56796 matches found
node.js的ws模块存在远程内存泄露漏洞
近日，在允许用户通过简单地发送ping数据帧，来分配内存的ws模块中发现存在着漏洞。该漏洞会拒绝用户发送数据的请求，使用户发送ping数据帧功能失效，在此之前，还会加大数据帧的负载。 实际上，这就是漏洞的具体表现。但在模块中，ws通常将我们所要传入内存的所有数据进行相应的转换，这就是漏洞之所在。我们对所要发送数据的类型都没做任何检查。当你在node.js中需要存储一个数字时，该漏洞就会自动给数字分配一个存储大量字节的字符串空间，从而加大内存的负载。 var x = new Buffer100; // vs var x = new Buffer'100';...
MacCMS v8 /inc/api.php SQL注入漏洞
No description provided by source...
EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow
No description provided by source. $Id: easyftpcwdfixret.rb 9179 2010-04-30 08:40:19Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of...
Wordpress Orange Themes CSRF File Upload Vulnerability
No description provided by source. Title : Wordpress Orange Themes CSRF File Upload Vulnerability Author : Jje Incovers Date : 01/12/2013 - 17 November 2013 Category : Web Applications Type : PHP Vendor : http://www.orange-themes.com/ Download : http://www.orange-themes.com/portfolio/ Tested :...
GNU C library dynamic linker $ORIGIN expansion Vulnerability
No description provided by source. from: http://marc.info/?l=full-disclosure&m=128739684614072&w=2 The GNU C library dynamic linker expands $ORIGIN in setuid library search path ------------------------------------------------------------------------------ Gruezi, This is CVE-2010-3847. The dynam...
vtiger CRM <= 4.2 (calpath) Multiple Remote File Include Vulnerabilities
No description provided by source. \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV54$2006 ----------------------------------------------------------------------------------------------- ECHOADV54$2006vtiger CRM =4.2 calpath Multiple Remote File Inclusion...
cPanel 5.0 Guestbook.cgi Remote Command Execution Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script. An attack...
CSCMS V3.5 最新版 后台命令执行GETSHELL（源码详析）
简要描述： CSCMS V3.5 最新版 后台PHP命令执行GETSHELL（源码详析） CSCMS的全新架构加强了安全性，以往的一串漏洞均已修复， 读代码，发现还有新的漏洞 代码分析见详细说明，测试演示在漏洞证明里 详细说明： 漏洞位置为后台的 网站设置-第三方登录设置 中 有关代码如下： /app/controllers/admin/setting.php line:426 public function dengluedit //设置第三方登录的几项配置 $this-CsdjAdmin-AdminQx'4'; //注意，本处已使用xssclean过滤特定字符，之后的结论会用到...
Microsoft IIS FTP Server <= 7.0 Stack Exhaustion DoS [MS09-053]
No description provided by source. Exploit Title: MS09-053 Microsoft IIS FTP Server = 7.0 Stack Exhaustion DoS Date: Jul 03, 2011 Author: Myo Soe YGN Ethical Hacker Group - http://yehg.net/ Software Link: http://www.microsoft.com/ Version: 5.0 - 7.0 Tested on: unpatched version of windows xp & 2k...
DNS BailiWicked Host Attack
No description provided by source. /msf3/msfconsole require 'msf/core' require 'net/dns' require 'scruby' require 'resolv' module Msf class Auxiliary::Spoof::Dns::BailiWickedHost Msf::Auxiliary include Exploit::Remote::Ip def initializeinfo = superupdateinfoinfo, 'Name' = 'DNS BailiWicked Host...
yaSSL多个远程溢出及无效内存访问漏洞
BUGTRAQ ID: 27140 yaSSL是用于实现SSL的开源软件包。 yaSSL实现上存在多个远程溢出及无效内存访问问题，远程攻击者可能利用此漏洞控制服务器。 ------------------------------------------- A ProcessOldClientHello缓冲区溢出 ------------------------------------------- 用于包含客户端所接收的Hello报文中的数据的缓冲区结构如下（源自yasslimp.hpp）： class ClientHello : public HandShakeBase...
WebCalendar 0.9.45 (includedir) Remote File Inclusion Vulnerability
No description provided by source. |-------------------------------------------------------------------------------| | | | WebCalendar v0.9.45 13 Dec 2004 login.php Remote File include | | | | Script : WebCalendar | | Version : v0.9.45 13 Dec 2004 | | Authord : Drackanz | | Contact : Drackanz at...
