56796 matches found
Hyland Perceptive Document Filters Microsoft Word CDATA Code Execution Vulnerability(CVE-2018-3851)
Summary An exploitable heap corruption exists in the Microsoft Word to many types conversion functionality of the Hyland Perspective Document Filters version 11.4.0.2647. A crafted Microsoft Word XML document can lead to heap corruption resulting in remote code execution. An attacker can provide ...
Moxa EDR-810 Service Agent Multiple Denial of Service Vulnerabilities(CVE-2017-14438 - CVE-2017-14439)
Summary Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cause a denial of service. An attacker can send a large packet to 4000/tcp and 4001/tcp to trigger this vulnerability. Tested Version...
Moxa EDR-810 Web Server OpenVPN Config Multiple Command Injection Vulnerabilities(CVE-2017-14432 - CVE-2017-14434)
Summary An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into various paramaters in the...
MikroTik RouterOS < 6.38.4 (x86) - 'Chimay Red' Stack Clash Remote Code Execution
!/usr/bin/env python2 Mikrotik Chimay Red Stack Clash Exploit by wsxarcher based on BigNerd95 POC tested on RouterOS 6.38.4 x86 ASLR enabled on libs only DEP enabled import socket, time, sys, struct from pwn import import ropgadget ASTSTACKSIZE = 0x800000 default stack size per thread 8 MB...
Windows Kernel double fetches in win32kfull!xxxImeWindowPosChanged and win32kfull!InternalRebuildHwndListForIMEClass( CVE-2018-0809)
We have noticed the following code in the win32kfull!xxxImeWindowPosChanged function on Windows 10 version 1709 32-bit listing from the IDA Pro disassembler: .text:000485A4 ; try // except at locF3502 .text:000485A4 mov ebp+msexc.registration.TryLevel, 0 .text:000485AB mov eax, ecx .text:000485AD...
Kaspersky Secure Mail Gateway Multiple Vulnerabilities
Advisory Information Title: Kaspersky Secure Mail Gateway Multiple Vulnerabilities Advisory ID: CORE-2017-0010 Advisory URL: http://www.coresecurity.com/advisories/kaspersky-secure-mail-gateway-multiple-vulnerabilities Date published: 2018-02-01 Date of last update: 2018-02-01 Vendors contacted:...
SonicDICOM PACS 2.3.2 Remote Vertical Privilege Escalation Exploit
Summary SonicDICOM is PACS software that combines the capabilities of DICOM Server with web browser based DICOM Viewer. Description The application suffers from a privilege escalation vulnerability. Normal user can elevate his/her privileges by sending a HTTP PATCH request seting the parameter...
7zip HFS+ NArchive::NHfs::CHandler::ExtractZlibFile Code Execution Vulnerability(CVE-2016-2334)
DESCRIPTION An exploitable heap overflow vulnerability exists in the NArchive::NHfs::CHandler::ExtractZlibFile method functionality of 7zip that can lead to arbitrary code execution. TESTED VERSIONS 7-Zip 32 15.05 beta 7-Zip 64 9.20 PRODUCT URLS http://www.7-zip.org/ CVSSv3 SCORE 7.3 -...
Aerospike Database Server Client Message Memory Disclosure Vulnerability(CVE-2016-9050)
Summary An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds read resulting in disclosure of memory within the process, the same vulnerability can also be use...
Foscam IP Video Camera WebService CGI Parameter Code Execution Vulnerability(CVE-2017-2805)
Summary An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simp...
Gdk-Pixbuf TIFF tiff_image_parse Code Execution Vulnerability(CVE-2017-2870)
Summary An exploitable integer overflow vulnerability exists in the tiffimageparse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this...
Wordpress SQLi
Source 1:https://medium. com/websec/wordpress-sqli-bbb2afcc8e94 Wordpress SQLi There won't be an intro, let us jump to the problem. This is the wordpress database abstraction the prepare method code: public function prepare $query, $args if isnull $query return; // This is not meant to be foolpro...
KDE kauth and kdelibs Logic Flaw Lets Local Users Obtain Root Privileges(CVE-2017-8422)
This document describes a generic root exploit against kde. The exploit is achieved by abusing a logic flaw within the KAuth framework which is present in kde4 org.kde.auth and kde5 org.kde.kf5auth. It is possible to spoof what KAuth calls callerID's which are indeed D-Bus unique names of the...
Google Nexus 9 SensorHub Firmware Downgrade Vulnerability(CVE-2017-0582)
Product Google Nexus 9 Vulnerable Version Nexus 9 Android Builds before N4F27B - May 2017, i.e. before bootloader 3.50.0.0143. Mitigation Install N4F27B or later bootloader version 3.50.0.0143. Technical Details The Nexus 9 device contains a SoC manufactured by Cywee which implements a “Sensor...
