56796 matches found
Linux Kernel CIFS字符串转换多个缓冲区溢出漏洞
BUGTRAQ ID: 34989 CVECAN ID: CVE-2009-1633 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的cifs处理代码通常将ucs2le字符串（windows所使用的双字节编码方案）转换为本地NLS字符集。字符串转换例程仅接受由所要转换的宽字符数所指定的单个长度参数，因此假设目标缓冲区已足够大，但实际上特制的CIFS字符串仍可触发缓冲区溢出。 Linux kernel 2.6.29 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
XChat PySys_SetArgv函数命令执行漏洞
BUGTRAQ ID: 33444 CVECAN ID: CVE-2009-0315 X-Chat是一款免费开放源代码的IRC客户端。 xchat的Python模块中使用了不可信任的搜索路径，本地用户可以在当前工作目录中放置恶意的Python文件并利用PySysSetArgv函数调用中的安全漏洞（CVE-2008-5983）执行任意代码。 X-Chat X-Chat 2.8.7b X-Chat X-Chat 2.8.6 厂商补丁： X-Chat ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
Microsoft Windows图形颜色管理组件堆溢出漏洞（MS08-046）
BUGTRAQ ID: 30594 CVECAN ID: CVE-2008-2245 Microsoft Windows是微软发布的非常流行的操作系统。 Windows操作系统中所捆绑的图形颜色管理（ICM）组件使用Microsoft颜色管理系统（MSCMS）模块帮助用户跨各种设备（扫描仪、相机、打印机等）始终一致的重新生成颜色。mscms.dll库的InternalOpenColorProfile函数没有正确地验证超长参数，如果用户受骗打开了特制的图像文件，就可能触发堆溢出，导致执行任意代码。 Microsoft Windows XP SP3 Microsoft Windows XP...
AShop Deluxe "cat" SQL注入漏洞
BUGTRAQ ID: CNCAN ID：CNCAN-2008070301 AShop Deluxe是一款基于PHP的WEB应用程序。 AShop Deluxe不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于脚本对用户提交给'cat'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 AShop Deluxe 4.x 升级到AShop Deluxe 4.8.5: http://www.ashopsoftware.com/ http://www.sebug.net/exploit/39...
MG-SOFT Net Inspector多个远程安全漏洞
BUGTRAQ ID: 28266 MG-SOFT Net Inspector是一个综合的网络管理系统（NMS）应用程序，能够监控并管理多协议分布式系统，如计算机网络或公共交换网络等。 Net Inspector的实现上存在多个安全漏洞，远程攻击者可能利用这些漏洞控制服务器或导致拒绝服务。 --------------------------- A mghttpd格式串漏洞 --------------------------- mghttpd是运行在5228端口上的HTTP守护程序，允许客户端下载Net Inspector...
SAPlpd多个远程溢出及拒绝服务漏洞
BUGTRAQ ID: 27613 CVECAN ID: CVE-2008-0620,CVE-2008-0621 SAPlpd是SAP GUI软件包中所捆绑的Windows平台行市打印机守护程序。 SAPLPD服务程序在处理LPD命令时存在多个缓冲区溢出漏洞，远程攻击者可能利用这些漏洞控制服务器或导致服务不可用。 如果向0x01、0x02、0x03、0x04、0x05、0x31、0x32、0x33、0x34和0x35 LPD命令传送了超长参数的话，就可以触发这些溢出，导致执行任意指令；如果向0x53 LPD命令传送了畸形参数，还可能导致服务器终止。 SAP SAPlpd = 6.28 S...
Oracle 10g R1 pitrig_drop PLSQL Injection (get users hash)
No description provided by source. // / Oracle 10g R1 xDb.XDBPITRIGPKG.PITRIGDROP / / SQL Injection Exploit / // / sploit get password Hashes / // / BY Sh2kerr Digital Security / // / tested on oracle 10.1.0.2.0 / // // / Date of Public EXPLOIT: January 28, 2008 / / Written by: &...
PHP Real Estate Classifieds "id" SQL Injection
t0pP8uZz & xprog have reported a vulnerability in PHP Real Estate Classifieds, which can be exploited by malicious people to conduct SQL injection attacks. Input passed to the "id" parameter in fullnews.php is not properly sanitised before being used in SQL queries. This can be exploited to...