Telnet-FTP Server目录遍历及远程拒绝服务漏洞
Telnet-Ftp Server是一款Windows平台上的多用户Telnet/Ftp服务器。 Telnet-Ftp Server的GET和PUT等命令的处理过程中存在输入验证错误，允许攻击者通过目录遍历攻击列出并下载FTP根目录外的任意文件。 此外，攻击者还可以通过发送两个连续的RETR命令导致服务崩溃。 Sorin Chitu Telnet-FTP Server 1.0 build 1.250 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://slimbyte.sufx.net/...
Serviio PRO 1.8 DLNA Media Streaming Server (mediabrowser) DOM Based XSS
Summary Serviio is a free media server. It allows you to stream your media files music, video or images to renderer devices e.g. a TV set, Bluray player, games console or mobile phone on your connected home network. Description The application is vulnerable to a DOM-based cross-site scripting. Da...
THEOL网络教学平台 /common/script/search.jsp 参数keyword SQL注入漏洞
No description provided by source...
TRSIDS系统任意账户密码重置漏洞
No description provided by source...
汇文软件某系统默认配置不当（小问题可引发大问题，威胁诸多用户）
简要描述： 默认配置不当 详细说明： 汇文软件 汇文应用服务系统Java版 默认配置不当，提供的下载软件包内的某文件中存储了通用的用户名密码（可直接登录），可以使用此账号密码进行钓鱼等操作，威胁诸多用户 漏洞证明： 下载得到软件包，解压得到配置文件 打开配置文件，账号密码全泄漏，可直接登录 登陆成功 可能存在的威胁猜想： 1:由于此软件包提供公开下载，使用者服务器上的配置也使用了此配置文件，一旦此账号密码被修改，可导致使用者平台用户的密码找回等功能无法使用。 2:此账号中包含了一些使用用户的少量信息，可使用此账号向用户邮箱推送钓鱼信息导致用户被钓鱼。...
Apache Tomcat 不完整修复拒绝服务漏洞
BUGTRAQ ID: 65767 CVECAN ID: CVE-2013-4322 Apache Tomcat是一个流行的开源JSP应用服务器程序。 Tomcat 8.0.0-RC1-8.0.0-RC5、Tomcat 7.0.0-7.0.47、Tomcat 6.0.0-6.0.37在实现上存在拒绝服务漏洞，攻击者可利用此漏洞造成拒绝服务。该漏洞源于CVE-2012-3544的不完整修复。所有使用Oracle Java 7 1.7, 1.7.0的系统都受到影响。Oracle Java 7 Update...
Squid 'cachemgr.cgi'不完整修复远程拒绝服务漏洞
Bugtraq ID:57646 CVE ID: CVE-2013-0189 Squid是一款功能强大的代理服务器和Web缓存服务器。 Squid tools/cachemgr.cc存在多个内存泄露问题，允许远程攻击者通过提交非法Content-Length头，超长POST请求，和特制的验证凭据触发此漏洞，造成应用程序崩溃。此问题是由于未完整修复CVE-2012-5643引起的。 0 Squid 2.x Squid 3.x Squid 3.2.x Squid 3.3.x 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息：...
CUPS texttops过滤器空指针引用漏洞
BUGTRAQ ID: 40943 CVE ID: CVE-2010-0542 Common Unix Printing System（CUPS）是一款通用Unix打印系统，是Unix环境下的跨平台打印解决方案，基于Internet打印协议，提供大多数 PostScript和raster打印机服务。 CUPS的texttops过滤器中缺少内存分配失败检查导致了空指针引用。攻击者可以创建恶意的文本文件，如果打印了该文件就会导致texttops崩溃或以lp用户权限执行任意代码。 Easy Software Products CUPS 1.4.4 厂商补丁： Easy Software...
MySQL多个畸形SQL操作处理拒绝服务漏洞
BUGTRAQ ID: 37297 CVE ID: CVE-2009-4019 MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。 MySQL的在处理特定的SQL操作时存在拒绝服务漏洞，本地或远程攻击者可能利用此漏洞导致服务器崩溃。 MySQL AB MySQL 6.0.x MySQL AB MySQL 5.1.x MySQL AB MySQL 5.0.x 厂商补丁： MySQL AB -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mysql.com/...
MySQL <=6.0 yaSSL <= 1.7.5 Hello Message Buffer Overflow
MySQL yaSSL SSL Hello Message Buffer Overflow 1. 漏洞介绍和分析 yaSSL是用于实现SSL的开源软件包。 yaSSL实现上存在多个远程溢出及无效内存访问问题，远程攻击者可能利用此漏洞控制服务器。 向堆栈缓冲区溢出的yaSSL1.7.5和更早的版本实现与MySQL捆绑 = 6.0。通过发送一个专门制作的HEllo 包 ，攻击者可以执行任意代码。 代码分析： 用于包含客户端所接收的Hello报文中的数据的缓冲区结构如下源自yasslimp.hpp： class ClientHello : public HandShakeBase...
