56796 matches found
Foscam IP Video Camera webService 9299.org DDNS Client Code Execution Vulnerability(CVE-2017-2857)
Summary An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating...
Libarchive zip zip_read_mac_metadata Code Execution Vulnerability(CVE-2016-1541)
SUMMARY An exploitable heap overflow vulnerability exists in the zip archive decompression functionality of libarchive. A specially crafted zip file can cause memory corruption leading to code execution. An attacker can send a malformed file to trigger this vulnerability. TESTED VERSIONS libarchi...
HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability(CVE-2016-4332)
Description HDF5 is a file format that is maintained by a non-profit organization, The HDF Group. HDF5 is designed to be used for storage and organization of large amounts of scientific data and is used to exchange data structures between applications in industries such as the GIS industry via...
Adobe Acrobat Reader DC jpeg decoder Remote Code Execution Vulnerability(CVE-2017-2971)
Summary A use of uninitialized memory vulnerability exists in JPEG image file format decoding code of Adobe Acrobat Reader which ultimately leads to a heap-based buffer overflow which can be abused to achieve remote code execution. A specially crafted PDF file with an embedded JPEG can trigger th...
Google Android Broadcom Wi-fi Driver Information Disclosure Vulnerability(CVE-2017-0633)
An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious component to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10,...
Roundcube mail body of the stored cross site Vulnerability(CVE-2017-6820)
Author: Badcode, sebao know Chong Yu 404 security lab Date: 2017-03-17 0x00 vulnerability overview 1. Vulnerability description Roundcube is a widely used open source e-mail program, in the globe there are many organizations and companies are in use. On the server to successfully install...
Safari the showModalDialog method UXSS vulnerability
This article translated from: http://mksben.l0.cm/2016/09/safari-uxss-showModalDialog.html （English version） http://masatokinugawa.l0.cm/2016/09/safari-uxss-showModalDialog.html （Japanese version） Author：Masato Kinugawa Translator: Holic know Chong Yu 404 security lab Translator's note: as the...
D-Link DI 7200系列路由器命令执行漏洞
No description provided by source...
D-Link DSR-250N路由器登录绕过
No description provided by source...
FFmpeg 2.x版本服务器端请求伪造漏洞
详情来源 ：ffmpeg SSRF漏洞分析 ffmpeg得反应很快，1月16日就发布了修复版本。 漏洞影响 如果ffmpeg解析了一个恶意的文件，会导致本地的文件信息泄露。受影响的出了ctf中这个在线视频格式转换的服务外，如果是采用ffmpeg了客户端如果可以输入恶意文件也会造成本地文件信息泄露。 漏洞分析 change log中提到了两个CVE CVE-2016-1897和CVE-2016-1898。 CVE-2016-1897 FFmpeg 2.x版本允许攻击者通过服务器端请求伪造SSRF：Server-Side Request Forgery...
KesionCMS ASP版 /item/?c-5,key-1.html SQL注入漏洞
0x01漏洞简介 KesionCMS ASP版在/item/?c-5,key-1.html存在伪静态注入漏洞。 0x02漏洞详情 很明显的一处注入；但是好像需要闭合，先提交了证明下注入 http://.../item/?c-5,key-1%27.html Microsoft JET Database Engine 错误 '80040e14' 语法错误 在查询表达式 'Verific=1 and deltf=0 And Title Like '%1'%' Order by ID Desc' 中。 /item/Index.asp，行 618 0x03修复方案 过滤。...
万户 ezEIP 4.0系统 hit.aspx 参数 f POST注入
No description provided by source...
espcms最新版V6.4.15.08.25任意用户登录漏洞
No description provided by source...
正方教务系统 ResultXml_common.aspx 文件 column 参数SQL注入漏洞
No description provided by source...
OpenSSLX509Certificate 反序列化漏洞
文章作者：没羽@阿里移动安全 来源: http://drops.wooyun.org/papers/10235 序 ---- 序列化 Serialization，是将对象的状态信息转换为可以存储或传输的形式的过程。在序列化期间，对象将其当前状态写入到临时或持久性存储区。使用者可以通过从存储区中读取或反序列化对象的状态，重新创建该对象。...
TRSWCM 文件读取漏洞通杀较新版本（二）
简要描述： 貌似是后续更新的时候添加的一个功能，通杀较新版本。 详细说明： 其实还是XML实体注入，不过这次是用的DOM解析XML。 web.xml中配置的Servlet ReceiveMASServlet： ReceiveMASServlet com.trs.components.video.ReceiveMASServlet ReceiveMASServlet /app/video/ReceiveMASServlet 对应的com/trscomponents/video/ReceiveMASServlet.java代码如下： protected void...
