56796 matches found
Quicksilver Forums <= 1.2.1 (set) Remote File Include Vulnerability
No description provided by source. WWW.SecurityWall.orG Quicksilver Forums v1.2.0+1.2.1 setincludepath Remote File Inclusion Vulnerabilities Author: mdx Class : Remote cont@ct: bilkopatathotmaildotcom v1.2.0+v1.2.1 Code: activeutil.php? requireonce $set'includepath' . '/lib/bbcode.php'; Exploit:...
pSlash 0.7 (lvc_include_dir) Remote File Include Vulnerability
No description provided by source. pSlash v0.7 lvcincludedir Remote Include Vulnerability Author: XORON Class: Remote cont@ct: x0r0nathotmaildotcom Code: require$lvcincludedir.'db/dbmysql.inc.php'; Exploit:...
pcAnywhere认证拒绝服务漏洞
BUGTRAQ ID: 15646 CVECAN ID: CVE-2005-3934 Symantec pcAnywhere是全球最畅销的用于管理服务器和提供管理人员支持的远程控制解决方案。 pcAnywhere在处理特制消息的时候存在溢出漏洞，可能导致拒绝服务。由于溢出发生在认证之前，因此远程攻击者无需有效的凭据便可利用这个漏洞。 Symantec pcAnywhere 11.5.1 Symantec pcAnywhere 11.0.1 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
CubeCart <= 3.0.6 Remote Command Execution Exploit
No description provided by source. !/usr/bin/perl cijfer-ccxpl - CubeCart =3.0.6 Remote Command Execution Exploit Copyright c 2005 cijfer [email protected] All rights reserved. 1. example cijfer@kalma:/research$ perl ./cijfer-ccxpl.pl -h www.xxx.com -d [email protected] /$ id;uname -a uid=48apache...
Insteon Hub Reboot Task Denial Of Service Vulnerability(CVE-2017-16348)
Summary An exploitable denial of service vulnerability exists in Insteon Hub running firmware version 1012. Leftover demo functionality allows for arbitrarily rebooting the device without authentication. An attacker can send an UDP packet to trigger this vulnerability. Tested Versions Insteon Hub...
WebKit: Use-after-free when resuming generator(CVE-2018-4218)
In WebKit, resuming a generator is implemented in JavaScript. An internal object property, @generatorState is used to prevent recursion within generators. In GeneratorPrototype.js, the state is checked by calling: var state = this.@generatorState; and set by calling: generator.@generatorState =...
Moxa EDR-810 Web Server strcmp Multiple Denial of Service Vulnerabilities(CVE-2017-14435 - CVE-2017-14437)
Summary An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXALOG.ini, /MOXACFG.ini, o...
Simple DirectMedia Layer Create RGB Surface Code Execution Vulnerability(CVE-2017-2888)
Summary An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provid...
HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability(CVE-2016-4333)
Description HDF5 is a file format that is maintained by a non-profit organization, The HDF Group. HDF5 is designed to be used for storage and organization of large amounts of scientific data and is used to exchange data structures between applications in industries such as the GIS industry via...
Tarantool Key-type Denial Of Service Vulnerability(CVE-2016-9037)
Summary An exploitable out-of-bounds array access vulnerability exists in the xrowheaderdecode function of Tarantool 1.7.2.0-g8e92715. A specially crafted packet can cause the function to access an element outside the bounds of a global array that is used to determine the type of the specified...
Poppler PDF Image Display DCTStream::readScan() Code Execution Vulnerability(CVE-2017-2814)
Summary An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler-0.53.0. A specifically crafted pdf can cause an image resizing after allocation has already occurred, resulting in heap corruption which can lead to code execution. An attacker controlled PDF...
Poppler PDF library JPEG 2000 levels Code Execution Vulnerability(CVE-2017-2820)
Summary An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code...
FreeRDP Rdp Client License Read Product Info Denial of Service Vulnerability(CVE-2017-2838)
Summary An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use ma...
Adobe Acrobat Reader DC AcroForm PDFDocEncoding Remote Code Execution Vulnerability(CVE-2017-11263)
Summary An exploitable case of parser confusion can lead to invalid pointer arithmetic in part of code responsible for parsing AcroForm forms in the Adobe Acrobat Reader DC 2017.009.20044. A specially crafted PDF file can abuse this unchecked pointer arithmetic to access and overwrite arbitrary...
FreeRDP Rdp Client License Read Challenge Packet Denial of Service Vulnerability(CVE-2017-2839)
Summary An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use ma...
