56796 matches found
Linux Kernel RTL8169 NIC远程拒绝服务漏洞
Bugraq ID: 35281 CVE ID：CVE-2009-1389 CNCVE ID：CNCVE-20091389 Linux是一款开放源代码的操作系统。 Linux RTL8169驱动存在设计错误，远程攻击者可以利用漏洞使内核触发OOPs，导致拒绝服务攻击。 RTL8169 GigE卡默认配置MTU为1500字节，发送单个包超过1500字节的报文，可导致驱动处理时破坏内核内存，造成OOPs。 Linux kernel 2.6.30 rc6 Linux kernel 2.6.30 -rc5 Linux kernel 2.6.30 -rc3 Linux kernel 2.6.30...
ACDSee产品TIFF及字体文件解析缓冲区溢出漏洞
BUGTRAQ ID: 35175,35176 ACDSee是一款图象查看、转换、管理工具，可使用在Microsoft Windows操作系统下。 如果用户使用ACDSee产品打开了畸形的TIFF图形或字体文件的话，就可以触发多个缓冲区溢出，导致执行任意代码。 ACD Systems, Inc ACDSee 9.x ACD Systems, Inc ACDSee 11.x ACD Systems, Inc ACDSee 10.x ACD Systems, Inc ACDSee Photo Manager Pro 2.5 ACD Systems, Inc ACDSee Photo...
动易网站管理系统vote.asp页面存在SQL注入漏洞
动易网站管理系统是一个采用 ASP 和 MSSQL 等其他多种数据库构建的高效网站内容管理解决方案产品。 vote.asp调用了动易组件PESite.ShowVote，此组件VoteOption参数过滤不严，导致可以进行mssql注入 但是其语句里面过滤了-- ;等字符，又是一个UPDATE形的注入，有一定的限制。但是其过滤的顺序不对。有导致mssql的注释符号--可以进入语句 PowerEasy CMS SP6 071030以下版本 更新动易组件（需要管理员的权限才能更新）。 不需要投票功能的用户，删除此文件。...
Apache Tomcat WebDav远程信息泄露漏洞
BUGTRAQ ID: 26070 CVECAN ID: CVE-2007-5461 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat在特定配置情况下存在漏洞，远程攻击者可能利用此漏洞非授权读写文件。 如果将Apache Tomcat的WebDAV servlet配置为同上下文使用且允许写访问的话，则远程攻击者可以通过提交指定了SYSTEM标签的WebDAV请求导致泄露任意文件的内容。 Apache Group Tomcat 6.0.0 - 6.0.14 Apache Group Tomcat 5.5.0 - 5.5.25 Apache...
Adobe Reader plug-in AcroPDF.dll 8.0.0.0 Resource Consumption
No description provided by source. ------------------------------------------------------------------------------- Adobe PDF Reader plug-in AcroPDF.dll ver. 8.0.0.0 Resource Consumption author: shinnai mail: shinnaiatautisticidotorg site: http://www.shinnai.altervista.org...
PHPWind <= 5.0.1 (AdminUser) Remote Blind SQL Injection Exploit
No description provided by source. ?php printr' --------------------------------------------------------------------------- PHPWind = 5.0.1 "AdminUser" blind SQL injection exploit by rgod [email protected] site: http://retrogod.altervista.org dorks: "powered by phpwind" "powered by phpwind v5.0.1"...
Jellyfin 任意文件读取漏洞（CVE-2021-21402）
GHSL-2021-050: Unauthenticated abritrary file read in Jellyfin - CVE-2021-21402 Jaroslav Lobacevski Coordinated Disclosure Timeline - 2021-03-19: Issue reported to maintainers. - 2021-03-22: Version 10.7.1 with fixes was released. Summary Jellyfin allows unauthenticated arbitrary file read. Produ...
VMware vRealize Operations Manager SSRF和文件读取漏洞（CVE-2021-21975 CVE-2021-21983）
Description On March 30, 2021, VMware published a security advisory for CVE-2021-21975 and CVE-2021-21983, two chainable vulnerabilities in its vRealize Operations Manager product. CVE-2021-21975 is an unauthenticated server-side request forgery SSRF, while CVE-2021-21983 is an authenticated...
New Android vulnerability allows attackers to modify apps without affecting their signatures(CVE-2017-13156)
A serious vulnerability CVE-2017-13156 in Android allows attackers to modify the code in applications without affecting their signatures. The root of the problem is that a file can be a valid APK file and a valid DEX file at the same time. We have named it the Janus vulnerability, after the Roman...
