56796 matches found
WarFTP 1.65 (USER) Remote Buffer Overlow Exploit (multiple targets)
No description provided by source. include stdio.h include string.h include winsock.h define VULNSERVER "WAR-FTPD 1.65" define VULNCMD "x55x53x45x52x20" define ZERO 'x00' define NOP 'x90' define VULNBUFF 485...
Grayscale Blog 0.8.0 (Security Bypass/SQL/XSS) Multiple Remote Vulns
No description provided by source. Security Advisory - Multiple Vulnerabilities in Grayscale Blog 0.8.0 Date : 2007-02-24 Product : Grayscale Blog Version : 0.8.0 - Prior version maybe also be affected Vendor : http://sourceforge.net/projects/gsblogger/ - http://www.karlcore.com/programming/blog/...
Microsoft Windows Print Spooler GetPrinterData拒绝服务漏洞
Microsoft Windows 2000是一款流行的操作系统。 Microsoft Windows spoolss GetPrinterData存在设计错误，远程攻击者可以利用漏洞进行拒绝服务攻击。 问题存在于GetPrinterData函数中，由于存在内存分配错误，可导致系统崩溃，造成拒绝服务攻击。 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000...
Sisfo Kampus文件包含及目录遍历漏洞
Sisfo Kampus是一款系统信息管理系统。 Sisfo Kampus在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 Sisfo Kampus的index.php和print.php脚本没有过滤slnt参数的输入，允许攻击者通过包含本地或外部资源的任意文件导致执行任意代码。 index.php中漏洞代码如下： -------------------------Line 27----------------------------- ?php if $exec=='main.php' &&...
Cisco Secure Desktop多个安全漏洞
Cisco Secure Desktop CSD可以通过加密降低远程用户注销或SSL VPN会话超时后Cookies、浏览器历史记录、临时文件和下载内容在系统上所遗留的风险。 CSD受以下漏洞的影响： 生成的浏览器导致信息泄漏 +-------------------------------------- 如果在创建了SSL VPN会话之后，所自动生成的用于显示主页的Internet浏览器使用了CSD所维护库文件之外目录来储存其会话信息的话，就会出现这个漏洞。这个漏洞还允许用户将在这个Internet浏览会话期间所下载的文件保存到CSD库文件之外，导致在SSL...
xeCMS 1.0.0 RC 2 (cookie) Remote Command Execution Exploit
No description provided by source. !/usr/bin/perl xeCMS 1.0.0 RC 2 Remote Command Execution Exploit Copyright c 2006 cijfer cijfer@netti!fi All rights reserved. never ctrl+c again. cijfer$ http://target.com/dir host changed to 'http://target.com/dir' cijfer$ greets to JagX $Id: cijfer-xecmsxpl.pl...
Windows TCP/IP 拒绝服务漏洞（CVE-2021-24086）
...
Apache Struts2 S2-056(CVE-2018-1327)
Summary A crafted XML request can be used to perform a DoS attack when using the Struts REST plugin | | | | :------------ | :------------ | | Who should read this | All Struts 2 developers and users which are using the REST plugin | | Impact of vulnerability | A DoS attack is possible when using...
Windows Kernel 64-bit pool memory disclosure via REG_RESOURCE_LIST registry values (CmResourceTypeDevicePrivate entries)(CVE-2018-0898)
We have discovered a Windows kernel memory disclosure vulnerability through the body of "AllocConfig" registry values of type REGRESOURCELIST, which can be found under HKLM\SYSTEM\CurrentControlSet\Enum\\Control\AllocConfig. The vulnerability affects 64-bit versions of Windows 7 to 10. The leak...
XXE Zeroday Vulnerability in HP PPM
Intro: XXE Zeroday Vulnerability in HP PPM Researchers at Rhino Security Labs discovered an XXE vulnerability in the way HP Project and Portfolio Management Center HP PPM processed imported tickets. Specifically, an XML external entity injection vulnerability allows an attacker to exploit the...
