56796 matches found
Wordpress XMLRPC.PHP SQL注入漏洞
Wordpress是一款基于PHP的WEB应用程序。 Wordpress不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'XMLRPC.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 WordPress WordPress 2.2 目前没有解决方案提供： http://wordpress.org/ http://www.sebug.net/show-exp-1993.html...
Cisco IOS FTP Server非授权访问及拒绝服务漏洞
Cisco IOS是Cisco网络设备所使用的操作系统。 Cisco IOS所带的FTP Server处理访问请求时存在漏洞，远程攻击者可能利用此漏洞非授权访问系统文件或导致拒绝服务。 启用了IOS FTP Server功能的Cisco IOS没有正确检查用户授权，可能允许攻击者非授权读写设备文件系统中的任意文件，包括设备保存的配置，其中可能有口令或其他敏感信息；此外这种配置的Cisco IOS还可能导致在通过FTP传输文件时IOS重载。 Cisco IOS 12.4 Cisco IOS 12.3 Cisco IOS 12.2 Cisco IOS 12.1 Cisco IOS 12.0...
Macrovision InstallAnywhere绕过口令和序列号认证漏洞
InstallAnywhere是领先的多平台安装解决方案，提供完整的安装工具套件，以生成功能全面、灵活的安装程序。 InstallAnywhere在处理软件安装时存在竞争条件漏洞，本地攻击者可能利用此漏洞获取应用的非授权访问。...
Retro64 CR64Loader ActiveX远程缓冲区溢出漏洞
CR64Loader对象是Retro64提供的一个ActiveX控件，用于提供在线游戏。 CR64Loader的实现上存在缓冲区溢出漏洞，如果用户受骗访问了恶意的WEB页面的话，就会触发这个漏洞，导致执行任意指令。 Retro64 CR64Loader 临时解决方法： 为以下CLSID设置kill bit： 288C5F13-7E52-4ADA-A32E-F5BF9D125F99 厂商补丁： Retro64 ------- 我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://retro64.com/...
Microsoft Exchange Server远程执行代码漏洞（CVE-2021-28482）
...
Insteon Hub PubNub "cc" Channel Message Handler Multiple Global Overflow Code Execution Vulnerabilities(CVE-2017-16338 ~CVE-2017-16347)
Summary Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a buffer overflow on a global section overwriting arbitrary data...
Windows: Global Reparse Point Security Feature Bypass/Elevation of Privilege(CVE-2018-0822)
Windows: Global Reparse Point Security Feature Bypass/Elevation of Privilege Platform: Windows 10 1709 functionality not present prior to this version Class: Security Feature Bypass/Elevation of Privilege Summary: It’s possible to use the new Global Reparse Point functionality introduced in Windo...
Microsoft Edge: Chakra: JIT: stack-to-heap copy bug(CVE-2018-0776)
If variables don't escape the scope, the variables can be allocated to the stack. However, there are some situations, such as when a bailout happens or accessing to arguments containing stack-allocated variables, where those variables should not exist in the stack. In these cases, the...
GNOME libsoup HTTP Chunked Encoding Remote Code Execution Vulnerability(CVE-2017-2885)
Summary An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability...
systemd CVE-2017-9445 Out-Of-Bounds Write Remote Code Execution Vulnerability
Vulnerability description Canonical's Ubuntu developer Chris Coulson found a critical vulnerability, you can use it to remotely attack run popular of the operating system of the machine. The vulnerability number CVE-2017-9445 located in the Systemd init system and service manager . A remote...
AMF3 Java implementations deserialization Vulnerability
Details reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers derive class instances from java. io. Externalizable rather than the AMF3 specification's recommendation of a flash. utils. IExternalizable. A remote attacker with the ability to...
ImageMagick Convert Tiff Adobe Deflate 任意代码执行漏洞（CVE-2016-8707）
This vulnerability is present in the convert utility bundled with ImageMagick. Thus utility is used by many web applications to parse and convert images and other formats inter changeably. It is a very popular piece of software for this use. The vulnerability arises when attempting to deflate an...
