56796 matches found
Windows: heap overflow in jscript.dll in Array.sort(CVE-2017-11907)
There is an heap overflow vulnerability in jscript.dll library used in IE, WPAD and other places. The bug affects 2 functions, JsArrayStringHeapSort and JsArrayFunctionHeapSort. PoC for IE note: page heap might be required to obsorve the crash: var vars = new Array100; var arr = new Array1000;...
Ruby pack_pack Use After Free Vulnerability(CVE-2016-2338)
DESCRIPTION An exploitable User After Free vulnerability exists in the packpack function of Ruby. In packpack function each element of array which should be "pack", based on template string is converted to binary representation in proper way. If element is not compatible with corresponding to him...
Discuz! X Front arbitrary file deletion vulnerability
Author: The know Chong Yu 404 laboratory 0x01 description Discuz! X community software, is a PHP and MySQL like other variety of database build performance, comprehensive, security and stability of the Community Forum platform. 2017 9 May 29, Discuz! Fix a security issue has been used to strength...
Google Android Broadcom Wi-fi Driver Information Disclosure Vulnerability(CVE-2017-0633)
An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious component to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10,...
Microsoft Windows (x86) - 'NDISTAPI' Privilege Escalation (MS11-062)
No description provided by source. / Exploit Title: Windows x86 all versions NDISTAPI privilege escalation MS11-062 Date: 2016-10-24 Exploit Author: Tomislav Paskalev Vulnerable Software: Windows XP SP3 x86 Windows XP Pro SP2 x64 Windows Server 2003 SP2 x86 Windows Server 2003 SP2 x64 Windows...
Trend Micro Threat Discovery Appliance - Session Generation Authentication Bypass (CVE-2016-8584)
In the last few months, I have been testing several Trend Micro products with Steven Seeley @steventseeley. Together, we have found more than 200+ RCE Remote Code Execution vulnerabilities and for the first time we presented the outcome of our research at Hack In The Box 2017 Amsterdam in April...
Roundcube mail body of the stored cross site Vulnerability(CVE-2017-6820)
Author: Badcode, sebao know Chong Yu 404 security lab Date: 2017-03-17 0x00 vulnerability overview 1. Vulnerability description Roundcube is a widely used open source e-mail program, in the globe there are many organizations and companies are in use. On the server to successfully install...
Ruby on Rails Action View 信息泄漏
Possible Information Leak Vulnerability in Action View. There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all the scenarios. This vulnerability has been assigned the CVE...
Discuz 7.2 admincp.php 反射型 xss漏洞
漏洞描述：Discuz! 7.X系列一处问题引发大面积XSS，基本上全部页面和文件都能触发。Discuz! 7.2,7.1,7.0三个版本都受影响漏洞分析：这里拿Discuz! 7.2做分析比如Discuz! 7.2安装包里面的第二个文件就是ajax.php注意最后一行的showmessage函数，跟进include/global.func.php文件。...
IBM Security AppScan Standard <= 9.0.2 - OLE Automation Array Remote Code Execution
IBM Security AppScan Standard OLE Automation Array Remote Code Execution Author: Naser Farhadi Linkedin: http://ir.linkedin.com/pub/naser-farhadi/85/b3b/909 Date: 1 June 2015 Version: = 9.0.2 Tested on: Windows 7 Exploit Based on MS14-064 CVE-2014-6332 http://www.exploit-db.com/exploits/35229/ if...
74CMS 3.4 /plus/weixin.php 任意文件下载漏洞
No description provided by source...
ManageEngine Desktop Central StatusUpdate Arbitrary File Upload
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...
帝国CMS（全版） 验证码可无视！可导致验证码无效（验证码识别都是渣渣）
简要描述： 帝国CMS 验证码可无视！可导致验证码无效（验证码识别都是渣渣） 详细说明： 看帝国 获取验证码的代码 //显示验证码 function ShowKey$v $vname=ecmsReturnKeyVarname$v; $key=strtolowerdomakepassword4; ecmsSetShowKey$vname,$key; .................. ecmsReturnKeyVarname 是返回保存验证码的cookie的名称 比如本列打开的页面上注册页面的验证码 url 是...
