Oracle Java 7 JmxMBeanServer类远程代码执行漏洞

BUGTRAQ ID: 57246 CVE ID: CVE-2013-0422 Oracle Java Runtime Environment JRE是一款为JAVA应用程序提供可靠运行环境的解决方案。 Oracle JRE7环境中的jmx.mbeanserver.JmxMBeanServer类存在沙盒绕过漏洞使得远程攻击者可以绕过java securityManager的检查远程执行任意java代码控制用户系统。 目前已知受影响环境为最新版本Oracle JRE7 update 10及其更早版本。经测试Oracle Java 6不受影响。 0 Oracle Java 7 Update ...

Ruby on Rails嵌套参数SQL注入漏洞

CVE ID: CVE-2012-2694,CVE-2012-2695 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails 3.2.6、3.1.6、3.0.14之前版本在SQL查询中使用了没有正确验证的输入，这些输入是通过嵌套查询参数传递到Active Record接口的，通过注入SQL代码操作SQL查询。在使用ActionPack时参数解析Rack的方式中也存在漏洞，可允许插入"IS NULL"到SQL查询。 0 Ruby on Rails 3.2.x Ruby on Rails...

Python SimpleXMLRPCServer远程拒绝服务漏洞

BUGTRAQ ID: 51996 CVE ID: CVE-2012-0845 Python是一种面向对象、直译式计算机程序设计语言，也是一种功能强大的通用型语言。 Python在实现上存在远程拒绝服务漏洞，攻击者可通过特制的HTTP POST请求利用此漏洞造成拒绝服务。 此漏洞源于在处理POST请求时，"SimpleXMLRPCRequestHandler.doPOST"方法没有正确处理EOF，可通过特制的请求导致较高的CPU消耗。 0 python 3.x python 2.7.x 厂商补丁： Python ------...

PHP ‘tidy_diagnose’函数拒绝服务漏洞

CVE-2012-0781 PHP是一款免费开放源代码的WEB脚本语言包，可使用在Microsoft Windows、Linux和Unix操作系统下。 PHP 5.3.8版本中的tidydiagnose函数中存在漏洞。远程攻击者可利用该漏洞借助对应用程序的特制输入，造成拒绝服务（空指针解引用进而应用程序崩溃），该应用程序试图在无效对象上执行Tidy::diagnose操作。 0 php:5.3.8 目前厂商还没有提供此漏洞的相关补丁或者升级程序，建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://us.php.net/sites.php -----BEGIN PGP...

Microsoft .NET Framework表单验证URL存在欺骗漏洞

BUGTRAQ ID: 51202 CVE ID: CVE-2011-3415 ASP.NET是一套由Microsoft分发的帮助开发者构建基于WEB应用的系统。 Microsoft .NET Framework在表单验证过程中验证返回的URL时存在欺骗漏洞，成功利用此漏洞的攻击者可将用户重定向到恶意站点，然后执行钓鱼攻击，获取用户敏感信息。此漏洞不允许攻击者直接执行代码或提升其用户权限。 0 Microsoft .NET Framework 4.x Microsoft .NET Framework 3.x Microsoft .NET Framework 2.x Microsoft...

正方教务管理系统web端成绩录入漏洞

简要描述： web端成绩录入可绕过密码验证录入成绩。 详细说明： web端在进行成绩录入时可以通过直接将动态页面从jscjmm.aspx修改为xfjscjlr.aspx进行绕过，只要具有教师的登录权限，不需要验证成绩录入密码即可直接进入成绩的录入和提交页面。 危害：成绩录入验证密码失效，意味着一旦教师密码被泄露因为很多教师用户的账户名和密码都为初始值没有进行修改，如改实例院校的教务系统有约30%的教师账户名和密码相同，任意用户可以在成绩录入有效期内于教师权限下的任意成绩修改与提交。 漏洞证明：...

IBM WebSphere ILOG Rule Team Server未明跨站脚本漏洞

Bugtraq ID: 50368 IBM WebSphere ILOG是一款业务规则管理系统。IBM WebSphere ILOG Rule Team Server是一个基于Web的规则管理和授权环境，它允许业务用户查看、创建和修改规则。 IBM WebSphere ILOG Rule Team Server content/error.jsp存在一个未明跨站脚本漏洞，允许攻击者构建恶意链接，诱使用户解析，可获得敏感信息或劫持用户会话。 IBM WebSphere ILOG Rule Team Server 7.1.1 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息：...

