56796 matches found
KwsPHP Module jeuxflash (cat) Remote SQL Injection Vulnerability
No description provided by source. KwsPHP Module jeuxflash Remote SQL Injection Exploit AUTHOR : HouSSamix From H-T Team Script : KwsPHP Module jeuxflash Version : last version Bug : Remote SQL Injection Exploit Dork : inurl:index.php?mod=jeuxflash EXPLOITS :...
PHPNuke-Clan <= 4.2.0 (mvcw_conver.php) RFI Vulnerability
No description provided by source. '/ -.- --------------------------oOO------OOo------------------------- | PHPNuke-Clan = v4.2.0 mvcwconver.php Remote File Inclusion | | coded by DNX | ------------------------------------------------------------------ ! Discovered: DNX ! Vendor:...
PHP会话数据反序列化代码执行漏洞
PHP是一款广泛使用的WEB开发脚本语言。 PHP会话数据反序列化存在问题，远程攻击者可利用此漏洞以应用程序权限执行任意指令。 当registerglobals激活时，会话数据反序列化可以覆盖任意全局变量，包括SESSION数组。特殊的实现可导致任意代码执行。 PHP PHP 5.1.6 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PHP 5.1.1 PHP PHP 5.1 PHP PHP 5.0.5 PHP PHP 5.0.4 PHP PHP 5.0.3 + Trustix Secu...
PHP <= 4.4.6 ibase_connect() Local Buffer Overflow Exploit
No description provided by source. ?php // PHP = 4.4.6 ibaseconnect & ibasepconnect local buffer overflow // poc exploit // windows 2000 sp3 en / seh overwrite // by rgod // site: http://retrogod.altervista.org if !extensionloaded"interbase" die"only works with interbase extension "; $scode=...
HP多个产品PML Driver HPZ12服务本地权限提升漏洞
PML Driver HPZ12服务是很多HP产品（尤其是多合一产品、打印机、扫描仪等）所安装的驱动服务。 PML Driver HPZ12服务在执行权限管理时存在漏洞，本地攻击者可能利用此权限提升自己的权限。 PML Driver HPZ12服务没有设置安全的SERVICECHANGECONFIG权限。默认下安装该服务时有以下属性： Name: PML Driver HPZ12 Filename: HPZipm12.exe Description: Used by HP Printer/Scanner/Copier printers to prevent Windows from...
phplive support request.php文件存在SQL注入漏洞以及暴绝对路径漏洞
暂无 php live =3.2.2 无 http://xxx.com/livechat/request.php?l=login&x=1%20and%20select%20count%20from%20mysql.user0/ 表: chatadmin login password ---------------------------------------------------------- 绝对路径 http://xxx.co...
MiMMS媒体流处理远程栈溢出漏洞
MiMMS是一款使用MMS协议下载并保存流媒体的程序。 MiMMS在处理畸形的数据时，远程攻击者可能利用此漏洞在用用户机器上执行任意指令。 MiMMS的getheader和getmediapacket函数在从服务器读取数据时存在栈溢出漏洞。如果用户受骗连接到了恶意的服务器的话，就会触发这个漏洞，导致执行任意代码。 xine xine-lib 1.1.0 xine xine-lib 1.0.1 xine xine-lib 1.0 MiMMS MiMMS 0.0.9 厂商补丁： Gentoo ------ Gentoo已经为此发布了一个安全公告（GLSA-200607-07）以及相应补丁:...
maluinfo <= 206.2.38 (bb_usage_stats.php) Remote File Include Exploit
No description provided by source. !/usr/bin/perl maluinfo 206.2.38 brazilian PHPBB Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high...
Apache JMeter uses an unsecure RMI connection in Distributed mode
Severity: Important Vendor: The Apache Software Foundation Versions Affected: JMeter 2.X, 3.X Description 0: When using Distributed Test only RMI based, jmeter uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code. This only affect...
Microsoft Windows10 AHCACHE.SYS Remote Denial Of Service(CVE-2016-3369)
Summary A denial of service vulnerability exists in the AHCACHE.SYS driver. A specially crafted Portable Executable file can cause a bugcheck in the Windows kernel resulting in remote denial of service. Tested Versions Windows 10, AHCACHE.SYS version 10.0.10586.0 Tested on Windows 10 X86 Product...
