56796 matches found
某通用型电子采购系统Oracle盲注漏洞
简要描述： 捡漏啊 详细说明： 前人有经验： WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） 厂商： http://www.1caitong.com/ 北京网达信联科技发展有限公司 SQL注入点： /GetPassWord.aspx POST参数txtUserName存在注入 Case: http://eps.umgg.com.cn/GetPassWord.aspx http://ygcg.xuangang.com.cn/GetPassWord.aspx http://222.134.89.6/GetPassWord.aspx...
强智教务管理信息系统任意文件下载致多所学校沦陷打包部分学校（赤裸裸的sa）
简要描述： RT 详细说明： 关键字：版 权:长沙市强智科技发展有限责任公司·版权所有 这只是我搜索的部分网站。 http://58.18.213.238/jwgl/public/download.asp?filename=../jwjs/conn/connstring.asp. http://jiaowu.hustwenhua.net/public/download.asp?filename=../jwjs/conn/connstring.asp...
@lex Guestbook <= 4.0.5 - index.php test Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/28519/info @lex Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the...
elgg <= 1.5 (/_css/js.php) Local File Inclusion Vulnerability
No description provided by source. Product: elgg.org Version: = 1.5 Dork: Powered by Elgg, the leading open source social networking platform eLwauxc2009 UASC.org.UA POC: /css/js.php?js=../../../../tmp/sessiondir%00&viewtype=xD need: in table datalists must be record simplecacheenabled = 0 defaul...
Java Applet Field Bytecode Verifier Cache Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
hassan consulting shopping cart 1.18 - Directory Traversal vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1777/info The $page variable in Hassan Consulting Shopping Cart does not properly check for insecure relative paths such as the double dot ... Therefore, requesting the following URL will display the specified file:...
Linux kernel execve函数本地拒绝服务漏洞
CVECAN ID: CVE-2009-2848 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的execve函数没有清除current-clearchildtid指针，在处理线程创建和退出过程中启用了CLONECHILDSETTID或CLONECHILDCLEARTID的clone系统调用会导致内存破坏。本地攻击者可以利用这个漏洞导致拒绝服务。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
BIND 9.4.1-9.4.2 Remote DNS Cache Poisoning Flaw Exploit (py)
No description provided by source. from scapy import import random Copyright C 2008 Julien Desfossez [email protected] http://www.solisproject.net/ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Softwa...
BIND 9.x Remote DNS Cache Poisoning Flaw Exploit (py)
No description provided by source. from scapy import import random Copyright C 2008 Julien Desfossez [email protected] http://www.solisproject.net/ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Softwa...
RunCMS 1.6 Multiple Remote Vulnerabilities
No description provided by source. Digital Security Research Group Advisory Application: RunCMS Versions Affected: RunCMS 1.6 Vendor URL: http://www.runcms.org Bugs: SQL Injections, XSS, PHP Include, Predictable session id, etc. Exploits: Aviable Reported: 14.12.2007 Vendor response: 15.12.2007...
XCMS 1.1 (Galerie.php) Local File Inclusion Vulnerabilities
No description provided by source. Author:: BlackNDoor | [email protected] Homepage:: www.learntohell.net Script:: XCMS : CMS Version:: 1.1 Type:: Remote Directory Listing & Local File Include Source:: http://groupeclan.free.fr/XCMS.zip Bug:: - Files: /Module/Galerie.php.php - vulncode:...
Microsoft Internet Explorer HTML拒绝服务漏洞
Microsoft Internet Explorer是一款流行的WEB浏览器。 Microsoft Internet Explorer处理HTML存在问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 构建如下恶意的HTML代码，诱使用户使用IE处理，可导致应用程序崩溃： usr/bin/python print "-------------------------------------------------------------------------" print " Internet Explorer 7.0.5730.11 Denial of Service"...
Cybozu Garoon SQL注入漏洞
Cybozu Garoon是一款基于PHP的WEB应用程序。 Cybozu Garoon不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是由于多个脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Cybozu Garoon 2.1 http://garoon.cybozu.co.jp/ http://www.example.com/scripts/cbgrn/grn.exe/todo/index?cid=SQL...
MDaemon POP3服务器预认证远程溢出漏洞
Alt-N MDaemon是一款基于Windows的邮件服务程序。 MDaemon POP3服务器在处理USER和APOP命令时存在缓冲区溢出漏洞。如果向USER或APOP命令发送了包含有“@”字符的超长字符串的话，就会触发这个漏洞，导致堆溢出。如果要利用这个漏洞，必须向POP3服务器发送多个USER命令。成功利用这个漏洞的攻击者可能会执行任意代码，具体取决于堆的状态及字符串的长度。 Alt-N MDaemon 9.06 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.altn.com PoC for Mdaemon POP3 preauth...
