56796 matches found
Microsoft Windows畸形IGMPv3报文远程拒绝服务漏洞（MS06-007）
Microsoft Windows是微软发布的非常流行的操作系统。 Microsoft Windows的TCP/IP协议栈在处理IGMPv3报文时存在问题，远程攻击者可以利用此漏洞对主机执行远程拒绝服务攻击。 Microsoft Windows在实现TCP/IP时没能正确的处理特制的IGMP报文，未经认证的远程攻击者可以通过向有漏洞系统发送特制的IGMP报文导致系统失去响应。 Microsoft Windows XP SP2 Microsoft Windows XP SP1 Microsoft Windows Server 2003 SP1 Microsoft Windows Serve...
Mambo com_serverstat Component <= 0.4.4 File Include Vulnerability
No description provided by source. =-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-= + +Mambo comserverstat Component =0.4.4 Remote File Include Vulnerability + =-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-= + +Author: xoron turkish...
MacOS so_pcb type confusion in necp_get_socket_attributes(CVE-2017-13855)
When getsockopt edited; original report said "setsockopt" is called on any socket with level SOLSOCKET and optname SONECPATTRIBUTES, necpgetsocketattributes is invoked. necpgetsocketattributes unconditionally calls sotoinpcbso: errnot necpgetsocketattributesstruct socket so, struct sockopt sopt i...
Jenkins Java Deserialization Remote Code Execution Vulnerability (CVE-2017-1000353)
Vulnerability Summary The following advisory describes Java deserialization vulnerability found in CloudBees Jenkins version 2.32.1 that leads to a Remote Code Execution. Jenkins helps to automate the non-human part of the whole software development process with now common things like continuous...
PHP Server Side Request Forgery Security Bypass Vulnerability（CVE-2017-7272）
For historical reasons, fsockopen accepts the port and hostname separately: fsockopen'127.0.0.1', 80 However, with the introdcution of stream transports in PHP 4.3, it became possible to include the port in the hostname specifier: fsockopen'127.0.0.1:80' Or more formally:...
TP-Link C2 and C20i command injection Vulnerability
Product Description TP-Link is a Chinese manufacturer of computer networking products such as routers and IOT devices. Vulnerabilities Summary Command Injections exist in the HTTP management interface up to the latest firmware version 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n of TP-Link C2 and...
ILas图书馆自动化集成系统 NTReaderCritic.aspx等2处 时间盲注漏洞
0x01漏洞简介 ILas图书馆自动化集成系统在NTReaderCritic.aspx和NTUniBookRetrInfo.aspx两个页面存在时间延迟注入漏洞。 0x02漏洞详情 NTReaderCritic.aspx sqlmap -u ".../NTReaderCritic.aspx?strRenco=1&strTitle=1" 相关代码如下： protected void PageLoadobject sender, EventArgs e if !base.IsPostBack if base.Request.QueryString"strRenco" != null &&...
万户OA xfire xml实体注入漏洞
xfire xml实体注入 webservice使用了xfire框架，存在xxe漏洞 jmx-console 存在默认口令: admin/ezoffice，网上搜一下基本没改。...
ecstore app/dev/svinfo.php 信息泄露漏洞
No description provided by source...
Huawei Home Gateway UPnP/1.0 IGD/1.00 - Password Disclosure
No description provided by source...
某通用图书管理系统存储型XSS
简要描述： XSS 可导致几十所大学学生身份证账号和姓名泄露 详细说明： 江苏汇文图书管理系统v5.0存在持久型xss漏洞 漏洞危害：存储型XSS，可以导致几十所大学学生姓名和身份证号码泄露，学生的个人信息处有身份证号码，以及部分学生手机号码和常用邮箱。 一共存在两处存储型xss ，以下用湖北工业大学图书馆为例 http://202.114.181.3:8080/opac/search.php 第一处：在图书评论处 1.首先我们登录图书馆账号和密码都是 1210100822 1210100823 1210100824 2.然后随便在搜索栏搜一本书，比如这本书...
