56796 matches found
Apache mod_imagemap和mod_imap模块跨站脚本漏洞
BUGTRAQ ID: 26838 CVECAN ID: CVE-2007-5000 Apache HTTP Server是一款流行的Web服务器。 Apache的modimagemap和modimap模块中没有正确地过滤某些用户输入，允许远程攻击者提交恶意的HTTP请求执行跨站脚本攻击。 Apache Group Apache 2.2.0 - 2.2.6 Apache Group Apache 2.0.35 - 2.0.61 Apache Group Apache 1.3.0 - 1.3.39 Apache Group ------------...
Net-SNMP GETBULK远程拒绝服务漏洞
BUGTRAQ ID: 26378 CVECAN ID: CVE-2007-5846 Net-SNMP是一个免费的、开放源码的SNMP实现，以前称为UCD-SNMP。 Net-SNMP在处理畸形的SNMP GETBULK请求时存在漏洞，远程攻击者可能利用此漏洞导致服务器不可用。 Net-SNMP没有正确地处理SNMP GETBULK请求，如果远程攻击者发送了包含有超长max-repetitions字段的畸形SNMP GETBULK请求的话，就可能导致耗尽大量CPU和内存资源。 0 Net-SNMP net-snmp 5.4.1...
Integramod Portal Phpbb_Root_Path远程文件包含漏洞
Integramod Portal是一款基于PHP的WEB应用程序。 Integramod Portal不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'functionsportal.php'脚本对用户提交的'PhpbbRootPath'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 IntegraMOD IntegraMOD Portal 2 http://www.integramod.com/...
IdeaBox <= 1.1 (gorumDir) Remote File Include Vulnerability
No description provided by source. $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$ $$ $$ IdeaBox = 1.1 gorumDir Remote File Include Vulnerability $$ script site: http://ideabox.phpoutsourcing.com/ $$ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $$ $$ Find by:...
MacOS/iOS multiple kernel UAFs due to incorrect IOKit object lifetime management in IOTimeSyncClockManagerUserClient(CVE-2017-13847)
IOTimeSyncClockManagerUserClient provides the userspace interface for the IOTimeSyncClockManager IOService. IOTimeSyncClockManagerUserClient overrides the IOUserClient::clientClose method but it treats it like a destructor. IOUserClient::clientClose is not a destructor and plays no role in the...
Apache Solr 7.0.1 - XML External Entity Expansion / Remote Code Execution(CVE-2017-12629)
First Vulnerability: XML External Entity Expansion deftype=xmlparser Lucene includes a query parser that is able to create the full-spectrum of Lucene queries, using an XML data structure. Starting from version 5.1 Solr supports "xml" query parser in the search query. The problem is that lucene x...
中国移动和路由 Telnet 漏洞
No description provided by source...
正方教务系统 ResultXml_common.aspx SQL 注入漏洞
Payload: /ResultXmlcommon.aspx?k=%&column='username='||xh||''||'passwd='||mm||''&table=xsjbxxb+where+rownum"; xml = xml + "" + dr0.ToString + ""; dr.Close; comm.Dispose; conn.Close; xml = x...
Shopex V4.8.4-4.8.5 svinfo.php 文件信息泄露漏洞
0x01 框架简述 Shopex是国内市场占有率最高的网店软件，基于免费开源但却性能卓越的Lamp（Linux+Apache+Mysql+Php）架构，最大程度降低您的总体拥有成本。 中文名：商派 外文名：Shopex 服务商：上海派浓网络科技有限公司 官方主页：http://www.shopex.cn/ 0x02 漏洞细节 如果install目录没删，下面这个可以看phpinfo http://www.xx.com/install/svinfo.php?phpinfo=true 两个实例： http://www.5fa.cc/install/svinfo.php?phpinfo=tru...
ASPCMS最新版V2.5.6权限提升漏洞
简要描述： ASPCMS最新版V2.5.6存在权限提升漏洞，注册普通用户的时候可以直接注册成超级管理员。 详细说明： ASPCMS最新版V2.5.6下载地址： http://www.aspcms.com/aspcms-2179839-1-1.html 该版本存在insert注入，在注册用户的时候没有判断性别参数Gender是否为数字，插入数据库的时候没有用引号引起来，导致过滤函数不起作用。利用Access 16%截断技巧注释掉后面的语句，可以直接注册GroupID为1的超级管理员组用户。 /member/reg.asp Sub addUser 'dim...
SafeNet Sentinel Protection Server 7.0 - 7.4 and Sentinel Keys Server 1.0.3 - 1.0.4 Directory Traversal
No description provided by source. !/usr/bin/python Exploit Title: SafeNet Sentinel Protection Server 7.0 - 7.4 and Sentinel Keys Server 1.0.3 - 1.0.4 Directory Traversal Date: 04/28/2014 Exploit Author: Matt Schmidt Syph0n Vendor Homepage: http://www.safenet-inc.com/ Software Link:...
