56796 matches found
HolaCMS 1.2.x/1.4.x Voting Module Directory Traversal Remote File Corruption Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/12799/info HolaCMS is prone to a vulnerability that may allow remote users to corrupt files on the server. This issue is similar to the vulnerability described in BID 12789 HolaCMS Voting Module Remote File Corruption...
shop7z 注入漏洞
简要描述： shop7z 注入漏洞 详细说明： Advsearchadmin.asp kindnum=trimrequest"kindnum" pipai=trimrequest"pipai" model=trimrequest"model" productname=trimrequest"productname" price11=trimrequest"price11" price12=trimrequest"price12" price21=trimrequest"price21" price22=trimrequest"price22" if price11="" then...
Java Applet JMX Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class...
Adobe ColdFusion 9 Administrative Login Bypass
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------------+ | Packet Storm Advisory 2013-0819-2 | | http://packetstormsecurity.com/ |...
MyAlbum <= 3.02 (language.inc.php) Remote File Inclusion Vulnerability
No description provided by source. ============================================================================================== MyAlbum = 3.02 langsdir Remote File Inclusion Vulnerability =============================================================================================== Critical...
pmaPWN! - phpMyAdmin Code Injection RCE Scanner & Exploit
No description provided by source. ?php $list = array '/phpmyadmin/', '/phpMyAdmin/', '/PMA/', '/pma/', '/admin/', '/dbadmin/', '/mysql/', '/myadmin/', '/phpmyadmin2/', '/phpMyAdmin2/', '/phpMyAdmin-2/', '/php-my-admin/', '/phpMyAdmin-2.2.3/', '/phpMyAdmin-2.2.6/', '/phpMyAdmin-2.5.1/',...
PHPEMS (在线考试系统) 设计缺陷 Getshell一枚(官网已shell)
简要描述： 号称是最好用的开源php考试系统? 果断来看看。 已拿下官网。 详细说明： PHPEMS整合了uc。 在api/config.inc.php中 define'UCCONNECT', 'mysql'; define'UCDBHOST', 'localhost'; define'UCDBUSER', 'root'; define'UCDBPW', 'root'; define'UCDBNAME', 'ucenter16'; define'UCDBCHARSET', 'utf8'; define'UCDBTABLEPRE', 'ucenter16.uc';...
用友某办公平台SQL注入漏洞（system)
简要描述： 详细说明： 总 、 疯狗叔叔.....通用型的。。等待确认 全版本sql注入漏洞，直接拿下服务器的。。。无需登录 intitle:"fe协作" 涉及客户群体为： 大型企业（如：拉芳集团等等超大企业）、学校（北京师范）、医药、政府（如：珠海市人民防空办公室、广东省渔政总队珠海支队、广东煤炭地质局等等。。。）、能源（电网）、银行等等 http://oa.bamatea.com http://oa.moonbasa.com http://oa.etonetech.com http://oa.ztcz.cn http://218.249.130.74...
Cisco WebEx Training Center培训注册跨站脚本漏洞
Bugtraq ID:64277 CVE ID:CVE-2013-6963 Cisco WebEx Training Center是一款互动式培训解决方案，可开展电子教学。 Cisco WebEx Training Center培训中心注册页面不正确过滤用户提交的输入，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可获取敏感信息或劫持用户会话。 0 Cisco WebEx Training Center 厂商补丁： Cisco ----- 用户可参考如下厂商提供的安全公告获得补丁信息：...
Apache Struts 'includeParams' 不完整修复安全绕过漏洞(CVE-2013-2115)
BUGTRAQ ID: 60167 CVECAN ID: CVE-2013-2115 Struts2 是第二代基于Model-View-Controller MVC模型的java企业级web应用框架。它是WebWork和Struts社区合并后的产物。 Apache Struts 2.0.0-2.3.14.1存在未彻底修复的安全措施绕过漏洞（CVE-2013-1966），攻击者可利用此漏洞以当前用户权限执行任意代码。此漏洞已经在Struts 2.3.14.2中修复。 0 Apache Group Struts2 2.0.0 - 2.3.14.1 厂商补丁： Apache ------...
phpMyAdmin 3.x 多个安全漏洞
CVE ID: CVE-2011-2505,CVE-2011-2506,CVE-2011-2507,CVE-2011-2508 phpMyAdmin是用PHP编写的工具，用于通过WEB管理MySQL。 phpMyAdmin在实现上存在多个漏洞，可被恶意用户利用泄露敏感信息并控制受影响系统。 1）libraries/auth/swekey/swekey.auth.lib.php中的"Swekeylogin"函数中存在错误，可被利用覆盖会话变量并注入和执行任意PHP代码；...
