56796 matches found
Microsoft Windows代码验证签名校验远程代码执行漏洞(ms12-024)
Bugtraq ID: 52868 CVE ID：CVE-2012-0151 Microsoft Windows是一款流行的操作系统 Microsoft Windows存在安全漏洞，允许恶意用户绕过部分安全限制 Windows代码验证签名Authenticode Signature校验功能不充分验证PE文件的文件摘要，攻击者可以利用漏洞操作已签名的可执行文件，如加入无效签名的代码 0 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 厂商解决方案...
WordPress GD Star Rating plugin <= 1.9.10 SQL Injection
No description provided by source. Exploit Title: WordPress GD Star Rating plugin = 1.9.10 SQL Injection Vulnerability Date: 2011-09-26 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/gd-star-rating.zip Version: 1.9.10 tested Not...
phpMyAdmin3 (pma3) Remote Code Execution Exploit
No description provided by source. !/usr/bin/env python coding=utf-8 pma3 - phpMyAdmin3 remote code execute exploit Author: [email protected] type="text/javascript" / !CDATA / functiontryvar...
phpwind远程代码执行漏洞
简要描述： phpwind较高版本论坛中存在一个严重的漏洞，成功利用该漏洞可以远程执行任意php代码，影响phpwind 7和phpwind 8 详细说明： pwajax.php中的 elseif $action == 'pcdelimg' InitGParray'fieldname','pctype'; InitGParray'tid','id',2; if !$tid || !$id || !$fieldname || !$pctype echo 'fail'; $id = int$id; if $pctype == 'topic' $tablename =...
phpwind 7.5 apps/groups/index.php远程包含漏洞
apps/groups/index.php 里$route和$basePath变量没有初始化,导致远程包含或者本地包含php文件,导致执行任意php代码 ?php if $route == "groups" requireonce $basePath . '/action/mgroups.php'; elseif $route == "group" requireonce $basePath . '/action/mgroup.php'; elseif $route == "galbum" requireonce $basePath . '/action/mgalbum.php';...
PHP proc_open()绕过safe_mode_protected_env_var限制漏洞
BUGTRAQ ID: 37138 CVE ID: CVE-2009-4018 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP没有执行任何检查便允许传送对procopen所指定的环境变量，这就忽略了safemodeallowedenvvars和safemodeprotectedenvvars设置。用户可以绕过safemode限制访问Apache UID可访问的任意文件。 PHP 5.3.x 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
BBSGood论坛程序UserInfo.asp页面Blogurl变量过滤不严导致SQL注入漏洞
BBSGood是国内首创使用缓存技术的论坛 在UserInfo.asp页面代码当中，我们可以看到变量Blogurl未经过滤带入sql语句，导致Sql注入漏洞。 代码举例: 行1729-1853. 1. case 14 2. if Request.QueryString"save"=1 then 3. if trimRequest.Form"blogurl""" then 4. Set rsdj = Server.CreateObject"ADODB.Recordset" 5. rsdj2="select id from LxTelUser where...
Gravity Board X 2.0b SQL Injection / Post Auth Code Execution
No description provided by source. ================================================================================ Found : brainpillow Dork : "Powered By Gravity Board X v2.0 BETA" Visit : brainpillow.cc, forum.antichat.ru, raz0r.name Mail : [email protected]...
Advanced Image Hosting (AIH) 2.3 (gal) Blind SQL Injection Vuln
No description provided by source. Advanced Image Hosting AIH Remote Blind SQL Injection Author : boom3rang Greetz : H!tm@N, KHG, chs, redc00de Vulnerability : Blind SQL injection Google Dork : Powered by: AIH v2.3 -------------------------------------------------- ! Product Name : Advanced Image...
