56796 matches found
Samba nmbd_packets.c NetBIOS回复栈溢出漏洞
BUGTRAQ ID: 26455 CVECAN ID: CVE-2007-5398 Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。 Samba的nmbd/nmbdpackets.c文件中的replynetbiospacket函数在发送NetBIOS回复时存在栈溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 如果客户端发送了多个特制的WINS “Name Registration”请求并跟随有WINS “Name...
Mono System.Web StaticFileHandler.cs源码泄露漏洞
BUGTRAQ ID: 26166 CVECAN ID: CVE-2007-5473 Mono是基于.NET框架的开源开发平台，允许开发人员构建Linux和跨平台的应用。 运行在Windows平台上的Mono中StaticFileHandler.cs文件没有正确地处理某些用户请求，可能导致源码泄露。 如果请求中所使用的文件名以空格或句号结束的话，Win32子系统就无法正确地处理这样的文件名，会忽略拖尾字符，允许调用的应用程序打开磁盘上的文件，即使该文件的名称不包含有请求中所使用的拖尾字符。发送上述请求就会导致XSP返回所请求页面的源码。 Mono 1.x...
BEA WebLogic Server空密码组信息泄露漏洞
BUGTRAQ ID: 25472 BEA Systems WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。 BEA Systems WebLogic在处理SSL连接时存在漏洞，可能导致敏感信息泄露。 在某些情况下，运行在服务器环境以外的SSL客户端可能无法找到创建SSL密码组列表所需的所有密码，这就会导致使用默认的非加密密码；客户端也可能无法支持服务器中任何可用的密码组，这时服务器就会选择使用空密码的密码组，导致SSL通讯没有加密，这样攻击者就可以获取明文传输的信息。 BEA Systems Weblogic Server 9.2...
Program Checker (sasatl.dll 1.5.0.531) Javascript Heap Spraying Exploit
No description provided by source. :. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: sasatl.dll 1.5.0.531 Program Checker - Javascript Heap Spraying Exploit ======================================================================== Internal ID: VULWAR200706280...
Xoops Module myAlbum-P <= 2.0 (cid) Remote SQL Injection Exploit
No description provided by source. !/usr/bin/perl Script Name: XOOPS Module myAlbum-P = 2.0 cid Remote BLIND SQL Injection Exploit Coded by : ajann Author : ajann Contact : : Dork : myAlbum-P 2.0 original Example S. : http://www.google.com.tr/search?q=+myAlbum-P+2.0+++original&hl=tr&start=0&sa=N...
PHP-Nuke Module Eve-Nuke 0.1 (mysql.php) RFI Vulnerability
No description provided by source. =========================================================================================== Eve-NukePortal file include phpbbrootpath =========================================================================================== Script name :Eve-Nuke Portal Downloa...
PHP 4 Userland ZVAL Reference Counter Overflow Exploit PoC
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || // // | |/ || '|/ |/ -| ' / -/ |||| /| || / //...
PhpLeague "cheminmini"远程文件包含漏洞
PhpLeague是一款基于PHP的WEB应用程序。 PhpLeague不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'consult/miniseul.php'和'config.php'脚本对用户提交的'cheminmini'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 PhpLeague 0.x 升级到0.82版本： http://phpleague.univert.org/...
Mambo CopperminePhotoGalery Component Remote Include Vulnerability
No description provided by source. CopperminePhotoGallery Component Found By k1tk4t Indonesia This bug allows a remote atacker to execute commands via RFI file: cpg.php bug: require $mosConfigabsolutepath."/administrator/components/comcpg/config.cpg.php"; path: add in cpg.php defined 'VALIDMOS' o...
Alt-N MDaemon本地不安全默认目录权限漏洞
Alt-N MDaemon是一款基于Windows的邮件服务程序。 MDaemon在安装文件时没能设置正确的访问权限，本地攻击者可能利用此漏洞提升权限。 MDaemon默认下以不安全权限安装到了系统根目录的MDaemon文件夹中，允许Users组的成员创建文件和目录。本地攻击者可以通过将恶意的RASAPI32.DLL或MPRAPI.DLL库放置在MDaemon\APP目录中导致以系统权限执行任意代码。 Alt-N MDaemon 9.53 Alt-N MDaemon 9.51 Alt-N MDaemon 9.06 Alt-N MDaemon 9.0.5 临时解决方法：...
