56796 matches found
PHP upload - (unijimpe) Remote File Upload Vulnerability
No description provided by source. || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ /'\ \ /\ \ \ \ /'\ \ | | \ \ /\ /\ \ \ \ /...
F5 BIG-IP Remote Root Authentication Bypass Vulnerability
No description provided by source. Matta Consulting - Matta Advisory https://www.trustmatta.com F5 BIG-IP remote root authentication bypass Vulnerability Advisory ID: MATTA-2012-002 CVE reference: CVE-2012-1493 Affected platforms: BIG-IP platforms without SCCP Version: 11.x 10.x 9.x Date:...
Arab Portal 2.1 - Remote File Disclosure Vulnerability (win only)
No description provided by source. Arab Portal v2.1 Remote File Disclosure Win32 AUTHOR : IRCRASH R3d.W0rm Sina Yazdanmehr Discovered by : R3d.W0rm Sina Yazdanmehr Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Sina Yazdanmehr - Hadi Kiamarsi Download : www.arabportal.ne...
Adobe ColdFusion APSB13-03 Remote Exploit
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'digest/sha1'...
phpmps后台任意文件上传
简要描述： 后台没做好过滤，导致任意文件上传 详细说明： 小伙伴说phpmps后台不好拿到shell，就看了下，发现居然存在任意上传 后台\admin\flash.php case 'insert': ifempty$REQUEST'url'show'链接不能为空'; ifempty$FILES'file''name' //仅仅检测是否有上传 show'没有上传图片'; else $name = date'Ymd'; for$i = 0;$i...
Barracuda Load Balancer‘/cgi-mod/index.cgi’远程命令注入漏洞
BUGTRAQ ID: 65508 Barracuda Load Balancer是美国梭子鱼（Barracuda Networks）公司的一款应用交付控制器。该控制器提供对入侵和攻击事件的防护功能，并同时优化应用负载和提供强大的性能支持。 Barracuda Load Balancer中存在远程命令注入漏洞。攻击者可利用该漏洞在受影响应用程序上下文中执行任意命令。Barracuda Load Balancer 340 4.2.2.007版本中存在漏洞，其他版本也可能受到影响。 0 Barracuda Load Balancer 340 4.2.2.007...
Apple XCode 4.x 信息泄露漏洞
BUGTRAQ ID: 54679 CVE ID: CVE-2012-3698,CVE-2011-3389 Xcode是苹果机器上所使用的开发工具。 Apple Xcode 4.4之前版本在实现上存在安全漏洞，可被恶意用户利用泄露敏感信息，劫持用户会话，绕过某些安全限制。 1） SSL 3.0和TLS 1.0协议的实现中存在设计错误。 2） DR实现中的错误可允许App Store应用访问用Xcode构建的Helper工具中的密钥链项目。 0 Apple XCode 4.x 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
phpMyAdmin3 (pma3) Remote Code Execution Exploit
No description provided by source. !/usr/bin/env python coding=utf-8 pma3 - phpMyAdmin3 remote code execute exploit Author: [email protected] type="text/javascript" / !CDATA / functiontryvar...
Tiki Wiki CMS Groupware 5.2 Multiple Vulnerabilities
No description provided by source. Source: http://www.securityfocus.com/bid/43507/info Tiki Wiki CMS Groupware is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit the local...
Linux Kernel e1000e驱动巨型帧处理绕过安全检查漏洞
BUGTRAQ ID: 37523 CVECAN ID: CVE-2009-4538 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel所使用的e1000e驱动中drivers/net/e1000e/netdev.c没有正确地检查超过MTU的以太网帧的大小，远程攻击者可以绕过已有的碎片检查，导致部分无效的帧传送给网络栈。 Linux kernel 2.6.32.3 厂商补丁： RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2010:0019-01）以及相应补丁: RHSA-2010:0019-01：Importan...
