56796 matches found
Dedecms V5.7后台的两处getshell(CVE-2018-9175)
第一个是常见的思路，把语句写入inc文件，然后在其他的include语句中，包含了恶意代码进而getshell。 漏洞代码在:/dede/sysverifies.php 代码如下： else if $action == 'getfiles' if!isset$refiles ShowMsg"你没进行任何操作！","sysverifies.php"; exit; $cacheFiles = DEDEDATA.'/modifytmp.inc'; $fp = fopen$cacheFiles, 'w'; fwrite$fp, ''; fclose$fp; $dirinfos = ''; if$...
Windows Kernel double fetches in win32kfull!xxxImeWindowPosChanged and win32kfull!InternalRebuildHwndListForIMEClass( CVE-2018-0809)
We have noticed the following code in the win32kfull!xxxImeWindowPosChanged function on Windows 10 version 1709 32-bit listing from the IDA Pro disassembler: .text:000485A4 ; try // except at locF3502 .text:000485A4 mov ebp+msexc.registration.TryLevel, 0 .text:000485AB mov eax, ecx .text:000485AD...
WebKit: UXSS via ContainerNode::parserInsertBefore(CVE-2017-2508)
VULNERABILITY DETAILS From /WebKit/Source/core/dom/ContainerNode.cpp: void ContainerNode::parserInsertBeforePassRefPtrWillBeRawPtr newChild, Node& nextChild ... while RefPtrWillBeRawPtr parent = newChild-parentNode parent-parserRemoveChildnewChild; if document != newChild-document...
CPP-Ethereum libevm create2 Information Leak Vulnerability(CVE-2017-14457)
Summary An exploitable information leak / denial of service vulnerability exists in the libevm Ethereum Virtual Machine create2 opcode handler of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read leading to memory disclosure or denial of service. An attacker ca...
Kaspersky Anti-Virus Unhandled Windows Messages Denial of Service Vulnerability(CVE-2016-4329)
Summary An local denial of service vulnerability exists in window broadcast message handling functionality of Kaspersky Anti-Virus software. Sending certain unhandled window messages, attacker can cause application termination and in the same way bypass KAV self-protection mechanism. Tested...
iBall ADSL2+ Home Router Authentication Bypass Vulnerability(CVE-2017-14244)
Exploit Title: iBall ADSL2+ Home Router Authentication Bypass Vulnerability CVE: CVE-2017-14244 Date: 15-09-2017 Exploit Author: Gem George Author Contact: https://www.linkedin.com/in/gemgrge Vulnerable Product: iBall ADSL2+ Home Router WRA150N https://www.iball.co.in/Product/ADSL2--Home-Router/7...
Apple: Multiple Race Conditions in PCIe Message Ring protocol leading to OOB Write and OOB Read(CVE-2017-7115)
Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. On iOS, the "AppleBCMWLANBusInterfacePCIe"...
Moxa AWK-3131A web_runScript Header Manipulation Denial of Service Vulnerability(CVE-2016-8726)
Summary An exploitable null pointer dereference vulnerability exists in the Web Application /forms/webrunScript iwfilename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web...
Poppler PDF Image Display DCTStream::readScan() Code Execution Vulnerability(CVE-2017-2814)
Summary An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler-0.53.0. A specifically crafted pdf can cause an image resizing after allocation has already occurred, resulting in heap corruption which can lead to code execution. An attacker controlled PDF...
FreeRDP Rdp Client License Read Product Info Denial of Service Vulnerability(CVE-2017-2838)
Summary An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use ma...
FreeRDP Rdp Client Recv RDP Code Execution Vulnerability(CVE-2017-2835)
Summary An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middl...
Supervisor Authenticated Remote Code Execution(CVE-2017-11610)
Vulnerability Summary The following advisory describes an authenticated remote code execution vulnerability in Supervisor version 3.1.2 and Supervisor version 3.3.2. Supervisor is a client/server system that allows its users to monitor and control a number of processes on UNIX-like operating...