Heap Overflow Vulnerability in Citrix NetScaler Gateway (CVE-2017-7219)
After presenting my findings on the Swisscom router at the CybSecConference last year, I started looking for a new product to analyze. I quickly found that it’s possible to download virtual “demo” appliances of Citrix products, so I went on to download a Netscaler VPX, which at the time was at...
Nagios Core < 4.2.4 - Root Privilege Escalation (CVE-2016-9566)
INTRODUCTION ------------------------- Nagios Core daemon in versions below 4.2.4 was found to perform unsafe operations when handling the log file. This could be exploited by malicious local attackers to escalate their privileges from 'nagios' system user, or from a user belonging to 'nagios'...
AVTECH video surveillance equipment authentication bypass and other vulnerabilities
Authentication bypass vulnerability There are two ways to achieve authentication bypass: The first one is. cab way, the cab file format is a video player plug-in, stored in the web root directory, it may need to verify directly be accessed and downloaded, and the device end only through the strst...
D-Link DSR-250N路由器登录绕过
No description provided by source...
一个Coremail的存储型XSS
简要描述： 某处 escape 姿势不对 详细说明： 目前的代码，在构造发件人时，代码如下： function getEmailDivemailAddress return '' 那么 escapeHTML 是什么呢？ function var div=document.createElement"div"; var 15=document.createTextNodethis; div.appendChild15; return div.innerHTML; 这种过滤并不会过滤单引号和双引号，所以可以构造特别的字符串逃逸到双引号以外 漏洞证明： 最简单触发方式是利用 onmousexx...
Mallbuilder商城系统change_status.php id参数SQL注入漏洞
No description provided by source...
Discuz X2.5 /uc_server/control/admin/db.php 路径泄露漏洞
No description provided by source...
某Zoomla系统漏洞导致服务器可控（已登录Zoomla公司邮箱和官方老论坛管理员帐号）
简要描述： 上传漏洞引起的一系列问题，乌云有该漏洞说明 详细说明： 通过http://www.njzxw.cn/Plugins/swfFileUpload/UploadHandler.ashx 可构造上传表单提交aspx马到服务器，原理可参考： WooYun: 逐浪cms 2.4某处任意文件上传（不需要登录） 通过查看，该应用所属权限较高，可以控制该服务器挂的几十个大小网站，发现其中有一个bbs.zoomla.cn的官方老版论坛也在该服务器，并且配置公司邮箱账户密码： 该密码可登录mail.hx008.com ，mail.zoomla.cn的官方账户:web，分别是逐浪和华夏互联的官方邮...
Mac OS X < 10.7.5, 10.8.2, 10.9.5 10.10.2 - rootpipe 本地提权漏洞
漏洞名称:Apple OS X Admin Framework 安全漏洞紧急程度:高危漏洞类型: 本地提权详细信息：Apple OS X是美国苹果（Apple）公司为Mac计算机所开发的一套专用操作系统。Apple OS X 10.10.2及之前版本的Admin Framework中的XPC实现过程中存在安全漏洞。本地攻击者可利用该漏洞绕过身份验证，获取管理员权限。 PoC exploit code for rootpipe CVE-2015-1130 Created by Emil Kvarnhammar, TrueSec Tested on OS X 10.7.5, 10.8.2,...
用友优普U8系统三处SQL注射漏洞
简要描述： 用友某系统两处SQL注射漏洞 详细说明： 前面有人提交这系统的漏洞 WooYun: 用友优普U8某系统两处SQL注入无需登录DBA权限83案例 搜索了好久终于找到了案例，于是乎漏洞来了。。。 总共三处漏洞， 0x01 SQL注入一 /Server/CmxUserGroup.php?pgid=GroupDelUserOK UserID=1&OrgID=1 POST /Server/CmxUserGroup.php?pgid=GroupDelUserOK HTTP/1.1 Referer: http://218.27.137.242:8080/ Cookie:...
ThinkPHP设计缺陷导致逻辑漏洞造成密码找回绕过等问题
简要描述： 在不正确使用 ThinkPHP 时，可能会造成参数处理流程导致的逻辑漏洞。 详细说明： ThinkPHP 处理传入的参数的时候，如果直接带入一个数组，接着数组带入 SQL 语句，会产生之前 phithon 大牛爆的 0day： WooYun: ThinkPHP框架架构上存在SQL注入 利用方式很简单： data0=exp&data1=SQLI 然而，thinkphp 支持的不仅仅是 exp，像 like、in，都会支持。 也就是说，我们可以在很多地方精心构造一个参数，导致造成逻辑漏洞。比如找回密码、权限验证等。 我们传入： data0=like&data1=x%25...
