56796 matches found
IMAP4rev1 12.261/12.264/2000.284 - (lsub) Remote Exploit
No description provided by source. / !!! Private !!! imapd IMAP4rev1 v12.261, v12.264 and 2000.284 Remote Exploit. Others? Yes! By: SkyLaZarT [email protected] .aka. Felipe Cerqueira Homepage: www.BufferOverflow.Org Thankz: cync, oldm and Jans. BufferOverflow.org Team Antonio Marcelo...
CMS Openpage (index.php) SQL Injection Vulnerability
No description provided by source. ==================================================== CMS Openpage index.php SQL Injection Vulnerability ==================================================== + Discovered by: Phenom + My id: http://inj3ct0r.com/author/2157 + Original:...
Samba 2.2.8 - Remote Root Exploit - sambal.c
No description provided by source. / Remote root exploit for Samba 2.2.x and prior that works against Linux all distributions, FreeBSD 4.x, 5.x, NetBSD 1.x and OpenBSD 2.x, 3.x and 3.2 non-executable stack. sambal.c is able to identify samba boxes. It will send a netbios name packet to port 137. ...
ClipShare ADODB-Connection.Inc.PHP远程文件包含漏洞
ClipShare是一款基于PHP的WEB应用程序。 ClipShare不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'ADODB-Connection.Inc.PHP'脚本对用户提交的'cmd'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 ClipShare 1.5.3 目前没有解决方案提供： http://www.clip-share.com/ http://www.example.com/Path/include/adodb-connection.inc.php?cmd=Shell-Attack...
Exploits Mcafee Network Agent (mcnasvc.exe) Remote DoS
No description provided by source. ///////////////////////////////////////////////////// // Mcafee Network Agent mcnasvc.exe Remote DoS // By JAAScois http://www.jaascois.com // Teston mcnasvc.exe ver1.0.178.0 // Path C:\Program Files\Common Files\McAfee\MNA // Port: 6646...
Spring data rest 远程代码执行(cve-2017-8046)
漏洞描述 漏洞描述 Spring Data Rest 在处理 PATCH 请求时存在RCE高危漏洞, 可以使用手工构造的JSON数据构造恶意PATCH请求提交至spring-data-rest服务器，使得服务器运行恶意JAVA代码。Spring Data Rest项目的目标是提供一种灵活的、可配置的机制，编写出可以对外暴露出HTTP协议的简单服务。 Git地址: https://github.com/spring-projects/spring-data-rest 漏洞来源: https://pivotal.io/security/cve-2017-8046 影响版本： Spring...
Network Time Protocol Broadcast Mode Poll Interval Enforcement Denial of Service Vulnerability(CVE-2016-7428)
Summary An exploitable denial of service vulnerability exists in the broadcast mode poll interval enforcement functionality of ntpd. To limit abuse, ntpd restricts the rate at which each broadcast association will process incoming packets. ntpd will reject broadcast mode packets that arrive befor...
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch(CVE-2017-1000112)
Bug details When building a UFO packet with MSGMORE ipappenddata calls ipufoappenddata to append. However in between two send calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb-len...
PHPizabi 0.848b C1 HP3 'id' Parameter Local File Include Vulnerability
No description provided by source...
EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow
No description provided by source. $Id: easyftpcwdfixret.rb 9179 2010-04-30 08:40:19Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of...
CSCMS V3.5 最新版 后台命令执行GETSHELL（源码详析）
简要描述： CSCMS V3.5 最新版 后台PHP命令执行GETSHELL（源码详析） CSCMS的全新架构加强了安全性，以往的一串漏洞均已修复， 读代码，发现还有新的漏洞 代码分析见详细说明，测试演示在漏洞证明里 详细说明： 漏洞位置为后台的 网站设置-第三方登录设置 中 有关代码如下： /app/controllers/admin/setting.php line:426 public function dengluedit //设置第三方登录的几项配置 $this-CsdjAdmin-AdminQx'4'; //注意，本处已使用xssclean过滤特定字符，之后的结论会用到...
Mozilla Firefox/SeaMonkey/Thunderbird多个远程安全漏洞
Mozilla Firefox/SeaMonkey/Thunderbird都是Mozilla发布的WEB浏览器和邮件新闻组客户端产品。 上述产品中存在多个安全漏洞，具体如下： 1 Mozilla产品中所捆绑的网络安全服务（NSS）库如果以指数3使用RSA密钥的话，就无法正确的处理签名中的额外数据，允许攻击者伪造SSL/TLS和邮件证书。这个漏洞是MFSA 2006-60中所报告RSA签名漏洞的变种。 2 攻击者可以在执行期间修改Script对象，导致执行任意JavaScript bytecode。 3...