Alpine Linux: From vulnerability discovery to code execution
I’ve recently uncovered two critical vulnerabilities in Alpine Linux’s package manager, assigned CVE-2017-9669 and CVE-2017-9671. These vulnerabilities could potentially lead to an attacker executing malicious code on your machines, if you are using Alpine knowingly or implicitly. Alpine Linux is...
MsMpEng: Remotely Exploitable Type Confusion(CVE-2017-0290)
MsMpEng is the Malware Protection service that is enabled by default on Windows 8, 8.1, 10, Windows Server 2012, and so on. Additionally, Microsoft Security Essentials, System Centre Endpoint Protection and various other Microsoft security products share the same core engine. MsMpEng runs as NT...
Wordpress Plugin Olimometer 2.56 - SQL Injection
Vulnerability parameters: olimometerid= Using sqlmap Parameter: olimometerid GET Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: olimometerid=1 AND 6227=6227 Type: AND/OR time-based blind Title: MySQL = 5.0.12 AND time-based blind Payload: olimometerid=1...
D-Link DSR-250N路由器登录绕过
No description provided by source...
一个Coremail的存储型XSS
简要描述： 某处 escape 姿势不对 详细说明： 目前的代码，在构造发件人时，代码如下： function getEmailDivemailAddress return '' 那么 escapeHTML 是什么呢？ function var div=document.createElement"div"; var 15=document.createTextNodethis; div.appendChild15; return div.innerHTML; 这种过滤并不会过滤单引号和双引号，所以可以构造特别的字符串逃逸到双引号以外 漏洞证明： 最简单触发方式是利用 onmousexx...
网康安全网关 默认弱口令漏洞
No description provided by source...
kingdee live800在线客服系统SQL注射漏洞
0x01 漏洞概述 相关厂商： live800.com 漏洞时间： 2015-10-18 loginAction.jsp SQL注射漏洞，可看客户与客服对话内容，泄露大量敏感信息。 0x02 漏洞细节 在loginAction.jsp中发现以下内容： String loginName=request.getParameter"loginName"; String password=request.getParameter"password"; String loginServerUrl = request.getParameter"loginServerUrl"; OperatorInf...
泛微Eoffice数据库配置文件 mysql_config.ini 下载漏洞
No description provided by source...
MySQL 弱口令 PoC
常见的用户名： root, admin, user, test 常用密码： 123456, admin, password, root, test...
iGENUS 邮件系统 V5.0 任意文件读取漏洞
login.php 文件中，选择语言环境后会读取语言文件，并加载到页面，后台接到请求后，没有对 Lang 参数过滤，就直接读取文件，从而造成任意文件读取漏洞。 http://221.130.182.230/igenus/login.php?Lang=../../../../../../../../../../etc/passwd%00.jpg...
Multiple EMC RSA Products ESA-2015-081 Multiple Security Vulnerabilities
受影响的产品： RSA BSAFE Micro Edition Suite MES all 4.1.x versions prior to 4.1.3 RSA BSAFE Micro Edition Suite MES all 4.0.x versions prior to 4.0.8 RSA BSAFE Crypto-C Micro Edition Crypto-C ME 4.1 RSA BSAFE Crypto-C Micro Edition Crypto-C ME all versions prior to 4.0.4 RSA BSAFE Crypto-J all versions...
方正阿帕比数字资源平台系统多处漏洞打包-可拖库-可getshell-可获取系统权限（通用 多案例）
简要描述： 乌云是目前最大的漏洞平台，只要你知道的系统、网站，它们的漏洞都可以从乌云上找到，所以乌云的漏洞库是一笔无形的巨大财富 详细说明： Apabi数字资源平台系统是一个用户量很大的图书馆系统 涉及网站太多为图书馆、学校等教育机构，甚至地方人社局等，而绝大部分服务器都不是单一的运行着这一套系统...真是个好“邻居”... None 漏洞证明： 漏洞证明在上面详细说明里已足够、拿下webshell后在99.9%均可获取到系统权限，进入远程桌面任意操作。这里就不证明了，并无深入！...
程氏舞曲 任意文件下载与设计缺陷
简要描述： 有利用条件！烦。 详细说明： 利用条件： 1、cms设置使用本机物理路径，就是上传文件存在本机服务器上。 2、后台关闭审核功能，或者通过审核。 条件1比较好达到，一般都在本机上。 条件2需要精心构造一下。 漏洞页面： user/music.php addsave函数用来上传歌曲的，这里提交数据包。...