MySpeach <= 3.0.2 (my_ms[root]) Remote File Include Vulnerability
No description provided by source. ============================================================================================== MySpeach = v3.0.2 mymsroot Remote File Inclusion Exploit =============================================================================================== Critical Level...
IE11: Use-after-free in Js::RegexHelper::RegexReplace(CVE-2018-0866)
There is a Use-after-free vulnerability in Internet Explorer that could potentially be used for memory disclosure. This was tested on IE11 running on Window 7 64-bit with the latest patches applied. Note that the PoC was tested in a 64-bit tab process via TabProcGrowth=0 registry flag and the pag...
Linux kernel Local Denial of Service Vulnerability (CVE-2017-7308 )
The packetsetring function in net/packet/afpacket.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service integer signedness error and out-of-bounds write, or gain privileges if the CAPNETRAW capability is held...
Apache Tomcat examples directory session vulnerabilities
No description provided by source...
VMware Remote Console e.x.p build-158248 - format string vulnerability
No description provided by source. DSECRG-09-053 VMware Remote Console - format string vulnerability http://www.dsecrg.com/pages/vul/show.php?id=153 VMrc vulnerable to format string attacks. Exploitation of this issue may lead to arbitrary code execution on the system where VMrc is installed...
Microsoft Internet Explorer释放后重用远程代码执行漏洞
BUGTRAQ ID: 65551 CVECAN ID: CVE-2014-0322 Internet Explorer是微软公司推出的一款网页浏览器。 Microsoft Internet Explorer 10在实现上存在释放后重利用漏洞，攻击者可利用此漏洞修改任意地址处的内存字节，结合Flash ActionScript获取内存读写权限，读出actionscript中对象的虚表指针，从而绕过ASLR；然后使用ROOP技术绕过DEP。 0 Microsoft Internet Explorer 10 临时解决方法： 安装EMET或升级到IE 11以防恶意利用此漏洞。...
Microsoft .NET Framework 远程权利提升漏洞(CVE-2014-0257)(MS14-009)
BUGTRAQ ID: 65417 CVECAN ID: CVE-2014-0257 .NET就是微软的用来实现XML，Web Services，SOA（面向服务的体系结构service-oriented architecture）和敏捷性的技术。.NET Framework是微软开发的软件框架，主要运行在Microsoft Windows上。 Microsoft.NET Framework内存在权限提升漏洞，可使攻击者提升其在受影响系统上的权限。 0 Microsoft .NET Framework 4.x Microsoft .NET Framework 3.x Microsoft...
FreeBSD 本地权限提升漏洞(CVE-2013-2171)
BUGTRAQ ID: 60615 CVECAN ID: CVE-2013-2171 FreeBSD是一种UNIX操作系统，是由经过BSD、386BSD和4.4BSD发展而来的Unix的一个重要分支 FreeBSD 9.0及其他版本的虚拟内存系统对权限检查不充分，注入debugger之类的跟踪进程可在未授权情况下修改被跟踪进程的地址空间，覆盖内核内存，造成权限提升或系统崩溃 0 FreeBSD = 9.0 厂商补丁： FreeBSD ------- FreeBSD已经为此发布了一个安全公告（FreeBSD-SA-13:06.mmap.asc）以及相应补丁:...
Microsoft Excel Office Art远程代码执行漏洞(MS11-021)
BUGTRAQ ID: 47226 CVE ID: CVE-2011-0979 Microsoft Excel是由Microsoft为Windows和Apple Macintosh操作系统的电脑而编写和运行的一款试算表软件。 Microsoft Excel在实现上存在缓冲区溢出漏洞，远程攻击者可利用此漏洞以当前用户权限执行任意代码，造成拒绝服务。 Microsoft Office Excel处理特制Excel文件的方式中存在一个远程执行代码漏洞，成功利用此漏洞的攻击者便可完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户 Microsoft...
Checkpoint VPN-1 PAT信息泄露漏洞
CVECAN ID: CVE-2008-5849 CheckPoint防火墙/VPN解决方案可为组织提供网络架构和信息安全保护。 对于启用了端口地址翻译（PAT）的CheckPoint VPN-1防火墙，如果远程攻击者向防火墙的18264/tcp端口发送设置有很低TTL值的报文的话，就可以触发ICMPTIMXCEEDINTRANS响应，而响应的封装IP报文中包含有内部IP地址，如下所示： 14:56:25.169480 IP tos 0xe0, ttl 255, id 21407, offset 0, flags none, proto: ICMP 1, length: 68...