Git Shell Bypass By Abusing Less (CVE-2017-8386)
The git-shell is a restricted shell maintained by the git developers and is meant to be used as the upstream peer in a git remote session over a ssh tunnel. The basic idea behind this shell is to restrict the allowed commands in a ssh session to the ones required by git which are as follows:...
yxcms1.2.9任意文件删除漏洞
yxcms1.2.9版本存在任意文件删除漏洞。漏洞文件：/protected/apps/member/controller/photocontroller.php添加图集时直接获取图片列表，然后进行入库，对图集进行删除时未对删除图片的路径进行任何过滤，如果文件路径存在，就将上传的文件列表进行遍历删除，在类的初始化有个$this-uploadpath=ROOTPATH.'upload/photos/';，可以在上传时将上传路径设置为../../protected/apps/install/install.lock，进行删除时，由于判断该文件存在，所以会被删除，删除install.lock可...
用友某管理系统后台弱口令
简要描述： 用友某管理系统后台弱口令 详细说明： http://nczx.ufida.com.cn admin asq66a3s 漏洞证明：...
用友FE办公平台通用SQL注入（2个）
简要描述： 用友FE办公平台通用SQL注入（2个） 详细说明： SQL注入1 漏洞文件及参数 /witapprovemanage/report/depReimburse.jsp?depid=1 漏洞证明： sqlmap.py -u "http://oa.shunhengli.com:9090/witapprovemanage/report/depReimburse.jsp?depid=1" sqlmap.py -u "http://oa.shunhengli.com:9090/witapprovemanage/report/depReimburse.jsp?depid=1" --dbs...
Veritas NetBackup - Remote Command Execution
No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...
Aker Secure Mail Gateway "msg_id"跨站脚本漏洞
CVE ID：CVE-2013-6037 Aker Secure Mail Gateway是一款邮件网关解决方案。 由于通过"msgid" GET参数传递到webgui/cf/index.php的输入在返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 Aker Secure Mail Gateway =2.5.2 厂商补丁： Aker ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.aker.com.br/atualizacoes-asmg?fieldtipovalue=A...
SiteServer 3.6.4 /ask/search.aspx SQL注入漏洞
No description provided by source...
cmseasy{易通CMS}v5.5最新getshell漏洞
简要描述： 利用该漏洞可以直接上传webshell等恶意文件，危害巨大且目前官方还未出任何补丁，这里做一下简单的漏洞分析。 详细说明： 漏洞利用入口文件位于：editor/editor/dialog/imageusermtmt.php/index.php?case=user&act=log： 通过该页面就可以上传任意文件到服务器了。 看下imageusermtmt.php的代码： $GET=array'case'='user','act'='fckupload'; includeonce...
Google Chrome 23.0.1271.91之前版本多个远程漏洞
BUGTRAQ ID: 56684 CVECAN ID: CVE-2012-5130,CVE-2012-5131,CVE-2012-5132,CVE-2012-5133,CVE-2012-5134,CVE-2012-5135,CVE-2012-5136 Google Chrome是由Google开发的一款设计简单、高效的Web浏览工具。 Google Chrome 23.0.1271.91之前版本在实现上存在多个远程漏洞，攻击者可利用这些漏洞在浏览器上下文中执行任意代码、造成拒绝服务、绕过同源策略等。 0 Google Chrome 23.0.1271.91 厂商补丁： Google...
DedeCMS 5.7 member/ajax_membergroup.php SQL注入漏洞
No description provided by source...
Linux RDS Protocol Local Privilege Escalation
No description provided by source. Source: http://www.vsecurity.com/resources/advisory/20101019-1/ / Linux Kernel = 2.6.36-rc8 RDS privilege escalation exploit CVE-2010-3904 by Dan Rosenberg [email protected] Copyright 2010 Virtual Security Research, LLC The handling functions for sending...
ASUS Eee PC主板BIOS SMM权限提升漏洞
BUGTRAQ ID: 35995 Eee PC是华硕推出的系列小型笔记本电脑。 华硕主板的BIOS固件包含有带有多个SMI处理器的特殊代码，在引导的时候这些处理器以系统管理模式运行并加载到受保护的内存部分（SMRAM）。 以下是其中的一个SMI处理器$SMISS处理器代码的反汇编： 0003F073: 50 push ax 0003F074: B4A1 mov ah,0A1 0003F076: 9A197D00F0 call 0F000:07D19 0003F07B: 2404 and al,004 0003F07D: 7414 je 00003F093 0003F07F: B434...
Xitami HTTP服务器套接字HEAD请求远程拒绝服务漏洞
BUGTRAQ ID: 34681 Xitami是一款多平台，多线程的开放源码Web服务器。 远程攻击者可以通过向Xitami服务器发送多个套接字HEAD请求导致HTTP服务崩溃。 Imatix Xitami = v5.0 Imatix ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.imatix.com...