Multiple vulnerabilities in all versions of ASUS routers
1 ASUSWRT 3.0.0.4.376 - multiple vulnerabilities in httpd server all versions of AsusWRT at the time of report to vendor, for previous 376 version see next section 1. Highly predictable session tokens The session token is generated for an authenticated user using stdlib rand function. The token...
Tplink Bridge Authenticated RCE
Vulnerability: Command Injection in bridge.lua ------------------------------------------ Exploitation: Can remote command execution on the root shell. ------------------------------------------ Vendor of Product: Tp-Link router ------------------------------------------ Affected Products and...
Windows: heap overflow in jscript.dll in Array.sort(CVE-2017-11907)
There is an heap overflow vulnerability in jscript.dll library used in IE, WPAD and other places. The bug affects 2 functions, JsArrayStringHeapSort and JsArrayFunctionHeapSort. PoC for IE note: page heap might be required to obsorve the crash: var vars = new Array100; var arr = new Array1000;...
National Instruments LabVIEW LvVarientUnflatten Code Execution Vulnerability(CVE-2017-2775)
Summary An exploitable memory corruption vulnerability exists in the LvVarientUnflatten functionality of LabVIEW 2016 version 16.0.0.49152. A specially crafted VI file can cause a user controlled value to be used as a loop terminator resulting in internal heap corruption. An attacker controlled V...
FineCMS_5.0.10_XSS#4
No description provided by source...
BigTree CMS - Bypass CSRF filter and execute code with PHPMailer
DESCRIPTION PHPMailer RCE CVE-2016-10033 An independent research uncovered a critical vulnerability in PHPMailer version Sender According to my analysis, if we can control the value of Sender, we can let sendmail save the context to any given path /var/www/html/shell.php, which means code...
FineCMS AttachmentController arbitrary file upload vulnerability
Source link: http://www.hackersb.cn/shenji/170.html Is still AttachmentController, of course, this is no longer kindeditorupload upload the file and then include the file so simple, but directly uploaded the script execution. This time the problem is ajaxswfuploadAction method, the method code is...
ThinkPHP v3.1-3.2 Driver.class.php SQL注入漏洞
No description provided by source...
泛微E-Office /inc/priv_user_list/priv_xml.php SQL注入漏洞
0x01 框架概述 泛微e-office是泛微公司面向中小型组织推出的OA产品,简单易用高效,部署快、投资少。提供免费试用体验。至今已为超过一万家客户提供方便高效的办公体验. 官方主页： www.weaver.com.cn 主页截图如下。 0x02 漏洞信息 先对系统进行解密。 /inc/privuserlist/privxml.php 大概18行开始 $pararr = explodestpar $REQUEST'par' ; $userpriv = $pararr'userpriv'; ... if $pararr'viewtype' == 0 unset $deptnameutf8...
Kirby CMS <= V2.1.0 文件上传漏洞
1.漏洞分析 漏洞程序下载地址： http://download.getkirby.com/files/kirby-2.1.0.zip panel/app/controllers/api/files.php 220行 php ifstrtolower$file-extension == kirby-option'content.file.extension', 'txt' throw new Exception'Content files cannot be uploaded'; else ifstrtolower$file-extension == 'php' or...
某通用型建站系统SQL注射之四
简要描述： 某通用型建站系统SQL注射之四 详细说明： 某通用型建站系统SQL注射之四。 源码：XYCMS教育培训机构网站源码 v5.1 http://down.chinaz.com/soft/30486.htm 注入点：dirurl.asp?id= 可谷歌搜索：inurl:dirurl.asp?id= 实例证明： http://www.nbjbtsyey.com/dirurl.asp?id=12 http://www.zhusiarts.com/dirurl.asp?id=21 http://www.jd19s.com/dirurl.asp?id=23...
phpdisk Z-core网赚版子程序过滤不严，导致可删除文件.
简要描述： phpdisk Z-core网赚版下载子程序sub过滤不严，导致可删除任意文件. 详细说明： 我们先来看子程序中phpdiskdelprocess.php这个文件相关代码。 parsestrpdencode$str,'DECODE'; 这里直接把传进来的值，解析到变量中了。但是被加密了，看似不可利用，其实不然。我们再来看dl.php。这个是最后下载页。 parsestrpdencodebase64decoderawurldecode$str,'DECODE';...
