56796 matches found
WEBO (Web Organizer) <= 1.0 (baseDir) Remote File Inclusion Vuln
No description provided by source. \ /\ / | \ | / // / | | \ \ Y / | / / \ /\| /\ / / / / / .OR.ID ECHOADV67$2007 ----------------------------------------------------------------------------------------- ECHOADV67$2007 WEBO Web Organizer = 1.0 baseDir Remote File Inclusion Vulnerability...
SSH Tectia Windows特定路径特权提升漏洞
SSH Tectia基于SSH技术，集中管理情况下提供 安全的系统管理，安全的文件传输，安全的程序之间的连接。 Windows版本下的SSH Tectia产品在子进程执行中处理路径名存在漏洞，本地攻击者可以利用漏洞提升特权。 如果本地用户允许建立系统盘ROOT目录中或者"Program Files"文件夹或其子目录中建立文件，就可能放置恶意程序代替正确的SSH Tectia子组件，结果导致以高权限执行任意程序。 SSH Communications Security Tectia Server 5.0.1 SSH Communications Security Tectia Server...
PHP-Nuke Category参数SQL注入漏洞
PHP-Nuke是一个广为流行的网站创建和管理工具，它可以使用很多数据库软件作为后端，比如MySQL、PostgreSQL、mSQL、Interbase、Sybase等。PHP-Nuke包含的'index.php'脚本对用户提交的参数缺少充分过滤，远程攻击者可以利用这个漏洞进行SQL注入攻击，可能获得数据库敏感信息及修改数据库内容。当执行搜索时，index.php脚本对用户提交给$category变量的数据缺少充分过滤，提交包含SQL命令的数据作为$category变量参数，可更改原来数据库逻辑，获得数据库敏感信息及修改数据库内容。 Francisco Burzi...
Cisco Secure Desktop多个安全漏洞
Cisco Secure Desktop CSD可以通过加密降低远程用户注销或SSL VPN会话超时后Cookies、浏览器历史记录、临时文件和下载内容在系统上所遗留的风险。 CSD受以下漏洞的影响： 生成的浏览器导致信息泄漏 +-------------------------------------- 如果在创建了SSL VPN会话之后，所自动生成的用于显示主页的Internet浏览器使用了CSD所维护库文件之外目录来储存其会话信息的话，就会出现这个漏洞。这个漏洞还允许用户将在这个Internet浏览会话期间所下载的文件保存到CSD库文件之外，导致在SSL...
MS Windows COM Structured Storage Local Exploit (MS05-012)
No description provided by source. // by Cesar Cerrudo - Argeniss - www.argeniss.com // MS05-012 - COM Structured Storage Vulnerability - CAN-2005-0047 Exploit // // More exploits at www.argeniss.com/products.html // // Works on Win2k sp4, WinXP sp2, Win2k3 sp0 // Close all runing programs to avo...
Microsoft Windows MHTML超长URI串溢出漏洞（MS06-043）
Microsoft Windows是微软发布的非常流行的操作系统。 inetcomm.dll在使用"mhtml:" URI解析器处理URL时存在栈溢出漏洞，成功利用此漏洞的攻击者可以完全控制受影响的系统。 攻击者可以通过超长的URL来触发这个漏洞，如诱骗用户通过Internet Explorer打开恶意的站点或打开特制的Internet快捷方式。 Microsoft Windows XP SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows Server 2003 x64 Edition Microsoft...
Attack on Pseudo-random number generator (PRNG) used in 1000 Guess, an Ethereum lottery game. (CVE-2018–12454)
Abstract An Ethereum lottery game, 1000 Guess, has a vulnerability that it generates random numbers predictable by anyone. This game decides a winner by a random number when the number of players who bet on the contract reaches to the predetermined number. The contract generates the random number...
ZKTeco ZKAccess Security System 5.3.1 Stored XSS Vulnerability
Summary ZKAccess Systems are built on flexible, open technology to provide management, real-time monitoring, and control of your access control system-all from a browser, with no additional software to install. Our secure Web-hosted infrastructure and centralized online administration reduce your...
Broadcom: Multiple overflows when handling 802.11r (FT) Reassociation Response(CVE-2017-11121)
Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. In order to allow fast roaming between access...