Mono System.Web StaticFileHandler.cs源码泄露漏洞
BUGTRAQ ID: 26166 CVECAN ID: CVE-2007-5473 Mono是基于.NET框架的开源开发平台，允许开发人员构建Linux和跨平台的应用。 运行在Windows平台上的Mono中StaticFileHandler.cs文件没有正确地处理某些用户请求，可能导致源码泄露。 如果请求中所使用的文件名以空格或句号结束的话，Win32子系统就无法正确地处理这样的文件名，会忽略拖尾字符，允许调用的应用程序打开磁盘上的文件，即使该文件的名称不包含有请求中所使用的拖尾字符。发送上述请求就会导致XSP返回所请求页面的源码。 Mono 1.x...
BEA WebLogic Server空密码组信息泄露漏洞
BUGTRAQ ID: 25472 BEA Systems WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。 BEA Systems WebLogic在处理SSL连接时存在漏洞，可能导致敏感信息泄露。 在某些情况下，运行在服务器环境以外的SSL客户端可能无法找到创建SSL密码组列表所需的所有密码，这就会导致使用默认的非加密密码；客户端也可能无法支持服务器中任何可用的密码组，这时服务器就会选择使用空密码的密码组，导致SSL通讯没有加密，这样攻击者就可以获取明文传输的信息。 BEA Systems Weblogic Server 9.2...
Program Checker (sasatl.dll 1.5.0.531) Javascript Heap Spraying Exploit
No description provided by source. :. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: sasatl.dll 1.5.0.531 Program Checker - Javascript Heap Spraying Exploit ======================================================================== Internal ID: VULWAR200706280...
PHP-Nuke Module Eve-Nuke 0.1 (mysql.php) RFI Vulnerability
No description provided by source. =========================================================================================== Eve-NukePortal file include phpbbrootpath =========================================================================================== Script name :Eve-Nuke Portal Downloa...
PHP 4 Userland ZVAL Reference Counter Overflow Exploit PoC
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || // // | |/ || '|/ |/ -| ' / -/ |||| /| || / //...
PhpLeague "cheminmini"远程文件包含漏洞
PhpLeague是一款基于PHP的WEB应用程序。 PhpLeague不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'consult/miniseul.php'和'config.php'脚本对用户提交的'cheminmini'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 PhpLeague 0.x 升级到0.82版本： http://phpleague.univert.org/...
Alt-N MDaemon本地不安全默认目录权限漏洞
Alt-N MDaemon是一款基于Windows的邮件服务程序。 MDaemon在安装文件时没能设置正确的访问权限，本地攻击者可能利用此漏洞提升权限。 MDaemon默认下以不安全权限安装到了系统根目录的MDaemon文件夹中，允许Users组的成员创建文件和目录。本地攻击者可以通过将恶意的RASAPI32.DLL或MPRAPI.DLL库放置在MDaemon\APP目录中导致以系统权限执行任意代码。 Alt-N MDaemon 9.53 Alt-N MDaemon 9.51 Alt-N MDaemon 9.06 Alt-N MDaemon 9.0.5 临时解决方法：...
Microsoft Windows MHTML超长URI串溢出漏洞（MS06-043）
Microsoft Windows是微软发布的非常流行的操作系统。 inetcomm.dll在使用"mhtml:" URI解析器处理URL时存在栈溢出漏洞，成功利用此漏洞的攻击者可以完全控制受影响的系统。 攻击者可以通过超长的URL来触发这个漏洞，如诱骗用户通过Internet Explorer打开恶意的站点或打开特制的Internet快捷方式。 Microsoft Windows XP SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows Server 2003 x64 Edition Microsoft...
Sony PSP TIFF图形浏览代码执行漏洞
Sony PSP是一款流行的便携式游戏机。 PSP在解码处理TIFF图像时存在漏洞，攻击者可能利用此漏洞在设备执行恶意指令。 如果用PSP的照片浏览器浏览了特制的libTIFF图形的话，就可能导致执行任意指令 Sony PSP v2.7+ Sony PSP v2.0 - v2.6 我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.yourpsp.com/ http://files.fanjita.org/psp/helloworldall.zip...
Nukedit CMS <= 4.9.6 Unauthorized Admin Add Exploit
No description provided by source. KAPDA - Security Science Researchers Institute Advisory : http://www.kapda.ir/advisory-337.html Vendor : http://www.nukedit.com/ What is : Nukedit is a Free Content Management Vulnerability : Unauthorized Admin Add Exploit if "register.asp" be enable! Discovered...
Sun Solaris AnswerBook2 Multiple XSS
No description provided by source. Sun Solaris AnswerBook2 is reported prone to multiple cross-site scripting vulnerabilities because the software fails to properly sanitize user-supplied data. Exploits will allow arbitrary HTML and script code to run in a victim's browser, allowing the attacker ...
