56796 matches found
Trend Micro OfficeScan管理控制台验证绕过漏洞
Trend Micro OfficeScan是一款企业级的网络防毒墙解决方案。 Trend Micro OfficeScan存在验证绕过问题，远程攻击者可以利用漏洞未授权登录管理接口并更改应用程序设置。 OfficeScan安装包含的WEB管理接口允许管理员配置应用程序和反病毒客户端管理。WEB接口由cgiChkMasterPwd.exe处理，传递由ActiveX控件生成的HASH和密码的加密版本。如果cgiChkMasterPwd.exe发送一个空的加密字符串和空的HASH，它会发送客户端一个合法会话ID用于访问WEB管理控制台。 Trend Micro OfficeScan...
Program Checker (sasatl.dll 1.5.0.531) Javascript Heap Spraying Exploit
No description provided by source. :. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: sasatl.dll 1.5.0.531 Program Checker - Javascript Heap Spraying Exploit ======================================================================== Internal ID: VULWAR200706280...
PHP 5 PHP_Stream_Filter_Create()函数缓冲区溢出漏洞
PHP是一款广泛使用的WEB开发脚本语言。 PHP phpstreamfiltercreate存在缓冲区溢出，远程攻击者可利用此漏洞以应用程序进程权限执行任意指令。 当一个过滤器通过phpstreamfiltercreate函数建立时，会首先在HASH表中通过名字搜索过滤器，如果不成功会检查是否有通用过滤器支持请求的过滤器，这通过如下代码执行： if SUCCESS == zendhashfindfilterhash, charfiltername, n, void&factory filter = factory-createfilterfiltername, filterparams...
PHP-Nuke Module Eve-Nuke 0.1 (mysql.php) RFI Vulnerability
No description provided by source. =========================================================================================== Eve-NukePortal file include phpbbrootpath =========================================================================================== Script name :Eve-Nuke Portal Downloa...
Mambo CopperminePhotoGalery Component Remote Include Vulnerability
No description provided by source. CopperminePhotoGallery Component Found By k1tk4t Indonesia This bug allows a remote atacker to execute commands via RFI file: cpg.php bug: require $mosConfigabsolutepath."/administrator/components/comcpg/config.cpg.php"; path: add in cpg.php defined 'VALIDMOS' o...
Xerox WorkCentre及WorkCentre Pro多个安全漏洞
Xerox WorkCentre是一款数码打印复印一体机。 Xerox WorkCentre的ESS/Network Controller和MicroServer Web Server代码中存在多个安全漏洞，具体如下： Web用户接口上的TCP/IP用户名存在命令注入漏洞； Web用户接口上的Scan-to-mailbox文件夹名称字段存在命令注入漏洞； Web用户接口上的Microsoft Networking配置参数存在命令注入漏洞； 浏览器权限可能允许非授权访问； TFTP/BOOTP自动配置选项可能允许非授权的配置设置； 可使用HTTP而不是HTTPS发布Web服务请求；...
MS Windows COM Structured Storage Local Exploit (MS05-012)
No description provided by source. // by Cesar Cerrudo - Argeniss - www.argeniss.com // MS05-012 - COM Structured Storage Vulnerability - CAN-2005-0047 Exploit // // More exploits at www.argeniss.com/products.html // // Works on Win2k sp4, WinXP sp2, Win2k3 sp0 // Close all runing programs to avo...
Microsoft Windows MHTML超长URI串溢出漏洞（MS06-043）
Microsoft Windows是微软发布的非常流行的操作系统。 inetcomm.dll在使用"mhtml:" URI解析器处理URL时存在栈溢出漏洞，成功利用此漏洞的攻击者可以完全控制受影响的系统。 攻击者可以通过超长的URL来触发这个漏洞，如诱骗用户通过Internet Explorer打开恶意的站点或打开特制的Internet快捷方式。 Microsoft Windows XP SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows Server 2003 x64 Edition Microsoft...
RsGallery2 <= 1.11.2 (rsgallery.html.php) File Include Vulnerability
No description provided by source. RsGallery2 for Joomla --------------------------------------------------------------------------- Discovered: marriottvn Remote : Yes Level : High --------------------------------------------------------------------------- Affected software description :...
Nukedit CMS <= 4.9.6 Unauthorized Admin Add Exploit
No description provided by source. KAPDA - Security Science Researchers Institute Advisory : http://www.kapda.ir/advisory-337.html Vendor : http://www.nukedit.com/ What is : Nukedit is a Free Content Management Vulnerability : Unauthorized Admin Add Exploit if "register.asp" be enable! Discovered...