LibTIFF TIFF2PDF TIFFTAG_JPEGTABLES Remote Code Execution Vulnerability(CVE-2016-5652)
Summary An exploitable heap based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means...
Microsoft Malware Protection Engine RCE (CVE-2017-0290)
Natalie Silvanovich and Tavis Ormandy of Google Project Zero found a pretty nasty bug in Microsoft Malware Protection Engine, allowing an attacker to execute arbitrary code as LocalSystem on any Windows computer running any Microsoft anti-malware product such as Security Essentials or Windows...
MS15-051 Win32k ClientCopyImage Elevation of Privilege Vulnerability (CVE-2015-1701)
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class MetasploitModule 'Windows ClientCopyImage...
PageAdmin CMS最新版二次注入
简要描述： 发现PageAdmin官网更新了版本，就去复查了一下，然后发现厂商的修复手段等于没修复！ http://www.pageadmin.net/soft/ 选择本地下载最新版，PageAdmin V3.0.20151204最后更新时间:2016-03-11 Demo站换了后台地址，这次仅在本地复现。 详细说明： 0 之前的漏洞是这个 http://.../bugs/wooyun-2016-0177673 1 依旧是/e/master/buildstatic.aspx 这个页面 原来的代码是这样的： ifIsNumIds sql="select...
金蝶某系统存在任意文件上传漏洞可威胁内网
简要描述： 上传绕过，可内网才是关键 详细说明： WooYun: 某大型在线考试系统通用型任意文件上传（涉及银行、证卷等企业） 问题发生后，是有进行相应的修补，但修补的有问题，限制了对jsp马的上传，但jspx毫无限制 上传jsp直接报错 但是jspx就 http://exam.kingdee.com/mana/edit/attachupload.jsp 可直接上传jspx马 上传成功后直接查看源代码获取shell地址 漏洞证明：...
上海寰创 WLAN 产品 DownloadServlet 任意文件下载漏洞
访问如下URL，可任意下载系统文件： http://ip:port/DownloadServlet?fileName=../../etc/shadow...
Siemens SIMATIC S7-1200固件版本低于4.1.3的设备跨站伪造请求（CSRF）漏洞
漏洞分析 Siemens SIMATIC S7-1200的web端可以与控制PLC的运行以及设备状态数据的获取。而固件版本低于4.1.3的web存在跨站请求伪造（CSRF）漏洞。 由于S7-1200的web端并没有采取针对CSRF攻击的防范措施，如验证HTTP Referer字段，因此攻击者可以实施CSRF攻击，在未授权的情况下进行PLC运行状态改变，更新固件等敏感操作。 漏洞验证 我们通过zoomeye，搜索到一款SIMATIC S7-1200，固件版本号为v3.00.01，经过测试发现存在CSRF漏洞。 验证过程：...
PHPMyWind 5.1 /include/common.func.php 代码执行漏洞
/include/common.func.php/字符串转数组/ if!functionexists'String2Array' function String2Array$data if$data == '' return array; @eval"$array = $data;"; return $array; $data变量进入eval执行，当传入$data为：111|222$phpinfo执行的PHP语句为：@eval"$array = array"1"="111|222$phpinfo","2"="";;"页面返回：...
万户OA所有版本任意文件下载
简要描述： 万户OA任意文件下载漏洞 详细说明： 万户OAdownloadold.jsp文件可以任意访问，导致无需登录，下载任意文件 测试URL： /defaultroot/downloadold.jsp?path=..&name=x&FileName=index.jsp /defaultroot/downloadold.jsp?path=..&name=x&FileName=WEB-INF/web.xml 快下班了，时间不够了，测试地址就不贴了，自行测试哈。。 漏洞证明：...
NRPE 2.15 - Remote Code Execution Vulnerability
No description provided by source. !/usr/bin/python Exploit Title : NRPE = 2.15 Remote Code Execution Vulnerability Discovered by : Dawid Golunski dawid at legalhackers dot com legalhackers.com Exploit Author : Claudio Viviani http://www.homelab.it [email protected] [email protected]...