Apache Tomcat JULI日志组件默认安全策略漏洞
BUGTRAQ ID: 27006 CVECAN ID: CVE-2007-5342 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat的JULI日志组件允许Web应用提供自己的日志配置，默认的安全策略没有限制这种配置，允许不可信任的Web应用添加文件，或覆盖Tomcat进程拥有权限的已有文件。 Apache Group Tomcat 6.0.0 - 6.0.15 Apache Group Tomcat 5.5.9 - 5.5.25 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Joomla Component joom12Pic 1.0 Remote File Inclusion Vulnerability
No description provided by source. Joom!12Pic Component RFI Bug in : /administrator/components/comjoom12pic/admin.joom12pic.php?mosConfiglivesite= Variable : $mosConfiglivesite Dork: "comjoom12pic" Example:...
Joomla Module AutoStand 1.0 Remote File Inclusion Vulnerability
No description provided by source. ======================================================= Joomla Module AutoStand Category = 1.1 Remote File include Vulnerabilities ======================================================= Found By : Cold z3ro , [email protected]...
Eir’s D1000 Modem Is Wide Open To Being Hacked.
Background The Eir D1000 Modem has bugs that allow an attacker to gain full control of the modem from the Internet. The modem could then be used to hack into internal computers on the network, as a proxy host to hack other computers or even as a bot in a botnet. A port scan of the the modem...
Xen: unbounded recursion in pagetable de-typing(CVE-2017-15595)
Xen allows pagetables of the same level to map each other as readonly in PV domains. This is useful if a guest wants to use the self-referential pagetable trick for easy access to pagetables by mapped virtual address. When cleaning up a pagetable after the last typed reference to it has been...
Adobe ColdFusion Deserialization RCE (CVE-2017-11283, CVE-2017-11238)
During my research into the Java Remote Method Invocation RMI protocol, the most common RMI service that I came across was Adobe ColdFusion’s Flex integration service which is used to support integration between Flash applications and ColdFusion components. A quick look at this service led to the...
RealAdmin (detail.php) Blind SQL Injection Vulnerability
No description provided by source. RealAdmin detail.php Blind Sql Injection Vulnerability ======================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Team : Sec Attack Team .:. Home : www.sec-attack.com/vb .:. Script : RealAdmin .:. Download Script:...
Audiotran 1.4.1 - Direct RET BoF
No description provided by source...
Heartbleed OpenSSL - Information Leak Exploit (1)
No description provided by source. / CVE-2014-0160 heartbleed OpenSSL information leak exploit ========================================================= This exploit uses OpenSSL to create an encrypted connection and trigger the heartbleed leak. The leaked information is returned within encrypted...
Samba 2.2.8 - Remote Root Exploit - sambal.c
No description provided by source. / Remote root exploit for Samba 2.2.x and prior that works against Linux all distributions, FreeBSD 4.x, 5.x, NetBSD 1.x and OpenBSD 2.x, 3.x and 3.2 non-executable stack. sambal.c is able to identify samba boxes. It will send a netbios name packet to port 137. ...
Mac OS X Sudo Password Bypass
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'shellwords' class Metasploit3...
PostgreSQL 安全绕过漏洞(CVE-2013-1901)
BUGTRAQ ID: 58878 CVECAN ID: CVE-2013-1901 PostgreSQL是一款高级对象－关系型数据库管理系统，支持扩展的SQL标准子集。 PostgreSQL 9.2.x、9.1.x没有正确检查REPLICATION权限，远程攻击者通过调用pgstartbackup或pgstopbackup函数，利用此漏洞可绕过目标备份安全限制。 0 Debian Linux 6.0 x PostgreSQL 9.2.x PostgreSQL 9.1.x 厂商补丁： PostgreSQL ----------...
lighttpd畸形HTTP请求远程拒绝服务漏洞
BUGTRAQ ID: 38036 CVE ID: CVE-2010-0295 Lighttpd是一款轻型的开放源码Web Server软件包。 Lighttpd服务器每次接收到网络报文都会分配4K或16K的堆内存，如果远程攻击者缓慢的发送HTTP请求（如每秒钟发送1字节），就会耗尽所有可用内存导致服务器终止。 LightTPD LightTPD 1.5 LightTPD LightTPD 1.4.x 厂商补丁： Debian ------ Debian已经为此发布了一个安全公告（DSA-1987-1）以及相应补丁: DSA-1987-1：lighttpd -- denial of...