Pligg 9.9.5 - CSRF Protection Bypass and Captcha Bypass
No description provided by source. Written By Michael Brooks Special thanks to str0ke! Pligg - XSRF Protection Bypass and Captcha Bypass affects 9.9.5 XSRF Protection Bypass html !-- Remove this iframe from this file and place it on a site that you want to force people to vote for. Change these...
Joomla 1.5.12 RCE via TinyMCE - Upload Vulnerability
No description provided by source. ?php / Joomla 1.5.12 Remote Code Execution via TinyMCE upload vulnerability Tested against : - Joomla 1.5.12 / Ubuntu 8.10 / Apache 2.2.9 - Joomla 1.5.12 / Windows XP SP2 / Apache 2.2.12 Luca daath De Fulgentis - daath at nibblesec.org http://blog.nibblesec.org ...
SMF Forum Mambo Component <= 1.3.1.3 Include Vulnerability
No description provided by source. Joomla-SMF Forum Bridge For Mambo 4.5.3+ And Mambo 4.5.3+ Remote File Inclusion Vulnebrality Discovered by : ASIANEAGLE Remote:Yes Level:High --------------------------------------------------------- Application: SMF Forum 1.3.1.3 Bridge Component For Joomla And...
PHP-Fusion 4.01 'readmore.php' SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/30680/info PHP-Fusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise th...
mail2forum phpBB Mod <= 1.2 (m2f_root_path) Remote Include Vulns
No description provided by source. Title : mail2forum = 1.2 Multiple Remote File Include Vulnerabilities Discovered By OLiBekaS ----------------------------------------------------------------------------- Affected software description : Application : mail for phpbb bulletin board/forum software...
SiteServer 3.6.4 background_log.aspx SQL注入漏洞
SiteServer 3.6.4 /siteserver/platform/backgroundlog.aspx文件使用了位于/Bin/BaiRong.BackgroundPages.dll代码，在接收DateFrom参数没有合适过滤，导致SQL注入漏洞。 0 SiteServer 3.6.4 升级到官方最新版： http://www.siteserver.cn...
appcms 1.3.708 /pic.php 任意文件下载漏洞
No description provided by source...
phpwind 9 /src/service/tag/dao/PwTagDao.php SQL注入漏洞
phpwind是国内一款流行的内容管理系统软件，其9版本/src/service/tag/dao/PwTagDao.php文件代码第116行的$tagName变量由$GET方式获得，代码117-119行拼接SQL语句，带入数据查询。在查询之前执行了/wind/db/mysql/WindMysqlPdoAdapter.php文件代码第24行设置编码为gbk，由此导致宽字节漏洞产生。 phpwind 9...
Microsoft Windows SMTP Server组件MX记录解析拒绝服务漏洞（MS10-024）
BUGTRAQ ID: 39308 CVE ID: CVE-2010-0024 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的SMTP组件处理特制的DNS邮件交换器（MX）资源记录的方式中存在拒绝服务漏洞。利用该漏洞的尝试不要求进行认证，攻击者可以通过向运行SMTP服务的计算机发送特制网络消息来利用该漏洞。成功利用此漏洞的攻击者可能会导致SMTP服务停止响应，直至重新启动。 Microsoft Exchange Server 2003 SP2 Microsoft Windows XP SP3 Microsoft Windows XP SP2...
多个BSD平台'strfmon()'函数整数溢出漏洞
BUGTRAQ ID: 28479 CVE ID:CVE-2008-1391 CNCVE ID:CNCVE-20081391 多个BSD平台'strfmon'函数处理存在整数溢出，可能以受影响应用程序上下文执行任意代码。失败的尝试可导致拒绝服务。 问题代码类似如下： include monetary.h ssizet strfmonchar restrict s, sizet maxsize, const char restrict format, ...; - --- 1. /usr/src/lib/libc/stdlib/strfmon.c -整数溢出...
XCMS 1.1 (Galerie.php) Local File Inclusion Vulnerabilities
No description provided by source. Author:: BlackNDoor | [email protected] Homepage:: www.learntohell.net Script:: XCMS : CMS Version:: 1.1 Type:: Remote Directory Listing & Local File Include Source:: http://groupeclan.free.fr/XCMS.zip Bug:: - Files: /Module/Galerie.php.php - vulncode:...