Linux Kernel RDS协议本地权限提升漏洞
BUGTRAQ ID: 44219 CVE ID: CVE-2010-3904 Linux Kernel是开放源码操作系统Linux所使用的内核。 在Linux上，使用了iovec结构执行recvmsg样式套接字调用以允许用户指定用于接收套接字数据的缓冲区基址和大小。每个报文家族负责定义拷贝套接字数据的函数，内核接收到这些数据后返回给用户空间以便用户程序处理所接收到的网络数据。 在将数据拷贝到用户空间时，RDS协议没有确认用户所提供iovec结构的基址指向了有效的用户空间地址便使用...
Linux Kernel 'fasync_helper()'本地特权提升漏洞
Bugraq ID: 37806 CVE ID：CVE-2009-4141 Linux是一款开放源代码的操作系统。 Linux内核处理锁定fasync文件描述符存在安全漏洞，允许攻击者以内核特权执行任意代码或使系统崩溃。 根据Linus分析，“问题是相同文件描述符可在多个fasync列表上，它可以在特定fasync列表上存在一次，但是文件锁定比较特殊，会使用 'fl-flfasync'列表无视在什么底层设备驱动或其他的情况下增加任意文件到它所属的fasync列表中。" 这个问题是因为它不正确假定某个文件只能在一个fasync列表中，所以fasynchelper会清除FASYNC标记。...
CUPS文件描述符处理远程拒绝服务漏洞
BUGTRAQ ID: 37048 CVE ID: CVE-2009-3553 Common Unix Printing System（CUPS）是一款通用Unix打印系统，是Unix环境下的跨平台打印解决方案，基于Internet打印协议，提供大多数PostScript和raster打印机服务。 CUPS的scheduler/select.c文件中的cupsdDoSelect函数在处理其文件描述符处理接口中引用的方式存在释放后使用错误，远程攻击者可以通过以特殊方式查询特定打印机的当前打印任务列表导致cupsd崩溃。 Easy Software Products CUPS 1.3.7...
Riorey RIOS Hardcoded Password Vulnerability 4.7.0
No description provided by source. Severity: High Full root access to the device Date: 07 October 2009 Versions Affected: RIOS 4.6.6 , 4.7.0 possibly others Discovered on: 25 July 2009 Vendor URL: www.riorey.com Author: Marek Kroemeke Overview: Riorey DDoS mitigation appliences www.riorey.com are...
Mozilla Firefox MFSA存在多个安全漏洞
Bugraq ID: 35758 CVE ID：CVE-2009-1194 CVE-2009-2462 CVE-2009-2463 CVE-2009-2464 CVE-2009-2465 CVE-2009-2466 CVE-2009-2467 CVE-2009-2468 CVE-2009-2469 CVE-2009-2471 CVE-2009-2472 CNCVE ID：CNCVE-20091194 CNCVE-20092462 CNCVE-20092463 CNCVE-20092464 CNCVE-20092465 CNCVE-20092466 CNCVE-20092467...
多个浏览器HTTPS内容上下文中的HTTP资源安全绕过漏洞
Bugraq ID: 35403 CVE ID：CVE-2009-2065 CVE-2009-2064 CVE-2009-2066 CVE-2009-2067 CNCVE ID：CNCVE-20092065 CNCVE-20092064 CNCVE-20092066 CNCVE-20092067 当页面通过不安全方法对安全内容请求资源进行操作时不正确显示警告，可导致绕过多个WEB浏览器安全限制。 攻击者可以利用这个漏洞进行钓鱼攻击或获得敏感信息。不过要利用此漏洞，攻击者必须截获或控制网络通信，如通过中间人，DNS毒药等攻击。 如下浏览器受此漏洞影响： Microsoft Internet...