TP-Link TD-W8951ND - Multiple Vulnerabilities
No description provided by source. ----------- Author: ----------- xistence xistenceat0x90.nl ------------------------- Affected products: ------------------------- Tested on TP-Link TD-W8951ND Firmware 4.0.0 Build 120607 Rel.30923 ------------------------- Affected vendors:...
WordPress 2.3.1 Unauthorized Post Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/26885/info WordPress is prone to a vulnerability that lets unauthorized users read draft posts before they have been published. This issue affects WordPress 2.3.1; other versions may also be affected. NOTE: This BID is...
Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution
No description provided by source. $Id: alcatelomnipcxmastercgiexec.rb 10556 2010-10-05 23:13:04Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing...
LANDesk Management Gateway 'gsb/drivers.php'代码注入漏洞
No description provided by source. 1. Advisory Information Title: Landesk OS command injection Advisory Id: CORE-2010-1018 Advisory URL: http://www.coresecurity.com/content/landesk-os-command-injection-vulnerability Date published: 2010-11-10 Date of last update: 2010-11-10 Vendors contacted:...
Linux Kernel < 2.6.36-rc1 CAN BCM - Privilege Escalation Exploit
No description provided by source. / i-CAN-haz-MODHARDEN.c Linux Kernel 2.6.36-rc1 CAN BCM Privilege Escalation Exploit Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2959 Ben Hawkes discovered an integer overflow in th...
Android 2.0/2.1 - Use-After-Free Remote Code Execution on Webkit
No description provided by source. Exploit Title: Android 2.0/2.1 Use-After-Free Remote Code Execution on Webkit Date: 14/11/2010 Author: Itzhak Avraham, mj Tested on: Droid 2.1 CVE : CVE-2010-1807 Better exploit better rate and more flexible for changes, also shorter shellcode than what you have...
IIS 1.0,Netscape Server 1.0/1.12,OReilly WebSite Professional 1.1 b BAT/.CMD Remote Command Execution
No description provided by source. IIS 1.0,Netscape Commerce Server 1.0/Communications Server 1.12,OReilly Software WebSite Professional 1.1 b BAT/.CMD Remote Command Execution source: http://www.securityfocus.com/bid/2023/info Some web servers that allow batch files to be executed via CGI are...
PHP-Fusion 7.02.05 - Multiple Vulnerabilities
No description provided by source. waraxe-2013-SA097 - Multiple Vulnerabilities in PHP-Fusion 7.02.05 =============================================================================== Author: Janek Vind waraxe Date: 27. February 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-97.ht...
Radio istek scripti 2.5 - Remote Configuration Disclosure Vulnerability
No description provided by source. turkish radio php script ====================================================== RADIO istek scripti tr Version 2.5 tr Remote config Vulnerability ! Found by? :? kurdish hackers team ! C0ntact : pshela at YaHoo .com ! Groups : Kurd-Team ! site : www.kurdteam.org...
Linux group_info refcounter - Overflow Memory Corruption
No description provided by source. / DoS poc for CVE-2014-2851 Linux groupinfo refcounter overflow memory corruption https://lkml.org/lkml/2014/4/10/736 @Tohmaxx - http://thomaspollet.blogspot.be If the app doesn't crash your system, try a different count argv1 Execution takes a while because 2^3...
libzip 0.9.3 _zip_name_locate NULL Pointer Dereference (incl PHP 5.3.5)
No description provided by source. Source: http://securityreason.com/securityalert/8146 libzip 0.9.3 zipnamelocate NULL Pointer Dereference incl PHP 5.3.5 Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - Dis.: 03.01.2011 - Pub.: 18.03.2011 CVE: CVE-2011-0421 CER...
Oracle Database Remote Listener Memory Corruption Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/37728/info Oracle Database is prone to a remote memory-corruption vulnerability in Listener. The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker does not require privileges to exploit this...