Banner Management Script (tr.php id) Remote SQL Injection Vulnerability
No description provided by source. || | | Banner Management Script tr.php id Remote SQL Injection Vulnerability | | |---------------------S.W.A.T.----------------------| | | Author: S.W.A.T. | | Home : www.svvat.ir | | email: svvateamatYahooDoTcom | | | | | | | script :...
Outlook Web Access for Exchange Server邮件字段跨站脚本漏洞（MS08-039）
BUGTRAQ ID: 30130 CVECAN ID: CVE-2008-2247,CVE-2008-2248 Microsoft Exchange Server是一款流行的邮件服务器，Outlook Web Access是Exchange中用于通过Web浏览器读取和发送邮件的工具。 Outlook Web Access for Exchange Server中存在跨站脚本漏洞，允许在Exchange...
MVC-Web CMS 1.0/1.2 (index.asp newsid) SQL Injection Vulnerability
No description provided by source. Bl@ckbe@rD 'Tunisian TerrorisT' ------------------------- $$$$$$$$$$$$$$$$$$$$$$$---------------------------------------...
Samba NSS_Info插件本地权限提升漏洞
BUGTRAQ ID: 25636 CVECAN ID: CVE-2007-4138 Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。 idmapad.so库中为Winbind提供了nssinfo扩展用于从活动目录域控制台检索用户的主目录路径、登录shell和主组id等，可通过将winbind nss info的smb.conf选项定义为sfu或rfc2307来启用这个功能。 Windows的Identity Management for Unix和Services for Unix...
Xoops iContent模块Spaw_Control.Class.PHP远程文件包含漏洞
Xoops iContent模块是一款基于PHP的WEB应用程序。 Xoops iContent模块不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'SpawControl.Class.PHP'脚本对用户提交的WEB参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Xoops iContent Module 1.0 目前没有解决方案提供： http://mirror.in.th/sourceforge.net/x/xo/xoops...
PHP <= 5.2.1 hash_update_file() Freed Resource Usage Exploit
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | \| || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / //...
MiMMS媒体流处理远程栈溢出漏洞
MiMMS是一款使用MMS协议下载并保存流媒体的程序。 MiMMS在处理畸形的数据时，远程攻击者可能利用此漏洞在用用户机器上执行任意指令。 MiMMS的getheader和getmediapacket函数在从服务器读取数据时存在栈溢出漏洞。如果用户受骗连接到了恶意的服务器的话，就会触发这个漏洞，导致执行任意代码。 xine xine-lib 1.1.0 xine xine-lib 1.0.1 xine xine-lib 1.0 MiMMS MiMMS 0.0.9 厂商补丁： Gentoo ------ Gentoo已经为此发布了一个安全公告（GLSA-200607-07）以及相应补丁:...
Pega Infinity登陆绕过漏洞（CVE-2021-27651）
Summary An attacker can bypass all stages of the password reset flow and reset any user's account on Pega infinity. This is done by 1 initiating the password reset flow and typing in the victim email, then 2 forcing the HTTP POST request to update the password through. An attacker could login usi...
New ceoAnyone Bug Identified in Multiple Crypto Game Smart Contracts (CVE-2018-11329)
Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow1, proxyOverflow2, transferFlaw3, ownerAnyone4, multiOverflow5, burnOverflow6. These vulnerabilities typically affect various tokens that may be publicly traded in...
EPoD: Ethereum Packet of Death (CVE-2018-12018)
PeckShield has so far discovered quite a few critical smart contract vulnerabilities. Besides smart contracts, the Ethereum ecosystem also includes other various components that are equally exposed to possible exploitation. Obviously, one such component is the core of Ethereum, i.e., the underlyi...
Insteon Hub PubNub "cc" Channel Message Handler Multiple Global Overflow Code Execution Vulnerabilities(CVE-2017-16338 ~CVE-2017-16347)
Summary Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a buffer overflow on a global section overwriting arbitrary data...