Google Nexus 9 Cypress SAR Firmware Injection via I2C(CVE-2017-0563)
Product Google Nexus 9 Vulnerable Version Nexus 9 Android Builds before N4F27B - May 2017, i.e. before bootloader 3.50.0.0143. Mitigation Install N4F27B or later bootloader version 3.50.0.0143. Technical Details The Nexus 9 device contains a sensor SoC manufactured by Cypress. The sensor is manag...
Windows Kernel win32k.sys multiple bugs in the NtGdiGetDIBitsInternal system call (CVE-2017-0058)
We have discovered two bugs in the implementation of the win32k!NtGdiGetDIBitsInternal system call, which is a part of the graphic subsystem in all modern versions of Windows. The issues can potentially lead to kernel pool memory disclosure bug 1 or denial of service bug 1 and 2. Under certain...
Schneider Electric Magelis HMI Advanced Panel denial of service vulnerability (PanelShock)
IMPROPER IMPLEMENTATION OF HTTP GET REQUEST CVE-2016-8367 / SVE-82003201 The timeout value for closing an HTTP client's requests in the Web Gate service is too long and allows a malicious attacker to open multiple connections to the targeted web server and keep them open for as long as possible b...
易企CMS install/install.php 代码执行
看代码\install\install.php 作用就是安装该cms，然后把install.php改为install.php.bak。由于apache解析问题，改文件还是会解析成php，然后就可以暴力getshell。 数据库连接文件会写到\include\config.inc.php 由于是双引号可直接shell，无限制。...
大汉互动管理平台文件包含漏洞
简要描述： 详细说明： 写信提的时候截断包含： lm/front/mailwriteover.jsp?editpagename=/../../../../../../../../../../../etc/passwd%00.ftl 例： http://.../lm/front/mailwriteover.jsp?editpagename=/../../../../../../../../../../../../../etc/passwd%00.ftl...
phpcms v9用户登录处存在sql注入漏洞
password字段如果存在特殊字符，在传入到程序时仍然会被转义，而且在phpsso的login中使用的是username做数据库查询，而不是password。针对第一个问题我们可以使用二次url编码的方法来搞定，在解码之后程序还是用了parsestr对字符串进行了拆解，而这个函数还附带了解url编码的功能。所以，我们只需要在传password内容时传递%2527就可以让单引号出现在phpsso的变量中了。第二个问题也用到parsestr的功能，parsestr在解析“username=123&password=456”这样的字符串，会把它解析为：Array username=123,...
Coremail一处存储型跨站脚本（有触发条件）
简要描述： Coremail一处存储型跨站脚本漏洞，已申请CVE编号：CVE-2015-6942 详细说明： 影响版本：XT3.0 其他版本未测试 测试步骤： 1.首先创建一个带有超链接的doc文档，超链接为"javascript:alert" 2.创建一封邮件并上传附件，然后发送给需要攻击的用户可发送给任意用户。 3.受害者如果在WebMail里打开邮件并在线预览doc文档时，点击超链接，即可执行攻击代码。 4.重新将文档中的超链接换成location.href方式获取Cookie的超连接的即可...
程氏舞曲 任意文件下载与设计缺陷
简要描述： 有利用条件！烦。 详细说明： 利用条件： 1、cms设置使用本机物理路径，就是上传文件存在本机服务器上。 2、后台关闭审核功能，或者通过审核。 条件1比较好达到，一般都在本机上。 条件2需要精心构造一下。 漏洞页面： user/music.php addsave函数用来上传歌曲的，这里提交数据包。...
Enalean Tuleap 7.2 - XXE File Disclosure
No description provided by source. Vulnerability title: Tuleap = 7.2 External XML Entity Injection in Enalean Tuleap CVE: CVE-2014-7177 Vendor: Enalean Product: Tuleap Affected version: 7.2 and earlier Fixed version: 7.4.99.5 Reported by: Jerzy Kramarz Details: A multiple XML External Entity...
Linux PolicyKit Race Condition Privilege Escalation
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class Metasploit4 Msf::Exploit::Local Rank = GreatRanking include Msf::Exploit::EXE include Msf::Post::File include...