用友内部论坛数据备份信息泄露一万多员工已经内部交流信息泄露
简要描述： 看到这有个正在维护的系统，写着"系统正在升级中...将于2011年10月27日正常访问，敬请谅解！" 于是果断扫了目录，果然有数据备份、 涉及一万多的内部人员数据、大量的用友邮箱、还有部分的内部交流信息、 能再上首页吗？ 详细说明： 涉及的IP：http://219.141.185.30/wk.htm 备份数据下载地址：http://219.141.185.30/webroot.rar 果断的解压、 数据挺多的，看了下下面这两个比较有意思、 搜了下，涉及用友邮箱一共1500多、 账户总数是一万七千多、 下面这个比较有意思、...
Windows OLE Package Manager SandWorm Exploit
No description provided by source. !/usr/bin/env python import os import zipfile import sys ''' Full Exploit: http://www.exploit-db.com/sploits/35019.tar.gz Very quick and ugly SandWorm CVE-2014-4114 exploit builder Exploit Title: CVE-2014-4114 SandWorm builder Built to run on: Linux/MacOSX Date:...
Drupal /xmlrpc.php 拒绝服务漏洞 poc
早在2012 年 12 月 17 日一些采用 PHP 的知名博客程序 WordPress被曝光存在严重的漏洞，该漏洞覆盖WordPress 全部已发布的版本（包括WordPress 3.8.1）。该漏洞的 WordPress 扫描工具也在很多论坛和网站发布出来。工具可以利用 WordPress 漏洞来进行扫描，也可以发起DDoS 攻击。经过测试，漏洞影响存在 xmlrpc.php 文件的全部版本。 Pingback 是三种类型的反向链接中的一种，当有人链接或者盗用作者文章时来通知作者的一种方法。可以让作者了解和跟踪文章被链接或被转载的情况。一些全球最受欢迎的 blog 系统比如...
用友人力资源管理软件SQL注入漏洞（无需登录，影响所有版本）
简要描述： 详细说明： 用友软件： 涉及客户非常多。都是大型国企、银行、能源、金融重要单位。 举例如下： 大连银行 http://zpyc.bankofdl.com 顺德农商行 http://career.sdebank.com 中国海洋石油总公司 http://zhaopin.cnooc.com.cn 北京市建筑设计研究院 www.biad.com.cn:88/ 民生银行 http://ehr.creditcard.cmbc.com.cn 中国中铁 http://61.232.6.108/ ....等等单位 直接谷歌搜 inurl:hrss/login.jsp inurl:hrss/r...
phpok 4.0.556 /data.php SQL注入漏洞
No description provided by source...
Final Draft 8 Multiple Stack Buffer Overflows
No description provided by source. Name : Final Draft 8 Multiple Stack Buffer Overflows Vendor Website : http://www.finaldraft.com/index.php Date Released : 29/11/2011 Affected Software : Final Draft 8.02 Researcher : Nick Freeman [email protected] Description...
OpenConf <= 4.11 (author/edit.php) Remote Blind SQL Injection Exploit
No description provided by source. ?php / --------------------------------------------------------------------- OpenConf = 4.11 author/edit.php Remote Blind SQL Injection Exploit --------------------------------------------------------------------- author...............: Egidio Romano aka EgiX...
Joomla Component joomlaradio 5.0 - Remote File Inclusion Vulnerability
No description provided by source. Joomla Radio v5 Component RFI Bug in : administrator/components/comjoomlaradiov5/admin.joomlaradiov5.php Variable : $mosConfiglivesite Download : http://www.joomlaos.de/option,comremository/Itemid,41/func,fileinfo/id,2661.html Dork: inurl:comjoomlaradiov5 Exampl...
Contra Haber Sistemi 1.0 Haber.ASP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/21626/info Contra Haber Sistemi is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...
Minerva <= 2.0.8a Build 237 (phpbb_root_path) File Include Vulnerability
No description provided by source. $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$ $$ $$ Minerva phpbbrootpath = 2.0.8a Build 237 Remote File Include Vulnerability $$ script site: http://sourceforge.net/projects/minerva/ $$ dork: Powered by Minerva 237 $$...
Joomla Media Manager File Upload Vulnerability
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
HP LaserJet Directory Traversal in PJL Interface
漏洞分析 密码爆破 惠普官方已经在2010年11月的安全通告上发布了漏洞解决办法，用户可以通过禁用 PJL 的文件系统访问权限或重新设置 PJL 密码来解决此问题。但 PJL 的安全密码是范围1-65535的数字，密码认证次数和频率并没有限制，远程攻击者可以通过爆破可以将 PJL 的密码安全保护禁用，进而可绕过密码验证通过 PJL 对打印机内置的文件系统进行读写。文件系统包含后台处理打印作业、收到的传真、日志文件和配置文件。 使用以下 Python3 程序对系统进行漏洞检测： 如果打印出“PoC OK!”，说明系统存在漏洞。PoC...