Calibre E-Book Reader Local Root Race Condition Exploit
No description provided by source. !/bin/sh .70-Calibrer Assault Mount by Dan Rosenberg @djrbliss and zx2c4 Yesterday we learned how Calibre's ability to mount anything anywhere resulted in a local root. Today's exploit shows a race condition to subvert recent changes preventing symlinks and...
Xoops 2.5.4 Blind SQL Injection Vulnerability
No description provided by source. Dork: "Powered by XOOPS 2.5.4" Download: http://sourceforge.net/projects/xoops/ Date: 10/12/2011 Author: blkhtc0rp Mail: blkhtc0rpatyahoodotcom Tested on: Freebsd 8 and Debian Squeeze Note: In order to be successful an attacker must have permission to access the...
ZoneAlarm Vsdatant.SYS驱动本地拒绝服务漏洞
ZoneAlarm是一款流行的个人防火墙系统。 ZoneAlarm 'vsdatant.sys'驱动处理参数存在问题，本地攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 SSDT函数句柄执行在内核模式下执行，但他们的调用者执行在用户模式下，因此所有函数参数来自用户模式，所以必须严格验证这些参数，不正确使用这些函数可导致系统崩溃。 ZoneAlarm在SSDT中hook多个函数，其中至少有2个情况下缺少丢来自用户模式下的参数数据，由于Kerio驱动fwdrv.sys和khips.sys驱动的错误，用户调用不合法的NtCreateKey和NtDeleteFile参数值可导致系统崩溃。 Zon...
Joomla 存储型XSS漏洞(CVE-2021-26032)
JOOMLA PASSWORD RESET VULNERABILITY AND A STORED XSS FOR FULL COMPROMISE Intro Joomla is one of the most popular CMS-es with over 1.5 million installations world-wide. We pentested Joomla 3.9.24 and found a password reset vulnerability which we chained with a set of vulnerabilities and features t...
Microsoft SharePoint远程代码执行漏洞（CVE-2021-31181）
CVE-2021-31181: MICROSOFT SHAREPOINT WEBPART INTERPRETATION CONFLICT REMOTE CODE EXECUTION VULNERABILITY June 02, 2021 | The ZDI Research Team In May of 2021, Microsoft released a patch to correct CVE-2021-31181 – a remote code execution bug in the supported versions of Microsoft SharePoint Serve...
Exim 4.89 - 'BDAT' Denial of Service(CVE-2017-16944)
On 23 November, 2017, we reported two vulnerabilities to Exim. These bugs exist in the SMTP daemon and attackers do not need to be authenticated, including CVE-2017-16943 for a use-after-free UAF vulnerability, which leads to Remote Code Execution RCE; and CVE-2017-16944 for a Denial-of-Service D...
Microsoft Windows COM Local Privilege Escalation Vulnerability(CVE-2017-0213)
Summary: When accessing an OOP COM object using IRemUnknown2 the local unmarshaled proxy can be for a different interface to that requested by QueryInterface resulting in a type confusion which can result in EoP. Description: Querying for an IID on a OOP or remote COM object calls the ORPC method...
Oracle Knowledge Management XXE Leading to a RCE
Vulnerability Summary The following advisory describe Information Disclosure found in Oracle Knowledge Management version 8.5.1. By enabling searches across a wide variety of sources, Oracle’s InQuira knowledge management products offer simple and convenient ways for users to access knowledge tha...
V2视频会议系统命令执行漏洞
No description provided by source...
Bash - CGI RCE (MSF) Shellshock Exploit
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...
Gemitel 3.50 Affich.PHP Remote File Include Command Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10156/info A vulnerability has been identified in the handling of input by Gemitel. Because of this, it may be possible for a remote user to gain unauthorized access to a system using the vulnerable software. It is possib...
miniCMS 1.0 & 2.0 - PHP Code Inject
No description provided by source...
Ajax File Browser 3b (settings.inc.php approot) RFI Vulnerability
No description provided by source. Ajax File Browser 3 Beta Remote File Inclusion found by the arfis project http://arfis.wordpress.com/ Project Info: ------------- Name: Ajax File Browser Link: http://sourceforge.net/projects/ajaxfb/ DL:...
亿邮某版本OPENSSL heartbleed 通杀
简要描述： 打包了一堆网站,内存里有cookies :D 详细说明： eYouMail 5 inurl:edu 搜素出来就能有漏洞的机率90%左右 前三页成功的结果 mail.jn.gov.cn mail.hpu.edu.cn mail.just.edu.cn mail.hnust.edu.cn mail.tjut.edu.cn mail.shupl.edu.cn mail.haust.edu.cn mail.dufe.edu.cn mail.jliae.edu.cn mail.hist.edu.cn dn1s.cmc.edu.cn mail.hbpu.edu.cn...
