.bl4ck-p0rtal.orghttp://www.bl4ck-p0rtal.org Exploit : Go to the shoutbox and type: font color="red"red text/font or marqueehi/marquee or 3xplo!t :...
Websense Email Security xss
No description provided by source. Security Advisory NSOADV-2009-003 Title: Websense Email Security Cross Site Scripting Severity: Low Advisory ID: NSOADV-2009-003 Found Date: 28.09.2009 Date Reported: 01.10.2009 Release Date: 20.10.2009 Author: Nikolas Sotiriu Mail: nso-research at sotiriu.de UR...
OpenSSH CBC模式信息泄露漏洞
BUGTRAQ ID: 32319 OpenSSH是一种开放源码的SSH协议的实现，初始版本用于OpenBSD平台，现在已经被移植到多种Unix/Linux类操作系统下。 如果配置为CBC模式的话，OpenSSH没有正确地处理分组密码算法加密的SSH会话中所出现的错误，导致可能泄露密文中任意块最多32位纯文本。在以标准配置使用OpenSSH时，攻击者恢复32位纯文本的成功概率为2^-18，此外另一种攻击变种恢复14位纯文本的成功概率为2^-14。 OpenSSH OpenSSH 4.7p1 SSH Communications Security Tectia Server 6.x SSH...
Coppermine Photo Gallery upload.php文件SQL注入漏洞
BUGTRAQ ID: 28766 Coppermine是用PHP编写的多用途集成web图形库脚本。 Coppermine的upload.php文件处理用户请求数据时存在输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击。 在执行URI/URL上传时Coppermine的upload.php文件没有正确地过滤远程HTTP服务器的MIME媒体类型输入，这允许远程攻击者通过操控SQL查询请求执行SQL注入攻击。 Coppermine Photo Gallery 1.4.16 临时解决方法： 在upload.php文件中找到以下行： else // We will try to get...
Mozilla Firefox table use-after-free（CVE-2017-5404）
Mozilla bug tracker link: https://bugzilla.mozilla.org/showbug.cgi?id=1340138 There is a use-after-free security vulnerability in Firefox. The vulnerability was confirmed on the nightly ASan build. PoC and ASan log can be found below. Notes for reproducing: - PoC uses domFuzzLite3 extension...
Dnsmasq < 2.50 - Heap Overflow & Null pointer Dereference Vulns
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Dnsmasq Heap Overflow and Null-pointer Dereference on TFTP Server 1. Advisory Information Title: Dnsmasq Heap Overflow and...
Novell GroupWise Messenger Client <= 2.1.0 Unicode Stack Overflow
No description provided by source. Luigi Auriemma Application: Novell GroupWise Messenger client http://www.novell.com/products/groupwise/ Versions: = 2.1.0 Platforms: Windows, Linux, NetWare Bug: unicode stack overflow Exploitation: remote, versus server Date: 16 Feb 2012 found 09 May 2011 Autho...
Cacti未明远程命令执行漏洞
Bugtraq ID:66387 CVE ID:CVE-2014-2328 Cacti是一套基于PHP,MySQL,SNMP及RRDTool开发的网络流量监测图形分析工具。 Cacti使用exec-like方法PHP函数调用，由于没有任何安全检查，允许攻击者利用漏洞提交恶意请求执行任意命令。 0 Cacti 0.8.7g 目前没有详细解决方案提供： http://www.cacti.net/...
JCMS 2010任意文件下载漏洞
大汉版通JCMS 2010内容管理系统是基于J2EE构架设计，以全新理念构建的内容管理系统。系统提供了从内容采集、 创建、管理、传递、发布、共享呈送等信息全生命周期过程中所需的各项功能。 在/module/download/downfile.jsp文件中,没有对pathfile和filename参数进行判断，导致可以下载任意 WEB目录下的文件。 JCMS 2010 SEBUG临时解决办法 对pathfile和filename参数进行合理判断。 ———— http://www.hanweb.com/...
Joomla Component rapidrecipe <= 1.6.5 SQL Injection Vulnerability
No description provided by source. joomla SQL Injectioncomrapidrecipe AUTHOR : S@BUN HOME : http://www.hackturkiye.com MA陌L : [email protected] DORK 1 : allinurl: "comrapidrecipe"userid DORK 2 : allinurl: "comrapidrecipe" categoryid EXPLOIT : after userid or catogryid add exploit...