Linux Kernel agp_allocate_memory/agp_create_user_memory本地权限提升漏洞

BUGTRAQ ID: 47535 CVE ID: CVE-2011-1746 Linux Kernel是Linux操作系统的内核。 Linux Kernel在agpallocatememory/agpcreateusermemory的实现上存在本地权限提升漏洞，本地攻击者可利用此漏洞以内核权限执行任意代码，造成完全控制受影响计算机。...

Easy RM to MP3 Converter 2.7.3.700

No description provided by source. import sys print "\n============================" print " Easy RM to MP3 Converter 2.7.3.700 .m3u File Buffer Overflow Exploit " print " Tested on Windows XP SP3 " print "============================\n" calc.exe - 85 bytes shellcode...

VMWare Virtual 8086 Linux Local Ring0 Exploit

No description provided by source. EDB-ID: 10207 CVE-ID: CVE-2009-2267 Title: VMWare Virtual 8086 Linux Local Ring0 Exploit Author: Tavis Ormandy and Julien Tinnes Published: 2009-10-27 Download N/A Bugtraq ID: 36841 Class: Design Error Published: Oct 27 2009 12:00AM Updated: Oct 27 2009 09:18PM...

ToutVirtual VirtualIQ Multiple Vulnerabilities

No description provided by source. Secure Network - Security Research Advisory Vuln name: ToutVirtual VirtualIQ Pro Multiple Vulnerabilities Systems affected: ToutVirtual VirtualIQ Professional 3.2 build 7882 Systems not affected: -- Severity: High Local/Remote: Remote Vendor URL:...

Microsoft Windows TCP/IP在处理特制报文中远程拒绝服务漏洞（MS09-048）

BUGTRAQ ID: 36269 CVECAN ID: CVE-2009-1926 Microsoft Windows是微软发布的非常流行的操作系统。 由于处理TCP接收窗口大小很小或为0的特制报文中的错误，导致Microsoft Windows的TCP/IP处理中存在拒绝服务漏洞。如果应用关闭了仍要发送数据的TCP连接且攻击者设置了很小的或为0的TCP接收窗口大小，受影响的服务器就无法彻底关闭TCP连接。攻击者可以通过向系统发送大量特制报文来利用这个漏洞，导致受影响的系统停止响应新的请求。即使在攻击者停止发送恶意报文之后系统仍保持无响应。 Microsoft Windows Vist...

Apache mod_proxy_ajp信息泄露漏洞

BUGTRAQ ID: 34663 CVECAN ID: CVE-2009-1191 Apache HTTP Server是一款流行的Web服务器。 Apache服务器的modproxyajp模块在处理畸形的POST请求时存在错误，远程攻击者可以通过提交特制的HTTP请求泄露其他用户请求相关的响应数据。 Apache 2.2.11 Apache Group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.apache.org/dist/httpd/patches/applyto2.2.11/PR46949.diff...

LiteNews <= 0.1 Insecure Cookie Handling Vulnerability

No description provided by source. litenews-01 = 1.2 Insecure Cookie Handling Vulnerability AUTHOR : Scary-Boys HOME : http://scary-boys.com Download : http://webscripts.softpedia.com/scriptDownload/LiteNews-Download-43228.htmldownloadlocations DorKs : "Powered By litenews" DESCRIPTION : Maian...

SNMPv3 HMAC validation error Remote Authentication Bypass Exploit

No description provided by source. snmpv3exp.sh exploit the vulnerability described in CVE-2008-0960, the HMAC check problem on multiple vendor Copyright c 2008 @ Mediaservice.net Srl. All rights reserved Wrote by Maurizio Agazzini inodeatmediaservice.net http://lab.mediaservice.net/...

PHP 5.2.6修复多个安全漏洞

BUGTRAQ ID: 29009 CVECAN ID: CVE-2008-0599 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的5.2.6之前版本存在多个安全漏洞，允许恶意用户绕过安全限制、导致拒绝服务或入侵有漏洞的系统。 1 FastCGI SAPI中的安全漏洞可能导致栈溢出。 2 处理escapeshellcmd中不完整多字节字符时存在安全漏洞。 3 cURL中的错误可能导致绕过safemode限制。 4 PCRE中的边界条件错误可能允许恶意用户导致拒绝服务或入侵有漏洞的系统。 PHP 5.2.6 PHP ---...