Red Hat证书系统代理组安全绕过漏洞
Bugraq ID: 35104 CVE ID：CVE-2009-0588 CNCVE ID：CNCVE-20090588 Red Hat Certificate System是一款认证系统，提供强大的安全框架来确保用户的身份以及通讯的私密性。 Red Hat Certificate System处理多个代理组时存在错误，远程攻击者可以利用漏洞绕过安全限制，允许代理组在任意队列中批准或拒绝证书。 Red Hat registration authority注册授权是Red Hat证书系统子系统的选项，用于验证和处理注册请求，PIN重置请求和格式化请求。 Robert Mead of...
ZaoCMS (user_updated.php) Remote Change Password Exploit
No description provided by source. form action="http://demo.zaocms.com/admin/modules/Users/userupdated.php" method="post" onsubmit="return checkFormthis;" id=form1 Name=form1 h2Cod3 By ThE g0bL!N ZaoCMS Remote Change Password /h2 tittle ThE g0bL!N/tittle table cellSpacing="0" cellPadding="0"...
Linux Kernel sock.c SO_BSDCOMPAT选项信息泄露漏洞
BUGTRAQ ID: 33846 CVECAN ID: CVE-2009-0676 Linux Kernel是开放源码操作系统Linux所使用的内核。 在Linux Kernel的net/core/sock.c文件的sockgetsockopt函数中，如果设置了SOBSDCOMPA选项的话optval v.val就会被错误的初始化并直接返回给用户域，导致信息泄露。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
CUPS < 1.3.8-4 (pstopdf filter) Privilege Escalation Exploit
No description provided by source. / cve-2008-5377.c CUPS 1.3.8-4 pstopdf filter exploit Jon Oberheide [email protected] http://jon.oberheide.org Usage: $ gcc cve-2008-5377.c -o cve-2008-5377.c $ ./cve-2008-5377 $ id uid=0root gid=1000vm ... Information:...
ZeeScripts ZeeBuddy 'bannerclick.php' SQL注入漏洞
BUGTRAQ ID:30628 CNCAN ID：CNCAN-2008081204 ZeeScripts ZeeBuddy是一款基于PHP的WEB应用程序。 ZeeScripts ZeeBuddy不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息或操作数据库。 问题是由于'bannerclick.php'脚本不正确过滤"adid"参数，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，可获得敏感信息或操作数据库。 ZeeScripts ZeeBuddy 2.1 目前没有解决方案提供：...
Mambo Component mambads <= 1.0 RC1 Beta SQL Injection Vulnerability
No description provided by source. !/usr/bin/perl -w Mambo Component mambads 1.0 RC1 Beta & 1.0 RC1 Remote SQL Injection Found by : Houssamix From H-T Team H-T Team HouSSaMix + ToXiC350 from MoroCCo Greetz : Stack & CoNaN & HaCkeREgY & room-hacker & Hak3r-b0y & All friends & All muslims HaCkeRs :...
zKup CMS 2.0 <= 2.3 Remote Add Admin Exploit
No description provided by source. !/usr/bin/php ?php / Name: zKup CMS v2.0 = v2.3 0-day exploit add admin Credits: Charles "real" F. charlesfolathotmail.fr Date: 03-08-2008 Conditions: None. This exploit add a new zKup admin. Thanks to darkfig, and his useful phpsploit class : / print "\n"; prin...
Joomla Component Nice Talk <= 0.9.3 (tagid) SQL Injection Vulnerability
No description provided by source. Title : Joomla Component Nice Talk = 0.9.3 tagid Remote Blind SQL Injection Vulnerability Author : ajann Contact : : S.Page : http://www.azrul.com $$ : ?? Dork : inurl:index.php?option=comnicetalk DorkEx :...
WordPress多个插件远程文件包含漏洞
WordPress是一款免费的论坛Blog系统，wp-Table和wordTube都是其中常用的插件。 WordPress的wp-Table和wordTube插件实现上存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 wordTube插件中wordtube-button.php文件没有正确验证wpPATH参数的输入，允许攻击者通过包含本地或外部资源的任意文件导致执行任意命令。漏洞代码如下： ----------------wordtube-button.php------------------- ... / // get and set path of functio...