BosDirectory v2.50 XSS Vulnerability
No description provided by source. ======================================================================================== | Title : BosDirectory Cross Site Scripting Vulnerability | Author : indoushka | email : [email protected] | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria...
Texas Rankem(player.asp player_id) Remote SQL Injection Vulnerability
No description provided by source. ? ?????????????????????????In The Name Of Allah The Mercifull?????????????????????? ? Tybe:player.asp playerid bl!nd SQL Injection Vulnerability Vendor: www.clicktech.com Software:Texas Rankem author: R3d-D3v!L Date: 17.dec.2009 T!ME: 3:03 am ? Home: WwW.xP10.ME...
NTP MODE_PRIVATE报文远程拒绝服务漏洞
BUGTRAQ ID: 37255 CVE ID: CVE-2009-3563 NTP（Network Time Protocol）是用于通过网络同步计算机时钟的协议。 ntpdc查询和控制工具使用NTP模式7（MODEPRIVATE），ntpq使用NTP模式6（MODECONTROL），而例程NTP时间传输使用模式1到5。在从非restrict ... noquery或restrict ... ignore网段所列出的地址接收到错误的模式7请求或模式7错误响应时，ntpd会回复模式7出错响应并记录一条消息日志。如果攻击者能够在发送给主机...
cP Creator v2.7.1 Remote Sql Injection
No description provided by source. !/usr/bin/python cP Creator v2.7.1 Remote Sql Injection AUTHOR : Sina Yazdanmehr R3d.W0rm Discovered by : Sina Yazdanmehr R3d.W0rm Our Site : http://IrCrash.com - Coming Soon Again My Official WebSite : http://R3dW0rm.ir IRCRASH Team Members : Khashayar Fereidan...
Gravity Board X 2.0b SQL Injection / Post Auth Code Execution
No description provided by source. ================================================================================ Found : brainpillow Dork : "Powered By Gravity Board X v2.0 BETA" Visit : brainpillow.cc, forum.antichat.ru, raz0r.name Mail : [email protected]...
Advanced Image Hosting (AIH) 2.3 (gal) Blind SQL Injection Vuln
No description provided by source. Advanced Image Hosting AIH Remote Blind SQL Injection Author : boom3rang Greetz : H!tm@N, KHG, chs, redc00de Vulnerability : Blind SQL injection Google Dork : Powered by: AIH v2.3 -------------------------------------------------- ! Product Name : Advanced Image...
libspf2 DNS TXT记录处理堆溢出漏洞
BUGTRAQ ID: 31881 CVECAN ID: CVE-2008-2469 libspf2是用于实现Sender Policy Framework的库，允许邮件系统检查SPF记录并确认邮件已经过域名授权。 libspf2库的Spfdnsresolv.c文件中的SPFdnsresolvlookup函数存在堆溢出漏洞，如果用户解析了带有特制长度字段的超长DNS TXT记录的话，就可能触发这个溢出，导致执行任意代码。 DNS...
Linux Kernel i915驱动drivers/char/drm/i915_dma.c内存破坏漏洞
BUGTRAQ ID: 31792 CVECAN ID: CVE-2008-3831 Linux Kernel是开放源码操作系统Linux所使用的内核。 在使用Intel G33系列芯片组的机器上，非root用户可以通过ioctl调用只有root用户才可以使用的i915内核驱动的i915setstatuspage函数。本地攻击者可以通过向驱动发送特制的IOCTL清零并重新映射内存位置。 Linux kernel 2.6.x Debian ------ Debian已经为此发布了一个安全公告（DSA-1655-1）以及相应补丁: DSA-1655-1：New Linux 2.6.24...
Banner Management Script (tr.php id) Remote SQL Injection Vulnerability
No description provided by source. || | | Banner Management Script tr.php id Remote SQL Injection Vulnerability | | |---------------------S.W.A.T.----------------------| | | Author: S.W.A.T. | | Home : www.svvat.ir | | email: svvateamatYahooDoTcom | | | | | | | script :...