Microsoft Windows MHTML超长URI串溢出漏洞（MS06-043）
Microsoft Windows是微软发布的非常流行的操作系统。 inetcomm.dll在使用"mhtml:" URI解析器处理URL时存在栈溢出漏洞，成功利用此漏洞的攻击者可以完全控制受影响的系统。 攻击者可以通过超长的URL来触发这个漏洞，如诱骗用户通过Internet Explorer打开恶意的站点或打开特制的Internet快捷方式。 Microsoft Windows XP SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows Server 2003 x64 Edition Microsoft...
Sony PSP TIFF图形浏览代码执行漏洞
Sony PSP是一款流行的便携式游戏机。 PSP在解码处理TIFF图像时存在漏洞，攻击者可能利用此漏洞在设备执行恶意指令。 如果用PSP的照片浏览器浏览了特制的libTIFF图形的话，就可能导致执行任意指令 Sony PSP v2.7+ Sony PSP v2.0 - v2.6 我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.yourpsp.com/ http://files.fanjita.org/psp/helloworldall.zip...
Nukedit CMS <= 4.9.6 Unauthorized Admin Add Exploit
No description provided by source. KAPDA - Security Science Researchers Institute Advisory : http://www.kapda.ir/advisory-337.html Vendor : http://www.nukedit.com/ What is : Nukedit is a Free Content Management Vulnerability : Unauthorized Admin Add Exploit if "register.asp" be enable! Discovered...
Sun Solaris AnswerBook2 Multiple XSS
No description provided by source. Sun Solaris AnswerBook2 is reported prone to multiple cross-site scripting vulnerabilities because the software fails to properly sanitize user-supplied data. Exploits will allow arbitrary HTML and script code to run in a victim's browser, allowing the attacker ...
Synology Audio Station 远程代码执行漏洞
...
Cisco RV34x系列 授权远程代码执行漏洞（CVE-2021-1413 CVE-2021-1414 CVE-2021-1415）
...
Insteon Hub HTTPExecuteGet Parameters Extraction Code Execution Vulnerability(CVE-2017-14446)
Summary An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation unsafely extracts parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HTTP GET request to trigger...
Dedecms V5.7后台的两处getshell(CVE-2018-9175)
第一个是常见的思路，把语句写入inc文件，然后在其他的include语句中，包含了恶意代码进而getshell。 漏洞代码在:/dede/sysverifies.php 代码如下： else if $action == 'getfiles' if!isset$refiles ShowMsg"你没进行任何操作！","sysverifies.php"; exit; $cacheFiles = DEDEDATA.'/modifytmp.inc'; $fp = fopen$cacheFiles, 'w'; fwrite$fp, ''; fclose$fp; $dirinfos = ''; if$...
Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access(CVE-2017-18014)
Vulnerability Summary The following advisory describes an unauthenticated persistent XSS that leads to unauthorized root access found in Sophos XG version 17. Sophos XG Firewall “provides unprecedented visibility into your network, users, and applications directly from the all-new control center...
ZKTeco ZKAccess Security System 5.3.1 Stored XSS Vulnerability
Summary ZKAccess Systems are built on flexible, open technology to provide management, real-time monitoring, and control of your access control system-all from a browser, with no additional software to install. Our secure Web-hosted infrastructure and centralized online administration reduce your...
Polycom HDX Series RCE
When doing external assessments you spend a decent amount of time footprinting your target and finding possible avenues of attack. Given a large corporate, you are pretty likely to hit video conferencing end-points. This post details a vulnerability in one of these video conferencing systems, the...
Cesanta Mongoose MQTT SUBSCRIBE Multiple Topics Remote Code Execution(CVE-2017-2894)
Summary An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT...
Microsoft Windows Kernel Local Information Disclosure Vulnerability(CVE-2017-11817)
This tracker entry is a fork of issue 1325, which this bug was reported as a part of. However, as some essential information and context was provided in issue 1325, the "Reported" date was adjusted there to account for it. The new information did not concern the vulnerability discussed here, so w...