用友CRM注入漏洞（无需登录通杀所有版本）
简要描述： 用友CRM注入漏洞，无需登录，通杀所有版本 详细说明： 漏洞url： http://220.178.27.116:8001/webservice/service.php?class=WSSystem&orgcode=1 使用sqlmap进行注入。 sqlmap.py -u "http://220.178.27.116:8001/webservice/service.php?class=WSSystem&orgcode=1" --current-user --current-db --is-dba sqlmap identified the following injectio...
WMAPM 3.1 Privilege Escalation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8995/info wmapm has been reported prone to a local privilege escalation vulnerability. The vulnerability has been conjectured to result from a lack of relative path usage while the vulnerable dock app is invoking a third...
Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution
No description provided by source. $Id: alcatelomnipcxmastercgiexec.rb 10556 2010-10-05 23:13:04Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing...
Sharetronix 3.3 - Multiple Vulnerabilities
No description provided by source. Advisory ID: HTB23214 Product: Sharetronix Vendor: Blogtronix, LLC Vulnerable Versions: 3.3 and probably prior Tested Version: 3.3 Advisory Publication: May 7, 2014 without technical details Vendor Notification: May 7, 2014 Vendor Patch: May 27, 2014 Public...
Yamamah 1.0 - SQL Injection Vulnerability
No description provided by source. Exploit Title: Yamamah 1.0 SQL Injection Vulnerability Date: 12/06/2010 Author: TheMaStEr [email protected] Software Link: http://www.yamamah.org/ Version: 1.00 Tested on: Windows SP3 Dork: intext:Powered By : Yamamah Version 1.00 Code :...
Sunbird 0.9 - Array Overrun (code execution) 0day
No description provided by source. full disclosure: http://seclists.org/fulldisclosure/2009/Dec/253 Sunbird 0.9 Array Overrun code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - Dis.: 07.05.2009 - Pub.: 11.12.2009 CVE: CVE-2009-0689 CWE: CWE-199 Risk: High...
PNphpBB2 <= 1.2g - (phpbb_root_path) Remote File Include Vulnerability
No description provided by source. Yeah, another ZeroDay Smile Vendor: http://www.pnphpbb.com/ Vulnerable File: includes/functionsadmin.php Vulnerable Code: //The phpbbrootpath isn't initialize includeonce $phpbbrootpath . 'includes/functions.' . $phpEx ; Method To Use:...
Apache Tomcat 5.5.25 - CSRF Vulnerabilities
No description provided by source. +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Apache Tomcat 5.5.25 CSRF Vulnerabilities Date : 10-24-2013 Author : Ivano Binetti http://ivanobinetti.com Author :...
php 5.3.8 - Multiple Vulnerabilities
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PHP 5.3.8 Multiple vulnerabilities Author: Maksymilian Arciemowicz Website: http://cxsecurity.com/ Date: 14.01.2012 CVE: CVE-2011-4153 zendstrndup Original link: http://cxsecurity.com/research/103 --- 1. Multiple NUL...
elkagroup (pid) Remote SQL Injection Vulnerability
No description provided by source. elkagroup pid Remote SQL Injection Vulnerability || Author: Hussin X || Home : WwW.IQ-TY.CoMhttp://WwW.IQ-TY.CoM || email: darkangelg85atYahooDoTcom ||| script : http://www.elkapax.com & http://www.elkagroup.com ||| DorK : Powered by :...
Crossday Discuz! 2.0/3.0 Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9584/info It has been reported that Discuz! is prone to an Cross Site Scripting vulnerability. This issue is caused by the application failing to properly sanitize links embedded within user messages. Upon successful...
Wordpress TimThumb 2.8.13 WebShot - Remote Code Execution (0-day)
No description provided by source...