Synology Audio Station 远程代码执行漏洞
...
Cisco RV34x系列 授权远程代码执行漏洞（CVE-2021-1413 CVE-2021-1414 CVE-2021-1415）
...
Insteon Hub HTTPExecuteGet Parameters Extraction Code Execution Vulnerability(CVE-2017-14446)
Summary An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation unsafely extracts parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HTTP GET request to trigger...
Dedecms V5.7后台的两处getshell(CVE-2018-9175)
第一个是常见的思路，把语句写入inc文件，然后在其他的include语句中，包含了恶意代码进而getshell。 漏洞代码在:/dede/sysverifies.php 代码如下： else if $action == 'getfiles' if!isset$refiles ShowMsg"你没进行任何操作！","sysverifies.php"; exit; $cacheFiles = DEDEDATA.'/modifytmp.inc'; $fp = fopen$cacheFiles, 'w'; fwrite$fp, ''; fclose$fp; $dirinfos = ''; if$...
Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access(CVE-2017-18014)
Vulnerability Summary The following advisory describes an unauthenticated persistent XSS that leads to unauthorized root access found in Sophos XG version 17. Sophos XG Firewall “provides unprecedented visibility into your network, users, and applications directly from the all-new control center...
ZKTeco ZKAccess Security System 5.3.1 Stored XSS Vulnerability
Summary ZKAccess Systems are built on flexible, open technology to provide management, real-time monitoring, and control of your access control system-all from a browser, with no additional software to install. Our secure Web-hosted infrastructure and centralized online administration reduce your...
Polycom HDX Series RCE
When doing external assessments you spend a decent amount of time footprinting your target and finding possible avenues of attack. Given a large corporate, you are pretty likely to hit video conferencing end-points. This post details a vulnerability in one of these video conferencing systems, the...
Cesanta Mongoose MQTT SUBSCRIBE Multiple Topics Remote Code Execution(CVE-2017-2894)
Summary An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT...
Microsoft Windows Kernel Local Information Disclosure Vulnerability(CVE-2017-11817)
This tracker entry is a fork of issue 1325, which this bug was reported as a part of. However, as some essential information and context was provided in issue 1325, the "Reported" date was adjusted there to account for it. The new information did not concern the vulnerability discussed here, so w...
Apple: Multiple Race Conditions in PCIe Message Ring protocol leading to OOB Write and OOB Read(CVE-2017-7115)
Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. On iOS, the "AppleBCMWLANBusInterfacePCIe"...
Moxa AWK-3131A web_runScript Header Manipulation Denial of Service Vulnerability(CVE-2016-8726)
Summary An exploitable null pointer dereference vulnerability exists in the Web Application /forms/webrunScript iwfilename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web...
Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol
Product Description Dlink is a multinational networking equipment manufacturing corporation. The Dlink 850L is a Wireless AC1200 Dual Band Gigabit "Cloud" Router. Mydlink Cloud Services allow you to access, view and control the devices on your home network from anywhere. Vulnerabilities Summary T...
Discuz X3. 3 authkey generation algorithm of the security vulnerability and the background arbitrary code execution vulnerability
0x00 background description Discuz official in 2017 8 May 1 release of the latest version of the X3. 4 version, the latest version fixes multiple security issues. 360CERT and 360 0KEE Team then for the events to follow. 0x01 vulnerability overview 360CERT and 360 0KEE Team by comparing DiscuzX3...
Supervisor Authenticated Remote Code Execution(CVE-2017-11610)
Vulnerability Summary The following advisory describes an authenticated remote code execution vulnerability in Supervisor version 3.1.2 and Supervisor version 3.3.2. Supervisor is a client/server system that allows its users to monitor and control a number of processes on UNIX-like operating...
Apple iOS / MacOS Domain Socket Kernel Use-After-Free(CVE-2017-2501)
iOS/MacOS kernel uaf due to bad locking in unix domain socket file descriptor externalization unpexternalize is responsible for externalizing the file descriptors carried within a unix domain socket message. That means allocating new fd table entries in the receiver and recreating a file which...
Oracle PeopleSoft HCM 9.2 XXE Injection
Application: Oracle PeopleSoft Versions Affected: PeopleSoft HCM 9.2 on PeopleTools 8.55 Vendor URL: http://oracle.com Bug: XXE Reported: 23.12.2016 Vendor response: 24.12.2016 Date of Public Advisory: 18.04.2017 Reference: Oracle CPU April 2017 Author: Nadya Krivdyuk ERPScan Description 1...