Tarantool Key-type Denial Of Service Vulnerability(CVE-2016-9037)
Summary An exploitable out-of-bounds array access vulnerability exists in the xrowheaderdecode function of Tarantool 1.7.2.0-g8e92715. A specially crafted packet can cause the function to access an element outside the bounds of a global array that is used to determine the type of the specified...
Moxa AWK-3131A HTTP GET Denial of Service Vulnerability(CVE-2016-8723)
Summary An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET request not preceded by an '/' will cause a segmentation fault in the web server. An attacker can send any of a multitude of...
Poppler PDF Image Display DCTStream::readScan() Code Execution Vulnerability(CVE-2017-2814)
Summary An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler-0.53.0. A specifically crafted pdf can cause an image resizing after allocation has already occurred, resulting in heap corruption which can lead to code execution. An attacker controlled PDF...
FreeRDP Rdp Client License Read Product Info Denial of Service Vulnerability(CVE-2017-2838)
Summary An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use ma...
FreeRDP Rdp Client Recv RDP Code Execution Vulnerability(CVE-2017-2835)
Summary An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middl...
Hanbanggaoke IP Camera Arbitrary Password Change
Vulnerability summary The following advisory describes an arbitrary password change vulnerability found in Hanbanggaoke webcams. Beijing Hanbang Technology, “one of the first enterprises entering into digital video surveillance industry, has been focusing on R&D of products and technology of...
Remote Exploitation of the NeoCoolcam IP Cameras and Gateway
Foreword The Internet of Connected Things has become a massive phenomenon during the past few years and will continue to grow at an incredible pace. More than 26 billion smart devices will be on the market by 2020, Gartner estimates. We’re looking at an explosive growth, as IoT opportunities...
OnePlus OTA Downgrade Vulnerability(CVE-2017-5948)
Products OnePlus 3T OnePlus 3 OnePlus 2 OnePlus X OnePlus One Vulnerable Version All OnePlus OxygenOS & HydrogenOS OTAs Technical Details lenient updater-script in the OnePlus OTAs which does not check that the current version is lower than or equal to the given image’s see below the 4.0.0...
MsMpEng: Remotely Exploitable Type Confusion(CVE-2017-0290)
MsMpEng is the Malware Protection service that is enabled by default on Windows 8, 8.1, 10, Windows Server 2012, and so on. Additionally, Microsoft Security Essentials, System Centre Endpoint Protection and various other Microsoft security products share the same core engine. MsMpEng runs as NT...
Broadcom: Stack buffer overflow when handling 802.11r (FT) authentication response (CVE-2017-6975)
Detailed analysis of reference : the https://googleprojectzero.blogspot.tw/2017/04/over-air-exploiting-broadcoms-wi-fi4.html the first part https://googleprojectzero.blogspot.tw/2017/04/over-air-exploiting-broadcoms-wi-fi11.html Part II Broadcom produces the Wi-Fi HardMAC SoCs which are used to...
WordPress Plugin Mail Masta 1.0 - SQL Injection
Vulnerability information Vulnerability title: WordPress Plugin Mail Masta 1.0 - SQL Injection Plugin home page: https://wpcore.com/plugin/mail-masta Vulnerability type: SQL injection CVE : CVE-2017-6095, CVE-2017-6096, CVE-2017-6097, CVE-2017-6098 Vulnerability analysis The first injection...
Windows gdi32.dll heap-based out-of-bounds reads / memory disclosure (CVE-2017-0038)
In issue 757, I described multiple bugs related to the handling of DIBs Device Independent Bitmaps embedded in EMF records, as implemented in the user-mode Windows GDI library gdi32.dll. As a quick reminder, the DIB-embedding records follow a common scheme: they include four fields, spots denotin...
Mastery OA /general/mytable/intel_view/video_file.php arbitrary File Download vulnerability
No description provided by source...