Cisco IOS双栈路由器IPv6拒绝服务漏洞

BUGTRAQ ID: 28461 CVECAN ID: CVE-2008-1153 Cisco IOS是思科网络设备中所使用的互联网操作系统。 运行Cisco IOS软件的设备如果启用了IPv6，就会受拒绝服务攻击影响。设备必须还要启用了IPv4 UDP服务才会受这个漏洞影响。如果要利用这个漏洞，攻击IPv6报文必须指向设备，通过路由器路由的报文不会触发这个漏洞。成功利用这个漏洞可能导致以下情况之一： 1. 如果接口上配置了RSVP服务则设备会崩溃。 2. 任何其他受影响的基于IPv4 UDP的服务会导致接口无法接收更多的通讯，仅有利用漏洞端口才会受影响。...

Microsoft Windows Animated Cursor Stack Overflow Exploit

No description provided by source. !/usr/bin/env python $Id: win32-loadaniicon.py 4 2007-06-02 00:47:59Z ramon $ Windows Animated Cursor Stack Overflow Exploit Copyright 2007 Ramon de Carvalho Valle [email protected], RISE Security [email protected] This program is free software; you...

OpenOffice畸形Word文件整数溢出漏洞

OpenOffice是个整合性的软件，包含了许多文字处理、表格、公式等办公工具。 OpenOffice在处理某些畸形Word文档时存在整数溢出，远程攻击者可能利用此漏洞在用户机器上执行任意指令。 memset会试图向堆中写入大量的0： Breakpoint 2, WW8PLCF::GeneratePLCF this=0xb12a36e8, pSt=0xabae6cc8, nPN=0, ncpN=587202560 at /usr/src/debug/OOD680m5/sw/source/filter/ww8/ww8scan.cxx:2299 2299 nIMax = ncpN;...

Xine-Lib RuleMatches远程缓冲区溢出漏洞

xine是一款免费的媒体播放器，支持多种格式。 xine的Real Media输入插件的asmrpmatch函数中存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。 在以下代码段中，rulematches是仅能容纳16个int的静态缓冲区，但asmrpmatch没有对参数执行边界检查： 8--------------------------------------------8 src/input/libreal/real.c:468 for i=0; idesc-streamcount; i++ int j=0; int n; char b64; int...

ProFTPD mod_tls预认证远程缓冲区溢出漏洞

ProFTPD是一款开放源代码FTP服务程序。 ProFTPD的模块modtls在处理用户认证时存在缓冲溢出漏洞，远程攻击者可能利用此漏洞完全控制服务器。 ProFTPD的modtls模块的tlsx509nameoneline函数中存在远程溢出漏洞，允许远程未经认证的攻击者获得root用户权限。漏洞相关的代码如下： contrib/modtls.c: """ static char tlsx509nameonelineX509NAME x509name static char buf256 = '\0'; / If we are using OpenSSL 0.9.6 or newer,...

xeCMS 1.0.0 RC 2 (cookie) Remote Command Execution Exploit

No description provided by source. !/usr/bin/perl xeCMS 1.0.0 RC 2 Remote Command Execution Exploit Copyright c 2006 cijfer cijfer@netti!fi All rights reserved. never ctrl+c again. cijfer$ http://target.com/dir host changed to 'http://target.com/dir' cijfer$ greets to JagX $Id: cijfer-xecmsxpl.pl...

KYOCERA Multi-Set Template Editor 3.4 Out-Of-Band XML External Entity Injection

Summary KYOCERA Net Admin is Kyocera's unified device management software that uses a web-based platform to give network administrators easy and uncomplicated control to handle a fleet for up to 10,000 devices. Tasks that used to require multiple programs or walking to each printer can now be...

New ownerAnyone Bug Allows For Anyone to ''Own'' Certain ERC20-Based Smart Contracts (CVE-2018-10705)

This morning, our vulnerability-scanning system at PeckShield identified a new vulnerability named ownerAnyone in certain ERC20-based smart contracts such as AURA, which is deployed by a decentralized banking and finance platform – AURORA. This bug, if successfully exploited, might introduce the...