Moxa AWK-3131A web_runScript Header Manipulation Denial of Service Vulnerability(CVE-2016-8726)
Summary An exploitable null pointer dereference vulnerability exists in the Web Application /forms/webrunScript iwfilename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web...
Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol
Product Description Dlink is a multinational networking equipment manufacturing corporation. The Dlink 850L is a Wireless AC1200 Dual Band Gigabit "Cloud" Router. Mydlink Cloud Services allow you to access, view and control the devices on your home network from anywhere. Vulnerabilities Summary T...
Discuz X3. 3 authkey generation algorithm of the security vulnerability and the background arbitrary code execution vulnerability
0x00 background description Discuz official in 2017 8 May 1 release of the latest version of the X3. 4 version, the latest version fixes multiple security issues. 360CERT and 360 0KEE Team then for the events to follow. 0x01 vulnerability overview 360CERT and 360 0KEE Team by comparing DiscuzX3...
Supervisor Authenticated Remote Code Execution(CVE-2017-11610)
Vulnerability Summary The following advisory describes an authenticated remote code execution vulnerability in Supervisor version 3.1.2 and Supervisor version 3.3.2. Supervisor is a client/server system that allows its users to monitor and control a number of processes on UNIX-like operating...
Apple iOS / MacOS Domain Socket Kernel Use-After-Free(CVE-2017-2501)
iOS/MacOS kernel uaf due to bad locking in unix domain socket file descriptor externalization unpexternalize is responsible for externalizing the file descriptors carried within a unix domain socket message. That means allocating new fd table entries in the receiver and recreating a file which...
Oracle PeopleSoft HCM 9.2 XXE Injection
Application: Oracle PeopleSoft Versions Affected: PeopleSoft HCM 9.2 on PeopleTools 8.55 Vendor URL: http://oracle.com Bug: XXE Reported: 23.12.2016 Vendor response: 24.12.2016 Date of Public Advisory: 18.04.2017 Reference: Oracle CPU April 2017 Author: Nadya Krivdyuk ERPScan Description 1...
Microsoft Windows Code injection vulnerability (DoubleAgent)
Overview We’d like to introduce a new Zero-Day technique for injecting code and maintaining persistency on a machine i.e. auto-run dubbed DoubleAgent. DoubleAgent can exploit: Every Windows version Windows XP to Windows 10 Every Windows architecture x86 and x64 Every Windows user...
Microsoft Internet Explorer Elevation of Privilege Vulnerability (CVE-2017-0154)
Original link: a Broken Browser Original author: Manuel Caballero Translation: Holic know Chong Yu 404 security lab Today we know from Internet Explorer since the birth there has been function. This feature allows the Web Developer instance of the external object, and therefore be the attacker to...
GitHub Enterprise SQL injection vulnerability
作者：Orange 前言 GitHub Enterprise 是一款 GitHub.com 所出品，可將整個 GitHub 服務架設在自身企業內網中的應用軟體。 有興趣的話你可以從 enterprise.github.com 下載到多種格式的映像檔並從網頁上取得 45 天的試用授權! 安裝完成後，你應該會看到如下的畫面: 好!現在我們有整個 GitHub 的環境了，而且是在 VM 裡面，這代表幾乎有完整的控制權可以對他做更進一步的研究，分析環境、程式碼以及架構等等... 環境 身為一個駭客，再進行入侵前的第一件事當然是 Port Scanning! 透過 Nmap 掃描後發現 VM 上一...
Mastery OA /general/mytable/intel_view/video_file.php arbitrary File Download vulnerability
No description provided by source...
万户 ezEIP 4.0系统 hit.aspx 参数 f POST注入
No description provided by source...
某邮件域管理系统通用注入（过万企业邮箱沦陷）
简要描述： 日了Feng狗···跑的好慢 详细说明： intitle:Login to webmail http://hanwang.com.cn/login.php 这个貌似是不存在注入的，但是对应的邮箱域管理的后台登陆有post注入 http://mail.tofine.com:8090/login.php 以及 http://mail.tofine.com:8090/sys/login.php http://mail.kddl.cn:8090/sys/login.php http://mail.cqdc.com:8090/sys/login.php...