XYCMS健身会所建站系统 v1.1 jsxm_detail.asp 参数id SQL注入漏洞
0x01漏洞简介 XYCMS健身会所建站系统采用asp+access架构。其v1.1版本在/jsxmdetail.asp处对参数id 过滤不严，导致出现SQL注入漏洞。 0x02漏洞详情 该系统默认存在一个管理员数据表adminuser，该表包含管理员名称字段admin和密码 md5加密字段password，远程攻击者可以结合union方式获取敏感信息，登陆后台，上传shell。 0x03修复方案 过滤。...
ruvar OA系统 SearchCondiction.aspx等3处 SQL注入漏洞
0x01漏洞简介 ruvar OA系统在以下3处存在SQL注入漏洞： 1WebUtility/SearchCondiction.aspx 2WebUtility/getfindcondiction.aspx 3include/getdict.aspx 0x02漏洞验证 NO.1：加单引号 ' 直接报错： NO.2：PageID 参数存在注入 NO.3：btid 参数存在注入 0x03修复方案 过滤，或者使用参数化的SQL语句。...
ACTi E31 surveillance Cameras 弱密码漏洞
Introduction The Perception Point Research team has identified a 0-day local privilege escalation vulnerability in the Linux kernel. While the vulnerability has existed since 2012, our team discovered the vulnerability only recently, disclosed the details to the Kernel security team, and later...
Discuz问卷调查专业版插件参数orderby存在SQL注入漏洞
No description provided by source...
Rockwell Automation /Allen-Bradley 1734-AENT 弱口令
No description provided by source...
Cisco ASR 1000 IOS XE安全绕过漏洞
漏洞详情： CVE ID CVE-2015-6383 漏洞描述 Cisco IOS XE on ASR 1000是美国思科（Cisco）公司的一套运行于ASR 1000系列路由器设备中的操作系统。 Cisco ASR 1000设备上的IOS XE 15.43S版本中存在安全漏洞，由于程序未能正确加载软件程序包。本地攻击者可通过使用命令行输入特制的文件名，利用该漏洞绕过许可限制，获取root权限。 参考链接 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6383...
MetInfo5.3 /include/interface/uidata.php信息泄露
MetInfo5.3中文件：/include/interface/uidata.php存在信息泄露问题。由于该模板后台存在找回管理员密码的功能 ，通过该页面可以获取后台设置的邮件密码。之后通过登录邮件系统即可重置密码。 requireonce '../common.inc.php'; requireonce ROOTPATH.'include/export.func.php'; // dump$M'config'; $data'config'=$M'config';//这个$M'config'是从数据库查出来的配置数据。 echo jsonencode$data; //直接给打印出了。。...
用友致远A6协同系统 Session泄漏漏洞
该漏洞泄露了当前登录用户（所有登录的）的SessionID;利用泄露的SessionID即可登录该用户，包括管理员，进入后getshell毫无压力/yyoa/ext/https/getSessionList.jsp部分代码%@ page contentType="text/html;charset=GBK"% %@ page session= "false" % %@ page import="net.btdz.oa.ext.https."% % String reqType = request.getParameter"cmd"; String outXML = ""; boolean...
程氏舞曲 任意文件下载与设计缺陷
简要描述： 有利用条件！烦。 详细说明： 利用条件： 1、cms设置使用本机物理路径，就是上传文件存在本机服务器上。 2、后台关闭审核功能，或者通过审核。 条件1比较好达到，一般都在本机上。 条件2需要精心构造一下。 漏洞页面： user/music.php addsave函数用来上传歌曲的，这里提交数据包。...
U-Mail最新版任意文件下载漏洞
简要描述： 下载了最新版的umail，发现漏洞还不少，不过上wooyun一搜索，都是以前大牛提交过了，只好另找一个了。任意文件下载，泄露系统重要敏感信息，还可导致可下载任意用户的全部邮件。u-mail的使用量就不说了，可以参考： http://www.wooyun.org/bugs/wooyun-2010-061859 详细说明： 问题出现的位置是在图片预览的地方...
Windows OLE Package Manager SandWorm Exploit
No description provided by source. !/usr/bin/env python import os import zipfile import sys ''' Full Exploit: http://www.exploit-db.com/sploits/35019.tar.gz Very quick and ugly SandWorm CVE-2014-4114 exploit builder Exploit Title: CVE-2014-4114 SandWorm builder Built to run on: Linux/MacOSX Date:...
CmsEasy 5.5 /lib/default/archive_act.php SQL注入漏洞
No description provided by source...
Supermicro Onboard IPMI Port 49152 敏感文件泄露漏洞
关于 IPMI：智能平台管理接口 IPMI 是一种开放标准的硬件管理接口规格，定义了嵌入式管理子系统进行通信的特定方法。IPMI 信息通过基板管理控制器 BMC（位于 IPMI 规格的硬件组件上）进行交流。IPMI是智能型平台管理接口（Intelligent Platform Management Interface）的缩写，是管理基于...
