56796 matches found
Adobe Flash Player和AIR远程整数溢出漏洞(CVE-2012-5677)
BUGTRAQ ID: 56896 CVECAN ID: CVE-2012-5677 Adobe Flash Player是一个集成的多媒体播放器。AIR是针对网络与桌面应用的结合所开发出来的技术，可以不必经由浏览器而对网络上的云端程式做控制。 Adobe Flash Player和AIR在实现上存在整数溢出漏洞，攻击者可利用此漏洞在受影响应用内执行任意代码。 0 Adobe Flash Player 11.2.202.235 Adobe AIR = 3.2.0.2080 厂商补丁： Adobe ----- Adobe已经为此发布了一个安全公告（APSB12-27）以及相应补丁:...
Linux Kernel Regsets 空指针引用本地拒绝服务漏洞(CVE-2012-1097)
Bugtraq ID: 52274 CVE ID：CVE-2012-1097 Linux是一款开放源代码的操作系统 Linux存在一个空指针引用条件，本地攻击者可以利用漏洞使内核崩溃，进行拒绝服务攻击。 0 Linux kernel 3.x Linux kernel 2.6.x 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息： http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c8e252586f8d5de906385d8cf6385fee289a825e...
Apache Tomcat Large Number Denial Of Service
No description provided by source. CVE-2012-0022 Apache Tomcat Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.22 - Tomcat 6.0.0 to 6.0.33 - Tomcat 5.5.0 to 5.5.34 - Earlier, unsupported versions may also be affected Descriptio...
Linux Kernel "ib_uverbs_poll_cq()"整数溢出漏洞
BUGTRAQ ID: 46073 CVE ID: CVE-2010-4649 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的"ibuverbspollcq"在实现上存在整数溢出漏洞，攻击者可利用此漏洞以提升的权限执行任意代码，使受影响内核崩溃，拒绝服务合法用户。 如果用户空间计入较大的cmd.ne，ibuverbspollcq代码会出现整数溢出。对kmalloc的调用将分配较小的缓冲区，导致内存破坏。如果没有使用完resp，也会造成信息泄露。虽然目前仅存在使用此函数的RDMA设备，无权限用户空间也将调用此函数。 Debian Linux...
Linux Kernel CIFS实现CIFSSMBWrite()函数拒绝服务漏洞
BUGTRAQ ID: 42242 CVE ID: CVE-2010-2248 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel CIFS实现的CIFSSMBWrite函数中存在漏洞，远程攻击者可以通过向目标CIFS客户端发送特制的SMB响应报文导致内核忙碌拒绝服务。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
K-Meleon 1.5.3 Remote Array Overrun
No description provided by source. From Full Disclosure: http://seclists.org/fulldisclosure/2009/Nov/222 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 K-Meleon 1.5.3 Remote Array Overrun Arbitrary code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - - Dis.:...
Oracle Outside In多个缓冲区溢出漏洞
Bugraq ID: 34994 CVE ID：CVE-2009-1009 CVE-2009-1010 CVE-2009-1011 CNCVE ID：CNCVE-20091009 CNCVE-20091010 CNCVE-20091011 Oracle Outside In是一款软件开发工具包套件SDK，为开发人员提供了一个访问、转换和控制 400 多种非结构化文件格式的内容的综合解决方案。 Oracle Outside In存在多个缓冲区溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 -处理Microsoft...
ClamAV UPack拒绝服务和cli_url_canon()栈溢出漏洞
BUGTRAQ ID: 34446 CVECAN ID: CVE-2009-1371,CVE-2009-1372 Clam AntiVirus是Unix的GPL杀毒工具包，很多邮件网关产品都在使用。 ClamAV的libclamav/phishcheck.c文件中的cliurlcanon函数存在栈溢出漏洞，远程攻击者可以通过提交恶意的URL来触发这个溢出，导致执行任意代码。 如果用户使用ClamAV扫描到了UPack编码的畸形文件的话，libclamav/others.h文件的CLIISCONTAINED宏中的安全漏洞可能导致应用程序崩溃。 ClamAV 0.95.1 ClamAV...