通达oa2013集团版注入
简要描述： 通达 详细说明： 官网demo登录: http://www.day900.com/ cw 登陆有点鸡肋 注入点+payload: http://www.day900.com/general/budget/budgetprocess/budgetyeardepts.php?DEPTID=1&DEPTIDPRIV=0&DEPTIDS=1 and select 1 from select count,concatselect concathost,user,password from mysql.user limit 0,1,floorrand02x from...
ecshop后台暴力破解验证码绕过
简要描述： ecshop后台暴力破解 详细说明： 登陆请求为 username=admin&password=admin888&captcha=1111&act=signin 请求的时候去掉cookie中的ECSCPID=参数 服务端就会不验证验证码直接验证账号的密码是否正确。 使用burp进行暴力破解测试。 漏洞证明：...
骑士CMS存储型等XSS
简要描述： 你们防护做的挺好，我X的十分不容易，加上漏洞影响，自评16rank/,/ 走小厂商又只有1/4rank不如给20吧 —，— 详细说明： 1 先来个 反射型xss 当开胃小菜 地址：http://demo.74cms.com/jobs/jobs-list.php?key=%c0%22;evalString.fromCharCode97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41// 影响：通杀全部浏览器 详情： 主页搜所后源码定位...
Mac OSX Server DirectoryService Buffer Overflow
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Mac OSX Server DirectoryService buffer overflow 1. Advisory Information Title: Mac OSX Server DirectoryService buffer overflow Advisory ID: CORE-2013-0103 Advisory URL:...
SmartWin CyberOffice Shopping Cart 2.0 Client Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1734/info Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for e-commerce enabled websites running Windows NT 4.0 or 2000. It is possible for a remote user to gain read access to the private...
TP-Link TL-WR740N Wireless Router - Denial of Service Exploit
No description provided by source. ?!/usr/local/bin/perl TP-Link TL-WR740N Wireless Router Remote Denial Of Service Exploit Vendor: TP-LINK Technologies Co., Ltd. Product web page: http://www.tp-link.us Affected version: - Firmware version: 3.16.4 Build 130205 Rel.63875n Released: 2/5/2013 -...
WEBBDOMAIN Post Card <= 1.02 (catid) SQL Injection Vulnerability
No description provided by source. post Card catid Remote SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc MaiL : [email protected] script : http://webbdomain.com/php/postcarden/index2.php script : http://webbdomain.com/php/postcardir/index2.php DorK :...
Apache Struts ClassLoader Manipulation Remote Code Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Apache Struts ClassLoader Manipulation Remote Code Execution', 'Description' = %q This module...
SquirrelMail 1.2.x Theme Remote Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4385/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. SquirrelMail allows for extended functionality through a plugin system...
Pandora FMS <= 3.1 - SQL Injection
No description provided by source. + Introduction Pandora FMS for Pandora Flexible Monitoring System is a software solution for monitoring computer networks. It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers, applicatio...
Oracle VirtualBox 3D Acceleration - Multiple Vulnerabilities
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities 1. Advisory Information Title: Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities Advisory...
dompdf 0.6.0 (dompdf.php, read param) - Arbitrary File Read
No description provided by source. Vulnerability title: Arbitrary file read in dompdf CVE: CVE-2014-2383 Vendor: dompdf Product: dompdf Affected version: v0.6.0 Fixed version: v0.6.1 partial fix Reported by: Alejo Murillo Moyas Details: An arbitrary file read vulnerability is present on dompdf.ph...
Microsoft Windows NT 4/2000 NetBIOS Name Conflict Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1514/info An attacker can send the NetBIOS name service a NetBIOS Name Conflict message even when the receiving machine is not in the process of registering its NetBIOS name. The target will then not attempt to use that...
MailEnable Webmail Cross-Site Scripting Vulnerability
No description provided by source. ME020567: MailEnable webmail cross-site scripting vulnerability CWE-79 References: CVE-2012-0389 Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567 Vendor contact:...