Apple Mac OS X v10.5.1 2007-009 Multiple Security Vulnerabilities
CVE-2007-4708 CVE-2007-4709 CVE-2007-4710 CVE-2007-5847 CVE-2007-5848 CVE-2007-5849 CVE-2007-5850 CVE-2007-5851 CVE-2007-5853 CVE-2007-5854 CVE-2007-5855 CVE-2007-5856 CVE-2007-5857 CVE-2007-5859 CVE-2007-5876 CVE-2007-5860 CVE-2007-5861 These issues affect Mac OS X and various applications,...
Oracle VirtualBox Multiple Guest to Host Escape Vulnerabilities(CVE-2018-2698)
Vulnerabilities summary The following advisory describes two 2 guest to host escape found in Oracle VirtualBox version 5.1.30, and VirtualBox version 5.2-rc1. Credit An independent security researcher, Niklas Baumstark, has reported this vulnerability to Beyond Security’s SecuriTeam Secure...
V2视频会议系统 /Conf/jsp/systembulletin/bulletinAction.do sysId参数SQL注入漏洞
No description provided by source...
中国移动和路由 Telnet 漏洞
No description provided by source...
SafeNet Sentinel Protection Server 7.0 - 7.4 and Sentinel Keys Server 1.0.3 - 1.0.4 Directory Traversal
No description provided by source. !/usr/bin/python Exploit Title: SafeNet Sentinel Protection Server 7.0 - 7.4 and Sentinel Keys Server 1.0.3 - 1.0.4 Directory Traversal Date: 04/28/2014 Exploit Author: Matt Schmidt Syph0n Vendor Homepage: http://www.safenet-inc.com/ Software Link:...
cPassMan 1.82 - Remote Command Execution Exploit
No description provided by source. Product. Collaborative Passwords Manager cPassMan Platform. Independent PHP Affected versions. 1.82 ?php / cPassMan v1.82 Remote Command Execution Exploit by ls [email protected] Disclaimer: cPassMan developer was notified of vulnerabilities in April 2011...
Joomla Component com_datsogallery 1.6 - Blind SQL Injection Exploit
No description provided by source. ? //Joomla Component comdatsogallery 1.6 Blind SQL Injection Exploit by +toxa+ //Greets: all members of antichat.ru & cih.ms //options settimelimit0; ignoreuserabort1; $normua='Mozilla/5.0 Windows; U; Windows NT 6.0; ru; rv:1.8.1.14 Gecko/20080404...
Kide Shoutbox 0.4.6 - XSS & AXFR
No description provided by source. andresg888 Web: : www.ilegalintrusion.nethttp://www.ilegalintrusion.net & www.bl4ck-p0rtal.orghttp://www.bl4ck-p0rtal.org Exploit : Go to the shoutbox and type: font color=redred text/font or marqueehi/marquee or 3xplo!t :...
Jetty 3.1.6/3.1.7/4.1 Servlet Engine Arbitrary Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5852/info A flaw in the CGIServlet in Jetty allows an attacker to execute arbitrary commands on the server. Specifically, it is possible for an attacker to use directory traversal sequences and cause the CGIServlet to...
eWebEditor 2.1.6 /upload.asp 文件上传漏洞
eWebEditor是一个基于浏览器的在线HTML编辑器，其 1.1.3 2.1.6版本/Upload.asp文件的InitUpload函数处第168行存在sql注入，这里并没有对请求中的参数style进行过滤。...
Xoops 2.5.4 Blind SQL Injection Vulnerability
No description provided by source. Dork: "Powered by XOOPS 2.5.4" Download: http://sourceforge.net/projects/xoops/ Date: 10/12/2011 Author: blkhtc0rp Mail: blkhtc0rpatyahoodotcom Tested on: Freebsd 8 and Debian Squeeze Note: In order to be successful an attacker must have permission to access the...
vsftpd FTP Server "ls.c"远程拒绝服务漏洞
BUGTRAQ ID: 46617 CVE ID: CVE-2011-0762 vsftpd是Very Secure FTP daemon的缩写，是UNIX类平台上安全的FTP服务器。 vsftpd在处理ls.c时存在远程拒绝服务漏洞，远程攻击者可利用此漏洞造成受影响应用程序崩溃，拒绝服务合法用户。 Vsftpd 2.3.2 Vsftpd 2.3 厂商补丁： Vsftpd ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://vsftpd.beasts.org/ include stdio.h include stdlib.h include...
