56796 matches found
Pluck 4.5.3 (update.php) Remote File Corruption Exploit
No description provided by source. ?php / Pluck 4.5.3 update.php remote file corruption exploit by Nine:Situations:Group::bookoo our site: http://retrogod.altervista.org/ Google dorks: "powered by pluck" +admin inurl:file=kop1.php inurl:file=kop2.php ... Exploit condition : registerglobals = on...
趋势科技OfficeScan cgiRecvFile.exe栈溢出漏洞
BUGTRAQ ID: 31139 CVECAN ID: CVE-2008-2437 OfficeScan是一种针对整个网段的分布式杀毒软件。 OfficeScan的cgiRecvFile.exe中存在栈溢出漏洞，如果远程攻击者在提交的HTTP请求中包含了超长的ComputerName参数的话，就可以触发这个溢出，导致执行任意指令。必须还要控制TempFileName、NewFileSize和Verify参数才能利用这个漏洞。 Trend Micro OfficeScan 7.3 patch 4 build 1362 Trend Micro -----------...
Joomla Component joovideo 1.2.2 (id) SQL Injection Vulnerability
No description provided by source. Mambo Component comjoovideo SQL InjectionPowered by joovideo V1.0 AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MA陌L : [email protected] TODAY MY B陌RTDAY SOO I WROTE 5 BUGS ALL FOR HACKERS 5 EXPLO陌TS HAVE 100.000 MAMBO-JOOMLA WEBPAGES ...
Remotely Anywhere 'Accept-Charset'字符NULL指针拒绝服务漏洞
BUGTRAQ ID: 28175 CNCAN ID:CNCAN-2008031103 Remotely Anywhere是一款远程管理软件。 Remotely Anywhere不正确处理特殊构建的HTTP请求，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 提交包含非法Accept-Charset参数的HTTP请求，可导致NULL指针引用而导致应用程序崩溃，造成拒绝服务攻击。 RemotelyAnywhere RemotelyAnywhere Workstation Edition 8.0.668 RemotelyAnywhere RemotelyAnywhere Server...
SAPlpd多个远程溢出及拒绝服务漏洞
BUGTRAQ ID: 27613 CVECAN ID: CVE-2008-0620,CVE-2008-0621 SAPlpd是SAP GUI软件包中所捆绑的Windows平台行市打印机守护程序。 SAPLPD服务程序在处理LPD命令时存在多个缓冲区溢出漏洞，远程攻击者可能利用这些漏洞控制服务器或导致服务不可用。 如果向0x01、0x02、0x03、0x04、0x05、0x31、0x32、0x33、0x34和0x35 LPD命令传送了超长参数的话，就可以触发这些溢出，导致执行任意指令；如果向0x53 LPD命令传送了畸形参数，还可能导致服务器终止。 SAP SAPlpd = 6.28 S...
PKs Movie Database 3.0.3 XSS / SQL Injection Vulnerabilities
No description provided by source. ------------------------------------------------------------- ----- H-T Team HouSSaMix + ToXiC350 from MoroCCo -------- ------------------------------------------------------------- = Author : HouSSaMix From H-T Team = Script : PKs Movie Database version 3.0.3 =...
Linux Kernel ISDN_Net.C本地缓冲区溢出漏洞
BUGTRAQ ID: 26605 CVE ID:CVE-2007-6063 CNCVE ID:CNCVE-20076063 Linux是一款开放源代码的操作系统。 Linux包含的'isdnnetsetcfg'函数存在设计错误，本地攻击者可以利用漏洞进行缓冲区溢出攻击，可能提升特权。 在isdnioctl函数中会调用isdnnetsetcfg： isdnioctl drivers/isdn/i4l/isdncommon.c: 1270 isdnioctlstruct inode inode, struct file file, uint cmd, ulong arg...
Microsoft Windows柯达图像查看器远程代码执行漏洞（MS07-055）
BUGTRAQ ID: 25909 CVECAN ID: CVE-2007-2217 Microsoft Windows是微软发布的非常流行的操作系统。 Windows中的柯达图像查看器处理特制图像文件的方式中存在内存破坏漏洞，远程攻击者可能利用此漏洞通过诱使用户处理畸形数据控制用户系统。 攻击者可以通过构建特制图像来利用此漏洞，如果用户访问网站、查看特制电子邮件或者打开电子邮件附件，该漏洞可能允许远程执行指令。成功利用此漏洞的攻击者可以完全控制受影响的系统。 Microsoft Windows XP SP2 Microsoft Windows Server 2003 SP2...
