56796 matches found
Oracle 10g R1 pitrig_drop PLSQL Injection (get users hash)
No description provided by source. // / Oracle 10g R1 xDb.XDBPITRIGPKG.PITRIGDROP / / SQL Injection Exploit / // / sploit get password Hashes / // / BY Sh2kerr Digital Security / // / tested on oracle 10.1.0.2.0 / // // / Date of Public EXPLOIT: January 28, 2008 / / Written by: &...
Apple iPhone Passcode Lock绕过安全限制漏洞
BUGTRAQ ID: 27297 CVECAN ID: CVE-2008-0034 Apple iPhone是苹果最新发布的智能手机。 iPhone的Passcode Lock功能允许用户锁定手机应用，除非输入了正确的密码，否则无法启动应用程序。但在处理紧急呼叫时的实现错误允许能够物理访问iPhone手机的用户无需输入密码便可以加载应用程序。 Apple iPhone 1.0 - 1.1.2 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.apple.com...
ClipShare (uprofile.php UID) Remote SQL Injection Vulnerability
No description provided by source. video sharing www.clip-share.com Remote SQL Injection Exploit All Version AUTHOR :Krit webmaster of http://www.thaishadow.com HOME : http://www.thaishadow.com Download : http://www.clip-share.com/ DorKs :inurl:/uprofile.php?UID= or "Powered by clipshare" EXPLOIT...
Samba nmbd_packets.c NetBIOS回复栈溢出漏洞
BUGTRAQ ID: 26455 CVECAN ID: CVE-2007-5398 Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。 Samba的nmbd/nmbdpackets.c文件中的replynetbiospacket函数在发送NetBIOS回复时存在栈溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 如果客户端发送了多个特制的WINS “Name Registration”请求并跟随有WINS “Name...
OpenSSL DTLS远程堆溢出漏洞
BUGTRAQ ID: 26055 CVECAN ID: CVE-2007-4995 OpenSSL是一种开放源码的SSL实现，用来实现网络通信的高强度加密，现在被广泛地用于各种网络应用程序中。 OpenSSL的DTLS支持中存在漏洞，攻击者可以创建能够触发堆溢出的恶意客户端或服务器，导致执行任意指令。 请注意这个漏洞仅影响使用DTLS的应用程序。 OpenSSL Project OpenSSL 0.9.8f OpenSSL Project OpenSSL 0.9.8 RedHat Linux 5.0 OpenSSL Project ---------------...
Joomla Component com_colorlab 1.0 Remote File Inclusion Vulnerability
No description provided by source. -------------------- Joomla comcolorlab Remote File Include -------------------- Found : xoron -------------------- Download: http://download.joomlaportal.ch/content/view/474/ -------------------- Wrong Code: include...
TotalCalendar <= 2.402 (view_event.php) Remote SQL Injection Vulns
No description provided by source. --==+================================================================================+==--br / --==+ TotalCalendar 2.402 SQL Injection Vulnerability +==--br /...
EfesTECH Haber 5.0 (id) Remote SQL Injection Vulnerability
No description provided by source. Title: EfesTECH Haber v5,0 Remote SQL Injection Vulnerability Author: CyberGhost Demo Page: http://www.haberguvercini.com Script Page: http://aspindir.com/indir.asp?id=4899&sIslem=%DDndir Vuln. Username -...
PHPMyPortal Articles.Inc.PHP远程文件包含漏洞
PHPMyPortal是一款基于PHP的WEB应用程序。 PHPMyPortal不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Articles.Inc.PHP'脚本对用户提交的'GLOBALSCHEMINMODULES'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 phpMyPortal phpMyPortal 3.0 RC3 http://phpmyportal.info/menu.php html head meta http-equiv="Content-Type" content="text/html;...
Windows VDM零页面竞争条件本地特权提升漏洞
Microsoft Windows是一款商业性质的操作系统。 Windows内核在实现虚拟DOS机VDM时存在竞争条件错误，本地攻击者可以利用漏洞提升特权。...
MS Windows DNS DnssrvQuery Remote Stack Overflow Exploit
No description provided by source. / Copyright c 2007 devcode ^^ D E V C O D E ^^ Windows DNS DnssrvQuery Stack Overflow CVE-2007-1748 Description: A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system. The vulnerabili...
Wserve HTTP Server 4.6 (Long Directory Name) Denial of Service Exploit
No description provided by source. !perl Wserve HTTP Server 4.6 Version Long Directory Name Buffer Overflow - Denial Of Service Type : Buffer Overflow - Denial of Service Release Date : 2007-04-05 Product / Vendor : Wserve HTTP Server http://sourceforge.net/projects/whttp PoC : GET / HTTP/1.0...