7zip CVE-2016-2334 HFS+ Code Execution Vulnerability
INTRODUCTION In 2016 Talos released an advisory for CVE-2016-2334, which was a remote code execution vulnerability affecting certain versions of 7zip, a popular compression utility. In this blog post we will walk through the process of weaponizing this vulnerability and creating a fully working...
AppCMS 1.3.855 SQL注入
No description provided by source...
Gdk-Pixbuf JPEG gdk_pixbuf__jpeg_image_load_increment Code Execution Vulnerability(CVE-2017-2862)
Summary An exploitable heap overflow vulnerability exists in the gdkpixbufjpegimageloadincrement functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability. Tested...
Windows: ManagementObject Arbitrary .NET Serialization RCE（CVE-2017-0160）
Windows: ManagementObject Arbitrary .NET Serialization RCE Platform: .NET 4.6, Powershell 4. Tested between Server 2016 and Windows 10 Anniversary Edition Class: Remote Code Execution Summary: Accessing a compromised WMI server over DCOM using System.Management classes or the Powershell...
Shopex V4.8.4-4.8.5 svinfo.php 文件信息泄露漏洞
0x01 框架简述 Shopex是国内市场占有率最高的网店软件，基于免费开源但却性能卓越的Lamp（Linux+Apache+Mysql+Php）架构，最大程度降低您的总体拥有成本。 中文名：商派 外文名：Shopex 服务商：上海派浓网络科技有限公司 官方主页：http://www.shopex.cn/ 0x02 漏洞细节 如果install目录没删，下面这个可以看phpinfo http://www.xx.com/install/svinfo.php?phpinfo=true 两个实例： http://www.5fa.cc/install/svinfo.php?phpinfo=tru...
WordPress Double-Opt-in-for-Download插件SQL注入漏洞
No description provided by source...
Audiotran 1.4.1 - Direct RET BoF
No description provided by source...
bitrix site manager 4.0.5 - Remote File Inclusion Vulnerability
No description provided by source. + Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just...
Coppermine Photo Gallery 1.x init.inc.php Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/10253/info Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly...
Virtual Programming VP-ASP 4/5 shopdisplayproducts.asp Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9164/info A vulnerability has been reported to exist in VP-ASP software that may allow a remote user to launch cross-site scripting attacks. A remote attacker may exploit this issue to potentially execute HTML or script...
Attachmate Reflection OpenSSL TLS心跳信息泄漏漏洞
CVE ID:CVE-2014-0160 Attachmate Reflection是一款优秀的Unix终端仿真软件。 Attachmate Reflection所绑定的OpenSSL存在安全漏洞，OpenSSL处理TLS”心跳“扩展存在一个边界错误，允许攻击者利用漏洞获取64k大小的已链接客户端或服务器的内存内容。内存信息可包括私钥，用户名密码等。 0 Attachmate Reflection 14.x 目前没有详细解决方案： http://www.attachmate.com/...
CUPS texttops过滤器空指针引用漏洞
BUGTRAQ ID: 40943 CVE ID: CVE-2010-0542 Common Unix Printing System（CUPS）是一款通用Unix打印系统，是Unix环境下的跨平台打印解决方案，基于Internet打印协议，提供大多数 PostScript和raster打印机服务。 CUPS的texttops过滤器中缺少内存分配失败检查导致了空指针引用。攻击者可以创建恶意的文本文件，如果打印了该文件就会导致texttops崩溃或以lp用户权限执行任意代码。 Easy Software Products CUPS 1.4.4 厂商补丁： Easy Software...
Zeroboard文件泄露远程任意命令执行漏洞
BUGTRAQ: 12258 Zeroboard不正确过滤用户提交的URL请求，远程攻击者可以利用这个漏洞查看系统文件内容或以进程权限执行任意命令。 Zeroboard 4.1 pl2-p15 厂商补丁： Zeroboard --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.zeroboard.com/ 远程用户可以提供包含多个'../'字符的数据作为参数提交给有漏洞的脚本处理，可以WEB进程权限查看任意文件内容：...