Discuz! x3.1 /utility/convert/index.php 代码执行漏洞
No description provided by source...
PHP-CGI Argument Injection Remote Code Execution
No description provided by source. !/usr/bin/python import requests import sys print """ CVE-2012-1823 PHP-CGI Arguement Injection Remote Code Execution This exploit abuses an arguement injection in the PHP-CGI wrapper to execute code as the PHP user/webserver user. Feel free to give me abuse abo...
Cisco Unified IP Phone SCCP及SIP协议多个远程安全漏洞
BUGTRAQ ID: 27774 CVECAN ID: CVE-2008-0530,CVE-2008-0526,CVE-2008-0527,CVE-2008-0528,CVE-2008-0529,CVE-2008-0531 Cisco Unified IP Phone是思科的统一IP电话解决方案。 DNS响应解析溢出 运行SCCP和SIP固件的Cisco Unified IP Phone 7940、7940G、7960和7960G设备在处理DNS响应时存在缓冲区溢出漏洞，特制的DNS响应可以触发缓冲区溢出，在有漏洞的电话上执行任意指令。该漏洞记录为CVE-2008-0530和Cisco...
Joomla Component rapidrecipe <= 1.6.5 SQL Injection Vulnerability
No description provided by source. joomla SQL Injectioncomrapidrecipe AUTHOR : S@BUN HOME : http://www.hackturkiye.com MA陌L : [email protected] DORK 1 : allinurl: "comrapidrecipe"userid DORK 2 : allinurl: "comrapidrecipe" categoryid EXPLOIT : after userid or catogryid add exploit...
Squirrelcart <= 1.x.x (cart.php) Remote File Inclusion Vulnerability
No description provided by source. Title : Squirrelcart = 1.x.x Remote File Inclusion URL : http://squirrelcart.com/ Google Dork : inurl:"/squirrelcart/" -squirrelcart.com Author : ShaiMagal Vulnerable file : popupwindow.php - config.php, line 13 - $siteisproot = "blablabla"; Exploit :...
通达OA /interface/auth.php SQL注入
通达OA 两处注入点： /interface/auth.php /general/score/flow/scoredate/result.php 主要原因还是由于宽字符导致的。 MYSQL的字符集转换过程 1. MySQL Server收到请求时将请求数据从charactersetclient转换为charactersetconnection； 2. 进行内部操作前将请求数据从charactersetconnection转换为内部操作字符集，其确定方法如下： • 使用每个数据字段的CHARACTER SET设定值； • 若上述值不存在，则使用对应数据表的DEFAULT CHARACTER...
Kide Shoutbox 0.4.6 - XSS & AXFR
No description provided by source. andresg888 Web: : www.ilegalintrusion.nethttp://www.ilegalintrusion.net & www.bl4ck-p0rtal.orghttp://www.bl4ck-p0rtal.org Exploit : Go to the shoutbox and type: font color=redred text/font or marqueehi/marquee or 3xplo!t :...
Early Impact ProductCart 2.6/2.7 viewPrd.asp idcategory Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/13881/info ProductCart is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful...
VWar <= v1.5.0 R15 (mvcw.php) Remote File Inclusion Vulnerability
No description provided by source. '/ -.- --------------------oOO------OOo-------------------- | VWar = v1.5.0 R15 mvcw.php Remote File Inclusion | | coded by DNX | ------------------------------------------------------- ! Discovered: DNX ! Vendor: http://www.vwar.de ! Detected: 26.02.2007 !...
PHP < 4.4.5 / 5.2.1 (shmop) SSL RSA Private-Key Disclosure Exploit
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || // // | |/ || '|/ |/ -| ' / -/ |||| /| || / //...
KarjaSoft Sami FTP Server多个命令远程缓冲区溢出漏洞
KarjaSoft Sami FTP Server是一款FTP服务程序。 KarjaSoft Sami FTP Server处理多个命令存在缓冲区溢出问题，远程攻击者可以利用漏洞以应用程序执行任意指令。 发送超长UER/PASS请求给服务器，可触发缓冲区溢出，精心构建提交数据可能以进程权限执行任意指令。 KarjaSoft Sami FTP Server 2.0.2 目前没有解决方案提供： http://www.karja.com/samiftp/main.php / KarjaSoft Sami FTP Server 2.0.2 USER/PASS buffer overflow &n...