LibTIFF库匿名字段合并拒绝服务漏洞
Libtiff是一种TIFF规范的标准ANSI C实现库。 Libtiff处理定制标记存在问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 建立匿名字段在前，合并CODEC信息的字段可导致recognised字段出现不期望的值，这种状态可导致异常行为，导致应用程序崩溃或任意代码执行等问题。 S.u.S.E. UnitedLinux 1.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x8664 S.u.S.E. Linux...
Cisco Secure Desktop多个安全漏洞
Cisco Secure Desktop CSD可以通过加密降低远程用户注销或SSL VPN会话超时后Cookies、浏览器历史记录、临时文件和下载内容在系统上所遗留的风险。 CSD受以下漏洞的影响： 生成的浏览器导致信息泄漏 +-------------------------------------- 如果在创建了SSL VPN会话之后，所自动生成的用于显示主页的Internet浏览器使用了CSD所维护库文件之外目录来储存其会话信息的话，就会出现这个漏洞。这个漏洞还允许用户将在这个Internet浏览会话期间所下载的文件保存到CSD库文件之外，导致在SSL...
Imageview <= 5 (Cookie/index.php) Remote Local Include Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? print ' ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::: :+: :+: :+: :+:...
OpenLDAP slapd "selfwrite"绕过安全限制漏洞
OpenLDAP是一款开放源代码的轻量级目录访问协议LDAP实现。 OpenLDAP在处理访问控制列表时存在错误，远程攻击者可能利用此漏洞绕过安全限制。 以下类型的ACL： access to dn.subtree="ou=groups,dc=example,dc=com" attr=member by selfwrite 应该仅允许用户对目标属性添加/删除自己的DN，但拥有selfwrite访问权限的用户确可以修改属性的任意值，允许攻击者绕过安全限制，获得非授权访问。 OpenLDAP OpenLDAP 2.3/HEAD 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载...
Clansys v.1.1 (showid) Remote SQL Injection Exploit
No description provided by source. ?php / |---==============================================================---| | /\¯\ /\¯\ | | \ \ \ \ \ \ | | / \ / \ / \ \ \ / / \ \ \ / /\ \ | | /, /\ /\ /\ \ \ \ /\ /\ \ \ \ /\ /\ \ / | | //\ \ \ / \\ \ \\ \ \ \\ \ | | // ////////...
Attack on Pseudo-random number generator (PRNG) used in 1000 Guess, an Ethereum lottery game. (CVE-2018–12454)
Abstract An Ethereum lottery game, 1000 Guess, has a vulnerability that it generates random numbers predictable by anyone. This game decides a winner by a random number when the number of players who bet on the contract reaches to the predetermined number. The contract generates the random number...
Windows Kernel 64-bit stack memory disclosure in win32k!XDCOBJ::RestoreAttributes(CVE-2018-0811)
We have discovered that the win32k!XDCOBJ::RestoreAttributes function leaks portions of uninitialized kernel stack memory to user-mode address space on Windows 7 to 10. It was confirmed on 64-bit platforms, 32-bit builds were not tested. The overall copied memory area is 0x1a0 bytes long, 4 of...
Windows Kernel 64-bit pool memory disclosure via REG_RESOURCE_REQUIREMENTS_LIST registry values(CVE-2018-0900)
We have discovered a Windows kernel memory disclosure vulnerability through the contents of "FilteredConfigVector" registry values of type REGRESOURCEREQUIREMENTSLIST, which can be found under HKLM\SYSTEM\CurrentControlSet\Enum\ACPI\\Control\FilteredConfigVector. The vulnerability affects 64-bit...
XXE Zeroday Vulnerability in HP PPM
Intro: XXE Zeroday Vulnerability in HP PPM Researchers at Rhino Security Labs discovered an XXE vulnerability in the way HP Project and Portfolio Management Center HP PPM processed imported tickets. Specifically, an XML external entity injection vulnerability allows an attacker to exploit the...
Discuz X3. 3 authkey generation algorithm of the security vulnerability and the background arbitrary code execution vulnerability
0x00 background description Discuz official in 2017 8 May 1 release of the latest version of the X3. 4 version, the latest version fixes multiple security issues. 360CERT and 360 0KEE Team then for the events to follow. 0x01 vulnerability overview 360CERT and 360 0KEE Team by comparing DiscuzX3...
Symantec Messaging Gateway <= 10.6.3-2 unauthenticated root RCE(CVE-2017-6327)
Bug 1: Web authentication bypass The web management interface is available via HTTPS, and you can't do much without logging in. If the current session identified by the JSESSIONID cookie has the user attribute set, the session is considered authenticated. The file LoginAction.class defines a numb...