DUportal Pro 3.4 cat.asp Multiple Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/13285/info DUportal Pro is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacke...
KnowledgeBuilder 2.0/2.1/3.0 - Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9292/info KnowledgeBuilder is prone to a remote file include vulnerability. An attacker could exploit this to cause hostile PHP scripts to be included and executed from a remote server. This would occur in the security...
Mozilla Firefox Firefox 4.0.1 Array.reduceRight() Exploit
No description provided by source. !-- Full Exploit Code: http://www.exploit-db.com/sploits/18531.zip PoC exploit for CVE-2011-2371 tested against Firefox 4.0.1 md5 of mozjs.dll: 5d7ffcc9deb5bb08417ceae51d2afed4 change constants to switch between w7/xp. see my blog if you want to know how this...
FineCMS设计缺陷导致大面积SQL注入
简要描述： FineCMS设计缺陷导致大面积SQL注入 详细说明： finecms最新版2.3.0，官方2014年4月18号更新。 finecms某功能存在SQL注入，无需登陆，可直接注入获取管理员账号。 此功能在多个模块使用，导致注入大面积爆发。 此漏洞整个MCS都在使用，导致漏洞大面积存在。 文件/FineCMSv2.3.0/dayrui/core/DModule.php： / 模块内容搜索页 / protected function search $this-load-model'searchmodel'; $mod = $this-getcache...
用友某办公自动化平台漏洞之1-未授权访问导致目录漏洞
简要描述： 文件上传页面没做权限控制，未对用户传递的目录进行过滤，导致../跳转上级目录 详细说明： 无意间看到这个平台 FE协作办公平台 测试版本：5.2.1 版本大于5.2.1未受影响 ，小于5.2.1的版本未测 在网上用百度找了一下 直接访问/system/mediafile/templateOfTaohongmanager.jsp?path=/../../../ 可以通过../跳转目录，导致敏感信息泄露 漏洞证明： 无意间看到这个平台 FE协作办公平台 测试版本：5.2.1 版本大于5.2.1未受影响 ，小于5.2.1的版本未测 在网上用百度找了一下...
SeedDMS '/op/op.AddFile2.php'任意文件上传漏洞
Bugtraq ID:66255 CVE ID:CVE-2014-2278 SeedDMS是一个强大易用的文档管理系统。 SeedDMS /op/op.AddFile2.php上传功能不充分的访问控制，允许攻击者控制上传文件的位置，并上传任意文件类型的文件，以服务器上下文执行任意代码。 0 SeedDMS 4.3.3 SeedDMS 4.3.4已经修复该漏洞，建议用户下载更新： https://sourceforge.net/projects/seeddms/files/seeddms-4.3.4/...
Vtiger CRM文件包含漏洞
CVE ID：CVE-2014-1222 vtiger CRM是一套基于Web以销售能力自动化SFA为主的客户关系管理系统CRM 。 本地文件包含漏洞被发现在vtigerCRM 6.0 RC的'kcfinder'组件。攻击者可以利用漏洞通过目录遍历序列包含任意文件，并泄漏任意文件内容。 0 Vtiger CRM 5.4.0 Vtiger CRM 6.0 RC Vtiger CRM 6.0.0 GA 厂商补丁： vtiger CRM ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.vtiger.com/ POST...
SIEMENS SIMATIC WinCC Open Architecture不安全密码哈希漏洞
BUGTRAQ ID: 65339 CVECAN ID: CVE-2014-1696 Siemens SIMATIC WinCC 是监测控制和数据采集SCADA及人机界面HMI系统。 SIEMENS SIMATIC WinCC OA 3.12 P002之前版本使用了弱密码哈希算法，存在安全漏洞，远程攻击者通过暴力攻击，即可获取访问权限。 0 Siemens SIMATIC WinCC Open Architecture 3.12 P002 January 厂商补丁： Siemens ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
建站之星任意文件上传漏洞(续二)
简要描述： 建站之星任意文件上传漏洞续二 详细说明： 1 漏洞产生 /module/modmedia.php flashpicker 和 imagepicker 两个函数 imagepicker 函数 None 访问upload.php并上传文件,上传的时候用Burpsuite 抓包 并修改 点击Forward即可在 https://images.seebug.org/upload/flash 下面生成php文件...