WordPress 4.2.0-4.5.1 flashmediaelement.swf 反射型 XSS 漏洞
漏洞概述 WordPress 于 2016 年 5 月 6 号发布新版本 4.5.2,其中修了一 个反射型 XSS 漏洞,直接影响 4.2.0 至 4.5.1 版本。该反射型 XSS 源 于 WordPress 一个处理媒体的插件 MediaElement,攻击者能够构 造恶意 Payload,使之解析媒体文件时触发 XSS 下面的分析部分来源：https://midzer0.github.io/2016/wordpress-4.5.1-xss/ Source Code Preparation 一般来说, 开源CMS所使用的Flash文件也都来自其他的开源项目,...
Wordpress Simple Backup 插件2.7.10-任意文件下载漏洞
No description provided by source...
福建四创灾害预警系统 /Disaster/ReportCount.aspx 文件 tabnm 参数SQL注入漏洞
0x01 框架介绍 四创软件――中国防灾减灾信息与应用服务提供商,是国内企业信息防灾第一人。 影响厂商：福建四创软件有限公司 官方主页：http://www.strongsoft.net 谷歌搜索： intitle:预警 系统 技术支持:福建四创 0x02 漏洞利用 注入链接：/Disaster/ReportCount.aspx?tabnm=1 注入参数：tabnm 【获取数据库版本】 /Disaster/ReportCount.aspx?tabnm=1%27%2bselect+1+where+1=convertint,@@version%2b%27 【管理员账号密码】...
某校园管理系统后台SQL注入(无需登录/SA权限)
简要描述： ... 详细说明： 百度dork：inurl:/ws2004/ 技术支持：南京苏亚星资讯科技开发有限公司 ---------------------------------------- 漏洞页面：ws2004/SysManage/LeaveWord/List.asp?AbPage=1&where=%20where%20Title%20like%20111 漏洞参数：where 均为sa权限 ---------------------------------------- 漏洞证明： 1 http://www.suyaxing.com:81/ws2004/...
XYCMS建站系统SQL注入#2
简要描述： XYCMS建站系统SQL注入2 详细说明： 同第一个 XYCMS建站系统SQL注入1 这里提交的在wooyun没有提交过！这里提交不重复，证明： 除了：fwxmdetail.asp，news.asp，teamdetail.asp这些外。。。 jobdetail.asp未对id进行任何过滤就直接带入数据库查询 id=request.QueryString"id" set rs=server.createobject"adodb.recordset" exec="select from zpxx where id="& id rs.open exec,conn,1,1 if...
JEECMS任意命令执行漏洞（涉及大量案例，Administrator权限）
简要描述： JEECMS任意命令执行漏洞（涉及大量案例，Administrator权限） 详细说明： 谷歌搜索：inurl:jeecms/ArtiSearch.do 涉及大量案例 http://www.wwxzfw.gov.cn/jeecms/ArtiSearch.do?count=10&searchKey=a%27+and+1%3D1&chnlId= http://www.cnfamily.com/family/jeecms/ArtiSearch.do?count=10&searchKey=%C1%BD%BB%E1...
Linux Kernel <= 3.13 - Local Privilege Escalation PoC (gid)
No description provided by source. / CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC Vitaly Nikolenko http://hashcrack.org Usage: ./poc filepath where filepath is the file on which you want to set the sgid bit / define GNUSOURCE include sys/wait.h include sched.h include stdio.h include...
phpliteadmin <= 1.9.3 - Remote PHP Code Injection Vulnerability
No description provided by source. Exploit Title: phpliteadmin = 1.9.3 Remote PHP Code Injection Vulnerability Google Dork: inurl:phpliteadmin.php Default PW: admin Date: 01/10/2013 Exploit Author: L@usch - http://la.usch.io - http://la.usch.io/files/exploits/phpliteadmin-1.9.3.txt Vendor Homepag...