JobSitePro 1.0 (search.php) Remote SQL Injection Exploit
No description provided by source. //Coded by ajann //'=============================================================================================== //'Script Name: JobSitePro 1.0 search.php Remote BLIND SQL Injection Exploit //'Coded by : ajann //'Author : ajann //'Contact : : //'S.Page :...
Hastymail IMAP SMTP命令注入漏洞
Hastymail IMAP是一款由PHP编写的IMAP协议实现客户端。 Hastymail IMAP不充分过滤用户提交的URI输入，远程攻击者可以利用漏洞执行其他SMTP命令。 由于对命令和信息缺少验证，可导致恶意用户注入任意IMAP/SMTP命令到邮件服务器，可导致绕过限制进行访问。 Hastymail Hastymail 1.5 Hastymail Hastymail 1.2 Hastymail Hastymail 1.1 Hastymail Hastymail 1.0.2 Hastymail Hastymail 1.0.1 升级程序： Hastymail Hastymail...
Foxes Among Us :: Foxit Reader Vulnerability Discovery and Exploitation
After discovering over 100 vulnerabilities in Foxit Reader, I figured it was about time I shared a full exploit chain that defeats ASLR and DEP. The first vulnerability is an uninitialized buffer that I found independently and was later killed by bit from meepwn. I leveraged this for an informati...
Goahead webserver <= 2.1.8-path bypass-sensitive File Download vulnerability
1 Introduction Goahead webserver is an embedded OpenSource server that can be build on a lot of systems CE, Ecos, GNU/Linux, Lynx, MacOS, NW, QNX4, VXWORKS, Win32 and others. It is supported by a lot of companies that use it for their projects and it is also used like "base" for other webservers,...
QEMU: virtfs permits guest to access entire host filesystem (CVE-2016-9602)
If an attacker can execute arbitrary code in the guest kernel and a virtfs is set up, the attacker can access the entire filesystem of the host using a symlink attack. This might require the security model "passthrough" or "none" - I haven't tested with the mapped modes. Repro steps: 1. Place som...
MetInfo 5.3 listmod.php SQL注入漏洞
No description provided by source...
Microsoft IIS <= 5.1 Hit Highlighting Authentication Bypass Exploit
No description provided by source. !/bin/sh NTLM && BASIC AUTH BYPASS : sha0atbadchecksum.net Based on my adv: http://www.securityfocus.com/bid/24105/info CVE-2007-2815 if $ != 2 then printf USAGE:\t\t$0 Site Protected Object\nExample:\t$0 http://www.microsoft.com /en/us/default.aspx\n\n; exit 0 ...
FusionPHP Fusion News 3.3/3.6 X-ForwordedFor PHP Script Code Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13661/info FusionPHP Fusion News is prone to a remote PHP code injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. This may facilitate unauthorized access. ...
My_EGallery Module 3.1.1 - Remote Include Command Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9113/info A problem has been identified in the handling of input by MyeGallery. Because of this, it may be possible for a remote user to gain unauthorized access to a system using the vulnerable software. MyeGallery explo...
Konqueror 4.7.3 Memory Corruption
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Nth Dimension Security Advisory NDSA20121010 Date: 10th October 2012 Author: Tim Brown mailto:[email protected] URL: http://www.nth-dimension.org.uk/ / http://www.machine.org.uk/ Product: Konqueror 4.7.3...
iGenus邮件系统 邮件储存型XSS(打开自动触发，多家政府，企业在使用）
简要描述： - iGenus邮件系统 邮件储存型XSS打开自动触发，多家政府，企业在使用） - 中国科学技术大学选用爱琴思邮件系统 - 北京市丰台教委量身定制教委应用邮件系统 - 浙江财经学院牵手爱琴思邮件系统 - 北京锐迪科微电子再次牵手爱琴思邮件 - 北京汉王科技再次选购爱琴思邮件系统 - 西安乐尚网络选购爱琴思邮件系统 - 北京瑞地通信选购爱琴思邮件系统 - 北京理工大学再次签约爱琴思邮件 - 上海宏洋网络选购爱琴思邮件系统 - 东软集团股份有限公司选购爱琴思邮件系统 - 上海劲霸投资公司选购爱琴思邮件系统 - 热烈祝贺中铁八局再次采购爱琴思邮件系统 - 卢米埃影业选购爱琴思邮件系...