JBoss Seam参数化EL表达式远程代码执行漏洞
BUGTRAQ ID: 41994 CVECAN ID: CVE-2010-1871 JBoss Seam是一个Java EE5框架，把JSF与EJB3.0组件合并在一起，从而为开发基于Web的企业应用程序提供一个最新的模式。 JBoss Seam处理某些参数化JBoss EL表达式的方式存在输入过滤漏洞。如果远程攻击者能够诱骗通过认证的JBoss Seam用户访问特制的网页，就可能导致执行任意代码。 JBoss Seam 2.0.2 SP1 JBoss Seam 2.0.2 JBoss Seam 2.0 厂商补丁： RedHat ------...
Apache APR-util apr_brigade_vprintf函数单字节溢出漏洞
BUGTRAQ ID: 35251 CVECAN ID: CVE-2009-1956 Apr-util是Apache所使用的Apache可移植运行时工具库。 big-endian平台上所运行的APR-util库的aprbrigadevprintf函数中存在单字节溢出漏洞： 632 APUDECLAREaprstatust aprbrigadevprintfaprbucketbrigade b, ... 638 struct brigadevprintfdatat vd; 639 char bufAPRBUCKETBUFFSIZE; 640 aprsizet written; ... 65...
MailBee Objects 5.5 (MailBee.dll) Remote Insecure Method Exploit
No description provided by source. body bgcolor="000000" div align="center" precodespan style="font: 10pt verdana;"font color="00FF00"=======================================================================/font /divcenter font face="Verdana" color="00FF00"bMailBee Objects v5.5 MailBee.dll Insecur...
Microsoft Windows递归DNS欺骗漏洞（MS07-062）
BUGTRAQ ID: 25919 CVECAN ID: CVE-2007-3898 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的DNS服务器实现上存在漏洞，远程攻击者可能利用此漏洞导致DNS欺骗。 在向上游DNS服务器发送请求时Windows的DNS服务（dns.exe）使用了可预测的事件，这允许攻击者执行DNS缓存破坏攻击。当DNS服务器执行递归查询的时候，攻击者就可以通过特制的DNS响应导致欺骗或者从合法位置重定向Internet流量。 Microsoft Windows Server 2003 x64 Edition Microsoft...
KarjaSoft Sami FTP Server多个命令远程缓冲区溢出漏洞
KarjaSoft Sami FTP Server是一款FTP服务程序。 KarjaSoft Sami FTP Server处理多个命令存在缓冲区溢出问题，远程攻击者可以利用漏洞以应用程序执行任意指令。 发送超长UER/PASS请求给服务器，可触发缓冲区溢出，精心构建提交数据可能以进程权限执行任意指令。 KarjaSoft Sami FTP Server 2.0.2 目前没有解决方案提供： http://www.karja.com/samiftp/main.php / KarjaSoft Sami FTP Server 2.0.2 USER/PASS buffer overflow &n...
Integramod Portal Phpbb_Root_Path远程文件包含漏洞
Integramod Portal是一款基于PHP的WEB应用程序。 Integramod Portal不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'functionsportal.php'脚本对用户提交的'PhpbbRootPath'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 IntegraMOD IntegraMOD Portal 2 http://www.integramod.com/...
CHIYU IoT services Authentication bypass in telnet server(CVE-2021-31251)
...
ASPCMS最新版V2.5.6权限提升漏洞
简要描述： ASPCMS最新版V2.5.6存在权限提升漏洞，注册普通用户的时候可以直接注册成超级管理员。 详细说明： ASPCMS最新版V2.5.6下载地址： http://www.aspcms.com/aspcms-2179839-1-1.html 该版本存在insert注入，在注册用户的时候没有判断性别参数Gender是否为数字，插入数据库的时候没有用引号引起来，导致过滤函数不起作用。利用Access 16%截断技巧注释掉后面的语句，可以直接注册GroupID为1的超级管理员组用户。 /member/reg.asp Sub addUser 'dim...