Hewlett-Packard UCMDB - JMX-Console Authentication Bypass
CVE-ID: CVE-2014-7883Affected versions: UCMDB 10.10 Other versions might also be affected The HP Universal CMDB UCMDB automatically collects and manages accurate andcurrent business service definitions, associated infrastructure relationships anddetailed information on the assets, and is a centra...
某大型政府系统任意文件读取及Oracle注入
简要描述： 某大型政府系统任意文件读取及Oracle注入 详细说明： 这系统有人提交过，详情： WooYun: 某大型政府服务系统Oracle注入使用量大 文件读取（获取数据库用户、密码等）： /download?url=../../WEB-INF/classes/wssp/util/dbconfig.properties http://hxasc.cn/download?url=../../WEB-INF/classes/wssp/util/dbconfig.properties...
致远公司某QQ邮箱泄漏导致公司内部人员联系方式信息泄漏（包含手机，QQ，邮箱等）
简要描述： 致远公司某QQ邮箱泄漏导致公司内部人员联系方式信息泄漏（包含手机，QQ，邮箱等） 详细说明： 为什么取这个名字呢 事情还要从这说起 WooYun: 都都宝某系统弱口令涉及公司内部个人信息 由于都都宝的OA不善 导致里面的配置邮箱帐号以及泄漏 后确认是致远内部人员的 而这两天没事又试试看 结果还可以登 这里顺便吐槽一句都都宝 这个弱口令漏洞 都提交了 你们还不修复啊？刚登了下 人还不少 邮箱帐号：[email protected] 密码：lee841126 登录进这个邮箱后··· https://images.seebug...
金蝶政务GSiS服务平台通用任意文件上传漏洞
简要描述： 参照下前人的描述：GSiS政务服务平台：首个完全根据国家政策要求全新开发的，支撑政务服务体系和行政权力监督体系融合运转的一体化平台。 存在任意文件上传漏洞，可获取webshell PS：两$$符啥感觉，给一个爽爽吧 详细说明： 程序名称：Kingdee GSIS 开发公司：金蝶 漏洞类型：任意文件上传 漏洞文件：/corehttps://images.seebug.org/upload/upload.jsp 关键词：inurl:/kdgs/ 收集几个案例，方便测试 //判断上传格式 String fileDesc; String fileExt; String...
Bash - CGI RCE (MSF) Shellshock Exploit
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...
帝国CMS（全版） 验证码可无视！可导致验证码无效（验证码识别都是渣渣）
简要描述： 帝国CMS 验证码可无视！可导致验证码无效（验证码识别都是渣渣） 详细说明： 看帝国 获取验证码的代码 //显示验证码 function ShowKey$v $vname=ecmsReturnKeyVarname$v; $key=strtolowerdomakepassword4; ecmsSetShowKey$vname,$key; .................. ecmsReturnKeyVarname 是返回保存验证码的cookie的名称 比如本列打开的页面上注册页面的验证码 url 是...
某教育类通用cms任意文件下载漏洞
简要描述： 某教育类通用cms任意文件下载漏洞 详细说明： 不知道算不算通用 可下载web.config文件，数据库信息文件泄露 http://sbc.xzit.edu.cn/hxjc/DownLoad.aspx?Accessory=../web.config http://hedds.njutcm.edu.cn/DownLoad.aspx?Accessory=../web.config http://www.emcjs.org/DownLoad.aspx?Accessory=../web.config...
方维团购 4.3 /app/source/goods_list.php SQL注入漏洞
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = 'SSV-87131' vul ID version = '1' author = 'fenghh' vulDate = '2014-07-11' createDate =...
Destoon前台getshell(CSRF任意代码执行)
简要描述： 测试版本 DESTOON B2B Version 5.0 Release 20140625 UTF-8 ZH-CN 详细说明： 0.问题文件 admin/tag.inc.php 95行 eval$tagcode; 未对用户提交的执行代码tagcode做安全限制 1.前台注册会员 2.进入会员中心，发布一条求购信息 信息标题：随意 行业分类：随意 产品图片：通过审查元素，修改 postthumb 的value为...
TinyWebGallery 1.8.3 - Multiple Vulnerabilities
No description provided by source. Date: 01/02/2011 dd/MM/yyyy Script: TinyWebGallery Version: 1.8.3 No fixes yet, might work on other versions too. Home: http://www.tinywebgallery.com -- Vulnerability: Non-persistent XSS Where: File: /admin/index.php Parameters: sview, tview, dir, item. Examples...