IBM XIV Storage System OpenSSL TLS/DTLS心跳信息泄漏漏洞
CVE ID:CVE-2014-0160 IBM XIV Storage System是一款网格存储解决方案。 IBM XIV Storage System所绑定的OpenSSL存在安全漏洞，OpenSSL处理TLS”心跳“扩展存在一个边界错误，允许攻击者利用漏洞获取64k大小的已链接客户端或服务器的内存内容。内存信息可包括私钥，用户名密码等。 0 IBM XIV Storage System 11.3.0 IBM XIV Storage System 11.3.0.a IBM XIV Storage System 11.3.1 IBM XIV Storage System 11.4.1...
强智综合教务系统后台上传漏洞，可沦陷服务器
简要描述： 后台上传获取webshell 通过搜索获得Oracle数据库管理权限 修改成绩 详细说明： http://www.qzdatasoft.com:8088/qznjw/ewebeditor/admin/ 默认账号密码admin 直接上传webshell 获取root权限 （ewebeditor后台授权漏洞修补 目前无法使用ewebeditor后台进行上传） 搜索 oracle.jdbc.driver.OracleDriver 可以获取Oracle数据库账号密码 通过官方PDF文档知晓 成绩保存在CJ0708 补考保存在CJ0708BK 通过近期对服务器信息收集发现...
Microsoft Excel Office Art远程代码执行漏洞(MS11-021)
BUGTRAQ ID: 47226 CVE ID: CVE-2011-0979 Microsoft Excel是由Microsoft为Windows和Apple Macintosh操作系统的电脑而编写和运行的一款试算表软件。 Microsoft Excel在实现上存在缓冲区溢出漏洞，远程攻击者可利用此漏洞以当前用户权限执行任意代码，造成拒绝服务。 Microsoft Office Excel处理特制Excel文件的方式中存在一个远程执行代码漏洞，成功利用此漏洞的攻击者便可完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户 Microsoft...
sablog-X v1.6 $page数值类型转换漏洞
sablog是国内安全研究人员写的一款blog程序。数值类型转换存在漏洞。 系统对分页函数$page处理上存在问题。 如果$page的参数为负数的话，程序就会出错。如：http://luoq.net/?page=-1 1是数字，-1就是字符了。暂且叫做数值类型转换上的问题吧。不过没有办法利用。哈哈。比较非主流。 sablog-X v1.6 对$page进行处理。 $page = isset$GET'page' ? max0, intval$GET'page' : 0;...
Linux Kernel 'truncate()'本地特权提升漏洞
BUGTRAQ ID: 31368 CVE ID：CVE-2008-4210 CNCVE ID：CNCVE-20084210 Linux是一款开放源代码的操作系统。 Linux内核'truncate'和'ftruncate'函数存在设计错误，本地攻击者可以利用漏洞提升特权。 当建立文件时，open/creat允许通过模式参数设置setgid位，由于bsdgroups mount选项或在setgid目录中建立文件，用户不属于新文件的组的成员。用户可以使用ftruncate和memory-mapped I/O使新文件成为任意两进制，获得此组的特权，原因是这些操作没有清除setgid位。...
RunCMS 1.6 Multiple Remote Vulnerabilities
No description provided by source. Digital Security Research Group Advisory Application: RunCMS Versions Affected: RunCMS 1.6 Vendor URL: http://www.runcms.org Bugs: SQL Injections, XSS, PHP Include, Predictable session id, etc. Exploits: Aviable Reported: 14.12.2007 Vendor response: 15.12.2007...