MyDNS远程动态DNS升级拒绝服务漏洞
MyDNS是运行在UNIX系统上的免费DNS服务程序。 MyDNS的src/mydns/update.c文件中updategobblerr函数存在堆溢出漏洞，远程攻击者可能利用此漏洞导致DNS拒绝服务。 如果远程攻击者向有漏洞的服务器提交了恶意查询请求的话，就可能触发这个溢出，导致拒绝服务。成功攻击要求用户拥有升级权限，且在mydns.conf文件中allow-update设置成为yes。 Don Moore MyDNS 1.1.0 临时解决方法： 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 将allow-update设置为no。 厂商补丁： Don...
EsForum 3.0 (forum.php idsalon) Remote SQL Injection Vulnerability
No description provided by source. ------------------------------------------------------------------------------------------------------------------- AYYILDIZ.ORG PreSents... Script: EsForum 3.0 Script Download: http://www.editeurscripts.com/scripts/dl-esforum-3.html Contact: ilker Kandemir...
perForms Mambo Component <= 1.0 Remote File Inclusion
No description provided by source. ------------------------------------------------------------------------ --- perForms = 1.0 mosConfigabsolutepath Remote File Inclusion ------------------------------------------------------------------------ --- Remote : Yes Critical Level : High Vuln founded i...
Cisco HyperFlex HX 未授权文件上传漏洞（CVE-2021-1499 ）
Technical Analysis CVE-2021-1499 Arbitrary file upload RCE implied in the /upload endpoint. Patch --- unpatched/springpath.conf 2021-05-17 19:06:17.000000000 -0500 +++ patched/springpath.conf 2021-05-17 19:06:23.000000000 -0500 @@ -36,14 +36,7 @@ include uwsgiparams; - location /crossdomain.xml -...
Full Disclosure of Highly-Manipulatable, tradeTrap-Affected ERC20 Tokens in Multiple Top Exchanges(CVE-2018-11446)
Update: 2018-06-12 The BMB BMB contract 0x0e935e976a47342a4aee5e32ecf2e7b59195e82f is NOT affected by tradeTrap. We sincerely apology for mistakenly listing it as a vulnerable ERC20 token. Quoted from our last blog 1, “publicly tradable ERC-20 tokens have considerable high market value. Various...
Windows Kernel 64-bit stack memory disclosure in msrpc!LRPC_CASSOCIATION::AlpcSendCancelMessage(CVE-2018-0896)
We have discovered that the msrpc!LRPCCASSOCIATION::AlpcSendCancelMessage function sends an ALPC message with portions of uninitialized memory from the local stack frame on Windows 7 64-bit other versions were not tested. The message is 0x18 bytes long, 8 of which are uninitialized. The layout of...
Ichano AtHome IP Cameras Multiple Vulnerabilities
Vulnerabilities Summary The following advisory describes three 3 vulnerabilities found in Ichano IP Cameras. AtHome Camera is “a remote video surveillance app which turns your personal computer, smart TV/set-top box, smart phone, and tablet into a professional video monitoring system in a minute....
TPshop 前台SQL注入#2
0x01 说明 TPshop开源商城系统 Thinkphp shop的简称 ，是深圳搜豹网络有限公司开发的一套多商家模式的商城系统。适合企业及个人快速构建个性化网上商城。包含PC+IOS客户端+Adroid客户端+微商城，系统PC+后台是基于ThinkPHP5 MVC构架开发的跨平台开源软件，设计得非常灵活，具有模块化架构体系和丰富的功能，易于与第三方应用系统无缝集成，在设计上，包含相当全面，以模块化架构体系，让应用组合变得相当灵活，功能也相当丰富。 下载地址：http://www.tp-shop.cn/Index/Index/download.html 目录大概结构 ├─index.p...
FineCMS_5.0.10_XSS#4
No description provided by source...