Apache Struts2 S2-053 (CVE-2017-12611)
0x00 基本信息 漏洞编号：S2-053（CVE-2017-12611） 漏洞影响：远程代码执行 影响版本：Struts 2.0.1 -Struts 2.3.33, Struts 2.5 - Struts 2.5.10 漏洞修复：升级至最新版本 0x01 环境搭建 先用struts-2.3.33搭一个freemarker的简单项目（官方推荐的min-lib中就带了freemarker-2.3.22.jar，不用再额外去找了），就用漏洞公告里给的那个写法 运行后，未发现效果 表着急，我们用的是hidden，看看源代码 根据经验，应该是二次解析造成的漏洞，验证一下 0x02 构造POC...
TikiWiki <= 1.9.8.1 - Local File Inclusion Vulnerabilities
No description provided by source. ====================================================================== TikiWiki = 1.9.8.1 Local File Inclusion ====================================================================== Author: L4teral l4teral 4t gmail com Impact: Local File Inclusion Status: patch...
Apache Tomcat Windows安装程序默认空口令漏洞
BUGTRAQ ID: 36954 CVE ID: CVE-2009-3548 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Windows安装程序默认对管理用户设置了空口令。如果在安装过程中没有更改这个口令，就会使用空口令创建各种管理用户。 Tomcat 5.5.0 to 5.5.28 Tomcat 6.0.0 to 6.0.20 厂商补丁： Apache Group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Firefox XSL解析root XML标签内存破坏漏洞
BUGTRAQ ID: 34235 CVECAN ID: CVE-2009-1169 Firefox是一款非常流行的开放源码WEB浏览器。 Firefox在转换XML文档时没有正确地处理出错情况，特制的XSLT代码可能导致将临时的被破坏栈变量处理为评估上下文对象。漏洞的起因是 evalContext是栈分配的，但在失败的情况下仍被txExecutionState对象引用，该对象的释放器之后又试图删除 evalContext。成功利用这个漏洞的攻击者可能导致浏览器崩溃或在用户机器上执行任意代码。 Mozilla Firefox 3.0.8 Mozilla SeaMonkey 1.1.16...
Microsoft Windows递归DNS欺骗漏洞（MS07-062）
BUGTRAQ ID: 25919 CVECAN ID: CVE-2007-3898 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的DNS服务器实现上存在漏洞，远程攻击者可能利用此漏洞导致DNS欺骗。 在向上游DNS服务器发送请求时Windows的DNS服务（dns.exe）使用了可预测的事件，这允许攻击者执行DNS缓存破坏攻击。当DNS服务器执行递归查询的时候，攻击者就可以通过特制的DNS响应导致欺骗或者从合法位置重定向Internet流量。 Microsoft Windows Server 2003 x64 Edition Microsoft...
Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability
Summary A vulnerability in the Secure Sockets Layer SSL VPN functionality of the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double fr...
Node.js arbitrary file read Vulnerability(CVE-2017-14849)
Author: niubl@TSRC 1. Vulnerability description 2017 9 November 28, the company scanner found a business there is an example of the arbitrary file read vulnerability, the team follow-up analysis found that this is the Node. js and Express the common result of a Common Vulnerability. As we prepare...
ProductCart 1.x/2.x Custva.asp redirectUrl Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/9669/info EarlyImpact ProductCart is reportedly prone to multiple vulnerabilities. The specific issues include SQL injection, cross-site scripting and cryptographic weaknesses. These issues could expose sensitive data suc...
cPanel 5.0 Guestbook.cgi Remote Command Execution Vulnerability (4)
No description provided by source. source: http://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script. An attack...
Attachmate Reflection OpenSSL TLS心跳信息泄漏漏洞
CVE ID:CVE-2014-0160 Attachmate Reflection是一款优秀的Unix终端仿真软件。 Attachmate Reflection所绑定的OpenSSL存在安全漏洞，OpenSSL处理TLS”心跳“扩展存在一个边界错误，允许攻击者利用漏洞获取64k大小的已链接客户端或服务器的内存内容。内存信息可包括私钥，用户名密码等。 0 Attachmate Reflection 14.x 目前没有详细解决方案： http://www.attachmate.com/...
MobileIron VSP/Sentry 'j_username'参数XPath注入漏洞
Bugtraq ID:66595 CVE ID:CVE-2014-1409 MobileIron是一个虚拟智能终端平台，包含VSP,Sentry等组件。 MobileIron VSP/Sentry管理接口存在验证绕过漏洞，https://target/mics/jspringsecuritycheck中的脚本不正确过滤'jusername'参数，允许未验证攻击者进行XPath注入攻击，可获取XML文档数据，如配置文件等。 0 MobileIron VSP 5.9.1 MobileIron Sentry 5.0 MobileIron VSP 5.9.1和MobileIron Sentry...
CuteEditor 6.0 任意文件下载漏洞
CuteEditor是国外一款非常流行的所见即所得文字编辑器,其6.0版本存在任意文件下载漏洞，攻击者可以利用该漏洞下载任意文件。 CuteEditor 6.0...
XAMPP WebDAV PHP Upload
No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...