Windows OLE Package Manager SandWorm Exploit
No description provided by source. !/usr/bin/env python import os import zipfile import sys ''' Full Exploit: http://www.exploit-db.com/sploits/35019.tar.gz Very quick and ugly SandWorm CVE-2014-4114 exploit builder Exploit Title: CVE-2014-4114 SandWorm builder Built to run on: Linux/MacOSX Date:...
全国高校某数字化校园统一认证平台一键获取管理员权限
简要描述： 数字化校园统一认证平台，进入之后，可以管理高校所以其他任意系统，如OA办公系统，图书馆系统，教务系统，多媒体平台等。一个权限认证绕过，可导致整个内网数据沦陷。 详细说明： 前言：此漏洞属猜解绕过，无技术含量，但影响大。 因为通用型，我们这里找了一个示例站点来作范例， 四川航天职业技术学院 http://220.167.53.63:8023/zfca/ 这个链接官网主页上面有，所以容易找到。 下面看图示： 我们这里直接常用思路，找回密码试试 这里没有密保手机和邮箱，只有试尝试密保问题找回咯，填入admin吧！...
CmsEasy 5.5 /lib/default/archive_act.php SQL注入漏洞
No description provided by source...
frcms 重装系统
简要描述： 重装了 之后 可以轻松getshell。 详细说明： 在install/index.php中 header"Content-Type: text/html; charset=$lang"; foreachArray'GET','POST','COOKIE' as $request foreach$$request as $k = $v $$k = runmagicquotes$v; function runmagicquotes&$svar if!getmagicquotesgpc if isarray$svar foreach$svar as $k = $v $svar$k...
phpok 4.0.556 /data.php SQL注入漏洞
No description provided by source...
Spaceacre (index.php) SQL/HTML/XSS Injection Vulnerability
No description provided by source. ------------------------------------------------------------------------------------------- Spaceacre index.php SQL/HTML/XSS Injection Vulnerability ------------------------------------------------------------------------------------------- Author: CoBRa21 Scrip...
IBM Websphere Application Server 2.0./3.0/3.0.2 .1 Showcode Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1500/info Certain versions of the IBM WebSphere application server ship with a vulnerability which allows malicious users to view the source of any document which resides in the web document root directory. This is possib...
TinyWebGallery 1.8.3 - Multiple Vulnerabilities
No description provided by source. Date: 01/02/2011 dd/MM/yyyy Script: TinyWebGallery Version: 1.8.3 No fixes yet, might work on other versions too. Home: http://www.tinywebgallery.com -- Vulnerability: Non-persistent XSS Where: File: /admin/index.php Parameters: sview, tview, dir, item. Examples...
Apple Safari 6.0.1 for iOS 6.0 and OS X 10.7/8 - Heap Buffer Overflow
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------------+ | Packet Storm Advisory 2013-0903-1 | | http://packetstormsecurity.com/ |...
Siemens Simatic S7-300 PLC Remote Memory Viewer
No description provided by source. Exploit Title: Siemens Simatic S7 300 Remote Memory Viewer Backdoor Date: 7-13-2012 Exploit Author: Dillon Beresford Vendor Homepage: http://www.siemens.com/ Tested on: Siemens Simatic S7-1200 PLC CVE : None require 'msf/core' class Metasploit3 Msf::Auxiliary...
Emefa Guestbook 3.0 - Remote Database Disclosure Vulnerability
No description provided by source. Title: Emefa Guestbook V 3.0 Remote Database Disclosure Vulnerability Credit: Cyber.Zer0 E-mail: Cyber.Zer04tHotmaildotcom Download: http://www.emefa.dyndns.org/downloads/ Remote: Yes Dork: Emefa Guestbook V 3.0 --=Database Disclosure=--...
Pandora FMS <= 3.1 - SQL Injection
No description provided by source. + Introduction Pandora FMS for Pandora Flexible Monitoring System is a software solution for monitoring computer networks. It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers, applicatio...