Trend Micro OfficeScan管理控制台验证绕过漏洞
Trend Micro OfficeScan是一款企业级的网络防毒墙解决方案。 Trend Micro OfficeScan存在验证绕过问题，远程攻击者可以利用漏洞未授权登录管理接口并更改应用程序设置。 OfficeScan安装包含的WEB管理接口允许管理员配置应用程序和反病毒客户端管理。WEB接口由cgiChkMasterPwd.exe处理，传递由ActiveX控件生成的HASH和密码的加密版本。如果cgiChkMasterPwd.exe发送一个空的加密字符串和空的HASH，它会发送客户端一个合法会话ID用于访问WEB管理控制台。 Trend Micro OfficeScan...
Xoops Module Virii Info <= 1.10 (index.php) Remote File Include Exploit
No description provided by source. html head meta http-equiv="Content-Type" content="text/html; charset=windows-1254" titleXoops Module Virii Info = 1.10 index.php Remote File Include Exploit/title script language="JavaScript"...
Web Content System 2.7.1 Remote File Inclusion Exploit
No description provided by source. Web Content System //'=============================================================================================== //'Script Name : Web Content System //' //'? //'.... //'.. //'ERROR------------------------------...
Active Auction Pro 7.1 (default.asp catid) SQL Injection Vulnerability
No description provided by source. Title : Active Auction Remote SQL Injection Vulnerability Author : CyberGhost Demo Page : http://www.activewebsoftwares.com/demoactiveauction Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=1 Vuln. Username :...
Takebishi Electric DeviceXPlorer OPC服务器远程代码执行漏洞
OPC OLE for Process Control 是一款为保证工业软件和设备的互联性而制订的程序接口国际标准。 Takebishi Electric DeviceXPlorer OPC服务器存在设计错误，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 通过OPCDA接口，可导致在OPC Server上访问任意内存，可导致执行任意指令。如下版本的DeviceXPlorer OPC Server受此漏洞影响： DeviceXPlorer MELSEC OPC Server DeviceXPlorer SYSMAC OPC Server DeviceXPlorer FA-M3 O...
Wordpress 2.1.1远程命令执行后门漏洞
WordPress是一款免费的论坛Blog系统。 WordPress提供软件下载的网站被入侵，入侵者修改了软件代码码植入远程可执行命令的后门，远程攻击者可能利用这个后门以Web进程权限在安装了恶意版本WordPress的服务器上执行任意命令。 被修改的文件是wp-includes/feed.php和wp-includes/theme.php，被添加了如下代码： 在wp-includes/feed.php文件中： function commenttextphpfilter$filterdata eval$filterdata; ... if $GET"ix"...
Mani Stats Reader <= 1.2 (ipath) Remote File Include Vulnerability
No description provided by source. Mani Admin Plugin Stats Reader V1.2 rfi : dork:"2006 by www.mani-stats-reader.de.vu" "allinurl:.php?ipath= inurl:"css"" vuln:index.php?ipath=evilshit greetz:RST, LinuxPakistan phpfreaks [email protected] milw0rm.com 2007-03-02...
PHP-Fusion Maincore.PHP SQL注入漏洞
PHP-Fusion是一款基于PHP的内容管理程序。 PHP-Fusion不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Maincore.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 PHP-Fusion PHPFusion 6.1.4 PHP-Fusion PHP-Fusion 6.0.307 PHP-Fusion PHP-Fusion 6.0.204 PHP-Fusion PHP-Fusion 6.0.110 PHP-Fusion PHP-Fusion...
ProFTPD mod_tls预认证远程缓冲区溢出漏洞
ProFTPD是一款开放源代码FTP服务程序。 ProFTPD的模块modtls在处理用户认证时存在缓冲溢出漏洞，远程攻击者可能利用此漏洞完全控制服务器。 ProFTPD的modtls模块的tlsx509nameoneline函数中存在远程溢出漏洞，允许远程未经认证的攻击者获得root用户权限。漏洞相关的代码如下： contrib/modtls.c: """ static char tlsx509nameonelineX509NAME x509name static char buf256 = '\0'; / If we are using OpenSSL 0.9.6 or newer,...
Mambo/Joomla plugin.class.php脚本远程文件包含漏洞
Mambo（也被称为Joomla）是一款开放源代码的WEB内容管理系统。 Mambo在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 在Mambo的comcomprofiler文件夹的plugin.class.php脚本中： -----------------------plugin.class.php---------------------- ?php / Plugin handler @package Joomla @author various, JoomlaJoe and Beat / requireonce...
PHP121 Instant Messenger <= 1.4 Remote Code Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "PHP121 Instant Messenger = 1.4 $SESSIONsessusername remote cmmnds xctn \r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "- works with magicquotesgpc = Off\r\n\r\n"...