Apache Tomcat 5.5.25 - CSRF Vulnerabilities
No description provided by source. +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Apache Tomcat 5.5.25 CSRF Vulnerabilities Date : 10-24-2013 Author : Ivano Binetti http://ivanobinetti.com Author :...
Sun Java Web Server 1.1 Beta Viewable .jhtml Source Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1891/info A vulnerability exists in Sun Microsystems' JavaWebServer for Win32, version 1.1Beta. JavaWebServer is a Java-oriented web application development platform. If a URL is submitted requesting a .jhtml file an HTML...
PHP-Fusion 7.02.05 - Multiple Vulnerabilities
No description provided by source. waraxe-2013-SA097 - Multiple Vulnerabilities in PHP-Fusion 7.02.05 =============================================================================== Author: Janek Vind waraxe Date: 27. February 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-97.ht...
Siemens SIMATIC WinCC Flexible (Runtime) Multiple Vulnerabilities
No description provided by source. Luigi Auriemma Application: Siemens SIMATIC WinCC flexible Runtime http://www.automation.siemens.com/mcms/human-machine-interface/en/visualization-software/wincc-flexible/wincc-flexible-runtime/Pages/Default.aspx Versions: 2008 SP2 + security patch 1 Platforms:...
SmartWin CyberOffice Shopping Cart 2.0 Client Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1734/info Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for e-commerce enabled websites running Windows NT 4.0 or 2000. It is possible for a remote user to gain read access to the private...
SpamAssassin spamd Remote Command Execution
No description provided by source. $Id: spamassassinexec.rb 9179 2010-04-30 08:40:19Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of...
DUportal Pro 3.4 cat.asp Multiple Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/13285/info DUportal Pro is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacke...
Nginx HTTP Server 1.3.9-1.4.0 - Chuncked Encoding Stack Buffer Overflow
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit4...
Factux LFI Vulnerability
No description provided by source. InformatioN Title : Factux LFI Vulnerability Author: altbta l9athotmail.com download : http://www.toocharger.com/telecharger/scripts/factux/3468.htm ExploiT dork: Factux le facturier libre V 1.1.5 includeonceinclude/language/$lang.php; Vulnerable File :...
MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2013-019: Multiple Vulnerabilities in MiCasaVerde VeraLite Published: 08/01/13 Version: 1.0 Vendor: MiCasaVerde http://www.micasaverde.com/ Product: VeraLite Version affected: 1.5.408 Product description: The MiCasaVerd...
ProductCart 1.x/2.x advSearch_h.asp Multiple Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/9669/info EarlyImpact ProductCart is reportedly prone to multiple vulnerabilities. The specific issues include SQL injection, cross-site scripting and cryptographic weaknesses. These issues could expose sensitive data suc...
XYCMS心理咨询中心建站系统存在SQL注入
简要描述： 。。。 详细说明： 下载地址:http://down.chinaz.com/soft/34989.htm 漏洞存在于: pxxmdetail.asp id=request.QueryString"id" set rs=server.createobject"adodb.recordset" exec="select from pxxm where id="& id rs.open exec,conn,1,1 if rs.eof then response.Write "没有相关信息！" response.End end if 未加入过滤代码导致注入产生 漏洞证明： 关键字:...
Srun3000计费系统无限制多处任意命令执行getshell
简要描述： Srun3000计费系统无限制任意命令执行getshell 详细说明： 文件： /enus/radonline.php srun3/web/online.php 4-76行 srun3/web/radonline.php 4-76行 if$POST"action"=="dm" $cmd = "/srun3/bin/raddrop -sdm ".$POST"sid"; if$fp=popen$cmd, "r" $con = fread$fp, 128; pclose$fp; $con = strreplace "\n", " ", $con; echo $con; exit;...
Qemu virtio-net "virtio_net_handle_mac()"整数溢出漏洞
CVE ID:CVE-2014-0150 QEMU是一款面向完整PC系统的开源仿真器。 QEMU "virtionethandlemac"函数hw/net/virtio-net.c存在整数溢出错误，允许本地攻击者利用漏洞使系统崩溃，造成拒绝服务攻击。 0 Qemu 1.x Qemu 0.x 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://thread.gmane.org/gmane.comp.emulators.qemu/266713...
OpenSSL ECDSA Nonces恢复漏洞
CVE ID:CVE-2014-0076 OpenSSL是一款开放源码的SSL实现，用来实现网络通信的高强度加密。 OpenSSL椭圆曲线签名与校验ECDSA实现存在错误，允许攻击者通过FLUSH+RELOAD缓存边道攻击来获取nonce值并之后得出私钥。 0 OpenSSL 1.x 用户可参考厂商的GIT库以获得补丁修复此漏洞： http://www.openssl.org/...