Boa 0.93.15 HTTP Basic Authentication Bypass Exploit
No description provided by source. / Boa HTTP Basic Authentication Bypass Vuln: Boa/0.93.15 with Intersil Extensions Original Advisory: http://www.securityfocus.com/archive/1/479434 http://www.ikkisoft.com/stuff/SN-2007-02.txt Luca "ikki" Carettoni http://www.ikkisoft.com / ---- !/usr/bin/env...
iFrame for Phpnuke (iframe.php) Remote File Inclusion Vulnerability
No description provided by source. iFRAME for PhpNuke iframe.php Remote File Include Vulnerabilities script :http://www.desarrollonuke.org http://up.9q9q.net/up/index.php?f=uTRRQnIjG file : iframe.php Dork : "/nuke/iframe.php" Found by & Contact : Cold z3ro , [email protected] ,...
CoolPlayer多个缓冲区溢出漏洞
CoolPlayer是一款媒体播放程序。 CoolPlayer存在多个缓冲区溢出问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 攻击者可以构建恶意的文件，诱使用户打开来触发，可导致以应用程序进程权限执行任意指令。 CoolPlayer CoolPlayer 215 升级程序： CoolPlayer CoolPlayer 215 CoolPlayer CoolPlayer216Bin.zip http://downloads.sourceforge.net/coolplayer/CoolPlayer216Bin.zip 可参考如下测试文件：...
NETGEAR R7000 缓冲区溢出漏洞（CVE-2021-31802）
SSD Advisory – NETGEAR Nighthawk R7000 httpd PreAuth RCE April 26, 2021 SSD Disclosure / Technical Lead Uncategorized TL;DR Find out how a vulnerability in NETGEAR R7000 allows an attacker to run arbitrary code without requiring authentication with the device. Vulnerability Summary A vulnerabilit...
Foxes Among Us :: Foxit Reader Vulnerability Discovery and Exploitation
After discovering over 100 vulnerabilities in Foxit Reader, I figured it was about time I shared a full exploit chain that defeats ASLR and DEP. The first vulnerability is an uninitialized buffer that I found independently and was later killed by bit from meepwn. I leveraged this for an informati...
Joomla内核SQL注入漏洞（CVE-2018-8045)
作者：绿盟科技 来源： CVE-2018-8045 漏洞简介 漏洞具体情况可参见绿盟科技安全威胁周报-201812周 Joomla! Core SQL注入漏洞： NSFOCUS ID：39158 CVE ID：CVE-2018-8045 受影响版本：Joomla! Joomla! 3.5.0-3.8.5 漏洞点评：Joomla是一套网站内容管理系统,使用PHP语言和MySQL数据库开发。Joomla! 3.5.0 -3.8.5版本对SQL语句内的变量缺少类型转换，导致User Notes列表视图内SQL注 入漏洞，可使攻击者访问或修改数据等。目前厂商已经发布了升级补丁，修复了这个...
Broadcom: Heap overflow when handling 802.11v WNM Sleep Mode Response(CVE-2017-7065)
Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. In order to allow clients to configure...
TP-Link C2 and C20i command injection Vulnerability
Product Description TP-Link is a Chinese manufacturer of computer networking products such as routers and IOT devices. Vulnerabilities Summary Command Injections exist in the HTTP management interface up to the latest firmware version 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n of TP-Link C2 and...
Joomla : 3.4.4 - 3.6.3 privilege elevation vulnerability
Author: p0wd3r know Chong Yu 404 security lab Date: 2016-10-26 0x00 vulnerability overview 1. Vulnerability description Joomla is a free open source content management system, recently researchers found in its 3. 4. 4 to 3. 6. 3 version there are two vulnerabilities: CVE-2016-8869, the...