Oracle Document Capture Actbar2.ocx Insecure Method
No description provided by source. Source: http://packetstormsecurity.org/files/view/97866/DSECRG-11-004.txt ActiveX components contain insecure methods. Digital Security Research Group DSecRG Advisory DSECRG-00153 Application: Oracle Document Capture Versions Affected: Release 10gR3 Vendor URL:...
Ethernet Device Drivers Frame Padding - Info Leakage Exploit (Etherleak)
No description provided by source. !/usr/bin/perl -w etherleak, code that has been 5 years coming. On 04/27/2002, I disclosed on the Linux Kernel Mailing list, a vulnerability that would be come known as the 'etherleak' bug. In various situations an ethernet frame must be padded to reach a specif...
LiteNews <= 0.1 Insecure Cookie Handling Vulnerability
No description provided by source. litenews-01 = 1.2 Insecure Cookie Handling Vulnerability AUTHOR : Scary-Boys HOME : http://scary-boys.com Download : http://webscripts.softpedia.com/scriptDownload/LiteNews-Download-43228.htmldownloadlocations DorKs : Powered By litenews DESCRIPTION : Maian...
DUware DUclassmate 1.x edit.asp iPro Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/14036/info DUclassmate is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker...
OpenBB 1.0.x member.php redirect Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/10214/info It has been reported that OpenBB is affected by multiple input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied user input. The SQL issues may...
McAfee ePolicy Orchestrator 4.6.0-4.6.5 (ePowner) - Multiple Vulnerabilities
No description provided by source. Exploit Title: McAfee ePolicy Orchestrator 4.6.0-4.6.5 ePowner - Multiple vulnerabilities Date: 20 November 2012 Exploit Author: [email protected] a.k.a. [email protected] Vendor Homepage: http://www.mcafee.com/uk/products/epolicy-orchestrator.aspx Version...
Linux Kernel < 2.6.19 - udp_sendmsg Local Root Exploit (x86/x64)
No description provided by source. / second verse, same as the first CVE-2009-2698 udpsendmsg, x86/x64 Cheers to Julien/Tavis for the bug, p0c73n1 for just throwing code at NULL and finding it executed This exploit is a bit more nuanced and thoughtful ; use ./therebel.sh for everything At this...
大汉网络JCMS任意文件下载
简要描述： 绝对路径文件下载的问题。 详细说明： 通过分析代码，某个下载功能没有限制权限，没有限制下载类型，通过设置绝对路径的参数，直接下载。 漏洞利用： jcms\m19\user\down.jsp?abspathfile=/etc/passwd 漏洞证明： 测试代码： http://www.njgl.gov.cn/jcms/m19/user/down.jsp?abspathfile=/etc/passwd 鼓楼区政府门户网站： 下载文件内容：...
Apache Commons FileUpload/Apache Tomcat拒绝服务漏洞
BUGTRAQ ID: 65400 CVECAN ID: CVE-2014-0050 Apache Commons FileUpload软件包可以向小服务程序和Web应用添加高性能的文件上传功能。Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache共享文件上传存在解析畸形的Content-Type头时存在漏洞，使用特制的请求，远程攻击者可能会使程序崩溃。 0 Commons FileUpload 1.0-1.3 Apache Tomcat 8.0.0-RC1-8.0.1 Apache Tomcat 7.0.0-7.0.50 Apache Tomcat 6...
Franklin Fueling Systems TS-550 evo‘cgi-bin/tsaws.cgi’安全绕过漏洞
Bugtraq ID:64996 CVE ID: CVE-2013-7247 Franklin Fueling Systems TS-550 evo是美国富兰克林油系统（Franklin Fueling Systems）公司的一套燃油管理系统，它可通过储罐监控系统全面控制燃油管理，并提供彩色通知和详细标识说明的警报页面功能，迅速获得警报内容。 使用2.0.0.6833和2.3.1.7492版本固件的Franklin Fueling Systems TS-550...
