56796 matches found
WebKit: JSC: Incorrect optimization in BytecodeGenerator::emitGetByVal(CVE-2017-7061)
Let's start with JS code. let o = ; for let i in xx: 0 oi; 0; i-- ForInContext& context = mforInContextStacki - 1.get; if context.local != property continue; if !context.isValid break; if context.type == ForInContext::IndexedForInContextType property = staticcastcontext.index; break;...
WordPress Plugin Mail Masta 1.0 - SQL Injection
Vulnerability information Vulnerability title: WordPress Plugin Mail Masta 1.0 - SQL Injection Plugin home page: https://wpcore.com/plugin/mail-masta Vulnerability type: SQL injection CVE : CVE-2017-6095, CVE-2017-6096, CVE-2017-6097, CVE-2017-6098 Vulnerability analysis The first injection...
Wordpress Plugin Olimometer 2.56 - SQL Injection
Vulnerability parameters: olimometerid= Using sqlmap Parameter: olimometerid GET Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: olimometerid=1 AND 6227=6227 Type: AND/OR time-based blind Title: MySQL = 5.0.12 AND time-based blind Payload: olimometerid=1...
74cms V3.4(<20140310) plus/ajax_officebuilding.php SQL 注入漏洞
No description provided by source...
Google浏览器AVG Web TuneUp插件XSS漏洞
今年8月15日, 来自project zero的成员Tavis提交了谷歌浏览器插件 AVG Web TuneUp的多个漏洞，由于该插件活跃用户约900万，所以影响范围非常广。 这个插件添加了很多的api用来操作谷歌浏览器，比如可以轻易的劫持搜索框和新标签页。而由于其安装过程十分复杂，所以能够逃避谷歌恶意软件的检查，特别是能够逃避谷歌浏览器“阻止滥用扩展的API”的检查。 事实上其中的很多api是有问题的，攻击者可以通过构造payload成功盗取用户在avg.com上的cookie，还可以获取用户的浏览记录以及其他的私人数据，甚至有可能成功实施任意命令执行。 攻击手法：...
espcms最新版V6.4.15.08.25任意用户登录漏洞
No description provided by source...
Discuz问卷调查专业版插件参数orderby存在SQL注入漏洞
No description provided by source...
Rockwell Automation /Allen-Bradley 1734-AENT 弱口令
No description provided by source...
PHPMyWind一枚注入
简要描述： rt 详细说明： Finger能把这个合到之前那个洞一起么 类似的 漏洞文件 /member.php else if$a == 'binding' //初始化参数 $username = empty$username ? '' : $username; $password = empty$password ? '' : md5md5$password; //验证输入数据 if$username == '' or $password == '' header'location:?c=binding'; exit; $row = $dosql-GetOne"SELECT...
Sun Java Web Server 1.1 Beta Viewable .jhtml Source Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1891/info A vulnerability exists in Sun Microsystems' JavaWebServer for Win32, version 1.1Beta. JavaWebServer is a Java-oriented web application development platform. If a URL is submitted requesting a .jhtml file an HTML...
CakePHP <= 1.3.5 / 1.2.8 unserialize() Vulnerability
No description provided by source. Source: http://securityreason.com/securityalert/8026 CakePHP = 1.3.5 / 1.2.8 unserialize Vulnerability felix |at| malloc.im =========================================================================== ==== Overview: CakePHP is a rapid development framework for PH...
Ultimate PHP Board 1.0 final beta ViewTopic.PHP Directory Contents Browsing
No description provided by source. source: http://www.securityfocus.com/bid/6334/info Ultimate PHP Board UPB is a freely available, open source PHP Bulletin Board. It is available for the Unix and Linux operating systems. Under some circumstances, it may be possible to disclose the contents of...
TP-Link TL-WR740N Wireless Router - Denial of Service Exploit
No description provided by source. ?!/usr/local/bin/perl TP-Link TL-WR740N Wireless Router Remote Denial Of Service Exploit Vendor: TP-LINK Technologies Co., Ltd. Product web page: http://www.tp-link.us Affected version: - Firmware version: 3.16.4 Build 130205 Rel.63875n Released: 2/5/2013 -...
Simple Machines Forum <= 1.1.5 Password Reset Security Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/33219/info Simple Machines Forum is prone to a security-bypass vulnerability because it fails to adequately restrict access to the password-reset feature. An attacker can exploit this issue to gain administrative access t...
TinyWebGallery 1.8.3 - Multiple Vulnerabilities
No description provided by source. Date: 01/02/2011 dd/MM/yyyy Script: TinyWebGallery Version: 1.8.3 No fixes yet, might work on other versions too. Home: http://www.tinywebgallery.com -- Vulnerability: Non-persistent XSS Where: File: /admin/index.php Parameters: sview, tview, dir, item. Examples...