全国高校某数字化校园统一认证平台一键获取管理员权限
简要描述： 数字化校园统一认证平台，进入之后，可以管理高校所以其他任意系统，如OA办公系统，图书馆系统，教务系统，多媒体平台等。一个权限认证绕过，可导致整个内网数据沦陷。 详细说明： 前言：此漏洞属猜解绕过，无技术含量，但影响大。 因为通用型，我们这里找了一个示例站点来作范例， 四川航天职业技术学院 http://220.167.53.63:8023/zfca/ 这个链接官网主页上面有，所以容易找到。 下面看图示： 我们这里直接常用思路，找回密码试试 这里没有密保手机和邮箱，只有试尝试密保问题找回咯，填入admin吧！...
方维团购最新版通杀注入（附大量案例）
简要描述： RT $$$$$$$$$$$$$$$$$$$$$$$ 详细说明： 官网没成功。但是基本通杀。 存在问题的地方是这个登录接口：m.php?m=User&a=doLogin post：origURL=ghost&password=ghost&email=ghost（email参数没有过滤） 报错注入 http://www.qianrengou.com/m.php?m=User&a=doLogin post：post：origURL=ghost&password=ghost&email=ghost 默认后台：admin.php...
Ultra Electronics 7.2.0.19 and 7.4.0.7 - Multiple Vulnerabilities
No description provided by source. Ultra Electronics / AEP Networks - SSL VPN Netilla / Series A / Ultra Protect Vulnerabilities http://www.osisecurity.com.au/advisories/ultra-aep-netilla-vulnerabilities Release Date: 02-Oct-2014 Software: Ultra Electronics - Series A...
frcms 重装系统
简要描述： 重装了 之后 可以轻松getshell。 详细说明： 在install/index.php中 header"Content-Type: text/html; charset=$lang"; foreachArray'GET','POST','COOKIE' as $request foreach$$request as $k = $v $$k = runmagicquotes$v; function runmagicquotes&$svar if!getmagicquotesgpc if isarray$svar foreach$svar as $k = $v $svar$k...
MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
IBM Websphere Application Server 2.0./3.0/3.0.2 .1 Showcode Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1500/info Certain versions of the IBM WebSphere application server ship with a vulnerability which allows malicious users to view the source of any document which resides in the web document root directory. This is possib...
WANGKONGBAO CNS-1000 UTM IPS-FW Directory Traversal
No description provided by source. Exploit Title: WANGKONGBAO CNS-1000 and 1100 Network Security Platform UTM Directory Traversal Date: 7/2/2012 Exploit Author: Dillon Beresford Vendor Homepage: http://www.wangkongbao.com/products.html Version: CNS-1000 and 1100 The issue is in the...
Emefa Guestbook 3.0 - Remote Database Disclosure Vulnerability
No description provided by source. Title: Emefa Guestbook V 3.0 Remote Database Disclosure Vulnerability Credit: Cyber.Zer0 E-mail: Cyber.Zer04tHotmaildotcom Download: http://www.emefa.dyndns.org/downloads/ Remote: Yes Dork: Emefa Guestbook V 3.0 --=Database Disclosure=--...
ttCMS <= 4 - (ez_sql.php lib_path) Remote File Inclusion Vulnerability
No description provided by source. DEVIL TEAM - HACKING POLISH TEAM Author: Kacper a.k.a Rahim Contact: [email protected] Homepage: http://www.rahim.webd.pl/ Irc: irc.milw0rm.com:6667 devilteam -------------------------------------------- Pozdro dla wszystkich z kanalu IRC oraz forum DEVIL TEAM...
RoundCube Webmail <= 0.2b Remote Code Execution Exploit
No description provided by source. !/bin/sh I was hoping the PoC would not appear so soon, but now that it is out, i thought i might as well publish my real exploit. Hunger http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5619 FOR LEARNING PURPOSES ONLY! PHP echoiniget'disablefunctions';...
Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow
No description provided by source. $Id: adobecooltypesing.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms ...
GIMP 2.8.0 FIT File Format DoS
No description provided by source. Summary ======= There is a file handling DoS in GIMP the GNU Image Manipulation Program for the 'fit' file format affecting all versions Windows and Linux up to and including 2.8.0. A file in the fit format with a malformed 'XTENSION' header will cause a crash i...
MCFileManager Plugin for TinyMCE 3.2.2.3 - Arbitrary File Upload Vulnerability
No description provided by source. ============================================== File Upload Vulnerability Plugins tinymce ============================================== http://tinymce.moxiecode.com/pluginsfilemanager.php Major version 3 Minor version 2.2.3 Author : Vladimir Vorontsov Contact :...