Spaceacre (index.php) SQL/HTML/XSS Injection Vulnerability
No description provided by source. ------------------------------------------------------------------------------------------- Spaceacre index.php SQL/HTML/XSS Injection Vulnerability ------------------------------------------------------------------------------------------- Author: CoBRa21 Scrip...
Siemens Simatic S7-300 PLC Remote Memory Viewer
No description provided by source. Exploit Title: Siemens Simatic S7 300 Remote Memory Viewer Backdoor Date: 7-13-2012 Exploit Author: Dillon Beresford Vendor Homepage: http://www.siemens.com/ Tested on: Siemens Simatic S7-1200 PLC CVE : None require 'msf/core' class Metasploit3 Msf::Auxiliary...
TP-Link TL-WR740N Wireless Router - Denial of Service Exploit
No description provided by source. ?!/usr/local/bin/perl TP-Link TL-WR740N Wireless Router Remote Denial Of Service Exploit Vendor: TP-LINK Technologies Co., Ltd. Product web page: http://www.tp-link.us Affected version: - Firmware version: 3.16.4 Build 130205 Rel.63875n Released: 2/5/2013 -...
Social Sites MyBB Plugin 0.2.2 - Cross Site Scripting
No description provided by source. Exploit Title: Social Sites MyBB Plugin 0.2.2 Cross Site Scripting Google Dork: inurl:usercp.php?action=socialsites Date: 13.12.2012 Exploit Author: s3m00t Vendor Homepage: http://mattrogowski.co.uk/mybb/ Software Link: http://mods.mybb.com/view/social-sites...
Apple Safari 6.0.1 for iOS 6.0 and OS X 10.7/8 - Heap Buffer Overflow
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------------+ | Packet Storm Advisory 2013-0903-1 | | http://packetstormsecurity.com/ |...
E107 Website System 0.6 Attached File Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14495/info e107 Website System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have...
CakePHP <= 1.3.5 / 1.2.8 unserialize() Vulnerability
No description provided by source. Source: http://securityreason.com/securityalert/8026 CakePHP = 1.3.5 / 1.2.8 unserialize Vulnerability felix |at| malloc.im =========================================================================== ==== Overview: CakePHP is a rapid development framework for PH...
Ultimate PHP Board 1.0 final beta ViewTopic.PHP Directory Contents Browsing
No description provided by source. source: http://www.securityfocus.com/bid/6334/info Ultimate PHP Board UPB is a freely available, open source PHP Bulletin Board. It is available for the Unix and Linux operating systems. Under some circumstances, it may be possible to disclose the contents of...
Emefa Guestbook 3.0 - Remote Database Disclosure Vulnerability
No description provided by source. Title: Emefa Guestbook V 3.0 Remote Database Disclosure Vulnerability Credit: Cyber.Zer0 E-mail: Cyber.Zer04tHotmaildotcom Download: http://www.emefa.dyndns.org/downloads/ Remote: Yes Dork: Emefa Guestbook V 3.0 --=Database Disclosure=--...
Sun xVM VirtualBox < 1.6.4 Privilege Escalation Vulnerability PoC
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Sun xVM VirtualBox Privilege Escalation Vulnerability Advisory Information Title: Sun xVM VirtualBox Privilege Escalation...
Mac OSX Server DirectoryService Buffer Overflow
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Mac OSX Server DirectoryService buffer overflow 1. Advisory Information Title: Mac OSX Server DirectoryService buffer overflow Advisory ID: CORE-2013-0103 Advisory URL:...
KnowledgeBuilder 2.0/2.1/3.0 - Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9292/info KnowledgeBuilder is prone to a remote file include vulnerability. An attacker could exploit this to cause hostile PHP scripts to be included and executed from a remote server. This would occur in the security...
RunCMS <= 1.2 (class.forumposts.php) Arbitrary Remote Inclusion Exploit
No description provided by source. ?php ---runcms13axpl.php 17.30 09/02/2006 RunCMS = 1.2 arbitrary remote inclusion exploit = 1.3a shell upload through FCKEditor coded by rgod site: http://retrogod.altervista.org usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: But when the...