Microsoft Windows NTLM凭据反射远程代码执行漏洞（MS09-013/MS09-014）
BUGTRAQ ID: 34439 CVECAN ID: CVE-2009-0550 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的HTTP服务没有正确地实现NTLM凭据反射保护以确保用户的凭据没有被反射和使用。如果用户连接到了攻击者的WEB服务器，Windows HTTP服务处理NTLM凭据的方式存允许攻击者重放用户凭据并以登录用户的权限执行任意代码。如果用户使用管理用户权限登录，成功利用此漏洞的攻击者便可完全控制受影响的系统。 Microsoft Internet Explorer 7.0 Microsoft Internet Explorer...
FCKeditor connector.php任意文件上传漏洞
BUGTRAQ ID: 31812 CVECAN ID: CVE-2008-6178 FCKeditor是一款开放源码的HTML文本编辑器。 FCKeditor的editor/filemanager/browser/default/connectors/php/connector.php模块中存在文件上传限制漏洞： 147. function FileUpload $resourceType, $currentFolder 148. 149. $sErrorNumber = '0' ; 150. $sFileName = '' ; 151. 152. if isset...
Microsoft Office畸形EPS/PICT过滤器远程代码执行漏洞（MS08-044）
BUGTRAQ ID: 30595,30597 CVECAN ID: CVE-2008-3019,CVE-2008-3018 Microsoft Office是非常流行的办公软件套件。 Microsoft Office过滤器处理畸形图像的方式中存在远程执行代码漏洞，攻击者可以通过构建特制封装的PostScript（EPS）或PICT文件来利用此漏洞。如果用户使用Office应用程序打开该文件，可能允许远程执行代码。此类特制文件可能包括在电子邮件附件中，或者宿主在恶意网站或受危害网站上。成功利用此漏洞的攻击者可以完全控制受影响的系统。不过，要利用此漏洞，需要进行大量用户交互。...
SNMPv3 HMAC validation error Remote Authentication Bypass Exploit
No description provided by source. snmpv3exp.sh exploit the vulnerability described in CVE-2008-0960, the HMAC check problem on multiple vendor Copyright c 2008 @ Mediaservice.net Srl. All rights reserved Wrote by Maurizio Agazzini inodeatmediaservice.net http://lab.mediaservice.net/...
ASG-Sentry 7.0.0存在多个漏洞
BUGTRAQ ID: 28188 CNCAN ID:CNCAN-2008031104 ASG-Sentry是一款网关管理软件。 ASG-Sentry存在多个安全问题，远程攻击者可以利用漏洞进行拒绝服务和任意代码执行攻击。 - fcheck.exe CGI -b选项处理存在问题，可导致任意文件删除。 - FxAgent进程处理包含超长community字段的SNMP请求时存在堆溢出问题。 - FxIAList不正确验证"exit"命令，任何用户可执行此命令使服务退出。 - FxIAList拷贝数据到缓冲区时存在缓冲区溢出。 ASG-Sentry 7.0 目前没有解决方案提供：...
SAP MaxDB cons.exe远程命令注入漏洞
BUGTRAQ ID: 27206 MaxDB是SAP应用中广泛使用的数据库管理系统。 MaxDB在处理用户请求数据时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 如果未经认证的远程攻击者执行了show或execsdbinfo等特殊命令的话，MaxDB服务器就会通过system执行cons.exe DATABASE COMMAND，而使用system执行cons程序允许外部攻击者通过传送&&或其他方式在服务器上执行任意命令。例如，可使用以下SAP命令查看Windows上C盘的内容： execsdbinfo && echo dir c:\ | cmd.exe SAP...