GLPI install.php Remote Command Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
RSA BSAFE Micro Edition Suite证书链处理拒绝服务漏洞
Bugtraq ID:66388 CVE ID:CVE-2014-0628 RSA BSAFE安全软件产品为开发商提供了一套完整的解决方案，帮助他们实现其应用程序的各种安全目标。 RSA BSAFE Micro Edition Suite处理某些证书链时存在错误，允许恶意用户利用漏洞使应用程序崩溃。 0 RSA BSAFE RSA BSAFE Micro Edition Suite 4.0.5已经修复该漏洞，建议用户下载更新： http://www.rsa.com/node.aspx?id=1204...
IBM InfoSphere BigInsights HTTP应答拆分漏洞
Bugtraq ID:66359 CVE ID:CVE-2013-3998 IBM InfoSphere BigInsights是用于分析和虚拟化海量数据的软件和服务。 IBM InfoSphere BigInsights web应用企业控制台不正确防止HTTP应答拆分，允许攻击者利用漏洞进行缓存投毒，跨站脚本，页面劫持等攻击。 0 IBM InfoSphere BigInsights 1.1 - 2.1 用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞： http://www-01.ibm.com/support/docview.wss?uid=swg21667812...
Oracle Java SE i18n子组件远程安全漏洞
BUGTRAQ ID: 52161 CVE ID: CVE-2012-0507 Sun Java Runtime Environment是一款为JAVA应用程序提供可靠的运行环境的解决方案。 Oracle Java SE中的Java Runtime Environment在实现上存在远程漏洞，可通过多个协议利用，未经验证的攻击者可利用此漏洞影响i18n子组件，导致部分控制受影响组件。此漏洞可影响：7 Update 2、6 Update 30、5.0 Update 33 0 Oracle Sun JRE 1.6.x Oracle Sun JDK 1.6.x 厂商补丁： Oracle...
Adobe Flash Player 'SWF'文件远程内存破坏漏洞
Bugtraq ID: 47314 CVE ID：CVE-2011-0611 Adobe Flash Player是一款Flash文件处理程序。 Windows, Macintosh, Linux和Solaris操作系统下的Adobe Flash Player 10.2.153.1和之前版本Adobe Flash Player 10.2.154.25和用于Chrome用户的早期版本，Android下的Adobe Flash Player 10.2.156.12及早期版本，Windows和Macintosh操作系统下的Adobe Reader及Acrobat X...
IBM WebSphere应用服务器default_create.log信息泄露漏洞
BUGTRAQ ID: 40694 CVE ID: CVE-2010-2323 IBM Websphere应用服务器以Java和Servlet引擎为基础，支持多种HTTP服务，可帮助用户完成从开发、发布到维护交互式的动态网站的所有工作。 在目标系统上使用zPMT和BBOWWPFx任务模板创建配置文件的时候，可能会向defaultcreate.log日志中写入敏感信息。 IBM Websphere Application Server 7.0.x 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
CoreHTTP Arbitrary Command Execution Vulnerability
No description provided by source. Package name: CoreHTTP server Version: 0.5.3.1 and below as long as cgi support is enabled Software URL: http://corehttp.sourceforge.net/ Exploit: http://aconole.brad-x.com/programs/corehttpcgienabled.rb Issue: CoreHTTP server fails to properly sanitize input...
NTP ntpq命令远程栈溢出溢出漏洞
BUGTRAQ ID: 34481 CVECAN ID: CVE-2009-0159 NTP（Network Time Protocol）是用于通过网络同步计算机时钟的协议。 ntpq程序中存在栈溢出漏洞。如果用户使用ntpq命令从远程时间服务器请求了对等端信息且服务器返回了恶意响应的话，就可能触发这个溢出。由于溢出仅限于两个字节，因此最可能的结果是拒绝服务。 University of Delaware NTP 4.2.4 厂商补丁： University of Delaware ----------------------...
GnuBoard 文件包含漏洞&远程代码执行漏洞
GnuBoard是韩国比较常见的一个论坛，存在较多的漏洞，其中common.php存在一个文件包含漏洞 看common.php代码 @extract$GET; @extract$POST; @extract$SERVER; …… if !$g4path || pregmatch"/:///", $g4path die"meta http-equiv='content-type' content='text/html; charset=$g4charset'script language='JavaScript' alert'肋给等 规过栏肺 函荐啊 沥狼登菌嚼聪促.';...