Virtual Support Office XP MyIssuesView.asp脚本远程SQL注入漏洞
BUGTRAQ ID: 28247 Virtual Support Office XP是基于Web的帮助台软件。 Virtual Support Office-XP（VSO-XP）的MyIssuesView.asp模块没有正确地验证对IssueID参数的输入便将其用到了SQL查询中，这允许远程攻击者通过提交特制的SQL查询请求执行SQL注入攻击。 Advanced Data Solutions Virtual Support Office-XP 2 Advanced Data Solutions -----------------------...
Apache Solr SSRF漏洞 (CVE-2021-27905)
...
Apache Druid远程代码执行漏洞（CVE-2021-26919）
...
IE11: Use-after-free in Js::RegexHelper::RegexReplace(CVE-2018-0866)
There is a Use-after-free vulnerability in Internet Explorer that could potentially be used for memory disclosure. This was tested on IE11 running on Window 7 64-bit with the latest patches applied. Note that the PoC was tested in a 64-bit tab process via TabProcGrowth=0 registry flag and the pag...
finecmsV5.0.8 \finecms\dayrui\controllers\Api.php getshell
Vulnerability in the C:\phpStudy\WWW\finecms\dayrui\controllers\Api. in php data2 function, approximately in the line 115, the problematic code about 178 rows public function data2 $data = array; // Route authentication if defined'SYSREFERER' && strlenSYSREFERER $http = $SERVER'HTTPREFERER' ?...
GNU tar（POINTYFEATHER） decompression path bypass vulnerability
Vulnerability analysis reference: http://paper.seebug.org/103/ Overview GNU tar' archiver can be tricked into extracting files and directories in the given destination, regardless of the path names specified on the command line. Description GNU tar' archiver attempts to avoid path traversal attac...
Adobe ColdFusion < 11 Update 10 - XML external entity injection
Discovered by: Dawid Golunski - http://legalhackers.com - dawid at legalhackers.com - APSB16-30 - Release date: 31.08.2016 I. VULNERABILITY Adobe ColdFusion = 11 XML External Entity XXE Injection II. BACKGROUND "Adobe ColdFusion 11 Enterprise Edition offers a single platform to rapidly build and...
万户 OA系统 专业版 downloadhttp.jsp 参数fileName 任意文件下载漏洞
No description provided by source...
泛微OA某接口无需登录可执行任意SQL语句（附脚本）
简要描述： 荒废了 啥都不会 找工作啊 详细说明： 先以本地为例 http://localhost:8088/ws http://localhost:8088/ws/query?wsdl 竟然提示 Unmarshalling Error: unexpected element uri:"http://.../", local:"arg0". Expected elements are arg1,arg0 搜索 提示是参数问题 改代码肯定是不行的 那就改参数吧 ORA-00900: 无效 sql 语句 看来是可以的 更改第一个参数 select...
Apache James Server 2.3.2 - Remote Command Execution
Exploit Title: Apache James Server 2.3.2 Authenticated User Remote Command Execution Date: 16\10\2014 Vendor Homepage: http://james.apache.org/server/ Software Link: http://ftp.ps.pl/pub/apache/james/server/apache-james-2.3.2.zip 版本: Apache James Server 2.3.2 Tested on: Ubuntu, Debian...
Mail Manage EX 3.1.8 MMEX Script Settings Parameter Remote PHP File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10457/info Mail Manage EX is reportedly prone to a remote file include vulnerability. This vulnerability results from insufficient sanitization of user-supplied data and may allow remote attackers to include arbitrary PHP...
Coremail一个CSRF 攻击可窃取用户邮件
简要描述： 利用 Coremail 邮件正文 filter 的一个漏洞，当用户打开 bad mail 时会触发 CSRF，进而设置邮件转发规则。 详细说明： Coremail 把邮件正文的 替换成 嗯，这里是相对地址，正巧 Coremail 没有过滤 tag。 以 http://mail..edu.cn 为例，用户浏览器会解析此地址为 http://hack.com/coremail/s?func=user:proxyGet&sid=CAPplXssSmOlqAgclQsslyZkmdzLcYdA&mid=2:1tbiAgQPE1KpqPIw4QAAsq&url=csrf.jpg...
Oracle数据库服务器CREATE ANY DIRECTORY权限提升漏洞
BUGTRAQ ID: 31738 Oracle是大型的商用数据库系统。 Oracle数据库中存在严重的权限提升漏洞，拥有CREATE ANY DIRECTORY权限的低权限用户可以通过UTLDIR用已知的二进制口令文件直接覆盖隐藏的口令文件获得SYSDBA权限。 Oracle Database 11g Oracle Database 10.2 Oracle Database 10.1 Oracle ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.oracle.com --note windows add...