SiteServer 3.6.4 background_thread.aspx SQL注入漏洞
SiteServer 3.6.4 /siteserver/bbs/backgroundthread.aspx 文件Title参数没有合适过滤，导致SQL注入漏洞。 0 SiteServer 3.6.4 升级到官方最新版： http://www.siteserver.cn...
Discuz! x3.1 /utility/convert/index.php 代码执行漏洞
No description provided by source...
PHP-CGI Argument Injection Remote Code Execution
No description provided by source. !/usr/bin/python import requests import sys print """ CVE-2012-1823 PHP-CGI Arguement Injection Remote Code Execution This exploit abuses an arguement injection in the PHP-CGI wrapper to execute code as the PHP user/webserver user. Feel free to give me abuse abo...
Linux Kernel BER Decoding Remote Buffer Overflow Vulnerability
CVE-2008-1673 The Linux Kernel is prone to a remote buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successfully exploiting this issue wil...
Cisco Unified IP Phone SCCP及SIP协议多个远程安全漏洞
BUGTRAQ ID: 27774 CVECAN ID: CVE-2008-0530,CVE-2008-0526,CVE-2008-0527,CVE-2008-0528,CVE-2008-0529,CVE-2008-0531 Cisco Unified IP Phone是思科的统一IP电话解决方案。 DNS响应解析溢出 运行SCCP和SIP固件的Cisco Unified IP Phone 7940、7940G、7960和7960G设备在处理DNS响应时存在缓冲区溢出漏洞，特制的DNS响应可以触发缓冲区溢出，在有漏洞的电话上执行任意指令。该漏洞记录为CVE-2008-0530和Cisco...
VWar <= v1.5.0 R15 (mvcw.php) Remote File Inclusion Vulnerability
No description provided by source. '/ -.- --------------------oOO------OOo-------------------- | VWar = v1.5.0 R15 mvcw.php Remote File Inclusion | | coded by DNX | ------------------------------------------------------- ! Discovered: DNX ! Vendor: http://www.vwar.de ! Detected: 26.02.2007 !...
Squirrelcart <= 1.x.x (cart.php) Remote File Inclusion Vulnerability
No description provided by source. Title : Squirrelcart = 1.x.x Remote File Inclusion URL : http://squirrelcart.com/ Google Dork : inurl:"/squirrelcart/" -squirrelcart.com Author : ShaiMagal Vulnerable file : popupwindow.php - config.php, line 13 - $siteisproot = "blablabla"; Exploit :...
QNAP Music Station/Malware Remover未授权远程代码执行漏洞（CVE-2020-36197 CVE-2020-36198）
QNAP MusicStation/MalwareRemover Pre-Auth Remote Code Execution Summary QNAP MusicStation and MalwareRemover official apps are affected by an arbitrary file upload and a command injection vulnerabilities, leading to pre-auth remote root command execution. Product description from vendor “QNAP...
D-Link DIR-3060 授权RCE漏洞（CVE-2021-28144）
Advisory: D-Link DIR-3060 Authenticated RCE CVE-2021-28144 MARCH 11, 2021 Overview The D-Link DIR-3060 running firmware versions below v1.11b04 is affected by a post-authentication command injection vulnerability. Anybody with authenticated access to a DIR-3060 would be able to run arbitrary syst...
Oracle Knowledge Management XXE Leading to a RCE
Vulnerability Summary The following advisory describe Information Disclosure found in Oracle Knowledge Management version 8.5.1. By enabling searches across a wide variety of sources, Oracle’s InQuira knowledge management products offer simple and convenient ways for users to access knowledge tha...
正方教务系统 ResultXml_common.aspx SQL 注入漏洞
Payload: /ResultXmlcommon.aspx?k=%&column='username='||xh||''||'passwd='||mm||''&table=xsjbxxb+where+rownum"; xml = xml + "" + dr0.ToString + ""; dr.Close; comm.Dispose; conn.Close; xml = x...
Pure-FTPd External Authentication Bash Environment Variable Code Injection
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Ftp include...
ProductCart 1.x/2.x Custva.asp redirectUrl Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/9669/info EarlyImpact ProductCart is reportedly prone to multiple vulnerabilities. The specific issues include SQL injection, cross-site scripting and cryptographic weaknesses. These issues could expose sensitive data suc...