Trend Micro Threat Discovery Appliance remote code execution（CVE-2016-7547）
A command injection in the adminsystime. the cgi interface that allows for an attacker to gain remote code execution CVE-2016-7547. Vulnerability linkage: https://www.seebug.org/vuldb/ssvid-92938 This module requires Metasploit: http://metasploit.com/download Current source:...
Roundcube mail body of the stored cross site Vulnerability(CVE-2017-6820)
Author: Badcode, sebao know Chong Yu 404 security lab Date: 2017-03-17 0x00 vulnerability overview 1. Vulnerability description Roundcube is a widely used open source e-mail program, in the globe there are many organizations and companies are in use. On the server to successfully install...
Windows gdi32.dll heap-based out-of-bounds reads / memory disclosure (CVE-2017-0038)
In issue 757, I described multiple bugs related to the handling of DIBs Device Independent Bitmaps embedded in EMF records, as implemented in the user-mode Windows GDI library gdi32.dll. As a quick reminder, the DIB-embedding records follow a common scheme: they include four fields, spots denotin...
ruvar OA系统 SearchCondiction.aspx等3处 SQL注入漏洞
0x01漏洞简介 ruvar OA系统在以下3处存在SQL注入漏洞： 1WebUtility/SearchCondiction.aspx 2WebUtility/getfindcondiction.aspx 3include/getdict.aspx 0x02漏洞验证 NO.1：加单引号 ' 直接报错： NO.2：PageID 参数存在注入 NO.3：btid 参数存在注入 0x03修复方案 过滤，或者使用参数化的SQL语句。...
Discuz 7.2 admincp.php 反射型 xss漏洞
漏洞描述：Discuz! 7.X系列一处问题引发大面积XSS，基本上全部页面和文件都能触发。Discuz! 7.2,7.1,7.0三个版本都受影响漏洞分析：这里拿Discuz! 7.2做分析比如Discuz! 7.2安装包里面的第二个文件就是ajax.php注意最后一行的showmessage函数，跟进include/global.func.php文件。...
MacCMS V8 /inc/module/user.php SQL注入漏洞
No description provided by source...
ManageEngine Desktop Central StatusUpdate Arbitrary File Upload
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...
某教育类通用cms任意文件下载漏洞
简要描述： 某教育类通用cms任意文件下载漏洞 详细说明： 不知道算不算通用 可下载web.config文件，数据库信息文件泄露 http://sbc.xzit.edu.cn/hxjc/DownLoad.aspx?Accessory=../web.config http://hedds.njutcm.edu.cn/DownLoad.aspx?Accessory=../web.config http://www.emcjs.org/DownLoad.aspx?Accessory=../web.config...
Crossday Discuz! 2.0/3.0 Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9584/info It has been reported that Discuz! is prone to an Cross Site Scripting vulnerability. This issue is caused by the application failing to properly sanitize links embedded within user messages. Upon successful...
Linux Kernel <= 2.6.33.3 SCTP INIT Remote DoS
No description provided by source. From: http://jon.oberheide.org/files/sctp-boom.py !/usr/bin/env python ''' sctp-boom.py Linux Kernel = 2.6.33.3 SCTP INIT Remote DoS Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1173...
OpenSSL < 0.9.7l / 0.9.8d - SSLv2 Client Crash Exploit
No description provided by source. !/usr/bin/perl Copyrightc Beyond Security Written by Noam Rathaus - based on beSTORM's SSL Server module Exploits vulnerability CVE-2006-4343 - where the SSL client can be crashed by special SSL serverhello response use strict; use IO::Socket; my $sock = new...
FreePBX 2.5.x - Information Disclosure
FreePBX 2.5.x 'admin/config.php'密码信息泄漏漏洞 1. 漏洞信息 FreePBX是一款用来控制Asterisk的图形化接口。 能访问管理段的用户可以通过查看HTML源代码来获得其他管理员的密码信息。 2.漏洞使用方法 访问管理段用户的url http://localhost/admin/config.php?display=ampusers&userdisplay=admin 查看网页源码 PasswordCreate a password for this new user: 可以看到了密码 3.厂商解决方案 freePBX...
K-Meleon 1.5.3 - Remote Array Overrun
No description provided by source. From Full Disclosure: http://seclists.org/fulldisclosure/2009/Nov/222 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 K-Meleon 1.5.3 Remote Array Overrun Arbitrary code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - - Dis.:...
Java Applet AverageRangeStatisticImpl Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class...
Linux Kernel < 2.6.37-rc2 ACPI custom_method Privilege Escalation
No description provided by source. / american-sign-language.c Linux Kernel 2.6.37-rc2 ACPI custommethod Privilege Escalation Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4347 This custommethod file allows to inject...