Reliable Controls® MACH-ProWebCom™ 未授权访问信息泄露
MACH-ProWebCom™ 是一个功能强大内置网络服务器完全可自由编程的BACnet® 楼宇控制器。可以快速方便地同 Reliable Controls® MACH-ProWebCom™ 将楼宇自控系统发布到网络上。 MACH-ProWebCom™ Web 服务存在未授权访问，可以下载服务配置等敏感信息 MACH-ProWebCom™, a fully programmable BACnet® Building Controller with a powerful, built-in Web server.It can post your building graphics to t...
MS15-051 Win32k ClientCopyImage Elevation of Privilege Vulnerability (CVE-2015-1701)
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class MetasploitModule 'Windows ClientCopyImage...
PageAdmin CMS最新版二次注入
简要描述： 发现PageAdmin官网更新了版本，就去复查了一下，然后发现厂商的修复手段等于没修复！ http://www.pageadmin.net/soft/ 选择本地下载最新版，PageAdmin V3.0.20151204最后更新时间:2016-03-11 Demo站换了后台地址，这次仅在本地复现。 详细说明： 0 之前的漏洞是这个 http://.../bugs/wooyun-2016-0177673 1 依旧是/e/master/buildstatic.aspx 这个页面 原来的代码是这样的： ifIsNumIds sql="select...
用友某软件存在通用XXE漏洞
简要描述： 详细说明： 1.民生证券 http://.../uapws/ 抓包 POST /uapws/soapFormat.ajax HTTP/1.1 Host: ... User-Agent: Mozilla/5.0 Windows NT 6.1; rv:43.0 Gecko/20100101 Firefox/43.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3...
金蝶某重要系统漏洞可导致大量信息泄露以及资金操作
简要描述： 金蝶某重要系统漏洞可导致大量信息泄露/可影响在线交易 详细说明： 存在漏洞的系统为 金蝶商城 http://shop.k3cloud.kingdee.com/ 其中 http://shop.k3cloud.kingdee.com/show.aspx?type=1&action=GetImg&pids=1 参数pids存在注入漏洞 漏洞证明： 直接爆出后台管理员密码： 密码比较简单，登陆后后台，有大量会员信息 包括16位MD5密码，部分信息如下： 另外可以在线生成礼品卡，可以换取商品： 总之 后台功能比较强大，权限大 可以更改添加商品 修改商品价格等等，危害相当严重！...
PHPMyWind 5.1 /include/common.func.php 代码执行漏洞
/include/common.func.php/字符串转数组/ if!functionexists'String2Array' function String2Array$data if$data == '' return array; @eval"$array = $data;"; return $array; $data变量进入eval执行，当传入$data为：111|222$phpinfo执行的PHP语句为：@eval"$array = array"1"="111|222$phpinfo","2"="";;"页面返回：...
srun3000计费系统 注入漏洞
简要描述： RT 详细说明： 挖得人还是挺多的啊。 SQL：SELECT count FROM user WHERE userloginname='1'' AND userrealname='Smith' error：You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Smith'' at line 1...
RoundCube Webmail <= 0.2-3 beta Code Execution Vulnerability
No description provided by source. Public Release Date of POC: 2008-12-22 Author: Jacobo Avariento Gimeno Sofistic CVE id: CVE-2008-5619 Bugtraq id: 32799 Severity: Critical Vulnerability reported by: RealMurphy Intro ---- Roundcube Webmail is a browser-based IMAP client that uses chuggnutt.com...
Arab Portal 2.1 - Remote File Disclosure Vulnerability (win only)
No description provided by source. Arab Portal v2.1 Remote File Disclosure Win32 AUTHOR : IRCRASH R3d.W0rm Sina Yazdanmehr Discovered by : R3d.W0rm Sina Yazdanmehr Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Sina Yazdanmehr - Hadi Kiamarsi Download : www.arabportal.ne...
toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilities
No description provided by source. &redirectSecure Network - Security Research Advisory Vuln name: ToutVirtual VirtualIQ Pro Multiple Vulnerabilities Systems affected: ToutVirtual VirtualIQ Professional 3.2 build 7882 Systems not affected: -- Severity: High Local/Remote: Remote Vendor URL:...