SquirrelMail 1.2.x Theme Remote Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4385/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. SquirrelMail allows for extended functionality through a plugin system...
IBM DB2 'kuddb2' Remote Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/38018/info IBM DB2 is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause the application to crash, denying service to legitimate users. IBM DB2 9.7 is vulnerable; other versions...
ProductCart 1.x/2.x advSearch_h.asp Multiple Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/9669/info EarlyImpact ProductCart is reportedly prone to multiple vulnerabilities. The specific issues include SQL injection, cross-site scripting and cryptographic weaknesses. These issues could expose sensitive data suc...
fusebox (ProductList.cfm?CatDisplay) - Remote SQL Injection Vulnerability
No description provided by source. ----------------------------------------------------------------------------------------- AJSADVISORIES01&2010 fusebox ProductList.cfm?CatDisplay Remote SQL Injection Vulnerability...
Nginx HTTP Server 1.3.9-1.4.0 - Chuncked Encoding Stack Buffer Overflow
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit4...
ACE Stream Media 2.1 - (acestream://) Format String Exploit PoC
No description provided by source. ? ACE Stream Media 2.1 acestream:// Format String Exploit PoC Vendor: ACE Stream Product web page: http://www.acestream.org Affected version: Ace Player HD 2.1.9 VLC 2.0.5 Summary: Ace Stream is an innovative multimedia platform of a new generation, which includ...
sweetrice cms 0.6.7 - Multiple Vulnerabilities
No description provided by source. Vulnerability ID: HTB22669 Reference: http://www.htbridge.ch/advisory/resetadminpasswordinsweetricecms.html Product: SweetRice CMS Vendor: basic-cms.org http://www.basic-cms.org/ Vulnerable Version: 0.6.7 Vendor Notification: 21 October 2010 Vulnerability Type:...
Oracle 9i Multiple Unspecified Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/10871/info Reportedly, multiple unspecified Oracle products contain multiple unspecified vulnerabilities. The reported vulnerabilities include SQL-injection issues, buffer-overflow issues, and others. There have also been...
Microsoft Internet Explorer内存破坏漏洞(MS14-010)
CVECAN ID:...
WPS Office 'Wpsio.dll'栈缓冲区溢出漏洞
BUGTRAQ ID: 59529 CVECAN ID: CVE-2012-4886 WPS Office 是金山软件公司的一套办公软件。 WPS Office 2012 及其他版本中，Wpsio.dll模块存在栈缓冲区溢出漏洞，该漏洞源于文件内的某BSTR类型的字符串被复制到栈缓冲区时没有检查长度。攻击者可利用此漏洞造成受影响软件崩溃，可能执行任意代码。 0 Kingsoft Corp WPS Office 厂商补丁： Kingsoft Corp ------------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： www.wps....
FreeSSHd freeSSHd.exe 远程身份验证绕过漏洞
BUGTRAQ ID: 56785 CVECAN ID: CVE-2012-6066 freeSSHd是开源的SSH和SFTP服务器。 freeFTPd和其内置SFTP服务器存在身份验证绕过漏洞，在提供证书之前,打开SSH通道可绕过身份验证。未经身份验证的远程攻击者可利用此漏洞登录，而不提供任何证书，登录后，上传特制的文件可以系统权限执行任意代码。 0 freeSSHd 1.2.6 厂商补丁： freeSSHd -------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://freesshd.com/ FreeSSHD al...
PHP 5.3.x 'open_basedir'安全限制绕过漏洞
BUGTRAQ ID: 54612 CVE ID: CVE-2012-3365 PHP 是一种 HTML 内嵌式的语言，PHP与微软的ASP颇有几分相似，都是一种在服务器端执行的嵌入HTML文档的脚本语言，语言的风格有类似于C语言，现在被很多的网站编程人员广泛的运用。 PHP 5.3.15之前版本在SQLite扩展中存在错误，可被利用绕过"openbasedir"功能。 0 PHP 5.3.x 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.php.net...
Linux Kernel ASLR安全限制绕过漏洞
BUGTRAQ ID: 52687 CVE ID: CVE-2012-1568 Linux Kernel是Linux操作系统的内核。 Linux Kernel在运行具有很多共享库的二进制文件时，在实现上存在对其中一个已经加载的库使用可预测的基础地址，导致绕过ASLR。 0 RedHat Fedora 16 厂商补丁： RedHat ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.redhat.com/apps/support/errata/index.html...
Linux Kernel epoll Subsystem “eventpoll.c”多个本地拒绝服务漏洞
BUGTRAQ ID: 46630 CVE ID: CVE-2011-1082,CVE-2011-1083 Linux Kernel是Linux操作系统的内核。 Linux Kernel 2.6.38之前版本的fs/eventpoll.c在epoll子系统的实现上存在本地拒绝服务安全漏洞，将epoll文件描述符放置在其他epoll数据结构中，没有检查已关闭的循环或深链接，攻击者可利用此漏洞造成拒绝服务 0 Linux kernel 2.6.38 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.or...