远古流媒体系统 POST注入漏洞
username=%27%20and%201%3Dconvert%28int%2C%20CHAR%28116%29%20%2b%20CHAR%28121%29%20%2b%20CHAR%28113%29%2bdbname%28%29%2bCHAR%28116%29%20%2b%20CHAR%28121%29%20%2b%20CHAR%28113%29%29-- URL:http://xxx.com/VIEWGOOD/ADI/portal/UserDataSync.aspx POST:UserGUID=1' and...
YonYou NC在/nc/servlet/nc.ui.iufo.login.LoginUI存在SQL盲注漏洞
No description provided by source...
aspcms最新版逻辑错误导致后台地址泄露
简要描述： 后台管理目录对于不少的web系统来说非常重要，一旦后台地址泄露，很可能造成致命的打击。 详细说明： aspcms的自带插件都存在泄露后台地址的漏洞。 例如下图所示/plug/oem/AspCmsOEMFun.asp文件： 直接浏览器访问： http://.../plug/oem/AspCmsOEM.asp 即可弹出错误提示，然后重定向用户到真正的后台地址。。。 漏洞证明：...
云锁 sql注入防御策略 完全bypass #1
简要描述： 先来一发 详细说明： payload： http://.../?id=/' union select 1,2 from users%23/ 过程参考我发的安全狗那个http://.../bugs/wooyun-2015-0163141 效果： 完全无视sql注入策略 使用这样的语句： http://.../?id=/' xxxxxxxxxx %23/ 中间xxx任意注入，可以完全bypass 漏洞证明： 本地下载了最新版云锁，开启了sql注入的防御 测一下 bypass...
SkillBase TalentBase /invoker/JMXInvokerServlet 文件上传漏洞
No description provided by source...
强智教务管理信息系统任意文件下载致多所学校沦陷打包部分学校（赤裸裸的sa）
简要描述： RT 详细说明： 关键字：版 权:长沙市强智科技发展有限责任公司·版权所有 这只是我搜索的部分网站。 http://58.18.213.238/jwgl/public/download.asp?filename=../jwjs/conn/connstring.asp. http://jiaowu.hustwenhua.net/public/download.asp?filename=../jwjs/conn/connstring.asp...
青果软件某系统存在通信敏感信息泄露漏洞
简要描述： 青果软件某系统存在敏感信息泄露 详细说明： 青果软件邮件系统 https://mail.kingosoft.com/ 存在OpenSSL心脏出血漏洞,导致敏感信息泄漏 漏洞证明： Connecting... Sending Client Hello... Waiting for Server Hello... ... received message: type = 22, ver = 0302, length = 66 ... received message: type = 22, ver = 0302, length = 770 ... received message...
srun3000计费系统 注入漏洞
简要描述： RT 详细说明： 挖得人还是挺多的啊。 SQL：SELECT count FROM user WHERE userloginname='1'' AND userrealname='Smith' error：You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Smith'' at line 1...
Vivotek IP Cameras - RTSP Authentication Bypass
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com Vivotek IP Cameras RTSP Authentication Bypass 1. Advisory Information Title: Vivotek IP Cameras RTSP Authentication Bypass Advisory ID: CORE-2013-0704 Advisory URL:...
pam-krb5 < 3.13 Local Privilege Escalation Exploit
No description provided by source. / cve-2009-0360.c pam-krb5 3.13 local privilege escalation Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0360 pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly...
Burning Board 1.1.1 URL Parameter Manipulation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4512/info Burning Board is web forum software. It is written in PHP, back-ended by MySQL, and will run on most Unix and Linux variants as well as Microsoft Windows. An attacker may allegedly create a malicious link which ...
PunBB <= 1.2.16 - Blind Password Recovery Exploit
No description provided by source. ?php / Original : http://sektioneins.de/advisories/SE-2008-01.txt Thanks to Stefan Esser, here's the exploit. Team : EpiBite firefox, petit-poney, thot Nous tenons a remercier nos mamans et papas respectifs. Let's get a fu coffee ! / // conf define'URL',...