Apache OFBiz 代码执行漏洞（CVE-2021-30128）
...
Windows TCP/IP 拒绝服务漏洞（CVE-2021-24086）
...
Multiple critical vulnerabilities in AGFEO smart home ES 5xx/6xx products
Vendor description: AGFEO GmbH & Co. KG is a vendor of telephone systems and other tele-communication products like DECT phones, headsets or smart home products as well. Business recommendation: The available patches should be installed immediately. SEC Consult recommends not to use this product ...
New batchOverflow Bug in Multiple ERC20 Smart Contracts (CVE-2018–10299)
Built on our earlier efforts in analyzing EOS tokens, we have developed an automated system to scan and analyze Ethereum-based ERC-20 token transfers. Specifically, our system will automatically send out alerts if any suspicious transactions e.g., involving unreasonably large tokens occur. In...
Dedecms V5.7后台的两处getshell(CVE-2018-9175)
第一个是常见的思路，把语句写入inc文件，然后在其他的include语句中，包含了恶意代码进而getshell。 漏洞代码在:/dede/sysverifies.php 代码如下： else if $action == 'getfiles' if!isset$refiles ShowMsg"你没进行任何操作！","sysverifies.php"; exit; $cacheFiles = DEDEDATA.'/modifytmp.inc'; $fp = fopen$cacheFiles, 'w'; fwrite$fp, ''; fclose$fp; $dirinfos = ''; if$...
Windows Kernel 64-bit pool memory disclosure via REG_RESOURCE_LIST registry values (CmResourceTypeDevicePrivate entries)(CVE-2018-0898)
We have discovered a Windows kernel memory disclosure vulnerability through the body of "AllocConfig" registry values of type REGRESOURCELIST, which can be found under HKLM\SYSTEM\CurrentControlSet\Enum\\Control\AllocConfig. The vulnerability affects 64-bit versions of Windows 7 to 10. The leak...
D-Link DNS-343 ShareCenter < 1.05 - Command Injection
Introduction The purpose of this article is to detail the research that I have recently completed regarding the D-Link DNS 343 ShareCenter. Background The D-Link ShareCenter 4-Bay Network Storage Enclosure DNS-343 connects to your network instead of to a computer so everyone on your network can...
CPP-Ethereum libevm create2 Information Leak Vulnerability(CVE-2017-14457)
Summary An exploitable information leak / denial of service vulnerability exists in the libevm Ethereum Virtual Machine create2 opcode handler of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read leading to memory disclosure or denial of service. An attacker ca...
Claymore's Dual Ethereum Miner unauth stack buffer overflow(CVE-2017-16929)
VuNote =================== Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-16929 Version: 0.2 Date: Nov 30th, 2017 Tag: claymore dual ethereum decred crypto currency miner Overview -------- Name: Claymore's Dual ETH + DCR/SC/LBC/PASC GPU Miner Vendor: nanopool/claymore...
Apple Core Graphics BMP Framework img_decode_read Remote Code Execution Vulnerability(CVE-2016-4637)
SUMMARY An exploitable out of bounds write exists in the handling of BMP images on Apple OS X and iOS. A crafted BMP document can lead to an out of bounds write resulting in remote code execution. Vulnerability can be triggered via a saved BMP file delivered by other means when opened in any...
Poppler PDF Image Display DCTStream::readScan() Code Execution Vulnerability(CVE-2017-2814)
Summary An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler-0.53.0. A specifically crafted pdf can cause an image resizing after allocation has already occurred, resulting in heap corruption which can lead to code execution. An attacker controlled PDF...
Invincea Dell Protected Workspace Protection Bypass(CVE-2016-8732)
Summary Multiple security flaws exists in InvProtectDrv.sys which is a part of Invincea Dell Protected Workspace 5.1.1-22303. Weak restrictions on the driver communication channel and additonal insufficient checks allow any application to turn off some of the protection mechanisms provided by the...
FreeRDP Rdp Client License Read Product Info Denial of Service Vulnerability(CVE-2017-2838)
Summary An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use ma...
Supervisor Authenticated Remote Code Execution(CVE-2017-11610)
Vulnerability Summary The following advisory describes an authenticated remote code execution vulnerability in Supervisor version 3.1.2 and Supervisor version 3.3.2. Supervisor is a client/server system that allows its users to monitor and control a number of processes on UNIX-like operating...