XXE Zeroday Vulnerability in HP PPM

Intro: XXE Zeroday Vulnerability in HP PPM Researchers at Rhino Security Labs discovered an XXE vulnerability in the way HP Project and Portfolio Management Center HP PPM processed imported tickets. Specifically, an XML external entity injection vulnerability allows an attacker to exploit the...

Windows: heap overflow in jscript.dll in Array.sort(CVE-2017-11907)

There is an heap overflow vulnerability in jscript.dll library used in IE, WPAD and other places. The bug affects 2 functions, JsArrayStringHeapSort and JsArrayFunctionHeapSort. PoC for IE note: page heap might be required to obsorve the crash: var vars = new Array100; var arr = new Array1000;...

Foscam IP Video Camera webService 9299.org DDNS Client Code Execution Vulnerability(CVE-2017-2857)

Summary An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating...

Automated Logic WebCTRL 6.1 Path Traversal Arbitrary File Write

Description The vulnerability is triggered by an authenticated user that can use the manualcommand console in the management panel of the affected application. The ManualCommand function in ManualCommand.js allows users to perform additional diagnostics and settings overview by using pre-defined...

OpenJPEG JPEG2000 mcc record Code Execution Vulnerability(CVE-2016-8332)

Summary An exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful...

HDF5 Group libhdf5 H5T_ARRAY Code Execution Vulnerability(CVE-2016-4330)

Description HDF5 is a fileformat that is maintained by a non-profit organization, The HDF Group. HDF5 is designed to be used for storage and organization of large amounts of scientific data and is used to exchange data structures between applications in industries such as the GIS industry via...

Discuz! X Front arbitrary file deletion vulnerability

Author: The know Chong Yu 404 laboratory 0x01 description Discuz! X community software, is a PHP and MySQL like other variety of database build performance, comprehensive, security and stability of the Community Forum platform. 2017 9 May 29, Discuz! Fix a security issue has been used to strength...

Artifex MuPDf JBIG2 Parser Code Execution Vulnerability(CVE-2016-8729)

Summary An exploitable memory corruption vulnerability exists in the JBIG2 parser of Artifex MuPDF 1.9. A specially crafted PDF can cause a negative number to be passed to a memset resulting in memory corruption and potential code execution. An attacker can specially craft a PDF and send to the...

Hanbanggaoke IP Camera Arbitrary Password Change

Vulnerability summary The following advisory describes an arbitrary password change vulnerability found in Hanbanggaoke webcams. Beijing Hanbang Technology, “one of the first enterprises entering into digital video surveillance industry, has been focusing on R&D of products and technology of...

Google Android Broadcom Wi-fi Driver Information Disclosure Vulnerability(CVE-2017-0633)

An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious component to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10,...

OnePlus OTA Downgrade Vulnerability(CVE-2017-5948)

Products OnePlus 3T OnePlus 3 OnePlus 2 OnePlus X OnePlus One Vulnerable Version All OnePlus OxygenOS & HydrogenOS OTAs Technical Details lenient updater-script in the OnePlus OTAs which does not check that the current version is lower than or equal to the given image’s see below the 4.0.0...

FineCMS AttachmentController arbitrary file upload vulnerability

Source link: http://www.hackersb.cn/shenji/170.html Is still AttachmentController, of course, this is no longer kindeditorupload upload the file and then include the file so simple, but directly uploaded the script execution. This time the problem is ajaxswfuploadAction method, the method code is...

用友GRP-U8 gzQuerydetail 参数KJND SQL注入漏洞

No description provided by source...

泛微E-Office /inc/priv_user_list/priv_xml.php SQL注入漏洞

0x01 框架概述 泛微e-office是泛微公司面向中小型组织推出的OA产品,简单易用高效,部署快、投资少。提供免费试用体验。至今已为超过一万家客户提供方便高效的办公体验. 官方主页： www.weaver.com.cn 主页截图如下。 0x02 漏洞信息 先对系统进行解密。 /inc/privuserlist/privxml.php 大概18行开始 $pararr = explodestpar $REQUEST'par' ; $userpriv = $pararr'userpriv'; ... if $pararr'viewtype' == 0 unset $deptnameutf8...