Linux Kernel "rds_ib_laddr_check()"空指针引用漏洞
CVE ID:CVE-2013-7339 Linux Kernel是一款开源的操作系统。 Linux Kernel "rdsibladdrcheck"函数net/rds/ib.c存在一个空指针引用错误，允许本地攻击者利用漏洞使内核崩溃，造成拒绝服务攻击。 0 Linux Kernel 2.6.32.61 用户可参考厂商的GIT库以获得补丁修复此漏洞： https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c2349758acf1874e4c2b93fe41d072336f1a31d0...
Unzipper目录遍历漏洞
Bugtraq ID:66250 CVE ID:CVE-2014-1975 Unzipper是一款基于PHP的在线解压应用。 Unzipper处理文件名存在目录遍历漏洞，允许远程攻击者可创建任意文件或覆盖已存在的文件。 0 Unzipper 1.0.1 用户可联系厂商获得最新的补丁或升级程序： https://play.google.com/store/apps/details?id=org.rhorita777.unzipper...
Apache Tomcat会话固定漏洞
Bugtraq ID:65769 CVE ID:CVE-2014-0033 Apache Tomcat是一款开放源码的JSP应用服务器程序。 由于对路径参数处理的修复引入的回溯，即使在启用disableURLRewriting的情况下也可导致一个会话固定攻击，允许远程攻击者利用漏洞未授权访问应用。 0 Apache Tomcat 6.0.0 - 6.0.37 厂商补丁： Apache ----- Apache Tomcat 6.0.39已经修复该漏洞，建议用户下载更新： http://tomcat.apache.org/...
IBM Rational Focal Point未明多个安全漏洞
CVE ID:CVE-2014-0839、CVE-2014-0840、CVE-2014-0842、CVE-2014-0843、CVE-2014-0853 IBM Rational Focal Point是IBM Rational基于Web的产品管理系统，内置了面向客户和市场的产品管理流程，提供产品管理过程中的工作流自动化、信息相关性分析、信息统计分析以及信息的优先级分析功能。 IBM Rational Focal Point存在多个安全漏洞： 1，不正确过滤部分用户输入，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。...
Linksys系列未明远程代码执行漏洞
No description provided by source. !/usr/bin/php ?php / Exploit for 0day linksys unauthenticated remote code execution vulnerability. As exploited by TheMoon worm; Discovered in the wild on Feb 13, 2013 by Johannes Ullrich. I was hoping this would stay under-wraps until a firmware patch could be...
建站之星任意文件上传漏洞(续二)
简要描述： 建站之星任意文件上传漏洞续二 详细说明： 1 漏洞产生 /module/modmedia.php flashpicker 和 imagepicker 两个函数 imagepicker 函数 None 访问upload.php并上传文件,上传的时候用Burpsuite 抓包 并修改 点击Forward即可在 https://images.seebug.org/upload/flash 下面生成php文件...
Appotech AX211 / AX215 8-bit SD卡控制器固件升级机制代码执行漏洞
Appotech AX211 / AX215是微型控制器设备。 Appotech AX211 / AX215 8位SD卡控制器在固件升级机制中存在安全漏洞，攻击者发送'knock'指令CMD63后跟'A', 'P', 'P', 'O'，就会让控制器进入固件加载模式，可物理访问内存卡的攻击者可在卡上执行任意指令。 0 Appotech AX211 Appotech AX215 目前没有详细解决方案提供： hhttp://www.appotech.com/dp/...
TRS身份认证系统任意文件读取漏洞+信息泄露
简要描述： @Finger 说让我提交成通用漏洞·····我就提交了 虽然可能该漏洞不能直接对系统造成危害，但是如果已经获取到内网某台服务器的shell，通过该漏洞读取数据库配置文件，然后连到数据库查看trs或其他用户的密码，危害甚大。 详细说明： trs ids 系统存在任意文件读取和信息泄露漏洞 具体文件路径在admin/debug/目录下，读取文件为fv.jsp，信息泄露为env.jsp等 google http://203.208.46.145/newwindow=1&q=intitle:trs身份&start=60...
ShopEx v4.8.5 Cookie数据远程SQL注入漏洞
ShopEx是在国内非常流行的网上商店平台软件。 ShopEx v4.8.5版本在处理某些Cookie的数据时存在输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击，从而控制应用系统。 0 shopex 4.8.5 厂商补丁： shopex ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.shopex.cn...