Coppermine Photo Gallery 1.3/1.4 YABBSE.INC.PHP Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/25243/info Coppermine Photo Gallery is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application a...
大汉版通系统任意文件上传/删除漏洞
简要描述： 大汉版通某系统存在多处任意文件上传/删除漏洞 详细说明： 一、漏洞代码 文件上传： 漏洞一：/xxgk/jcmsfiles/jcms1/web1/site/zfxxgk/ysqgk/attachupload.jsp 漏洞二：/xxgk/jcmsfiles/jcms1/web1/site/zfxxgk/ysqgk/applyattachupload.jsp 文件删除： 上述两个文件同时存在任意文件删除漏洞 先来看任意文件删除的代码： if"D".equalsstrBillStatus delFileName =...
dedecms(织梦) < 5.7 多个SQL注入漏洞
BUGTRAQ ID: 51211 CVE ID: CVE-2011-5200 DedeCms是免费的PHP网站内容管理系统。 DedeCMS 5.6存在多个SQL注入漏洞，通过id参数向 list.php、members.php、book.php传参，可允许远程攻击者利用这些漏洞控制应用、访问或修改数据、利用下层数据库内的其他漏洞。 0 dedecms 5.7 厂商补丁： dedecms ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.dedecms.com/products/dedecms/ Ded...
phpBB 3.0.10 多个SQL注入漏洞
BUGTRAQ ID: 54734 phpBB是全球流行的开源公告牌系统。 phpBB 3.0.10及其他版本在实现上存在多个SQL注入漏洞，成功利用后可允许攻击者控制应用，访问或修改数据，利用下层数据库中的其他漏洞。 0 phpBB 3.0.10 厂商补丁： phpBB Group ----------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.phpbb.com/ Request : --- POST /kuba/phpBB/phpBB3/ucp.php?i=prefs&mode=personal...
DirectAdmin硬链接本地特权提升漏洞
Bugtraq ID: 47690 DirectAdmin是一款功能强大的虚拟主机在线管理系统。 当创建备份时不正确检查部分硬链接，本地攻击者可以通过硬链接攻击操作部分文件，提升特权。 JBMC Software DirectAdmin 1.33.6 JBMC Software DirectAdmin 1.33.4 JBMC Software DirectAdmin 1.33.3 JBMC Software DirectAdmin 1.30.2 JBMC Software DirectAdmin 1.30.1 JBMC Software DirectAdmin 1.381 JBMC...
Tiki Wiki CMS Groupware 5.2 Multiple Vulnerabilities
No description provided by source. Source: http://www.securityfocus.com/bid/43507/info Tiki Wiki CMS Groupware is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit the local...
BosDirectory v2.50 XSS Vulnerability
No description provided by source. ======================================================================================== | Title : BosDirectory Cross Site Scripting Vulnerability | Author : indoushka | email : [email protected] | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria...
Texas Rankem(player.asp player_id) Remote SQL Injection Vulnerability
No description provided by source. ? ?????????????????????????In The Name Of Allah The Mercifull?????????????????????? ? Tybe:player.asp playerid bl!nd SQL Injection Vulnerability Vendor: www.clicktech.com Software:Texas Rankem author: R3d-D3v!L Date: 17.dec.2009 T!ME: 3:03 am ? Home: WwW.xP10.ME...