Microsoft Windows Code injection vulnerability (DoubleAgent)
Overview We’d like to introduce a new Zero-Day technique for injecting code and maintaining persistency on a machine i.e. auto-run dubbed DoubleAgent. DoubleAgent can exploit: Every Windows version Windows XP to Windows 10 Every Windows architecture x86 and x64 Every Windows user...
Microsoft Internet Explorer Elevation of Privilege Vulnerability (CVE-2017-0154)
Original link: a Broken Browser Original author: Manuel Caballero Translation: Holic know Chong Yu 404 security lab Today we know from Internet Explorer since the birth there has been function. This feature allows the Web Developer instance of the external object, and therefore be the attacker to...
GitHub Enterprise SQL injection vulnerability
作者：Orange 前言 GitHub Enterprise 是一款 GitHub.com 所出品，可將整個 GitHub 服務架設在自身企業內網中的應用軟體。 有興趣的話你可以從 enterprise.github.com 下載到多種格式的映像檔並從網頁上取得 45 天的試用授權! 安裝完成後，你應該會看到如下的畫面: 好!現在我們有整個 GitHub 的環境了，而且是在 VM 裡面，這代表幾乎有完整的控制權可以對他做更進一步的研究，分析環境、程式碼以及架構等等... 環境 身為一個駭客，再進行入侵前的第一件事當然是 Port Scanning! 透過 Nmap 掃描後發現 VM 上一...
Mastery OA /general/mytable/intel_view/video_file.php arbitrary File Download vulnerability
No description provided by source...
万户 ezEIP 4.0系统 hit.aspx 参数 f POST注入
No description provided by source...
通达oa2013集团版注入
简要描述： 通达 详细说明： 官网demo登录: http://www.day900.com/ cw 登陆有点鸡肋 注入点+payload: http://www.day900.com/general/budget/budgetprocess/budgetyeardepts.php?DEPTID=1&DEPTIDPRIV=0&DEPTIDS=1 and select 1 from select count,concatselect concathost,user,password from mysql.user limit 0,1,floorrand02x from...
致远公司某QQ邮箱泄漏导致公司内部人员联系方式信息泄漏（包含手机，QQ，邮箱等）
简要描述： 致远公司某QQ邮箱泄漏导致公司内部人员联系方式信息泄漏（包含手机，QQ，邮箱等） 详细说明： 为什么取这个名字呢 事情还要从这说起 WooYun: 都都宝某系统弱口令涉及公司内部个人信息 由于都都宝的OA不善 导致里面的配置邮箱帐号以及泄漏 后确认是致远内部人员的 而这两天没事又试试看 结果还可以登 这里顺便吐槽一句都都宝 这个弱口令漏洞 都提交了 你们还不修复啊？刚登了下 人还不少 邮箱帐号：[email protected] 密码：lee841126 登录进这个邮箱后··· https://images.seebug...
骑士CMS存储型等XSS
简要描述： 你们防护做的挺好，我X的十分不容易，加上漏洞影响，自评16rank/,/ 走小厂商又只有1/4rank不如给20吧 —，— 详细说明： 1 先来个 反射型xss 当开胃小菜 地址：http://demo.74cms.com/jobs/jobs-list.php?key=%c0%22;evalString.fromCharCode97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41// 影响：通杀全部浏览器 详情： 主页搜所后源码定位...
SmartWin CyberOffice Shopping Cart 2.0 Client Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1734/info Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for e-commerce enabled websites running Windows NT 4.0 or 2000. It is possible for a remote user to gain read access to the private...
TP-Link TL-WR740N Wireless Router - Denial of Service Exploit
No description provided by source. ?!/usr/local/bin/perl TP-Link TL-WR740N Wireless Router Remote Denial Of Service Exploit Vendor: TP-LINK Technologies Co., Ltd. Product web page: http://www.tp-link.us Affected version: - Firmware version: 3.16.4 Build 130205 Rel.63875n Released: 2/5/2013 -...
WEBBDOMAIN Post Card <= 1.02 (catid) SQL Injection Vulnerability
No description provided by source. post Card catid Remote SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc MaiL : [email protected] script : http://webbdomain.com/php/postcarden/index2.php script : http://webbdomain.com/php/postcardir/index2.php DorK :...
Apache Struts ClassLoader Manipulation Remote Code Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Apache Struts ClassLoader Manipulation Remote Code Execution', 'Description' = %q This module...
SquirrelMail 1.2.x Theme Remote Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4385/info SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems. SquirrelMail allows for extended functionality through a plugin system...
Oracle VirtualBox 3D Acceleration - Multiple Vulnerabilities
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities 1. Advisory Information Title: Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities Advisory...