Linux IGMP Remote Denial Of Service (Introduced in linux-2.6.36)
No description provided by source. / linux-undeadattack.c Linux IGMP Remote Denial Of Service Introduced in linux-2.6.36 CVE-2012-0207 credits to Ben Hutchings: http://womble.decadent.org.uk/blog/igmp-denial-of-service-in-linux-cve-2012-0207.html written By Kingcope Year 2012 Ripped & modified co...
Apache Tomcat sendfile请求安全限制绕过和拒绝服务漏洞
CVE ID: CVE-2011-2526 Tomcat是由Apache软件基金会下属的Jakarta项目开发的一个Servlet容器，按照Sun Microsystems提供的技术规范，实现了对Servlet和JavaServer Page（JSP）的支持，并提供了作为Web服务器的一些特有功能。 Apache Tomcat在sendfile请求的处理上存在安全限制绕过和拒绝服务漏洞，本地攻击者可利用此漏洞绕过安全限制或造成拒绝服务。 1）当Apache Tomcat运行在安全管理器下时没有正确验证sendfile请求的属性，可被恶意Web应用程序利用绕过目标限制并泄露本地文件。...
Linux Kernel fs/partitions/osf.c信息泄露漏洞
BUGTRAQ ID: 46878 CVE ID: CVE-2011-1163 Linux Kernel是Linux操作系统的内核。 Linux Kernel在fs/partitions/osf.c的实现上存在信息泄露漏洞，本地攻击者可利用此漏洞从堆内存获取敏感信息。 自动验证存储设备的OSF分区表的代码中存在缓冲区溢出错误 Linux kernel 2.6.x OpenVZ Project OpenVZ 028stab091.1 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/...
PHP ZipArchive::getArchiveComment()函数空指针引用拒绝服务漏洞
BUGTRAQ ID: 44718 CVE ID: CVE-2010-3709 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 ZipArchive库允许透明的读写ZIP压缩档案及其之中的文件。对于PHP中所使用的ZipArchive::getArchiveComment函数： - --- 1945 static ZIPARCHIVEMETHODgetArchiveComment 1946 1947 struct zip intern; 1948 zval this = getThis; 1949 long flags = 0; 1950 const ch...
Microsoft Windows CreateWindow Function Callback Vulnerability (MS10-048)
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://corelabs.coresecurity.com/ Microsoft Windows CreateWindow function callback vulnerability 1. Advisory Information Title: Microsoft Windows CreateWindow function...
lighttpd < 1.4.25-r1 Denial of Service
No description provided by source. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - ...
Microsoft ASP.NET 2.0 InnerHtml属性远程跨站脚本漏洞
CVE ID: CVE-2010-2084 ASP.NET是一套由Microsoft分发的帮助开发者构建基于WEB应用的系统。 大多数ASP.NET控件都是从HtmlContainerControl继承的，而ASP.NET 2.0没有禁止对其设置InnerHtml属性，这可能导致跨站脚本攻击。 Microsoft ASP.NET 2.0 厂商补丁： Microsoft --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.microsoft.com/technet/security/...
MacOS X 10.6 HFS File System Attack (Denial of Service)
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 / Proof of Concept for CVE-2010-0105 MacOS X 10.6 hfs file system attack Denial of Service by Maksymilian Arciemowicz from SecurityReason.com http://securityreason.com/achievementexploitalert/15 NOTE: This DoS will b...
Linux Kernel do_pages_move()本地信息泄露漏洞
BUGTRAQ ID: 38144 CVE ID: CVE-2010-0415 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的mm/migrate.c文件中的dopagesmove函数没有正确地验证从用户空间所接收到的node值，本地用户可以通过特制的movepages系统调用读取内核内存。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
WebSphere 6.1 跨站脚本漏洞
漏洞信息： WebSphere 是 IBM 的软件平台。它包含了编写、运行和监视全天候的工业强度的随需应变 Web 应用程序和跨平台、跨产品解决方案所需要的整个中间件基础设施，如服务器、服务和工具。WebSphere 提供了可靠、灵活和健壮的软件。 IBM WebSphere Application Server WAS的UDDI用户控制台的uddigui/navigateTree.do中存在多个跨站脚本攻击漏洞。 远程攻击者可以借助1 keyField, 2 nameField, 3 valueField, 和 4 frameReturn参数，注入任意web脚本或HTML。 漏洞影响：...