Vino VNC Server 3.7.3 - Persistent Denial of Service
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2013-028: Persistent Denial of Service Vulnerability in Vino VNC Server Published: 09/16/13 Version: 1.0 Vendor: The GNOME Project https://wiki.gnome.org/Vino Product: Vino VNC Server Version affected: Vino VNC Server...
GIMP 2.8.0 FIT File Format DoS
No description provided by source. Summary ======= There is a file handling DoS in GIMP the GNU Image Manipulation Program for the 'fit' file format affecting all versions Windows and Linux up to and including 2.8.0. A file in the fit format with a malformed 'XTENSION' header will cause a crash i...
Enthrallweb eClassifieds dircat.asp cid Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/21192/info eClassifieds is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to...
Oracle Document Capture 10.1.3.5 Insecure Method / Buffer Overflow
No description provided by source. Source: http://packetstormsecurity.org/files/view/97871/DSECRG-11-006.txt ActiveX components contain insecure methods. Digital Security Research Group DSecRG Advisory DSECRG-11-006 internal DSECRG-09-066 Application: Oracle Document Capture Versions Affected:...
Native Instruments Kontakt 4 Player NKI File Syntactic Analysis Buffer Overflow PoC
No description provided by source. / Title: Native Instruments Kontakt 4 Player NKI File Syntactic Analysis Buffer Overflow PoC Vendor: Native Instruments GmbH Product web page: http://www.native-instruments.com Affected version: 4.1.3.4125 Standalone Summary: KONTAKT 4 PLAYER is the free sample...
sap netweaver dispatcher 7.0 ehp1/2 - Multiple Vulnerabilities
No description provided by source. 1. Advisory Information Title: SAP Netweaver Dispatcher Multiple Vulnerabilities Advisory ID: CORE-2012-0123 Advisory URL: http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities Date published: 2012-05-08 Date of last update:...
DLink DIR-645 / DIR-815 diagnostic.php Command Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
Oracle VirtualBox 3D Acceleration - Multiple Vulnerabilities
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities 1. Advisory Information Title: Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities Advisory...
RunCMS <= 1.2 (class.forumposts.php) Arbitrary Remote Inclusion Exploit
No description provided by source. ?php ---runcms13axpl.php 17.30 09/02/2006 RunCMS = 1.2 arbitrary remote inclusion exploit = 1.3a shell upload through FCKEditor coded by rgod site: http://retrogod.altervista.org usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: But when the...
Linux Kernel 2.0.x/2.2.x/2.4.x,FreeBSD 4.x Network Device Driver Frame Padding Information Disclosure
No description provided by source. source: http://www.securityfocus.com/bid/6535/info Network device drivers for several vendors have been reported to disclose potentially sensitive information to attackers. Frames that are smaller than the minimum frame size should have the unused portion of the...
PHPMyWind最新版SQL注入漏洞
简要描述： PHPMyWind最新版SQL注入 详细说明： 文件：/data/alipay/returnurl.php $alipayNotify = new AlipayNotify$alipayconfig; $verifyresult = $alipayNotify-verifyReturn; if$verifyresult //验证成功...
Linux Kernel "inet_frag_intern()"竞争条件漏洞
CVE ID:CVE-2014-0100 Linux Kernel是一款开源的操作系统。 Linux Kernel在"inetfragintern"函数net/ipv4/inetfragment.c的实现上存在竞争条件漏洞，攻击者通过特制的ICMP Echo请求，利用此漏洞可造成间接引用已经释放的内存。 0 Linux kernel 3.13.x Linux kernel 3.12.x Linux kernel 3.10.x 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://www.kernel.org/...
MantisBT 'mc_issue_attachment_get' SOAP API SQL注入漏洞
BUGTRAQ ID: 65445 CVE ID: CVE-2014-1608 MantisBT是基于Web的bug跟踪系统。 MantisBT 1.2.16之前版本，api/soap/mcfileapi.php内的mcifileget函数存在SQL注入漏洞，这可使远程攻击者通过mcissueattachmentget SOAP请求内的特制envelope标签，利用此漏洞执行任意SQL命令。 0 mantisbt mantisbt 1.2.16 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mantisbt.org/...