Interstage Application Server未明跨站脚本漏洞
Interstage Application Server是一款企业级电子商务解决方案。 Interstage Application Server不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 目前没有详细漏洞细节提供。 Fujitsu INTERSTAGE Studio Standard-J Edition 8.0.1 Fujitsu INTERSTAGE Studio Enterprise Edition 8.0.1 Fujitsu INTERSTAGE Job Workload Server 8.1 Fujitsu INTERSTAGE...
phpBB Spider Friendly Module <= 1.3.10 File Include Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? print ' | \\ | \\ | \ . . |\ \ \ /\ \ / /| || | | | | \ | \ Y / | || | | \ | \ \ / | || | |/ // / / ||| \ | / / \ / \ |\ /\ / / \ / \ | | | | / /\ \ / \ / \ | | | | / | / Y \ || / /| /| /...
Yapi 远程命令执行漏洞
如何复现此问题 登录注册后，创建一个项目 然后选择设置全局的mock脚本，设置命令为远程访问我的服务器地址。 随后添加接口，访问接口的mock地址 服务器可看到响应如下，远程服务器接受到请求 poc: const sandbox = this const ObjectConstructor = this.constructor const FunctionConstructor = ObjectConstructor.constructor const myfun = FunctionConstructor'return process' const process = myfun...
Asus_DeleteOfflineClientOverflow
Vulnerability: Stack buffer overflow in httpd ------------------------------------------ Exploitation: Can control the $pc. Use together with a session hijack vulnerability or in a csrf attack, can remote code execution and then get a connectback shell. ------------------------------------------...
Google PDFium TIFF Image Flate Decoder Code Execution Vulnerability(CVE-2017-5133)
Summary An off-by-one read/write on the heap vulnerability exists in the TIFF image decoder functionality of Pdfium as used by Google Chrome up to and including 60.0.3112.101. A specially crafted PDF file can trigger an off-by-one read and write on the heap resulting in memory corruption and a...
SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)
DESCRIPTION ------------------------- SwiftMailer class uses PHP mail function as its default transport. SwiftMailer suffers from the same vulnerability as the one disclosed in PHPMailer in the advisory at:...
Apache Shiro remote security restriction bypass Vulnerability, CVE-2016-6802）
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging the use of a non-root servlet context path. shiro in the path control, the attacker can bypass the filter to access filtered path, the impact of the version shrio 1.3.2 From the above figur...
Metinfo 5.3.1 /login_check.php 注入漏洞
No description provided by source...
用友软件企业门户xxe漏洞[测试前用友官域]
简要描述： 用友自带技能。 详细说明： 漏洞描述： 测试的时候发现使用yongyou nc的目录下有uapws/目录。百度百科。 打开后。自带登录模式，密码直接给你准备好了，登录就行了。好有爱。 找个接口，先提交请求。然后进行format the response（在这里抓包） xxe漏洞 漏洞证明： 高清无码 https://images.seebug.org/upload/201509/301834010d7b0d90e830d78290493a8fee...
TP-Link NC200/NC220 无线网络云摄像头硬编码漏洞
TP-Link NC200/NC220 Cloud Camera 300Mbps Wi-Fi Hard-Coded Credentials Vendor: TP-LINK Technologies Co., Ltd. Product web page: http://www.tp-link.us Affected version: NC220 V1 1.0.28 Build 150629 Rel.22346 NC200 V1 2.0.15 Build 150701 Rel.20962 Summary: Designed with simplicity in mind, TP-LINK's...
ISPConfig <= 3.0.5.4p7 monitor/show_sys_state.php SQL注入漏洞
因为不完整地过滤导致了SQL注入, 通过HTTP GET方式传递的server参数给了 /monitor/showsysstate.php页面攻击者可以传入任意恶意SQL命令并在数据库中执行该漏洞的成功的利用可以让攻击者获得数据库的读写权限甚至危机整个web应用但是该漏洞此时仍然是一个鸡肋漏洞, 因为攻击者要进行此攻击必须是认证通过的用户而且还需要有monitor权限然而, 结合CSRF Cross-Site Request Forgery in ISPConfig:...
Firefox toString console.time Privileged Javascript Injection
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/exploitation/jsobfu' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include...
YXcms伪造cookie绕过验证任一用户登录
简要描述： 源代码中有对cookie的加解密函数，可以伪造cookie，而且程序使用cookie进行权限验证，可以实现任一用户登录。 详细说明： Protected/apps/members/controller/indexController.php public function login if!$this-isPost//不使用post时 $cookieauth=getcookie'auth';//此时直接从cookie中获取认证信息，我们跟进getcookie函数看能否伪造cookie绕过认证 if!empty$this-auth...