WebKit: Use-after-free when resuming generator(CVE-2018-4218)
In WebKit, resuming a generator is implemented in JavaScript. An internal object property, @generatorState is used to prevent recursion within generators. In GeneratorPrototype.js, the state is checked by calling: var state = this.@generatorState; and set by calling: generator.@generatorState =...
SQLi, XSS zero-days expose Belkin IoT devices, Android smartphones
LONDON, UK – Research director Scott Tenaglia and lead research engineer Joe Tanen detailed the vulnerabilities during their ‘Breaking BHAD: Abusing Belkin Home Automation devices’ talk at the Black Hat Europe conference in London last Friday. The zero-day flaws specifically relate to Belkin’s...
Moxa EDR-810 Web Server strcmp Multiple Denial of Service Vulnerabilities(CVE-2017-14435 - CVE-2017-14437)
Summary An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXALOG.ini, /MOXACFG.ini, o...
CPP-Ethereum JSON-RPC miner_start improper authorization Vulnerability(CVE-2017-12117)
Summary An exploitable improper authorization vulnerability exists in minerstart API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigg...
SonicDICOM PACS 2.3.2 Remote Vertical Privilege Escalation Exploit
Summary SonicDICOM is PACS software that combines the capabilities of DICOM Server with web browser based DICOM Viewer. Description The application suffers from a privilege escalation vulnerability. Normal user can elevate his/her privileges by sending a HTTP PATCH request seting the parameter...
Apple Image I/O API Tiled TIFF Remote Code Execution Vulnerability(CVE-2016-4631)
SUMMARY An exploitable heap based buffer overflow exists in the handling of TIFF images on Apple OS X and iOS operating systems. A crafted TIFF document can lead to a heap based buffer overflow resulting in remote code execution. This vulnerability can be triggered via malicious web page, MMS...
Poppler PDF library JPEG 2000 levels Code Execution Vulnerability(CVE-2017-2820)
Summary An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code...
Drupal 7.x Services module unserialize() to RCE
Upon auditing Drupal's Services module, the Ambionics team came accross an insecure use of unserialize. The exploitation of the vulnerability allowed for privilege escalation, SQL injection and, finally, remote code execution. Services module Services is a "standardized solution for building API'...
PHP PEAR 1.10.1 - arbitrary File Download Vulnerability (CVE-2017-5630)
Author: mapl0 Vulnerability details In the PEAR Base System The 1. 10. 1 version of the installer, can be in after the redirect does not verify file type and file name, and then allows the remote http server via a specially crafted request to overwrite the hacked server files, such as. htaccess i...
GitHub Enterprise SQL injection vulnerability
作者：Orange 前言 GitHub Enterprise 是一款 GitHub.com 所出品，可將整個 GitHub 服務架設在自身企業內網中的應用軟體。 有興趣的話你可以從 enterprise.github.com 下載到多種格式的映像檔並從網頁上取得 45 天的試用授權! 安裝完成後，你應該會看到如下的畫面: 好!現在我們有整個 GitHub 的環境了，而且是在 VM 裡面，這代表幾乎有完整的控制權可以對他做更進一步的研究，分析環境、程式碼以及架構等等... 環境 身為一個駭客，再進行入侵前的第一件事當然是 Port Scanning! 透過 Nmap 掃描後發現 VM 上一...
Web interface for DNSmasq / Mikrotik - SQL Injection
No description provided by source...
大汉网站群访问统计系统 /vc/vc/style/opr_copycode.jsp SQL注入
No description provided by source...
Windows 权限提升漏洞 CVE-2015-6132
No description provided by source...
育软电子政务平台SQL注入漏洞
No description provided by source...
PHPMyWind任意用户密码重置
简要描述： PHPMyWind任意用户密码重置 详细说明： 首先我们注册两个用户 第一个叫jkgh006 第二个叫test123 那么我们下来分析一下代码: member.php: else if$a == 'saveedit' //检测数据完整性 if$password!=$repassword or $email=='' header'location:?c=edit'; exit; //HTML转义变量 $answer = htmlspecialchars$answer; $cnname = htmlspecialchars$cnname; $enname =...
BIND9 TKEY assert Dos
我们对 9.9.7-P1 和 9.9.7-P2 这两个版本进行了 diff,发现其主要 Patch 点位于 lib/dns/tkey.c文件中第 653 行 dnstkeyprocessquery 函数中: 在该函数中两次调用 dnsmessagefindname 函数来分别从 DNSSECTIONADDITIONAL 和 DNSSECTIONANSWER 中寻找 TEKY 记录,从代码中可以看到,第一次函数调用之前 na me 变量进行了初始化,被赋值为 NULL,而第二次调用前却未进行初始化。 dnsmessagefindname 函数原型位于 lib/dns/message.c...