QNAP QTS multiple RCE vulnerabilities (CVE-2017-6361, CVE-2017-6360, CVE-2017-6359)
QNAP QTS multiple RCE vulnerabilities The latest version of this advisory is available at: https://sintonen.fi/advisories/qnap-qts-multiple-rce-vulnerabilities.txt Overview -------- QNAP QTS firmware contains multiple Command Injection CWE-77 vulnerabilities that can be exploited to gain remote...
iOS/macOS Remote code execution triggered by malformed GIF in ImageIO framework（CVE-2017-2416）
ImageIO Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-2017-2416:...
OnePlus 3/3T OxygenOS Unauthorized Boot Mode Changing (CVE-2017-5623)
Summary A physical attacker or one with authorized-ADB access, e.g. PC malware can change the ‘boot mode’ of a locked OnePlus 3/3T device, by rebooting into fastboot and issuing the fastboot oem bootmode rf/wlan/ftm/normal command. The vulnerability may allow the attacker to elevate his privilege...
Roundcube 1.2.2: Command Execution via Email
中文分析：http://paper.seebug.org/138/ Author: p0wd3r, LG 知道创宇404安全实验室 Roundcube is a widely distributed open-source webmail software used by many organizations and companies around the globe. The mirror on SourceForge, for example, counts more than 260,000 downloads in the last 12 months1 which is on...
shopnc /circle/index.php groupbuy_order参数 SQL注入漏洞
No description provided by source...
TurboGate邮件网关漏洞合集
简要描述： 拓波软件旗下另一款产品，用户量还是挺大的。 详细说明： TurboGate其实相当于TurboMail的早期版本，TurboGate集成了大量的在TurboMail中出现的漏洞。 这里只列出无需登录即可利用的漏洞，厂商可以根据TurboMail漏洞进行自查。 1. http://.../bugs/wooyun-2016-0167905 在TurboGate中使用的是axis2%remote; $alpharand g00dPa$$w0rD $alpharand 1 1 https://images.seebug.org/upload/201603/052322256...
ThinkSAAS平衡权限漏洞二
简要描述： 权限控制.. 详细说明： 官网最新版存在平衡权限漏洞，进入用户自己的空间，修改基本信息： 添加“个人标签”，抓包，改包: 将objid修改为1，1是admin用户ID 登入admin查看个人标签： admin1的标签已经成了admin的标签.... 漏洞证明： https://images.seebug.org/upload/201503/10204855f2f51b9f73e4b6fcb7dbcd388a566d28.pn...
Joomla Akeeba Kickstart Unserialize Remote Code Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' require 'json' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include...
Dropbear SSH <= 0.34 Remote Root Exploit
No description provided by source. / Linux x86 Dropbear SSH = 0.34 remote root exploit coded by live You'll need a hacked ssh client to try this out. I included a patch to openssh-3.6.p1 somewhere below this comment. The point is: the buffer being exploited is too small25 bytes to hold our...
N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability
No description provided by source. N/X - Web CMS N/X WCMS 4.5 Multiple Vulnerability =================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ /'...
Serendipity <= 1.0.3 (comment.php) Local File Include Exploit
No description provided by source. ? print ' ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::: :+: :+: :+: :+: +:+:+: :+:+:+ +:+ +:+ +:+ +:+ +:+...
Java Applet Driver Manager Privileged toString() Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class...
IBM AIX <= 5.3 sp6 capture Terminal Sequence Local Root Exploit
No description provided by source. / 07/2007: public release IBM AIX = 5.3 sp6 AIX capture Local Root Exploit By qaaz / include stdio.h include stdlib.h include string.h include fcntl.h include unistd.h include sys/wait.h include sys/select.h define TARGET /usr/bin/capture define VALCNT 40 define...
Zavio IP Cameras Firmware 1.6.03 - Multiple Vulnerabilities
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com Zavio IP Cameras multiple vulnerabilities 1. Advisory Information Title: Zavio IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0302 Advisory URL:...
Internet Security Systems ICECap Manager 2.0.23 Default Username and Password
No description provided by source. source: http://www.securityfocus.com/bid/1216/info ICECap Manager is a management console for BlackICE IDS Agents and Sentries. By default, ICECap Manager listens on port 8081, transmits alert messages to another server on port 8082, and has an administrative...