OpenSSL DTLS远程堆溢出漏洞
BUGTRAQ ID: 26055 CVECAN ID: CVE-2007-4995 OpenSSL是一种开放源码的SSL实现，用来实现网络通信的高强度加密，现在被广泛地用于各种网络应用程序中。 OpenSSL的DTLS支持中存在漏洞，攻击者可以创建能够触发堆溢出的恶意客户端或服务器，导致执行任意指令。 请注意这个漏洞仅影响使用DTLS的应用程序。 OpenSSL Project OpenSSL 0.9.8f OpenSSL Project OpenSSL 0.9.8 RedHat Linux 5.0 OpenSSL Project ---------------...
TotalCalendar <= 2.402 (view_event.php) Remote SQL Injection Vulns
No description provided by source. --==+================================================================================+==--br / --==+ TotalCalendar 2.402 SQL Injection Vulnerability +==--br /...
elkagroup Image Gallery 1.0 Remote SQL Injection Vulnerability
No description provided by source. --==+================================================================================+==-- --==+ Image Gallery 1.0 SQL Injection Vulnerbilitys +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xpr...
Mbedthis AppWeb HTTP TRACE信息泄露漏洞
Mbedthis AppWeb是一款WEB应用服务程序。 Mbedthis AppWeb处理HTTP TRACE请求存在问题，远程攻击者可以利用漏洞获得敏感信息。 目前没有详细漏洞细节提供。 Mbedthis AppWeb 2.2.1 升级到Mbedthis AppWeb 2.2.2版本： http://www.mbedthis.com/...
Supasite 1.23b Multiple Remote File Inclusion Vulnerabilities
No description provided by source. Supasite v1.23b = Multiple Remote File Include Vulnerablitiy D.Script: http://belnet.dl.sourceforge.net/sourceforge/supasite/supasite1.23b.tar.gz Discovered by: GolDM = Mahmoodali Homepage: http://www.Tryag.cc...
Pixel Motion Config.PHP远程命令执行漏洞
Pixel Motion是一款基于PHP的web应用程序。 Pixel Motion不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于‘config. php’脚本对用户提交的web参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Pixel Motion Pixel Motion 2.1.1 目前没有解决方案提供，请关注以下链接： http://www.pixelmotion.org/ !/usr/bin/perl Affected.scr..: Blog Pixel Motion V2.1.1...
PHP-Fusion Maincore.PHP SQL注入漏洞
PHP-Fusion是一款基于PHP的内容管理程序。 PHP-Fusion不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Maincore.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 PHP-Fusion PHPFusion 6.1.4 PHP-Fusion PHP-Fusion 6.0.307 PHP-Fusion PHP-Fusion 6.0.204 PHP-Fusion PHP-Fusion 6.0.110 PHP-Fusion PHP-Fusion...
Microsoft Internet Explorer MSOE.DLL拒绝服务漏洞
Microsoft Internet Explorer是一款流行的WEB浏览器。 Microsoft Internet Explorer实例化msoe.dll COM对象存在问题，远程攻击者可以利用漏洞进行内存破坏攻击，可能以进程权限执行任意指令。 当Microsoft Internet Explorer尝试以ActiveX控件实例化msoe.dll COM对象，可能破坏系统内存造成拒绝服务，可能导致任意代码执行。 Microsoft Internet Explorer 6.0 SP2 Microsoft Internet Explorer 6.0 SP1 Microsoft...
OpenLDAP slapd "selfwrite"绕过安全限制漏洞
OpenLDAP是一款开放源代码的轻量级目录访问协议LDAP实现。 OpenLDAP在处理访问控制列表时存在错误，远程攻击者可能利用此漏洞绕过安全限制。 以下类型的ACL： access to dn.subtree="ou=groups,dc=example,dc=com" attr=member by selfwrite 应该仅允许用户对目标属性添加/删除自己的DN，但拥有selfwrite访问权限的用户确可以修改属性的任意值，允许攻击者绕过安全限制，获得非授权访问。 OpenLDAP OpenLDAP 2.3/HEAD 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载...
Mambo com_registration_detailed <= 4.1 Remote File Include
No description provided by source. Mambo comregistrationdetailed = 4.1 Remote File Inclusion Download Source : http://mamboxchange.com/projects/regdetailed/ Dork = allinur:comextendedregistration Found By: k1tk4t - k1tk4td0th4ck4tgmaild0tcom Location: Indonesia file ; registrationdetailed.inc.php...