ASPCMS存在SQL注入漏洞可获取敏感信息
简要描述： ASPCMS系统对用户提交的参数过滤不严，导致攻击者可以提交SQL语句查询数据库获取敏感信息。 详细说明： 漏洞存在于/adminaspcms/content/Content/AspCmsContentFun.asp，这个文件未验证管理员权限，因此如何人都可以访问，同时该文件对获取的参数没有使用自定义的filterPara函数过滤，导致多处注入，代码入下： % 'die debugmode dim action : action=getForm"action","get" dim ContentID, LanguageID, SortID, GroupID, Exclusiv...
Apache Tomcat FORM身份验证安全绕过漏洞
BUGTRAQ ID: 56812 CVECAN ID: CVE-2012-3546 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Tomcat v7.0.30、6.0.36之前版本在FORM身份验证的实现上存在安全漏洞。在使用FORM验证时，若其他组件（如Single-Sign-On）在调用FormAuthenticatorauthenticate之前调用了request.setUserPrincipal，则攻击者可以通过在URL结尾添加"/jsecuritycheck"以绕过FORM验证 0 Apache Group Tomcat 7.0.0 - 7.0.2...
Microsoft Windows SSL/TLS信息泄露漏洞
CVE ID: CVE-2011-3389 Microsoft Windows是微软发布的非常流行的操作系统。 Microsoft Windows在SSL/TLS协议的实现上存在信息泄露漏洞，远程攻击者可利用此漏洞泄露敏感信息并劫持用户会话。 此漏洞源于在CBC模式中结合对称密码套件使用Secure Sockets Layer 3.0 SSL和Transport Layer Security 1.0 TLS 协议时出现的设计错误，通过中间人攻击加密HTTPS会话。 Microsoft Windows Microsoft Windows XP Home Microsoft Windows ...
KindEditor 3.5.5 遍历目录漏洞
No description provided by source. 1.http://localhost/67cms/kindeditor/php/filemanagerjson.php?path=/ //path=/，爆出绝对路径D:\AppServ\www\67cms\kindeditor\php\filemanagerjson.php 2.http://localhost/67cms/kindeditor/php/filemanagerjson.php?path=AppServ/www/67cms/ //根据爆出的绝对路径，修改path的值为AppServ/www/67cms/...
PHP 5.3.6 Buffer Overflow PoC (ROP) CVE-2011-1938
No description provided by source. ?php / Jonathan Salwan - @shellstorm http://shell-storm.org 2011-06-04 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1938 Stack-based buffer overflow in the socketconnect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow...
MIT Kerberos GSS-API校验和空指针引用拒绝服务漏洞
BUGTRAQ ID: 40235 CVE ID: CVE-2010-1321 Kerberos是一款广泛使用的使用强壮的加密来验证客户端和服务器端的网络协议。MIT Kerberos 5是一种常用的开源Kerberos实现。 MIT Kerberos的GSS-API库中存在空指针引用错误，通过认证的远程攻击者可以通过发送缺少校验和字段的特制GSS-API令牌来利用这个漏洞，导致使用GSS-API认证机制的服务器应用崩溃。 MIT Kerberos 5 1.8 MIT Kerberos 5 1.7 MIT Kerberos 5 1.6 厂商补丁： MIT ---...
CMScontrol 7.x (index.php id_menu) SQL Injection Vulnerability
No description provided by source. =Info======================================================================= Software: CMScontrol Content Management Portal Solutions Sql Injection Version: 7. Vulnerability: Remote Sql Injection Google Dork: "index.php?idmenu=" CMScontrol Off. site:...
BBSGood论坛程序UserInfo.asp页面Blogurl变量过滤不严导致SQL注入漏洞
BBSGood是国内首创使用缓存技术的论坛 在UserInfo.asp页面代码当中，我们可以看到变量Blogurl未经过滤带入sql语句，导致Sql注入漏洞。 代码举例: 行1729-1853. 1. case 14 2. if Request.QueryString"save"=1 then 3. if trimRequest.Form"blogurl""" then 4. Set rsdj = Server.CreateObject"ADODB.Recordset" 5. rsdj2="select id from LxTelUser where...