Siemens SIMATIC WinCC Flexible (Runtime) Multiple Vulnerabilities
No description provided by source. Luigi Auriemma Application: Siemens SIMATIC WinCC flexible Runtime http://www.automation.siemens.com/mcms/human-machine-interface/en/visualization-software/wincc-flexible/wincc-flexible-runtime/Pages/Default.aspx Versions: 2008 SP2 + security patch 1 Platforms:...
MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2013-019: Multiple Vulnerabilities in MiCasaVerde VeraLite Published: 08/01/13 Version: 1.0 Vendor: MiCasaVerde http://www.micasaverde.com/ Product: VeraLite Version affected: 1.5.408 Product description: The MiCasaVerd...
KnowledgeBuilder 2.0/2.1/3.0 - Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9292/info KnowledgeBuilder is prone to a remote file include vulnerability. An attacker could exploit this to cause hostile PHP scripts to be included and executed from a remote server. This would occur in the security...
Lotus Domino <= R6 Webmail Remote Password Hash Dumper Exploit
No description provided by source. !/bin/bash $Id: raptordominohash,v 1.3 2007/02/13 17:27:28 raptor Exp $ raptordominohash - Lotus Domino R5/R6 HTTPPassword dump Copyright c 2007 Marco Ivaldi [email protected] Lotus Domino R5 and R6 WebMail, with Generate HTML for all fields enabled, stores...
Sun Java System Calendar Server 6.3 Duplicate URI Request Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/34150/info Sun Java System Calendar Server is prone to a denial-of-service vulnerability because it fails to handle certain duplicate URI requests. An attacker can exploit this issue to crash the Calendar Server, resultin...
XYCMS心理咨询中心建站系统存在SQL注入
简要描述： 。。。 详细说明： 下载地址:http://down.chinaz.com/soft/34989.htm 漏洞存在于: pxxmdetail.asp id=request.QueryString"id" set rs=server.createobject"adodb.recordset" exec="select from pxxm where id="& id rs.open exec,conn,1,1 if rs.eof then response.Write "没有相关信息！" response.End end if 未加入过滤代码导致注入产生 漏洞证明： 关键字:...
OpenSSL ECDSA Nonces恢复漏洞
CVE ID:CVE-2014-0076 OpenSSL是一款开放源码的SSL实现，用来实现网络通信的高强度加密。 OpenSSL椭圆曲线签名与校验ECDSA实现存在错误，允许攻击者通过FLUSH+RELOAD缓存边道攻击来获取nonce值并之后得出私钥。 0 OpenSSL 1.x 用户可参考厂商的GIT库以获得补丁修复此漏洞： http://www.openssl.org/...
SeedDMS '/op/op.AddFile2.php'任意文件上传漏洞
Bugtraq ID:66255 CVE ID:CVE-2014-2278 SeedDMS是一个强大易用的文档管理系统。 SeedDMS /op/op.AddFile2.php上传功能不充分的访问控制，允许攻击者控制上传文件的位置，并上传任意文件类型的文件，以服务器上下文执行任意代码。 0 SeedDMS 4.3.3 SeedDMS 4.3.4已经修复该漏洞，建议用户下载更新： https://sourceforge.net/projects/seeddms/files/seeddms-4.3.4/...
Maccms V8 Sql Injection #2
简要描述： 现在 V8版本 基本全部文件都有zend加密了。 只有那么少数的几个文件没加密。。 我就看看那几个把。。 详细说明： 在inc/user/alipay/notifyurl.php中 $alipayNotify = new AlipayNotify$alipayconfig; $verifyresult = $alipayNotify-verifyNotify; $verifyresult2 = $alipayNotify-verifyReturn; if$verifyresult //验证成功...
IBM Algo One Algo多个安全漏洞
CVE ID:CVE-2013-6299、CVE-2013-6300、CVE-2013-6301、CVE-2013-6302、CVE-2013-6303、CVE-2013-6318、CVE-2013-6319、CVE-2013-6320、CVE-2013-6331、CVE-2013-6333 IBM Algo One是一个风险管理软件解决方案。 IBM Algo One存在多个安全漏洞： 1，应用程序不正确校验用户权限，允许攻击者利用漏洞获取受限内容。 2，存在多个跨站脚本漏洞，允许攻击者构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。...
Apache Tomcat会话固定漏洞
Bugtraq ID:65769 CVE ID:CVE-2014-0033 Apache Tomcat是一款开放源码的JSP应用服务器程序。 由于对路径参数处理的修复引入的回溯，即使在启用disableURLRewriting的情况下也可导致一个会话固定攻击，允许远程攻击者利用漏洞未授权访问应用。 0 Apache Tomcat 6.0.0 - 6.0.37 厂商补丁： Apache ----- Apache Tomcat 6.0.39已经修复该漏洞，建议用户下载更新： http://tomcat.apache.org/...