Maran PHP Shop (prod.php cat) SQL Injection Vulnerability
No description provided by source. Maran PHP Shop prod.php cat SQL Injection Vulnerability url: http://www.maran.pamil-visions.com/maranshop.php Author: JosS mail: sys-projectathotmaildotcom site: http://spanish-hackers.com team: Spanish Hackers Team - SHT This was written for educational purpose...
Linux Kernel i915驱动drivers/char/drm/i915_dma.c内存破坏漏洞
BUGTRAQ ID: 31792 CVECAN ID: CVE-2008-3831 Linux Kernel是开放源码操作系统Linux所使用的内核。 在使用Intel G33系列芯片组的机器上，非root用户可以通过ioctl调用只有root用户才可以使用的i915内核驱动的i915setstatuspage函数。本地攻击者可以通过向驱动发送特制的IOCTL清零并重新映射内存位置。 Linux kernel 2.6.x Debian ------ Debian已经为此发布了一个安全公告（DSA-1655-1）以及相应补丁: DSA-1655-1：New Linux 2.6.24...
动易网站管理系统vote.asp页面存在SQL注入漏洞
动易网站管理系统是一个采用 ASP 和 MSSQL 等其他多种数据库构建的高效网站内容管理解决方案产品。 vote.asp调用了动易组件PESite.ShowVote，此组件VoteOption参数过滤不严，导致可以进行mssql注入 但是其语句里面过滤了-- ;等字符，又是一个UPDATE形的注入，有一定的限制。但是其过滤的顺序不对。有导致mssql的注释符号--可以进入语句 PowerEasy CMS SP6 071030以下版本 更新动易组件（需要管理员的权限才能更新）。 不需要投票功能的用户，删除此文件。...
Microsoft SQL Server sqldmo.dll ActiveX控件缓冲区溢出漏洞
BUGTRAQ ID: 25594 Apache HTTP Server是一款流行的Web服务器。 Microsoft SQL Server分布式管理对象OLE DLL（sqldmo.dll）中存在缓冲区溢出漏洞。如果用户受骗访问了恶意网页并向该控件的Start方式传送了超长字符的话，就可能触发这个溢出，导致执行任意代码。 Microsoft SQL Server 2005 SP2 Microsoft --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
Apache Tomcat Manager和Host Manager上传跨站脚本漏洞
Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat包含的管理和主机管理WEB应用程序不正确处理URL数据，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 提交恶意POST请求，由于不充分过滤，可导致提交恶意脚本代码作为参数，当其他用户解析时可泄露敏感信息。 Apache Tomcat 6.0.13 Apache Tomcat 6.0.12 Apache Tomcat 6.0.11 Apache Tomcat 6.0.10 Apache Tomcat 6.0.9 Apache Tomcat 6.0.8 Apache Tomcat...
0irc-client v1345 build20060823 Denial of Service Exploit
No description provided by source. / 0irc-client v1345 build 20060823 DoS Exploit By DiGitalX [email protected] Date: 22/3/2007 -- MicroSystem Team -- Site: http://DiGitalX.I.am Description: 0irc-client suffers from a NULL pointer derefrencing bug. / define WIN32LEANANDMEAN include winsock2.h...
SourceForge database.php远程文件包含漏洞
SourceForge是用于协助开源软件开发的在线Web应用。 SourceForge在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 SourceForge的 include/database.php 脚本没有对sysdbtype变量数据做充分的检查过滤，远程攻击者可能利用此漏洞使服务器包含远程服务器上的PHP代码执行。 sourceforge SourceForge 1.0.4 我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
Multiple Vulnerabilities in NagiosXI
We found four vulnerabilities in NagiosXI, and chained them together to create a root RCE exploit, available here. Vulnerability chaining can increase the risk posed by individual vulns, it takes a village to raise a root RCE etc. etc. If you’re running NagiosXI = 5.4.12, update. If you perform...
MacOS so_pcb type confusion in necp_get_socket_attributes(CVE-2017-13855)
When getsockopt edited; original report said "setsockopt" is called on any socket with level SOLSOCKET and optname SONECPATTRIBUTES, necpgetsocketattributes is invoked. necpgetsocketattributes unconditionally calls sotoinpcbso: errnot necpgetsocketattributesstruct socket so, struct sockopt sopt i...
Linux: mincore() discloses uninitialized kernel heap pages(CVE-2017-16994)
I found the following bug with an AFL-based fuzzer: When walkpagerange is used on a VMHUGETLB VMA, callbacks from the mmwalk structure are only invoked for present pages. However, domincore assumes that it will always get callbacks for all pages in the range passed to walkpagerange, and when this...