PHPMyInventory Global.Inc.PHP远程文件包含漏洞
PHPMyInventory是一款基于PHP的WEB应用程序。 PHPMyInventory不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'Global.Inc.PHP'脚本对用户提交的'strIncludePrefix'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 phpMyInventory 2.8 目前没有详细解决方案提供： http://sourceforge.net/projects/phpmyinventory/...
MS Exchange Server Remote Code Execution Exploit (MS05-021)
漏洞描述：Microsoft Exchange是一款由微软开发的邮件服务程序。Microsoft Exchange Server中存在缓冲区溢出漏洞，攻击者可能利用此漏洞在主机上执行任意指令。 起因是Exchange SMTP Server在处理特殊的扩展SMTP verb时存在缓冲区溢出。漏洞可能允许攻击者连接到Exchange服务器的SMTP端口并发送精心构造的恶意命令，这些命令可能导致拒绝服务或以SMTP服务进程的权限运行攻击者所选择的代码。漏洞影响：受影响的软件： •Microsoft Exchange Server 2000 Service Pack 3 •Microsoft...
致远OA thirdpartyController.do 未授权RCE漏洞
...
XNU kernel heap overflow due to bad bounds checking in MPTCP(CVE-2018-4241)
mptcpusrconnectx is the handler for the connectx syscall for the APMULTIPATH socket family. The logic of this function fails to correctly handle source and destination sockaddrs which aren't AFINET or AFINET6: // verify salen for AFINET: if dst-safamily == AFINET && dst-salen !=...
ManageEngine Desktop Central 10 Build 100087 RCE(CVE-2017-11346)
Description: When uploading a file, the FileUploadServlet class does not check the user-controlled fileName parameter using hasVulnerabilityInFileName function. This allows a remote attacker to create a malicious file and place it under a directory that allows server-side scripts to run, which...
Firefox Integer overflow leading to a buffer overflow in nsScriptLoadHandler (CVE-2016-9066)
This post will explore how CVE-2016-9066, a simple but quite interesting from an exploitation perspective vulnerability in Firefox, can be exploited to gain code execution. tl;dr an integer overflow in the code responsible for loading script tags leads to an out-of-bounds write past the end of an...
MS16-032 Secondary Logon Handle local mention the right vulnerability
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/payloadgenerator' require 'msf/core/exploit/powershell' require 'rex' class MetasploitModule...
某学校综合管理平台另一处Getshell漏洞
简要描述： 某学校综合管理平台另一处Getshell漏洞 详细说明： 系统名称：学校综合管理平台 厂商：上海安脉计算机科技有限公司 关键字：版权所有：上海安脉计算机科技有限公司 系统架构：ASPX+MSSQL ASP+MSSQL 漏洞成因：编辑器不规范使用（弱口令+数据库可下载） 漏洞证明： 枚举部分案例： http://anmai.net:81/PrepManage/Editor/adminlogin.asp http://jwxx.am.jsedu.sh.cn/ANMAI/PrepManage/Editor/adminlogin.asp...
elgg <= 1.5 (/_css/js.php) Local File Inclusion Vulnerability
No description provided by source. Product: elgg.org Version: = 1.5 Dork: Powered by Elgg, the leading open source social networking platform eLwauxc2009 UASC.org.UA POC: /css/js.php?js=../../../../tmp/sessiondir%00&viewtype=xD need: in table datalists must be record simplecacheenabled = 0 defaul...
hassan consulting shopping cart 1.18 - Directory Traversal vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1777/info The $page variable in Hassan Consulting Shopping Cart does not properly check for insecure relative paths such as the double dot ... Therefore, requesting the following URL will display the specified file:...
UCenter Home 2.0 - SQL Injection Vulnerability
No description provided by source. --==UCenter Home 2.0 -0day Remote SQL Injection Vulnerability==-- / Author : KnocKout / Greatz : DaiMon,BARCOD3,RiskY and iranian hackers / Contact: [email protected] / Cyber-Warrior.org/CWKnocKout --==--==--==--==--==--==--==--==--==--== Script : UCenter Home...