Drupal Core <= 7.32 - SQL Injection (PHP)
No description provided by source. ?php ----------------------------------------------------------------------------- Exploit Title: Drupal core 7.x - SQL Injection Date: Oct 16 2014 Exploit Author: Dustin Dörr Software Link: http://www.drupal.com/ Version: Drupal core 7.x versions prior to 7.32...
phpBB Spider Friendly Module <= 1.3.10 File Include Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? print ' | \\ | \\ | \ . . |\ \ \ /\ \ / /| || | | | | \ | \ Y / | || | | \ | \ \ / | || | |/ // / / ||| \ | / / \ / \ |\ /\ / / \ / \ | | | | / /\ \ / \ / \ | | | | / | / Y \ || / /| /| /...
Ultimate eShop Error Based SQL Injection Vulnerability
No description provided by source. Exploit Title: Ultimate eShop Error Based SQL Injection Vulnerability Google Dork: inurl:index.cgi?aktion=shopview Date: 19/04/2011 Author: Romka Software Link: http://www.ultimate-eshop.de/ Tested on: Windows XP SP3 Exploit:...
Mambo/Joomla Com_comprofiler 1.0 Plugin.class.PHP Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/19725/info The Mambo and Joomla comcomprofiler component is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary...
DataLife Engine 9.7 (preview.php) PHP Code Injection Vulnerability
No description provided by source...
Java Web Start Double Quote Injection Remote Code Execution
No description provided by source. ======================================================== Java Web Start Double Quote Inject Remote Code Execution ======================================================== Date: Jun 12 2012 updated: Jun 6 2013 Author: Rh0 Version: At least Java 1.6.31 to 1.6.35 a...
OpenSSL SSLv2 - Null Pointer Dereference Client Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/20246/info OpenSSL is prone to a denial-of-service vulnerability. A malicious server could cause a vulnerable client application to crash, effectively denying service. !/usr/bin/perl Copyrightc Beyond Security Written by...
Mac OS X - Java applet Remote Deserialization Remote PoC (updated)
No description provided by source. Critical Mac OS X Java Vulnerabilities Introduction Five months ago, CVE-2008-5353 and other vulnerabilities were publicly disclosed, and fixed by Sun. CVE-2008-5353 allows malicious code to escape the Java sandbox and run arbitrary commands with the permissions...
Adobe Flash Player < 10.1.53 .64 Action Script Type Confusion Exploit (DEP+ASLR bypass)
No description provided by source. Source: http://www.abysssec.com/blog/2011/04/exploiting-adobe-flash-player-on-windows-7/ Adobe Flash player Action script type confusion exploit DEP+ASLR bypass advisory text : Here is another reliable windows 7 exploit . the main method used for exploitation is...
Cisco Wireless Lan Controller 7.2.110.0 - Multiple Vulnerabilities
No description provided by source. Cisco WLC CSRF, DoS, and Persistent XSS Vulnerabilities Exploit Title: u M@d? - Cisco WLC CSRF, DoS, and Persistent XSS Vulnerabilities Date: Discovered and reported November 2012 Author: Jacob Holcomb/Gimppy042 - Security Analyst @ Independent Security Evaluato...
DFD Cart 1.1 - Multiple Remote File Inclusion Vulnerabilities
No description provided by source. DFD Cart 1.1 Multiple Remote File Inclusion Vulnerabilities Vulnerability Type: Remote File Inclusion Vulnerable file: /dfdcart/app.lib/product.control/core.php/product.control.config.php Exploit URL:...
Dotproject 2.0 /modules/projects/gantt.php dPconfig[root_dir] Parameter Remote File Inclusion
No description provided by source...
PHP <= 5.2.8 gd library - imageRotate() Information Leak Vulnerability
No description provided by source. PHP - gd library - imageRotatefunction Information Leak Vulnerability Discovered by: Hamid Ebadi, Further research and exploit: Mohammad R. Roohian CSIRT Team Members Amirkabir University APA Laboratory Introduction PHP is a popular web programming language whic...
CUPS 1.1.x HPGL File Processor Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11968/info CUPS is reported prone to a remote buffer overflow vulnerability. The issue is reported to exist in the 'hpgl-input.c' source file and is because of a lack of sufficient boundary checks performed on data...
Kayako eSupport <= 2.3.1 (subd) Remote File Inclusion Vulnerability
No description provided by source. Script: Kayako eSupport = 2.3.1 Vendor: Kayako www.kayako.com Discovered: beford xbefordx gmail com Comments: It seems like the vendor silently fixed the issue in the current version more like since v2.3.5 withouth warning users of previous versions, noobs...