蓝凌OA EKP 后台SQL注入漏洞（CNVD-2021-01363）
...
APPCMS comment.php文件SQL注入
AppCMS 官网：http://www.appcms.cc/ 审计版本：2.0.101 下载连接：http://www.appcms.cc/download/appcms2.0.101.zip AppCMS comment.php SQL Injection 0x00 前言 一开始是在cnvd（）上看到有人提交这个漏洞没有详情，去官网下载源码本地审计没有审计出来；一次偶然的机会看到@Thinking分享的文章，才知道服务器端获取的“HTTPCLIENTIP”值是http头中“CLIENT-IP”字段的值是可伪造的！看到这个就恍然大悟了 0x01 分析...
Foscam IP Video Camera webService 9299.org DDNS Client Code Execution Vulnerability(CVE-2017-2857)
Summary An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating...
Automated Logic WebCTRL 6.1 Path Traversal Arbitrary File Write
Description The vulnerability is triggered by an authenticated user that can use the manualcommand console in the management panel of the affected application. The ManualCommand function in ManualCommand.js allows users to perform additional diagnostics and settings overview by using pre-defined...
Ruby pack_pack Use After Free Vulnerability(CVE-2016-2338)
DESCRIPTION An exploitable User After Free vulnerability exists in the packpack function of Ruby. In packpack function each element of array which should be "pack", based on template string is converted to binary representation in proper way. If element is not compatible with corresponding to him...
Microsoft Windows PDF API Jpeg2000 csiz Remote Code Execution Vulnerability(CVE-2016-3319)
Description An exploitable out of bounds write vulnerability exists in the PDF parsing API in the latest versions of Microsoft Windows. A specially crafted PDF file can cause an out of bounds write resulting in arbitrary code execution. Vulnerability can be triggered via malicious web page or a...
Discuz! X Front arbitrary file deletion vulnerability
Author: The know Chong Yu 404 laboratory 0x01 description Discuz! X community software, is a PHP and MySQL like other variety of database build performance, comprehensive, security and stability of the Community Forum platform. 2017 9 May 29, Discuz! Fix a security issue has been used to strength...
Hanbanggaoke IP Camera Arbitrary Password Change
Vulnerability summary The following advisory describes an arbitrary password change vulnerability found in Hanbanggaoke webcams. Beijing Hanbang Technology, “one of the first enterprises entering into digital video surveillance industry, has been focusing on R&D of products and technology of...
Nexus 9 vs. Malicious Headphones, Take Two
Nexus 9 vs. Malicious Headphones, Take Two In March 2017 we disclosed CVE-2017-0510, a critical vulnerability in Nexus 9, that allowed for quite unique an attack by malicious headphones. Interestingly, its patch was insufficient. We had responsibly reported that finding CVE-2017-0648 to Google,...
Microsoft Windows (x86) - 'NDISTAPI' Privilege Escalation (MS11-062)
No description provided by source. / Exploit Title: Windows x86 all versions NDISTAPI privilege escalation MS11-062 Date: 2016-10-24 Exploit Author: Tomislav Paskalev Vulnerable Software: Windows XP SP3 x86 Windows XP Pro SP2 x64 Windows Server 2003 SP2 x86 Windows Server 2003 SP2 x64 Windows...
Trend Micro Threat Discovery Appliance remote code execution（CVE-2016-7547）
A command injection in the adminsystime. the cgi interface that allows for an attacker to gain remote code execution CVE-2016-7547. Vulnerability linkage: https://www.seebug.org/vuldb/ssvid-92938 This module requires Metasploit: http://metasploit.com/download Current source:...
Windows gdi32.dll heap-based out-of-bounds reads / memory disclosure (CVE-2017-0038)
In issue 757, I described multiple bugs related to the handling of DIBs Device Independent Bitmaps embedded in EMF records, as implemented in the user-mode Windows GDI library gdi32.dll. As a quick reminder, the DIB-embedding records follow a common scheme: they include four fields, spots denotin...