Microsoft Office SMB Information Disclosure
Vulnerability Summary The following advisory describes an information disclosure found in Microsoft Office versions 2010, 2013, and 2016. Microsoft Office is: “Whether you’re working or playing, Microsoft is here to help. We’re the company that created Microsoft Office, including Office 365 Home,...
Microsoft Edge Content Security Bypass Vulnerability
Summary An exploitable information leak vulnerability exists in the Content Security Policy enforcement functionality of Microsoft Edge 40.15063.0.0. A specially crafted web page can cause a content security policy bypass resulting in an information leak. An attacker can create a malicious webpag...
Serv-U FTP/MFT Server Unauthenticated Privilege Escalation
Details source: https://www.trustwave.com/Resources/SpiderLabs-Blog/Exploiting-Privilege-Escalation-in-Serv-U-by-SolarWinds/?page=1&year=0&month=0 I was recently working on an external network penetration test where I identified a new vulnerability in a file sharing web application called Serv-U ...
MS16-032 Secondary Logon Handle local mention the right vulnerability
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/payloadgenerator' require 'msf/core/exploit/powershell' require 'rex' class MetasploitModule...
绿麻雀 p2p网贷系统sql注入漏洞
No description provided by source...
DFE SCADA(东方电子电力工控)默认弱口令漏洞
No description provided by source...
Edusoho敏感信息泄露漏洞
No description provided by source...
Java RMIConnectionImpl Deserialization Privilege Escalation Exploit
No description provided by source. $Id: javarmiconnectionimpl.rb 10490 2010-09-27 00:09:17Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...
VSFTPD 2.3.4 - Backdoor Command Execution
No description provided by source. $Id: vsftpd234backdoor.rb 13099 2011-07-05 05:20:47Z hdm $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of...
AWStats < 6.4 (referer) Remote Command Execution Exploit
No description provided by source. !/usr/bin/perl AWStats 6.4 command execution exploit based on http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities coded by 1dt.w0lf 11.08.2005 RST/GHC http://rst.void.ru http://ghc.ru Note Exploitation will not occur until the stats page...
Drools任意代码执行漏洞
Bugtraq ID:66659 CVE ID:CVE-2013-6468 Drools具有一个易于访问企业策略、易于调整以及易于管理的开源业务规则引擎，符合业内标准，速度快、效率高。 Drools存在一个安全漏洞，允许远程通过验证的攻击者在MVEL或者Drools表达式中提交任意Java代码，可以应用服务安全上下文执行任意代码。 0 Drools 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： https://rhn.redhat.com/errata/RHSA-2014-0371.html...
Wing FTP Server 4.0.1之前版本信息泄露漏洞
Bugtraq ID: 50355 Wing FTP Server是一款FTP服务程序。 Wing FTP Server相关HTTP协议存在安全漏洞，允许恶意用户获得敏感信息。 Wing FTP Server 4.x 厂商解决方案 Wing FTP Server 4.0.1已经修复此漏洞，建议用户下载使用： http://www.wftpserver.com/...
Linux Kernel < 2.6.36-rc1 CAN BCM Privilege Escalation Exploit
No description provided by source. / i-CAN-haz-MODHARDEN.c Linux Kernel 2.6.36-rc1 CAN BCM Privilege Escalation Exploit Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2959 Ben Hawkes discovered an integer overflow in th...
PHP 'create_function()'代码注入漏洞
BUGTRAQ ID: 31398 CNCAN ID：CNCAN-2008092610 PHP是一款流行的WEB编程语言。 PHP不正确过滤传递给'createfunction'的输入，远程攻击者可以利用漏洞以特权应用程序权限执行任意代码。 PHP使用createfunction函数用于CREATE一个匿名函数： 1，使用createfunction建立一个匿名函数： ?php $newfunc = createfunction'$a,$b', 'return "ln$a + ln$b = " . log$a $b;'; echo "New anonymous function:...
Coppermine Photo Gallery lang参数本地文件包含漏洞
BUGTRAQ ID: 30480 Coppermine是用PHP编写的多用途集成Web图形库脚本。 Coppermine Photo Gallery没有正确地过滤对data cookie中编码的lang部分输入便用于包含文件，这允许远程攻击者通过目录遍历攻击和空字节包含本地资源的任意文件。成功攻击要求将字符编码设置为Unicode utf-8，而这是默认配置。 Coppermine Photo Gallery 1.4.18 Coppermine ---------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
MG-SOFT Net Inspector 6.5.0.828 Multiple Remote Vulnerabilities
No description provided by source. Luigi Auriemma Application: MG-SOFT Net Inspector http://www.mg-soft.com/netinsp.html bug C affects any MgWTrap3 service which is included in...