IBM Security AppScan Enterprise 弱密码安全绕过漏洞(CVE-2013-0531)
BUGTRAQ ID: 62179 CVECAN ID: CVE-2013-0531 IBM Securityl AppScan Enterprise 是一个基于Web 的多用户Web 应用程序安全解决方案，提供集中的安全性扫描、数据合并和报告、补救功能、执行仪表板等功能 IBM Security AppScan Enterprise 即之前的IBM Rational AppScan Enterprise 支持使用弱加密算法的SSL套件，攻击者无需本地网络访问及身份验证，即可利用此漏洞解密客户端和服务器之间的通讯，或在客户端上执行中间人攻击，从而获取敏感信息，执行未授权操作 0 IBM...
欧朋浏览器官方网易微博被劫持（社工）
简要描述： 大数据HACK 详细说明： 本来想用大数据的能力搞到欧朋论坛的admin，但是admin没搞到，反而弄到了欧朋的网易微博，从而可以发布欺骗或者危害的信息 怎么开始的？ 首先我是查看了http://bbs.oupeng.com/home.php?mod=space&username=admin的信息，发现她的名字有点特别，于是，我就利用大数据的能力，获得了Csineneo用户的密码信息等 [email protected] loveyou...
部分Discuz!论坛 用户可以任意刷积分！
简要描述： 有些Discuz!论坛 用户可以任意刷积分 详细说明： 对于有些Discuz!论坛对推广访问这个地方不重视从而可以使用户能够任意的刷论坛的用户积分和等级 先点击推广访问 可以看到这个界面 “如果您的朋友通过下面任意一个链接访问站点，您将获得积分奖励 金钱+1”我们可以复制一个推广链接 用流量精灵挂着 不一会儿 我们的积分就会上去。论坛等级也会提高！ 漏洞证明：...
正方高校现代管理系统任意修改成绩查看照片漏洞
简要描述： 还是传说中1000所高校用的正方高校现代管理系统 详细说明： 一般院校都有一个可以查到学号工号的地方，例如： 信息门户-好友系统 有的学校没有这个信息门户，或者信息门户只对教师开放，那么还有一个在线教学平台可以查到哦 具体位置自己找吧。 先输入你老师的名字，找到其工号…… 然后到高校现代管理系统（这里可能会有两个地址，一个是评教系统，没什么用，另一个可以选择登陆身份的就是我们要进的系统了） 当然是弱密码经测试80%的高校都没让老师们修改弱密码！大学老师啊！！ 输入工号（密码相同）。 先说查看照片。...
nginx 中间人攻击漏洞(CVE-2011-4968)
Bugtraq ID:57139 CVE ID:CVE-2011-4968 nginx是一款高性能的web服务器，使用非常广泛，其不仅经常被用作反向代理，也可以非常好的支持PHP的运行 nginx包含的Http代理模块允许通过https与源服务器通信，但是没有正确校验源服务器身份，允许攻击者在代理和源服务器之间进行中间人攻击 0 Igor Sysoev nginx 0.8.40 Igor Sysoev nginx 0.8.36 Igor Sysoev nginx 0.8.35 Igor Sysoev nginx 0.8.33 Igor Sysoev nginx 0.7.66 Igor...
Oracle Java SE JRE 2D子组件远程安全漏洞(CVE-2012-0497)
BUGTRAQ ID: 52009 CVE ID: CVE-2012-0497 Sun Java Runtime Environment是一款为JAVA应用程序提供可靠的运行环境的解决方案。 Oracle Java SE中的Java Runtime Environment在实现上存在远程漏洞，可通过多个协议利用，未经验证的攻击者可利用此漏洞影响2D子组件，导致完全控制受影响组件。此漏洞可影响：7 Update 2、6 Update 30 0 Oracle Sun JRE 1.6.x Oracle Sun JDK 1.6.x 厂商补丁： Oracle ------...