MsMpEng: Remotely Exploitable Type Confusion(CVE-2017-0290)
MsMpEng is the Malware Protection service that is enabled by default on Windows 8, 8.1, 10, Windows Server 2012, and so on. Additionally, Microsoft Security Essentials, System Centre Endpoint Protection and various other Microsoft security products share the same core engine. MsMpEng runs as NT...
Microsoft Windows Code injection vulnerability (DoubleAgent)
Overview We’d like to introduce a new Zero-Day technique for injecting code and maintaining persistency on a machine i.e. auto-run dubbed DoubleAgent. DoubleAgent can exploit: Every Windows version Windows XP to Windows 10 Every Windows architecture x86 and x64 Every Windows user...
Mastery OA /general/mytable/intel_view/video_file.php arbitrary File Download vulnerability
No description provided by source...
D-Link DSR-250N路由器登录绕过
No description provided by source...
网康安全网关 默认弱口令漏洞
No description provided by source...
泛微e-office E-mobile/Data/downfile.php url参数 任意文件下载
漏洞信息： 泛微e-office是泛微公司面向中小型组织推出的OA产品,简单易用高效,部署快、投资少。提供免费试用体验。至今已为超过一万家客户提供方便高效的办公体验。 泛微e-office存在任意文件上传漏洞导致敏感信息泄漏。 漏洞分析： 漏洞存在于E-mobile/Data/downfile.php $fileurl = $REQUEST'url'; $sessionstr = $REQUEST'sessionkey'; $strexplode = explode ",", $sessionstr ; $sessionkey = $strexplode0; $curruserid =...
FHFS - FTP/HTTP File Server 2.1.2 远程命令执行
No description provided by source. !/usr/bin/python FHFS - FTP/HTTP File Server 2.1.2 Remote Command Execution Author: Naser Farhadi Date: 26 August 2015 Version: 2.1.2 Tested on: Windows 7 SP1 32 bit Link : http://sourceforge.net/projects/fhfs/ Description : FHFS is a FTP and HTTP Web Server...
方正阿帕比数字资源平台系统多处漏洞打包-可拖库-可getshell-可获取系统权限（通用 多案例）
简要描述： 乌云是目前最大的漏洞平台，只要你知道的系统、网站，它们的漏洞都可以从乌云上找到，所以乌云的漏洞库是一笔无形的巨大财富 详细说明： Apabi数字资源平台系统是一个用户量很大的图书馆系统 涉及网站太多为图书馆、学校等教育机构，甚至地方人社局等，而绝大部分服务器都不是单一的运行着这一套系统...真是个好“邻居”... None 漏洞证明： 漏洞证明在上面详细说明里已足够、拿下webshell后在99.9%均可获取到系统权限，进入远程桌面任意操作。这里就不证明了，并无深入！...
PHPMyWind一枚注入
简要描述： rt 详细说明： Finger能把这个合到之前那个洞一起么 类似的 漏洞文件 /member.php else if$a == 'binding' //初始化参数 $username = empty$username ? '' : $username; $password = empty$password ? '' : md5md5$password; //验证输入数据 if$username == '' or $password == '' header'location:?c=binding'; exit; $row = $dosql-GetOne"SELECT...
程氏舞曲 任意文件下载与设计缺陷
简要描述： 有利用条件！烦。 详细说明： 利用条件： 1、cms设置使用本机物理路径，就是上传文件存在本机服务器上。 2、后台关闭审核功能，或者通过审核。 条件1比较好达到，一般都在本机上。 条件2需要精心构造一下。 漏洞页面： user/music.php addsave函数用来上传歌曲的，这里提交数据包。...
强智教务系统通用型文件上传（getshell）
简要描述： 任意上传getshell 详细说明： 看见前人提交了一个 WooYun: 强智教务系统通杀Getshell提权服务器内网渗透 ，我也来提交一下。。。 1，任意文件上传 漏洞文件 /jwgl/jxjh/JxjhXGBc.asp 部分源码如下： 文件上传 - 长沙市强科技发展有限责任公司·版权所有 0 then '如果出错 select case upfile.err case 1 Response.Write "你没有上传数据呀???是不是搞错了??" case 2 Response.Write "你上传的文件超出我们的限制,最大10M" end select else %...
Windows OLE Package Manager SandWorm Exploit
No description provided by source. !/usr/bin/env python import os import zipfile import sys ''' Full Exploit: http://www.exploit-db.com/sploits/35019.tar.gz Very quick and ugly SandWorm CVE-2014-4114 exploit builder Exploit Title: CVE-2014-4114 SandWorm builder Built to run on: Linux/MacOSX Date:...