Linux x86 PUSH reboot()
No description provided by source. / Linux x86 PUSH reboot - 30 bytes Jonathan Salwan js.rac.projetATgmail.com Web: http://racprojet.zapto.org Disassembly of section .text: 08048054 .text: 8048054: 31 c0 xor %eax,%eax 8048056: 50 push %eax 8048057: 68 62 6f 6f 74 push $0x746f6f62 804805c: 68 6e 2...
w3blabor CMS 3.0.5 Arbitrary File Upload & LFI Exploit
No description provided by source. !/usr/bin/perl use LWP::UserAgent; use HTTP::Request::Common qwPOST; use Getopt::Long; '/ -.- ------------------oOO------OOo----------------- | | | / / / / | | / / / / / / / / / / / | | // // / / / // / // / // | | ///,// /./,/, // | | Security Research...
Linux Kernel lbs_process_bss()函数远程拒绝服务漏洞
BUGTRAQ ID: 32484 CVECAN ID: CVE-2008-5134 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的libertas子系统的drivers/net/wireless/libertas/scan.c文件中，lbsprocessbss函数存在缓冲区溢出漏洞。如果远程AP向系统发送了无效的beacon/probe响应的话，就可能触发这个溢出，导致拒绝服务的情况。 Linux kernel 2.6.27.5 Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
FREEsimplePHPguestbook (guestbook.php) Remote Code Execution Vulnerability
No description provided by source. | | | \ \ \ / / / \ / | / | / | | | | | | \ V / / \ | | | | | | | | | | | / \ | || | | | | | || || \ || // \ | | | FREEsimplePHPguestbook guestbook.php Remote Code Execution Vulnerability Get Script : http://www.sanusart.com/php/FREEsimplePHPguestbook.zip...
Admidio 1.4.8 (getfile.php) Remote File Disclosure Vulnerability
No description provided by source. /---------------------------------------------------------------\ + + + Admidio 1.4.8 Remote File Disclosure + + + ---------------------------------------------------------------/ Author : n3v3rh00d, http://forum.antichat.ru Download :...
Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.12修复多个安全漏洞
BUGTRAQ ID: 27683 CVECAN ID: CVE-2008-0412,CVE-2008-0413,CVE-2008-0414,CVE-2008-0415,CVE-2008-0417,CVE-2008-0419,CVE-2008-0591,CVE-2008-0592,CVE-2008-0593,CVE-2008-0594 Firefox/Thunderbird/SeaMonkey是Mozilla所发布的WEB浏览器和邮件/新闻组客户端。...
WengoPhone SIP Soft Phone畸形报文拒绝服务漏洞
WengoPhone SIP Soft Phone是一款基于SIP的VoIP电话程序。 WengoPhone SIP Soft Phone实现存在消息验证检查问题，远程攻击者可以利用漏洞进行拒绝服务攻击，使应用程序崩溃。 问题是存在于SIP客户端组件不正确处理SIP报文，MESSAGE处理没有"Content-Type"字段的畸形报文可导致应用程序崩溃。 Wengo WengoPhone 2.1 目前没有解决方案提供： http://www.wengophone.com/ /main.cpp/ include stdio.h include string using namespace...
Yahoo! Messenger Webcam 8.1 ActiveX Remote Buffer Overflow Exploit 2
No description provided by source. This affects the viewer ywcvwr.dll with yahoo messenger latest version tested. Fixed bug in last post x=0;xi800;x++ should be x=0; x800; x++ Here is your 2nd 0day!!! link:http://www.informationweek.com/news/showArticle.jhtml?articleID=199901856 ...
Multiple vendors ZOO file decompression Infinite Loop DoS PoC
No description provided by source. / Exploit for the vulnerability: Multiple vendors ZOO file decompression infinite loop DoS coded by Jean-Sébastien Guay-Leroux September 2006 / include stdio.h include stdlib.h include string.h // Structure of a ZOO header define ZOOHEADERSIZE 0x0000002a define...