Discuz3.2后台文件包含漏洞可后台拿shell
简要描述： 最新版本：Discuz! X3.2 Release 20140618 包括以前版本 详细说明： 由于创建专题时未对 静态化名称 做任何限制引发此漏洞 1.全局-站点信息 网站 URL: http://www.comsenz.com/ 2.工具-更新缓存 3.门户-HTML管理 静态文件扩展名: htm 专题HTML存放目录:data/cache 4.创建专题 静态化名称此处未做任何限制：../../template/default/portal/portaltopictest 5.专题管理 对刚添加的专题 开启 并生成 img...
SiteServer 3.6.4 /SiteServer/cms/console_user.aspx SQL注入漏洞
No description provided by source...
XTCMS /manage/download.aspx 任意文件下载漏洞
No description provided by source...
南京大汉某系统存在越权及任意文件上传漏洞
简要描述： 呵呵 详细说明： 大汉的VC系统。 官网介绍应该是这个吧：http://hanweb.com/col/col41/index.html 存在一处越权及一处getshell漏洞（最好结合使用） 漏洞证明： 直接访问： http://www.zjdlr.gov.cn/vc/setup/oprsetting.jsp 此时管理员admin的密码已经被清空，系统某些信息被重置。 直接admin/空密码 登录 版本号 2.1.9u13 上传license文件那直接改后缀： http://www.zjdlr.gov.cn/vc/jsp.jspx 虽然编译出错，但是已经显示有test by...
用友某办公自动化平台漏洞之1-未授权访问导致目录漏洞
简要描述： 文件上传页面没做权限控制，未对用户传递的目录进行过滤，导致../跳转上级目录 详细说明： 无意间看到这个平台 FE协作办公平台 测试版本：5.2.1 版本大于5.2.1未受影响 ，小于5.2.1的版本未测 在网上用百度找了一下 直接访问/system/mediafile/templateOfTaohongmanager.jsp?path=/../../../ 可以通过../跳转目录，导致敏感信息泄露 漏洞证明： 无意间看到这个平台 FE协作办公平台 测试版本：5.2.1 版本大于5.2.1未受影响 ，小于5.2.1的版本未测 在网上用百度找了一下...
Linux Kernel 'mac80211/sta_info.c'空指针引用拒绝服务漏洞
Bugtraq ID:66591 CVE ID:CVE-2014-2706 Linux Kernel是一款开源的操作系统。 支持Generic IEEE 802.11网络栈的Linux Kernel 'mac80211/stainfo.c'在处理TX路径和STA唤醒存在竞争条件漏洞，允许攻击者利用漏洞进行拒绝服务攻击，使内核崩溃。 0 Linux Kernel 目前厂商已经发布了升级补丁以修复漏洞，请下载使用：...
Linux Kernel "rds_ib_laddr_check()"空指针引用漏洞
CVE ID:CVE-2013-7339 Linux Kernel是一款开源的操作系统。 Linux Kernel "rdsibladdrcheck"函数net/rds/ib.c存在一个空指针引用错误，允许本地攻击者利用漏洞使内核崩溃，造成拒绝服务攻击。 0 Linux Kernel 2.6.32.61 用户可参考厂商的GIT库以获得补丁修复此漏洞： https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c2349758acf1874e4c2b93fe41d072336f1a31d0...
IBM Algo One Algo多个安全漏洞
CVE ID:CVE-2013-6299、CVE-2013-6300、CVE-2013-6301、CVE-2013-6302、CVE-2013-6303、CVE-2013-6318、CVE-2013-6319、CVE-2013-6320、CVE-2013-6331、CVE-2013-6333 IBM Algo One是一个风险管理软件解决方案。 IBM Algo One存在多个安全漏洞： 1，应用程序不正确校验用户权限，允许攻击者利用漏洞获取受限内容。 2，存在多个跨站脚本漏洞，允许攻击者构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。...
Apple Mac OS X多个安全漏洞(APPLE-SA-2014-02-25-1)
BUGTRAQ ID: 65777 CVECAN ID: CVE-2014-1254,CVE-2014-1262,CVE-2014-1255,CVE-2014-1256,CVE-2014-1257,CVE-2014-1258,CVE-2014-1261,CVE-2014-1263,CVE-2014-1265,CVE-2014-1259,CVE-2014-1264,CVE-2014-1260,CVE-2014-1246,CVE-2014-1247,CVE-2014-1248,CVE-2014-1249,CVE-2014-1250,CVE-2014-1245 OS X（前称Mac OS...