Coppermine Photo Gallery 1.3/1.4 YABBSE.INC.PHP Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/25243/info Coppermine Photo Gallery is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application a...
NiTrO Web Gallery <= 1.4.3 (section) Remote SQL Injection Vulnerability
Viva IslaM Viva IslaM Remote SQL Injection Vulnerability NiTrO Web Gallery V1.3 - V1.4- V1.41 - 1.42 - V1.43 albums.php section AuTh0r : Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM Email : [email protected] !! SYRIAN HaCkErS !! Script : NiTrO Web Gallery Versions : V1.3 - V1.4- V1.41 - V1.42 - V1.43 Site :...
Linux Kernel Sendpage Local Privilege Escalation
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require...
WordPress GD Star Rating plugin <= 1.9.10 SQL Injection
No description provided by source. Exploit Title: WordPress GD Star Rating plugin = 1.9.10 SQL Injection Vulnerability Date: 2011-09-26 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/gd-star-rating.zip Version: 1.9.10 tested Not...
nginx HTTP请求远程缓冲区溢出漏洞
Bugraq ID: 36384 CVE ID：CVE-2009-2629 nginx是一款高性能的HTTP 和反向代理服务器。 nginx处理特殊构建的URIs存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序程序执行任意指令。 当处理特殊构建的URIs时ngxhttpparsecomplexuri函数存在缓冲区下溢错误，可导致nginx服务器把URI中的数据在分配缓冲区前就写入到堆内存中，可导致以服务进程权限执行任意指令。 Igor Sysoev nginx 0.8.14 Igor Sysoev nginx 0.7.61 Igor Sysoev nginx 0.6.38 Igor...
Dnsmasq TFTP服务远程空指针引用漏洞
BUGTRAQ ID: 36120 CVECAN ID: CVE-2009-2958 Dnsmasq是可方便配置的轻型DNS转发器和DHCP服务器。 dnsmasq在启用了TFTP服务的时候存在空指针引用漏洞，可能允许恶意的TFTP服务端导致dnsmasq服务崩溃。 漏洞的起因是以下循环中的第一个if： /----------- while opt = next&p, end if strcasecmpopt, "blksize" == 0 && opt = next&p, end && !daemon-options & OPTTFTPNOBLOCK transfer-blocksiz...
Apple Safari 4.0多个安全漏洞
BUGTRAQ ID: 35260 CVECAN ID:...
动力(My Powe)SQL注射漏洞
就是当用％20and%201=1返回如下： 错误信息 产生错误的可能原因：· 请指定文章ID 返回上一页 当用%20and%201=2返回如下： 错误信息 产生错误的可能原因： 你要找的文章不存在，或者已经被管理员删除！ 返回上一页 进行SQL注射 动力My Power3.6版 下载官方最新补丁http://www.asp163.net !/usr/bin/env python coding: utf-8 from pocsuite.api.request import req from pocsuite.api.poc import register from...
Hosting Controller <= 0.6.1 Unauthenticated User Registration Exploit
No description provided by source. !-- Tested google = intext:"powered by Hosting Controller" intitle:"Hosting Controller" /str0ke Advisory Information ------------------------- Software Package : Hosting Controller Vendor Homepage : http://www.hostingcontroller.com Platforms : Windows based...
Mantis多个输入验证漏洞
BUGTRAQ ID: 29297 CVECAN ID: CVE-2008-2276 Mantis是用PHP脚本语言编写的基于web的漏洞跟踪系统。 Mantis没有正确地验证用户输入，Mantis的returndynamicfilters.php文件中存在跨站脚本漏洞，manageusercreate.php文件中存在跨站请求伪造漏洞。此外如果用户通过上述漏洞获得了有效的管理帐号的话，由于在admconfigset.php文件的的第80行的以下语句： eval '$tvalue = ' . $fvalue . ';' ; 这里$fvalue是在34行定义的： $fvalue =...