Safari the showModalDialog method UXSS vulnerability
This article translated from: http://mksben.l0.cm/2016/09/safari-uxss-showModalDialog.html （English version） http://masatokinugawa.l0.cm/2016/09/safari-uxss-showModalDialog.html （Japanese version） Author：Masato Kinugawa Translator: Holic know Chong Yu 404 security lab Translator's note: as the...
天融信TopADS ads_bwlist_download.php任意文件读取及删除漏洞
No description provided by source...
XYCMS健身会所建站系统 v1.1 jsxm_detail.asp 参数id SQL注入漏洞
0x01漏洞简介 XYCMS健身会所建站系统采用asp+access架构。其v1.1版本在/jsxmdetail.asp处对参数id 过滤不严，导致出现SQL注入漏洞。 0x02漏洞详情 该系统默认存在一个管理员数据表adminuser，该表包含管理员名称字段admin和密码 md5加密字段password，远程攻击者可以结合union方式获取敏感信息，登陆后台，上传shell。 0x03修复方案 过滤。...
IBM Security AppScan Standard <= 9.0.2 - OLE Automation Array Remote Code Execution
IBM Security AppScan Standard OLE Automation Array Remote Code Execution Author: Naser Farhadi Linkedin: http://ir.linkedin.com/pub/naser-farhadi/85/b3b/909 Date: 1 June 2015 Version: = 9.0.2 Tested on: Windows 7 Exploit Based on MS14-064 CVE-2014-6332 http://www.exploit-db.com/exploits/35229/ if...
phpok最新版(phpok4.2.024)一处盲注+后台getshell
简要描述： RT 详细说明： 文件/framework/www/postcontrol.php 26-38行 function indexf $id = $this-get"id"; $pid = $this-get'pid'; if!$id && !$pid errorPLang'未指定项目','','error'; $projectrs = $this-call-phpok'project',array"phpok"=$id,'pid'=$pid; if!$projectrs || !$projectrs'module' errorPLang"项目不符合要求",'','error';...
ManageEngine Desktop Central StatusUpdate Arbitrary File Upload
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...
某教育类通用cms任意文件下载漏洞
简要描述： 某教育类通用cms任意文件下载漏洞 详细说明： 不知道算不算通用 可下载web.config文件，数据库信息文件泄露 http://sbc.xzit.edu.cn/hxjc/DownLoad.aspx?Accessory=../web.config http://hedds.njutcm.edu.cn/DownLoad.aspx?Accessory=../web.config http://www.emcjs.org/DownLoad.aspx?Accessory=../web.config...
AllMyLinks 0.x - footer.inc.php Arbitrary Code Execution
No description provided by source. source: http://www.securityfocus.com/bid/9664/info Reportedly the AllMyPHP applications AllMyGuests, AllMyLinks and AllMyVisitors are prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed variables that are used i...
MercuryBoard 1.1 - Multiple Input Validation Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/12359/info Multiple input validation vulnerabilities affect MercuryBoard. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in critical functionality. An...
ProFTPD <= 1.2.10 Remote Users Enumeration Exploit
No description provided by source. / Details Vulnerable Systems: ProFTPD Version 1.2.10 and below It is possible to determine which user names are valid, which are special, and which ones do not exist on the remote system. This can be accomplished by code execution path timing analysis attack at...
DUportal Pro 3.4 cat.asp Multiple Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/13285/info DUportal Pro is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacke...
KDE KMail 1.7.1 HTML EMail Remote Email Content Spoofing Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13085/info A remote email message content spoofing vulnerability affects KDE KMail. This issue is due to a failure of the application to properly sanitize HTML email messages. An attacker may leverage this issue to spoof...
MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2013-019: Multiple Vulnerabilities in MiCasaVerde VeraLite Published: 08/01/13 Version: 1.0 Vendor: MiCasaVerde http://www.micasaverde.com/ Product: VeraLite Version affected: 1.5.408 Product description: The MiCasaVerd...