D-Link revA v1.13 路由器后门

下载了D-link无线路由器型号：DIR-100 revA的固件程序 v1.13。使用工具Binwalk，很快的就从中发现并提取出一个只读SquashFS文件系统，没用多大功夫我就将这个固件程序的web server/bin/webs加载到了IDA中： 基于上面的字符信息可以看出，这个/bin/webs二进制程序是一个修改版的thttpd，提供路由器管理员界面操作功能。看起来是经过了台湾明泰科技D-Link的一个子公司的修改。他们甚至很有心计的将他们很多自定义的函数名都辅以“alpha”前缀： 这个 alphaauthcheck 函数看起来很有意思！...

Dedecms远程写文件漏洞

来源链接：http://seclists.org/fulldisclosure/2015/Jun/47 http://blog.nsfocus.net/dedecms-write-file-vuln/ 0x00 漏洞概述2015年6月17日seclists网站上公布了Dedecms的一个远程getshell漏洞细节，造成这个漏洞的原因也有些让人玩味。官方已在2015年6月18日发布了修复版本，下载链接：http://www.dedecms.com/products/dedecms/downloads/本篇文章将分析这个漏洞的成因，并给出触发利用方法。0x01...

IBM Security AppScan Standard <= 9.0.2 - OLE Automation Array Remote Code Execution

IBM Security AppScan Standard OLE Automation Array Remote Code Execution Author: Naser Farhadi Linkedin: http://ir.linkedin.com/pub/naser-farhadi/85/b3b/909 Date: 1 June 2015 Version: = 9.0.2 Tested on: Windows 7 Exploit Based on MS14-064 CVE-2014-6332 http://www.exploit-db.com/exploits/35229/ if...

phpdisk Z-core网赚版子程序过滤不严，导致可删除文件.

简要描述： phpdisk Z-core网赚版下载子程序sub过滤不严，导致可删除任意文件. 详细说明： 我们先来看子程序中phpdiskdelprocess.php这个文件相关代码。 parsestrpdencode$str,'DECODE'; 这里直接把传进来的值，解析到变量中了。但是被加密了，看似不可利用，其实不然。我们再来看dl.php。这个是最后下载页。 parsestrpdencodebase64decoderawurldecode$str,'DECODE';...

vSpin Classified System 2004 cat.asp catname Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/21190/info vSpin Classified System is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied data...

PHP 5.3.3 NumberFormatter::getSymbol Integer Overflow

No description provided by source. From: Maksymilian Arciemowicz cxib securityreason com Date: Fri, 10 Dec 2010 14:43:32 +0100 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PHP 5.3.3 NumberFormatter::getSymbol Integer Overflow Author: Maksymilian Arciemowicz http://securityreason.com/...

elkagroup (pid) Remote SQL Injection Vulnerability

No description provided by source. elkagroup pid Remote SQL Injection Vulnerability || Author: Hussin X || Home : WwW.IQ-TY.CoMhttp://WwW.IQ-TY.CoM || email: darkangelg85atYahooDoTcom ||| script : http://www.elkapax.com & http://www.elkagroup.com ||| DorK : Powered by :...

Java storeImageArray() Invalid Array Indexing Vulnerability

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class...

TP-Link TD-W8951ND - Multiple Vulnerabilities

No description provided by source. ----------- Author: ----------- xistence xistenceat0x90.nl ------------------------- Affected products: ------------------------- Tested on TP-Link TD-W8951ND Firmware 4.0.0 Build 120607 Rel.30923 ------------------------- Affected vendors:...

Sharetronix 3.3 - Multiple Vulnerabilities

No description provided by source. Advisory ID: HTB23214 Product: Sharetronix Vendor: Blogtronix, LLC Vulnerable Versions: 3.3 and probably prior Tested Version: 3.3 Advisory Publication: May 7, 2014 without technical details Vendor Notification: May 7, 2014 Vendor Patch: May 27, 2014 Public...

MySpeach <= 3.0.2 (my_ms[root]) Remote File Include Vulnerability

No description provided by source. ============================================================================================== MySpeach = v3.0.2 mymsroot Remote File Inclusion Exploit =============================================================================================== Critical Level...

Apache Tomcat <= 6.0.15 Cookie Quote Handling Remote Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/27706/info Apache Tomcat is prone to an information-disclosure vulnerability because it fails to adequately sanitize user-supplied data. Attackers can exploit this issue to access potentially sensitive data that may aid i...