全国高校某数字化校园统一认证平台一键获取管理员权限
简要描述： 数字化校园统一认证平台，进入之后，可以管理高校所以其他任意系统，如OA办公系统，图书馆系统，教务系统，多媒体平台等。一个权限认证绕过，可导致整个内网数据沦陷。 详细说明： 前言：此漏洞属猜解绕过，无技术含量，但影响大。 因为通用型，我们这里找了一个示例站点来作范例， 四川航天职业技术学院 http://220.167.53.63:8023/zfca/ 这个链接官网主页上面有，所以容易找到。 下面看图示： 我们这里直接常用思路，找回密码试试 这里没有密保手机和邮箱，只有试尝试密保问题找回咯，填入admin吧！...
大米cms 暴力getshell
简要描述： rt.最近流行路人甲。 详细说明： 看到 install\index.php 漏洞证明： 如上所述。官网就不测试了。...
TinyWebGallery 1.8.3 - Multiple Vulnerabilities
No description provided by source. Date: 01/02/2011 dd/MM/yyyy Script: TinyWebGallery Version: 1.8.3 No fixes yet, might work on other versions too. Home: http://www.tinywebgallery.com -- Vulnerability: Non-persistent XSS Where: File: /admin/index.php Parameters: sview, tview, dir, item. Examples...
LANDesk Management Gateway 'gsb/drivers.php'代码注入漏洞
No description provided by source. 1. Advisory Information Title: Landesk OS command injection Advisory Id: CORE-2010-1018 Advisory URL: http://www.coresecurity.com/content/landesk-os-command-injection-vulnerability Date published: 2010-11-10 Date of last update: 2010-11-10 Vendors contacted:...
Emefa Guestbook 3.0 - Remote Database Disclosure Vulnerability
No description provided by source. Title: Emefa Guestbook V 3.0 Remote Database Disclosure Vulnerability Credit: Cyber.Zer0 E-mail: Cyber.Zer04tHotmaildotcom Download: http://www.emefa.dyndns.org/downloads/ Remote: Yes Dork: Emefa Guestbook V 3.0 --=Database Disclosure=--...
Oracle Database Remote Listener Memory Corruption Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/37728/info Oracle Database is prone to a remote memory-corruption vulnerability in Listener. The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker does not require privileges to exploit this...
GIMP 2.8.0 FIT File Format DoS
No description provided by source. Summary ======= There is a file handling DoS in GIMP the GNU Image Manipulation Program for the 'fit' file format affecting all versions Windows and Linux up to and including 2.8.0. A file in the fit format with a malformed 'XTENSION' header will cause a crash i...
lotuscms 3.0.3 - Multiple Vulnerabilities
No description provided by source. Vulnerability ID: HTB22886 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinlotuscms.html Product: LotusCMS Vendor: Arboroia Network http://www.lotuscms.org/ Vulnerable Version: 3.0.3 and probably prior versions Vendor Notification: 01 March 2011 Vulnerabili...
Native Instruments Kontakt 4 Player NKI File Syntactic Analysis Buffer Overflow PoC
No description provided by source. / Title: Native Instruments Kontakt 4 Player NKI File Syntactic Analysis Buffer Overflow PoC Vendor: Native Instruments GmbH Product web page: http://www.native-instruments.com Affected version: 4.1.3.4125 Standalone Summary: KONTAKT 4 PLAYER is the free sample...
Manage Engine Service Desk Plus 7.6 - woID SQL Injection
No description provided by source...
Oracle 9i Multiple Unspecified Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/10871/info Reportedly, multiple unspecified Oracle products contain multiple unspecified vulnerabilities. The reported vulnerabilities include SQL-injection issues, buffer-overflow issues, and others. There have also been...
AllMyGuests <= 0.4.1 (cfg_serverpath) Remote File Include Vulnerability
No description provided by source. ============================================================================ AllMyGuests = ?AMGconfigcfgserverpath Remote File Inclusion Exploit ============================================================================ Scirpt Infected signin.php Critical leve...
GeekLog <= 1.4.0sr3 (_CONF[path]) Remote File Include Vulnerabilities
No description provided by source. --------------------------------------------------------------------------- GeekLog = 1.4.0 CONFpath Remote File Include Vulnerabilities --------------------------------------------------------------------------- Google d0rk: powered by geeklog Discovered By...