CMScontrol 7.x (index.php id_menu) SQL Injection Vulnerability
No description provided by source. =Info======================================================================= Software: CMScontrol Content Management Portal Solutions Sql Injection Version: 7. Vulnerability: Remote Sql Injection Google Dork: "index.php?idmenu=" CMScontrol Off. site:...
nginx HTTP请求远程缓冲区溢出漏洞
Bugraq ID: 36384 CVE ID：CVE-2009-2629 nginx是一款高性能的HTTP 和反向代理服务器。 nginx处理特殊构建的URIs存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序程序执行任意指令。 当处理特殊构建的URIs时ngxhttpparsecomplexuri函数存在缓冲区下溢错误，可导致nginx服务器把URI中的数据在分配缓冲区前就写入到堆内存中，可导致以服务进程权限执行任意指令。 Igor Sysoev nginx 0.8.14 Igor Sysoev nginx 0.7.61 Igor Sysoev nginx 0.6.38 Igor...
BIND 9.x Remote DNS Cache Poisoning Flaw Exploit (c)
No description provided by source. / Exploit for CVE-2008-1447 - Kaminsky DNS Cache Poisoning Attack Compilation: $ gcc -o kaminsky-attack kaminsky-attack.c dnet-config --libs -lm Dependency: libdnet aka libdumbnet-dev under Ubuntu Author: marc.bevand at rapid7 dot com / define BSDSOURCE include...
Hosting Controller <= 0.6.1 Unauthenticated User Registration Exploit
No description provided by source. !-- Tested google = intext:"powered by Hosting Controller" intitle:"Hosting Controller" /str0ke Advisory Information ------------------------- Software Package : Hosting Controller Vendor Homepage : http://www.hostingcontroller.com Platforms : Windows based...
ELSE IF CMS 0.6 Multiple Remote Vulnerabilities / Exploit
No description provided by source. ELSEIF CMS Tested on "Else If version Beta 0.6" Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] These Are Examples .. iam tiered fetching the injected files : Remote File inclusion...
phpBG 0.9.1 (rootdir) Remote File Inclusion Vulnerabilities
No description provided by source. phpBG 0.9.1 rootdir Remote File Inclusion Vulnerability D.Script: http://phpbg.sourceforge.net/ POC: /intern/admin/other/backup.php?admin=1&rootdir=Shell /intern/admin/?rootdir=Shell /intern/clan/memberadd.php?rootdir=Shell /intern/config/key2.php?rootdir=Shell...
PHP 4.4.5 / 4.4.6 session_decode() Double Free Exploit PoC
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || // // | |/ || '|/ |/ -| ' / -/ |||| /| || / //...
phplive support request.php文件存在SQL注入漏洞以及暴绝对路径漏洞
暂无 php live =3.2.2 无 http://xxx.com/livechat/request.php?l=login&x=1%20and%20select%20count%20from%20mysql.user0/ 表: chatadmin login password ---------------------------------------------------------- 绝对路径 http://xxx.co...
Joomla Link Directory Component <= 1.0.3 Remote Include Vulnerability
No description provided by source. .: insecurity research team :. ....:...:. . .:. | |/ :/ // :/ .:. : | | | \\ /\ / :. . ..: ||| / \ \ .: .:.. .. ./ .:/:. ./. .:/: . ...:. .advisory. .:... :..................: 18.o8.2oo6 .. Affected Application: Link Directory = v1.0.3 Mambo/Joomla CMS...
HTTP协议栈远程代码执行漏洞（CVE-2021-31166）
...
Ivanti Avalanche目录遍历漏洞
SSD Advisory – Ivanti Avalanche Directory Traversal May 11, 2021 SSD Disclosure / Technical Lead Uncategorized TL;DR Find out how a directory traversal vulnerability in Ivanti Avalanche allows remote unauthenticated user to access files that reside outside the ‘image’ folder. Vulnerability Summar...
QNAP QTS Unauthenticated Remote Code Execution(CVE-2017-17033)
Vulnerability Summary The following advisory describes a memory corruption vulnerability that can lead to an unauthenticated remote code execution in QNAP QTS versions 4.3.x and 4.2.x, including the 4.3.3.0299. QNAP Systems, Inc. “specializes in providing networked solutions for file sharing,...