Python SimpleXMLRPCServer远程拒绝服务漏洞
BUGTRAQ ID: 51996 CVE ID: CVE-2012-0845 Python是一种面向对象、直译式计算机程序设计语言，也是一种功能强大的通用型语言。 Python在实现上存在远程拒绝服务漏洞，攻击者可通过特制的HTTP POST请求利用此漏洞造成拒绝服务。 此漏洞源于在处理POST请求时，"SimpleXMLRPCRequestHandler.doPOST"方法没有正确处理EOF，可通过特制的请求导致较高的CPU消耗。 0 python 3.x python 2.7.x 厂商补丁： Python ------...
WordPress 3.3.1 Code Execution / Cross Site Scripting
No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2012-002: Multiple Vulnerabilities in WordPress https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt Published: 1/24/12 Version: 1.0 Vendor: WordPress http://wordpress.org/ Product: WordPress Version...
Linux Kernel agp_allocate_memory/agp_create_user_memory本地权限提升漏洞
BUGTRAQ ID: 47535 CVE ID: CVE-2011-1746 Linux Kernel是Linux操作系统的内核。 Linux Kernel在agpallocatememory/agpcreateusermemory的实现上存在本地权限提升漏洞，本地攻击者可利用此漏洞以内核权限执行任意代码，造成完全控制受影响计算机。...
Linux Kernel "posix-cpu-timers.c"本地竞争条件漏洞
BUGTRAQ ID: 45028 CVE ID: CVE-2010-4248 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel在实现上存在漏洞，攻击者可以利用此漏洞引起内核瘫痪，异常终止受影响的计算机。 posix-cpu-timers.c认为将要终止的进程会执行posixcputimersexitgroup并将从 signal-cputimers列表中删除所有!CPUCLOCKPERTHREAD计时器。但它错误地认为 timer-it.cpu.task总是组前导，这样dead -task就表示不作用的线程组。 Linux kernel...
Microsoft Office Property Code Execution exploit (CVE-2006-2389)
No description provided by source. Microsoft Office Property Code Execution exploit CVE-2006-2389 Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Vulnerble application MS office 2003 Tested...
VMWare Tools软件包库引用代码执行漏洞
BUGTRAQ ID: 39392 CVE ID: CVE-2010-1141 VMWare是一款虚拟PC软件，允许在一台机器上同时运行两个或多个Windows、DOS、LINUX系统。 VMWare产品中所使用的VMWare Tools软件包没有正确地访问函数库，Windows平台的Guest操作系统用户受骗点击了网络共享上所存储的文件就会导致执行任意代码。 VMWare Workstation 5.5.x VMWare ACE 2.5.x VMWare Player 2.5.x VMWare Server 2.x VMWare Fusion 2.x VMWare ESX 4.0...
ToutVirtual VirtualIQ Multiple Vulnerabilities
No description provided by source. Secure Network - Security Research Advisory Vuln name: ToutVirtual VirtualIQ Pro Multiple Vulnerabilities Systems affected: ToutVirtual VirtualIQ Professional 3.2 build 7882 Systems not affected: -- Severity: High Local/Remote: Remote Vendor URL:...
Apple Mac OS X 2009-006更新修复多个安全漏洞
BUGTRAQ ID: 36956 CVE ID:...
Linux kernel md驱动本地拒绝服务漏洞
CVECAN ID: CVE-2009-2849 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的md驱动（drivers/md/md.c）中存在拒绝服务漏洞，本地用户可以通过suspend sysfs属性和suspendlostore或suspendhistore函数触发空指针引用。只有在sysfs可写的情况下才可以利用这个漏洞。以下是有漏洞的代码段： static ssizet suspendlostoremddevt mddev, const char buf, sizet len char e; unsigned long long...
WordPress Privileges Unchecked in admin.php and Multiple Information
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ WordPress Privileges Unchecked in admin.php and Multiple Information Disclosures 1. Advisory Information Title: WordPress Privilege...