Linux Kernel VDSO本地权限提升漏洞
BUGTRAQ ID: 32099 CVECAN ID: CVE-2008-3527 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的arch/i386/kernel/sysenter.c没有正确地实现虚拟动态共享对象（vDSO），本地攻击者可以通过调用installspecialmapping、syscall和syscall32nopage函数获得权限提升或导致拒绝服务。 Linux kernel 2.6.x Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
phpBG 0.9.1 (rootdir) Remote File Inclusion Vulnerabilities
No description provided by source. phpBG 0.9.1 rootdir Remote File Inclusion Vulnerability D.Script: http://phpbg.sourceforge.net/ POC: /intern/admin/other/backup.php?admin=1&rootdir=Shell /intern/admin/?rootdir=Shell /intern/clan/memberadd.php?rootdir=Shell /intern/config/key2.php?rootdir=Shell...
CartWeaver (Details.cfm ProdID) Remote SQL Injection Vulnerability
No description provided by source. author:meoconxatvnbrain.net product:CartWeaver main site:www.cartweaver.com 1.with CFM CartWeaver: sql injection in: Details.cfm?ProdID=a' demo: http://www.jbracing.co.uk/Details.cfm?ProdID=1' exploit: http://www.xxx.com/Details.cfm?ProdID=sql query link admin:...
AOL YGPPDownload ActiveX控件堆溢出漏洞
America Online 9.0 Security Edition是美国在线发布的基于Internet Explorer技术的客户端软件，可提供安全性和可用性功能。 AOL的YGPPDownload ActiveX控件（YGPPicDownload.dll）在处理对AddPictureNoAlbum方式及downloadFileDirectory属性的输入时存在两个堆溢出漏洞，可能允许攻击者在用户浏览器中执行任意指令。 AOL AOL 9.0 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.aol.com/...
IM+本地明文用户名口令泄露漏洞
IM+是一款即时消息软件，允许用户同时连接到多个即时消息帐号。 IM+在处理存储用户名口令时存在漏洞，本地攻击者可能利用此漏洞轻易获取认证信息。 IM+没有使用任何安全措施或加密保护即时消息帐号的用户名和口令。恶意用户可以在\Program Files\IMPlus目录下获得implus.cfg文件，然后使用文本编辑器打开该文件，浏览所有帐号信息，包括明文的用户名和口令。 SHAPE Services IM+ v3.10 for Pocket PC 我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
致远OA thirdpartyController.do 未授权RCE漏洞
...
Cisco SD-WAN vManage 缓冲区溢出漏洞（CVE-2021-1479）
...
GitLab 未授权RCE漏洞（CVE-2021-22192）
When rendering wiki content with certain extensions such as .rmd, renderwikicontent will call othermarkupunsafe which will end up calling GitHub::Markup.render from the github-markup gem. Files with any extension can be uploaded by checking out the wiki with git, commiting the files and pushing t...
NagiosXI <= 5.4.12 commandline.php SQL injection(CVE-2018-10735)
NagiosXI = 5.4.12 commandline.php SQL injectionCVE-2018-10735 Description A SQL injection issue was discovered in Nagios XI via the admin/commandline.php cname parameter. Affected Version Nagios XI 5.2.x Nagios XI 5.4.x before 5.4.13 Proof of concept http...
Backdoor in Tpshop <= 2.0.8 (CVE-2018-9919)
Backdoor in Tpshop = 2.0.8 CVE-2018-9919 The Tpshop open source mall system is a multi-merchant mode mall system developed by Shenzhen Leopard Network Co., Ltd.This system is based on the Thinkphp development framework. Product Download: http://www.tp-shop.cn/Index/Index/download.html Vulnerabili...
Windows Kernel 64-bit stack memory disclosure in win32k!SfnINLPHELPINFOSTRUCT (via user-mode callback)(CVE-2018-0810)
We have discovered that a user-mode callback invoked by the win32k!SfnINLPHELPINFOSTRUCT function via KeUserModeCallback leads to the disclosure of uninitialized stack memory to user-mode clients, due to compiler-introduced structure padding. The vulnerability affects Windows 7 64-bit; other...
Windows Kernel pool memory disclosure in nt!NtNotifyChangeDirectoryFile(CVE-2017-0299)
We have discovered that the nt!NtNotifyChangeDirectoryFile system call discloses portions of uninitialized pool memory to user-mode clients, due to output structure alignment holes. On our test Windows 10 32-bit workstation, an example layout of the output buffer is as follows: --- cut ---...