LHA 1.x - Buffer Overflow/Directory Traversal Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/10243/info LHA has been reported prone to multiple vulnerabilities that may allow a malicious archive to execute arbitrary code or corrupt arbitrary files when the archive is operated on. The first issues reported have be...
SOOP Portal Raven 1.0b SQL Injection Vulnerability
No description provided by source. Exploit Title: SOOP Portal Raven 1.0b sql injection Google Dork: Powered by SOOP Portal Raven 1.0b Date: date Author: Evil-Thinker Version: Raven 1.0b Tested on: Windows Soft Technologie : ASP.net Exploit Details :...
RunCMS <= 1.2 (class.forumposts.php) Arbitrary Remote Inclusion Exploit
No description provided by source. ?php ---runcms13axpl.php 17.30 09/02/2006 RunCMS = 1.2 arbitrary remote inclusion exploit = 1.3a shell upload through FCKEditor coded by rgod site: http://retrogod.altervista.org usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: But when the...
Cisco Wireless Lan Controller 7.2.110.0 - Multiple Vulnerabilities
No description provided by source. Cisco WLC CSRF, DoS, and Persistent XSS Vulnerabilities Exploit Title: u M@d? - Cisco WLC CSRF, DoS, and Persistent XSS Vulnerabilities Date: Discovered and reported November 2012 Author: Jacob Holcomb/Gimppy042 - Security Analyst @ Independent Security Evaluato...
Ubiquiti airCam RTSP Service 1.1.5 - Buffer Overflow
Core Security - Corelabs Advisory http://corelabs.coresecurity.com Buffer overflow in Ubiquiti airCam RTSP service 1. Advisory Information Title: Buffer overflow in Ubiquiti airCam RTSP service Advisory ID: CORE-2013-0430 Advisory URL:...
Joomla Seyret Video Component (com_seyret) Blind SQL Injection Exploit
No description provided by source. 1 1 0 I'm RoAdKiLlEr member from Inj3ct0r Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 +Title :Joomla Component comseyret Blind SQL Injection Exploit +Author :RoAdKiLlEr +Contact :RoAdKiLlEratKhg-CrewdotWs +Tested on :Win X...
MS Excel Malformed FEATHEADER Record Exploit (MS09-067)
No description provided by source. MS Excel Malformed FEATHEADER Record Exploit CVE-2009-3129, MS09-067, OSVDB-59860 Vulnerble application MS office 2003/2007 Tested on XP SP2 - MS Ofice 2003 v. 11.5604.5606 Sean Larsson - Original Discovery !/usr/bin/python import sys import zlib Allwin WinExec...
Windows NT - User Mode to Ring 0 Escalation Vulnerability
No description provided by source. Microsoft Windows NT GP Trap Handler Allows Users to Switch Kernel Stack ------------------------------------------------------------------------- CVE-2010-0232 In order to support BIOS service routines in legacy 16bit applications, the Windows NT Kernel support...
OpenSSL SSLv2 - Null Pointer Dereference Client Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/20246/info OpenSSL is prone to a denial-of-service vulnerability. A malicious server could cause a vulnerable client application to crash, effectively denying service. !/usr/bin/perl Copyrightc Beyond Security Written by...
ShoutCMS (content.php) Blind SQL Injection Vulnerability
No description provided by source. Shout! content.php Blind Sql Injection Vulnerability ======================================================= .:. Author : Zero Cold [email protected] .:. Team : Sec Attack Team .:. Home : www.sec-attack.com/vb .:. Script : Shout! Script .:. Vendor :...
MobPartner Counter - Remote File Upload Vulnerability
No description provided by source. MobPartner Counter Remote File Upload Vulnerability + Author : wlhaan hacker + Email : [email protected] + Site : www.sa-hacker.com/vb + team wlhaan Hacker + Dork : MobPartner Counter upload files The exploit : http://localhost/path/upload.php edit shell...
KDE KDELibs 4.3.3 - Remote Array Overrun
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE KDELibs 4.3.3 Remote Array Overrun Arbitrary code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - - Dis.: 07.05.2009 - - Pub.: 20.11.2009 CVE: CVE-2009-0689 Risk: High Remote:...
Adobe Flash Player < 10.1.53 .64 Action Script Type Confusion Exploit (DEP+ASLR bypass)
No description provided by source. Source: http://www.abysssec.com/blog/2011/04/exploiting-adobe-flash-player-on-windows-7/ Adobe Flash player Action script type confusion exploit DEP+ASLR bypass advisory text : Here is another reliable windows 7 exploit . the main method used for exploitation is...