Symantec Endpoint Protection Manager本地SQL注入漏洞(CVE-2013-5015)
BUGTRAQ ID: 65467 CVECAN ID: CVE-2013-5015 Symantec Endpoint Protection SEP是反病毒和防火墙产品。 Symantec Endpoint Protection Manager 11.0、Symantec Endpoint Protection Center Small Business Edition 12.0、Symantec Endpoint Protection Manager 12.1版本没有有效过滤数据库的本地请求，恶意本地用户可利用此漏洞注入任意SQL数据库查询。 0 Symantec Web Gatew...
ECSHOP 后台getshell
简要描述： ECSHOP 后台getshell 详细说明： admin/order.php elseif $REQUEST'act' == 'edittemplates' / 更新模板文件的内容 / $filename = @fopen'../' . DATADIR . '/orderprint.html', 'w+'; //写出模板，，只要有一个调用模板就可以getshell了 echo '../' . DATADIR . '/orderprint.html'; echo stripslashes$POST'FCKeditor1'; @fwrite$filename,...
Microsoft Windows ASLR安全绕过漏洞(CVE-2013-2556)
BUGTRAQ ID: 58566 CVECAN ID: CVE-2013-2556 Microsoft Windows是微软公司推出的一系列操作系统。 Microsoft Windows 7内存在不明细节漏洞，可允许攻击者绕过ASLR保护机制。 0 Microsoft Windows 7 厂商补丁： Microsoft --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.microsoft.com/windows/ie/default.asp...
nginx 中间人攻击漏洞(CVE-2011-4968)
Bugtraq ID:57139 CVE ID:CVE-2011-4968 nginx是一款高性能的web服务器，使用非常广泛，其不仅经常被用作反向代理，也可以非常好的支持PHP的运行 nginx包含的Http代理模块允许通过https与源服务器通信，但是没有正确校验源服务器身份，允许攻击者在代理和源服务器之间进行中间人攻击 0 Igor Sysoev nginx 0.8.40 Igor Sysoev nginx 0.8.36 Igor Sysoev nginx 0.8.35 Igor Sysoev nginx 0.8.33 Igor Sysoev nginx 0.7.66 Igor...
Google Chrome 18.0.1025.142之前版本多个内存破坏漏洞
BUGTRAQ ID: 52762 CVE ID: CVE-2011-3058,CVE-2011-3059,CVE-2011-3060,CVE-2011-3061,CVE-2011-3062,CVE-2011-3063,CVE-2011-3064,CVE-2011-3065 Google Chrome是由Google开发的一款设计简单、高效的Web浏览工具。 Google Chrome 18.0.1025.142之前版本在实现上存在多个安全漏洞，攻击者可利用这些漏洞执行任意代码、绕过安全限制、执行跨站脚本执行攻击。 0 Google Chrome 18.0.1025.142 厂商补丁：...
PHP ‘tidy_diagnose’函数拒绝服务漏洞
CVE-2012-0781 PHP是一款免费开放源代码的WEB脚本语言包，可使用在Microsoft Windows、Linux和Unix操作系统下。 PHP 5.3.8版本中的tidydiagnose函数中存在漏洞。远程攻击者可利用该漏洞借助对应用程序的特制输入，造成拒绝服务（空指针解引用进而应用程序崩溃），该应用程序试图在无效对象上执行Tidy::diagnose操作。 0 php:5.3.8 目前厂商还没有提供此漏洞的相关补丁或者升级程序，建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://us.php.net/sites.php -----BEGIN PGP...
phpMyAdmin3 remote code execute exploit [Not jilei(chicken\'s ribs)]
No description provided by source. !/usr/bin/php ?php printr' +---------------------------------------------------------------------------+ pma3 - phpMyAdmin3 remote code execute exploit Not jileichicken's ribs by oldjunwww.oldjun.com welcome to www.t00ls.net mail: [email protected] Assigned CVE...