CA BrightStor Backup 11.5.2.0 (Mediasvr.exe) Remote Code Exploit
No description provided by source. !/usr/bin/python Computer Associates CA Brightstor Backup Mediasvr.exe Remote Code Exploit Previously Unknown There seems to be an design error in the handling of RPC data with xdr procedures across several .dll's imported by Mediasvr.exe. Four bytes from an RPC...
iPhotoAlbum 1.1 (header.php) Remote File Include Vulnerability
No description provided by source. iPhotoAlbum v1.1header.phpRemote File Include Vulnerability D.Script: http://sourceforge.net/projects/iphotoalbum/ Discovered by: GloDM = Mahmoodali Homepage: http://www.Tryag.cc V.Code Exploit:Path/lib/static/header.php?setmenu=SheLL Greetz To: Tryag-Team &...
Microsoft Project Server 2003 PDSRequest.ASP XML请求信息泄露漏洞
Microsoft Project server 2003实现部分瘦客户端功能，瘦客户端使用XML请求对HTTPS服务进行对话。 这些请求其中一个返回用于访问SQL数据库的MSProjectUser帐户的用户名和密码信息： -------------------------------------------------------------- POST http://SERVER/projectserver/logon/pdsrequest.asp HTTP/1.0 Accept: / Accept-Language: en-nz Pragma: no-cache Host:...
Asterisk存在多个安全漏洞
Asterisk是一款开放源代码的PBX系统。 Asterisk MGCP实现存在远程堆栈缓冲区溢出，远程攻击者可以利用漏洞以进程权限执行任意指令。 攻击者可以通过使用畸形AUEP audit endpoint应答消息来触发。 另一个问题是存在于处理发送给Record函数的文件名，通过格式串攻击可导致任意代码执行，或者通过目录遍历攻击可导致任意文件覆盖。不过这个漏洞需要管理员使用客户端控制的变量作为文件名的一部分。 Asterisk Asterisk 1.2.10 Asterisk Asterisk 1.2.9 Asterisk Asterisk 1.2.8 Asterisk...
Symantec Backup Exec多个堆溢出漏洞
Symantec Backup Exec Remote Agent是一款备份解决方案。 Netware Servers版本下的Symantec Backup Exec不正确验证和过滤用户输入，远程攻击者可以利用漏洞进行堆破坏攻击，可导致拒绝服务或执行任意指令。 Backup Exec 9.1 and 9.2 for Netware Servers Remote Agent for Windows Servers存在这些漏洞，根据报告Backup Exec for Windows Servers, Backup Exec Continuous Protection Server CPS...
TikiWiki 1.9.5 Sirius (sort_mode) Information Disclosure Vulnerability
No description provided by source. /==========================================/ //tikiwiki version 1.9.5 CVS -Sirius- PoC // Product: Tikiwiki // URL: http://tikiwiki.org/ // RISK: critical /==========================================/ there's a critical security bug in tikiwiki version 1.9.5 CVS...
Attackers can steal all of Ether in ROC (Rasputin Online Coin) token smart contract (CVE-2018–10944)
Abstract I found a vulnerability of a smart contract for ROC aka Rasputin Online Coin, an Ethereum ERC20 token CVE-2018–109441. The requestdividend function has a critical bug similar to Reentrancy attack. Attackers can call the function in multiple times to steal Ether constantly until all of th...
ESnet iPerf3 JSON parse_string UTF Code Execution Vulnerability(CVE-2016-4303)
DESCRIPTION An exploitable remote code execution vulnerability exists in the JSON handling functionality of ESnet iPerf3. A specially crafted JSON string can lead to buffer overflow on the heap resulting in remote code execution. An attacker can send an unauthenticated packet to any reachable...
Synology Photo Station Unauthenticated Remote Code Execution
Vulnerability Summary The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier / 6.3-2967 and earlier. Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home/photo...
PhpMyAdmin 4.3.0—4.6.2 authorized users remote command execution vulnerability
Problem source code part in PMA 4.6.2: - libraries/controllers/table/TableSearchController.php:708: php 708: private function getRegexReplaceRows ... 727: if isarray$result 728: foreach $result as $index=$row 729: $result$index1 = pregreplace 730: "/" . $find . "/", 731: $replaceWith, 732: $row0...