Open&Compact FTP Server 1.2 (Gabriel's FTP Server) - Auth Bypass & Directory Traversal SAM Retrieval Exploit
No description provided by source. !/usr/bin/python Exploit Title: Open&Compact Ftp Server = 1.2 Auth bypass & directory traversal sam retrieval Date: Aug 7, 2013 By Wireghoul - http://www.justanotherhacker.com Based on Serge Gorbunov's auth bypass http://www.exploit-db.com/exploits/13932/ Softwa...
Postfix 1.1.x Denial of Service Vulnerabilities (1)
No description provided by source. source: http://www.securityfocus.com/bid/8333/info Debian has reported two vulnerabilities in the Postfix mail transfer agent. The first vulnerability, CAN-2003-0468, can allow for an adversary to bounce-scan a private network. It has also been reported that thi...
glibc LD_AUDIT arbitrary DSO load Privilege Escalation
No description provided by source. !/bin/sh I Can't Read and I Won't Race You Either by zx2c4 This is an exploit for CVE-2010-3856. A while back, Tavis showed us three ways to exploit flaws in glibc's dynamic linker involving LDAUDIT. 1 2 The first way involved opening a file descriptor and using...
PHP <= 4.4.7 / 5.2.3 MySQL/MySQLi Safe Mode Bypass Vulnerability
No description provided by source. Affected Products: = PHP 5.2.3 = PHP 4.4.7 Authors: Mattias Bengtsson [email protected] Philip Olausson [email protected] Reported: 2007-06-05 Released: 2007-08-30 CVE: CVE-2007-3997 Issue: A vulnerability exists in PHP's MySQL and MySQLi extenstions which can be use...
Sun Java Web Start BasicServiceImpl Remote Code Execution Exploit
No description provided by source. $Id: javabasicserviceimpl.rb 11623 2011-01-22 00:16:57Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and ter...
CUPS 1.1.x HPGL File Processor Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11968/info CUPS is reported prone to a remote buffer overflow vulnerability. The issue is reported to exist in the 'hpgl-input.c' source file and is because of a lack of sufficient boundary checks performed on data...
ES CmS 0.1 - SQL Injection Vulnerability
No description provided by source. ? Exploit Title: ES CmS 0.1 Sql Injection Vulnerability Google Dork: inurl:/page.php?id= Date: 2012 Exploit Author: MR.XpR Software Link: http://es-cms.com , http://sourceforge.net/projects/escms/files/esCMS Alpha/0.1/escmsalphav01.zip Version: v.0.1 Tested on: ...
程氏舞曲CMS最新版某处SQL注射漏洞（官方演示站）
简要描述： 今天刚看到这个网站，于是就射了一吧！ 详细说明： 在歌曲搜索的地方，敲了一个单引号，于是就出现了如下的错误，其中单引号要转码为%27 http://demo.chshcms.com/index.php/dance/so/key/%27 然后构造了一下http://demo.chshcms.com/index.php/dance/so/key/wooyun' or '%'=' 转码后为http://demo.chshcms.com/index.php/dance/so/key/wooyun%27%20or%20%27%25%27%3D%27 所有的歌曲都查询出来了！...
ECSHOP后台getshell漏洞
简要描述： ECSHOP 后台getshell 详细说明： admin/editlanguages.php elseif $REQUEST'act' == 'edit' / 语言项的路径 / $langfile = isset$POST'filepath' ? trim$POST'filepath' : ''; / 替换前的语言项 / $srcitems = !empty$POST'item' ? stripslashesdeep$POST'item' : ''; / 修改过后的语言项 / $dstitems = array; $POST'itemid' =...
PHPSHE B2C商城系统通杀SQL注入漏洞
No description provided by source...
大汉网络几处命令执行漏洞
简要描述： RT 详细说明： 存在漏洞的地址： http://oa5.hanweb.com/notice/admin/login/login.action http://oa6.hanweb.com/jact/admin/login/login.action 不是小厂商吧？ 漏洞证明：...
Ruby on Rails XML解析远程拒绝服务漏洞(CVE-2013-1856)
BUGTRAQ ID: 58554 CVECAN ID: CVE-2013-1856 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails 3.0.0及之后版本在使用JRuby时，ActiveSupport XML解析器的JDOM后端内存在漏洞，攻击者可利用此漏洞造成拒绝服务或访问应用服务器上的文件。 0 Ruby on Rails 3.x Ruby on Rails 2.x 临时解决方法： 如果您不能立刻安装补丁或者升级，建议您采取以下措施以降低威胁：...