MySQL sql_parse.cc远程格式串漏洞
BUGTRAQ ID: 35609 MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。 MySQL的sqlparse.cc文件中的dispatchcommand函数存在格式串错误： 2084行： case COMCREATEDB: // QQ: To be removed char db=thd-strduppacket, alias; HACREATEINFO createinfo; statisticincrementthd-statusvar.comstatSQLCOMCREATEDB, &LOCKstatus; // null test to...
VMware产品Descheduled Time Accounting Driver拒绝服务漏洞
Bugraq ID: 35141 CVE ID：CVE-2009-1805 CNCVE ID：CNCVE-20091805 VMware提供包含多个虚拟主机和服务器的解决方案。 VMware Descheduled Time Accounting driver存在一个未明的安全问题，本地攻击者可以利用漏洞对虚拟机进行拒绝服务攻击。 符合如下条件的虚拟机受此漏洞影响： -虚拟机运行在windows操作系统下。 -VMware Descheduled Time Accounting driver安装在虚拟机上。 -VMware Descheduled Time...
Downline Goldmine paidversion (tr.php id) SQL Injection Vulnerability
No description provided by source. paidversion tr.php id Remote SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc script : http://www.downlinegoldmine.com/ DorK : inurl:tr.php?id= Exploit :...
Tiger PHP News System 1.0b build 39 Remote SQL Injection Vulnerability
No description provided by source. / Tiger PHP News System SQL Injection Bug found bY 0in from DaRk-Coders Group! Homepage: http://dark-coders.4rh.eu or http://dark-coders.prv.pl IRC:dark-coders at irc.freenode.org Email: 0indotemailatgmaildotcom / Script home: http://tpns.k-na.se/ Exploit:...
Simplog <= 0.9.2 (s) Remote Commands Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "Simplog = 0.9.2 "s" remote cmmnds xctn\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "dork: intext:"Powered by simplog"\r\n\r\n"; if $argc5 echo "Usage: php...
WebKit: Info leak in WebAssembly Compilation(CVE-2018-4222)
There is an out-of-bounds read when compiling WebAssembly source buffers in WebKit. When a source buffer is compiled, it is first copied into a read-only buffer by the functuion getWasmBufferFromValue. This function returns the code buffer as follows: return arrayBufferView ?...
D-Link DSL-3782 Code execution(CVE-2018-8941)
CVE-2018-8941: D-Link DSL-3782 Code execution Proof of Concept Adam Simuntis :: https://twitter.com/adamsimuntis Mindaugas Slusnys :: https://twitter.com/mislusnys The buffer overflow vulnerability was found in the "/userfs/bin/tcapi" binary which is used as a wrapper for the "Diagnostics"...
Internet Explorer 11 VBScript engine memory corruption vulnerability
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Internet Explorer 11 VBScript Engine Memory Corruption", 'Description' = %q This module...
PHPMyWind 5.0后台管理界面的SQL注入漏洞
No description provided by source...
Doyo建站 SQL注入
简要描述： 由用户输入表名，未任何过滤 详细说明： 在source/pay.php下 function buymolds $this-id=$this-syArgs'id'; $this-molds=$this-syArgs'molds',1; if!$this-id&&!$this-moldsmessage"a"; $this-info=syDB$this-molds-findarray'id'=$this-id,'isshow'=1,null,'title,mgold,litpic'; if!$this-infomessage"指定购买内容不存在或未审核。";...
DCP-Portal 5.0.1 editor.php root Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/6525/info DCP-Portal is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. An attacker may exploit this by supplying a path to a maliciously created file, located on a...
Umbraco CMS Remote Command Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
McAfee Email Gateway OpenSSL TLS心跳信息泄漏漏洞
CVE ID:CVE-2014-0160 McAfee Email Gateway是一款全面的电子邮件安全解决方案。 McAfee Email Gateway所绑定的OpenSSL存在安全漏洞，OpenSSL处理TLS”心跳“扩展存在一个边界错误，允许攻击者利用漏洞获取64k大小的已链接客户端或服务器的内存内容。内存信息可包括私钥，用户名密码等。 0 McAfee Email Gateway 7.x 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： https://kc.mcafee.com/corporate/index?page=content&id=SB10071...
ExtMail1.2 邮件系统跨站脚本漏洞（3P）
北洋贱队2009.12.31首发 Extmail 是一个以perl语言编写，面向大容量/ISP级应用，免费的高性能Webmail软件。 最新版本为1.2，检测出三出处跨站漏洞。 1.免费新用户注册的"signup.cgi"对‘domain’参数未进行参数过滤，构建恶意脚本代码作为参数数据，并诱使用户访问恶意链接，可触发恶意脚本代码在目标用户浏览器上执行，导致敏感信息泄漏。 demo:http://demo.extmail.org/extman/cgi/signup.cgi?domain=%22%3E%3Ciframe%20src=http://www.gohack.org%3E...