Microsoft Windows SMB NT Trans请求缓冲区溢出漏洞（MS09-001）
BUGTRAQ ID: 33121 CVECAN ID: CVE-2008-4834 Windows是微软发布的非常流行的操作系统。 Microsoft服务器消息块（SMB）协议软件处理特制SMB数据包的方式存在缓冲区溢出漏洞，未经认证的远程攻击者可以在NT Trans请求中指定畸形的值导致内核忙碌，必须重启系统才能恢复操作。利用此漏洞的大多数尝试会导致系统拒绝服务，但是远程执行代码在理论上是可行的。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Server 2003 SP2 Microsoft...
jPortal 'humor.php' SQL注入漏洞
BUGTRAQ ID: 31274 CNCAN ID：CNCAN-2008092309 jPortal是一款基于PHP的WEB应用程序。 jPortal不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'humor.php'脚本对用户提交给'id'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 JPortal 2 目前没有解决方案提供： http://www.jportal.info/downloadjportal.php...
Kaspersky AntiVirus杀毒引擎ARJ文档解析堆溢出漏洞
CVECAN ID: CVE-2007-0445 Kaspersky Antivirus是非常流行的杀毒软件。 Kaspersky Antivirus的杀毒引擎在处理ARJ文档格式时存在堆溢出漏洞，如果使用该引擎的杀毒软件扫描了恶意文档的话就会触发这个溢出，可能导致执行任意指令。 来源：ZDI （http://www.zerodayinitiative.com/） 链接：http://www.zerodayinitiative.com/advisories/ZDI-07-013.html http://www.kaspersky.com/technews?id=203038693...
CVE-2018-1273: RCE with Spring Data Commons
...
iOS/MacOS kernel double free due to IOSurfaceRootUserClient not respecting MIG ownership rules(CVE-2017-13861)
I have previously detailed the lifetime management paradigms in MIG in the writeups for: CVE-2016-7612 https://bugs.chromium.org/p/project-zero/issues/detail?id=926 and CVE-2016-7633 https://bugs.chromium.org/p/project-zero/issues/detail?id=954 If a MIG method returns KERNSUCCESS it means that th...
Serviio PRO 1.8 DLNA Media Streaming Server (mediabrowser) DOM Based XSS
Summary Serviio is a free media server. It allows you to stream your media files music, video or images to renderer devices e.g. a TV set, Bluray player, games console or mobile phone on your connected home network. Description The application is vulnerable to a DOM-based cross-site scripting. Da...
Cesanta Mongoose Websocket Protocol Fragmented Packet Code Execution Vulnerability(CVE-2017-2922)
Summary An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause a buffer to be allocated while leaving stale pointers which leads to a use-after-free vulnerability which can be exploited...
Microsoft Windows PowerShell Security Feature Bypass Vulnerability (CVE-2017-0007)
Over the past few months, I have had the pleasure to work side-by-side with Matt Graeber @mattifestation and Casey Smith @subtee in their previous job roles, researching Device Guard user mode code integrity UMCI bypasses. If you aren't familiar with Device Guard, you can read more about it here:...
Magento < 2.0.6 - Unauthenticated Remote Code Execution
参考来源：http://netanelrub.in/2016/05/17/magento-unauthenticated-remote-code-execution/ The vulnerability CVE-2016-4010 allows an attacker to execute PHP code at the vulnerable Magento server unauthenticated. This vulnerability actually consists of many small vulnerabilities Magento is an extremely...
用友oa getSessionList.jsp信息泄露
https://g.jiuminghu.com/newwindow=1&q=intitle:%E3%80%8A%E7%94%A8%E5%8F%8BU8-OA%E3%80%8B&btnK=+%E6%90%9C%E7%B4%A2 intitle:《用友U8-OA》 谷歌搜索即可搜出来大量案例 漏洞存在于：http://www.example.com/yyoa/ext/https/getSessionList.jsp?cmd=getAll 该漏洞允许攻击者获取所有用户的用户名和密码MD5值...
QEMU pcnet_receive 堆缓冲区溢出漏洞(CVE-2015-7504)
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://lists.gnu.org/archive/html/qemu-devel/2015-11/msg06342.html pcnet是虚拟化软件QEMU中实现AMD PCNET网卡功能模拟的组件，相关的代码实现位于/hw/net/pcnet.c中。 在qemu软件中使用pcnet网卡，需要如下的命令行进行配置： qemu-system-x8664 centos-6.5-x64.img -m 1024 - net nic,model=pcnet -net user...