Linux Kernel net/mac80211/子系统远程拒绝服务漏洞
BUGTRAQ ID: 37170 CVECAN ID: CVE-2009-4026,CVE-2009-4027 Linux Kernel是开放源码操作系统Linux所使用的内核。 远程攻击者可以通过向Linux Kernel的mac80211子系统发送特制Delete Block ACK（DELBA）报文触发竞争条件等错误，导致拒绝服务的情况。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Linux Kernel < 2.6.19 udp_sendmsg Local Root Exploit
No description provided by source. / hoagieudpsendmsg.c LOCAL LINUX KERNEL ROOT EXPLOIT 2.6.19 - CVE-2009-2698 udpsendmsg bug exploit via output callback function used in dstentry / rtable Bug reported by Tavis Ormandy and Julien Tinnes of the Google Security Team Tested with Debian Etch r0 $ cat...
Free Download Manager多个远程安全漏洞
CVECAN ID: CVE-2009-0183,CVE-2009-0184 Free Download Manager是一种强大易用而且免费的网络下载管理及加速软件。 Free Download Manager的实现上存在多个远程安全漏洞，远程攻击者可能利用此漏洞控制运行了FDM的用户系统。 Free Download Manager处理torrent文件中的文件名、注释、URL等字串时存在堆或栈缓冲区溢出，攻击者可能通过诱使用户处理恶意的torrent文件触发漏洞控制用户系统。FDM的Remote Control...
Ninja Blog 4.8 Remote Information Disclosure Vulnerability
No description provided by source. Vendor: http://ninjadesigns.co.uk Versions: Ninja Blog 4.8 May also affect earlier versions Credit: Danny Moules Critical: Yes See PUSH 55 Advisory at http://www.push55.co.uk/index.php?s=ad&id=6 ---- Due to insufficient validation of client-side data, we can alt...
Adobe Flash Player 9.0.124.0版本修改多个安全漏洞
BUGTRAQ ID: 27034,28695,26966,28697,26930,28696,28694 CVECAN ID: CVE-2007-5275,CVE-2007-6243,CVE-2007-6637,CVE-2007-6019,CVE-2007-0071,CVE-2008-1655,CVE-2008-1654 Flash Player是一款非常流行的FLASH播放器。 Flash Player 9.0.124.0版本修复了多个安全漏洞，成功利用这些漏洞允许恶意用户绕过安全限制、执行跨站脚本或入侵用户系统，具体包括： 1 处理Declare Function...
Info-ZIP UnZip inflate_dynamic()函数堆破坏漏洞
BUGTRAQ ID: 28288 CVECAN ID: CVE-2008-0888 unzip是在Unix下对.zip文件格式进行解压的工具。 unzip的实现上存在漏洞，攻击者可能利用此漏洞通过诱使用户处理恶意文档提升权限。...
Adult Script <= 1.6 Unauthorized Administrative Access Exploit
No description provided by source. ? obimplicitflushtrue; ? titleAdult Script Unauthorized Administrative Access Exploit/title style bodymargin:0px;font-style:normal;font-size:10px;color:FFFFFF;font-family:Verdana,Arial;background-color:3a3a3a;scrollbar-face-color: 303030;scrollbar-highlight-colo...
D-LINK DWL-2000AP+远程拒绝服务漏洞
D-LINK DWL-2000AP+是一款流行的无线接入路由器。 DWL-2000AP+在处理大量ARP请求时存在漏洞，远程攻击者可能利用此漏洞导致设备无法正常工作。 D-LINK DWL-2000AP+没有正确的处理arp...
CuteNews Aj-fork Shows.Inc.PHP远程文件包含漏洞
CuteNews Aj-fork是一款基于PHP的WEB应用程序。 CuteNews Aj-fork不充分过滤用户提交的URI输入，远程攻击者可以利用漏洞以WEB进程权限执行任意指令。 问题是'Shows.Inc.PHP'脚本对用户提交的WEB参数缺少过滤，指定远程服务器上的任意文件作为包含对象，可导致以进程权限执行任意指令。 Cutenews Aj-fork Cutenews Aj-fork beta http://sourceforge.net/projects/ajfork...
Apache OpenSSL Remote Exploit (Multiple Targets) (OpenFuckV2.c)
No description provided by source. / OF version r00t VERY PRIV8 spabam Compile with: gcc -o OpenFuck OpenFuck.c -lcrypto objdump -R /usr/sbin/httpd|grep free to get more targets hackarena irc.brasnet.org / include arpa/inet.h include netinet/in.h include sys/types.h include sys/socket.h include...
RsGallery2 <= 1.11.2 (rsgallery.html.php) File Include Vulnerability
No description provided by source. RsGallery2 for Joomla --------------------------------------------------------------------------- Discovered: marriottvn Remote : Yes Level : High --------------------------------------------------------------------------- Affected software description :...