TinyShop SQL注入（开启GPC，绕过过滤）
简要描述： 之前的都是找程序员的疏忽，这个位置是绕过程序的防注入。 详细说明： 环境： GPC = On public static function sql$str //过滤函数 if !getmagicquotesgpc //gpc off 就转义，把之前那个奇葩的漏洞补了 //不使用主要是因为，先有mysql的连接 //$str = mysqlrealescapestring$str; $str = addslashes$str; $str =...
WebPhotoPro Multiple SQL Injection Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/32829/info WebPhotoPro is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to...
Anymacro /reg.php SQL注入漏洞
No description provided by source...
RealAdmin suffers from a remote blind SQL injection vulnerability
No description provided by source. .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Team : Sec Attack Team .:. Home : www.sec-attack.com/vb .:. Script : RealAdmin .:. Download Script: http://www.redcow.ca/products/realadmin/ .:. Bug Type : Blind Sql Injection .:. Dork : "Powered by RealAdmin and Red...
ExtMail1.2 邮件系统跨站脚本漏洞（3P）
北洋贱队2009.12.31首发 Extmail 是一个以perl语言编写，面向大容量/ISP级应用，免费的高性能Webmail软件。 最新版本为1.2，检测出三出处跨站漏洞。 1.免费新用户注册的"signup.cgi"对‘domain’参数未进行参数过滤，构建恶意脚本代码作为参数数据，并诱使用户访问恶意链接，可触发恶意脚本代码在目标用户浏览器上执行，导致敏感信息泄漏。 demo:http://demo.extmail.org/extman/cgi/signup.cgi?domain=%22%3E%3Ciframe%20src=http://www.gohack.org%3E...
SIU Guarani Multiple Remote Vulnerabilities
No description provided by source. multiple remote vulnerabilities siu guarani general information ------------------- bug type : multiple remote vulnerabilities software name : SIU Guarani vendor : SIU www.siu.edu.ar authors : proudhon & Ubik date : the 341st day of the year 2008 contact : N/A...
DNS BailiWicked Host Attack
No description provided by source. /msf3/msfconsole require 'msf/core' require 'net/dns' require 'scruby' require 'resolv' module Msf class Auxiliary::Spoof::Dns::BailiWickedHost Msf::Auxiliary include Exploit::Remote::Ip def initializeinfo = superupdateinfoinfo, 'Name' = 'DNS BailiWicked Host...
FreeCMS 'index.php' SQL注入漏洞
BUGTRAQ ID: 29773 CNCAN ID：CNCAN-2008061903 FreeCMS是一款基于PHP的WEB应用程序。 FreeCMS不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题是'index.php'脚本对用户提交给'page'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 FreeCMS.us FreeCMS 0.2 目前没有解决方案提供： http://www.freecms.us/...
Uebimiau Web-Mail 2.7.10/2.7.2 Remote File Disclosure Vulnerability
No description provided by source. ---- Uebimiau Web-Mail Remote File Reader ... ITDefence.ru Antichat.ru Uebimiau Web-Mail Remote File Reader Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /...
Adobe ColdFusion CFID/CFTOKEN会话劫持漏洞
BUGTRAQ ID: 26429 CVECAN ID: CVE-2007-5905 ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。 ColdFusion在处理用户会话时存在漏洞，远程攻击者可能利用此漏洞获取敏感信息。 对于使用ColdFusion编译的应用程序，远程攻击者可以通过CFID或CFTOKEN劫持应用程序的用户会话，然后就可以浏览敏感信息或扮演成为合法用户执行请求。使用J2EE会话管理的用户不受这个漏洞影响。 Adobe...
ASUS wiress router Remote Command/Code Execution Vulnerability
Vulnerability Details Affected Vendor:RT-AC5300,RTAC1900P,RT-AC68U,RT-AC68P,RT-AC88U,RT-AC66U,RT-AC66UB1,RT-AC58U,RT-AC56U,RT-AC55U,RT-AC52U,RT-AC51U,RT-N18U,RT-N66U,RT-N56U,RT-AC3200,RT-AC3100,RTAC1200GU,RTAC1200G,RT-AC1200,RT-AC53,RT-N12HP,RT-N12HPB1,RT-N12D1,RT-N12+,RTN12+PRO,RT-N16,RT-N300...
WebKit memory corruption vulnerability(CVE-2016-4657 )
Can be used for: CVE-2016-4657 Nintendo Switch Node Server Quick node.js server for the WebKit exploit. The virus can be modified in exploit.js Installing and Running cd npm i sudo node server.js Server runs on port 80 needs root unless specified otherwise. Route conntest.nintendowifi.net to your...