56796 matches found
VigileCMS <= 1.8 Stealth Remote Command Execution Exploit
No description provided by source. !/usr/bin/python -- coding: iso-8859-15 -- ''' | || | | | | | ' / -||| ' / | '/ / / \ \ / ||||||| ./,|| ,,/\ || ------------------------------------------------------------------------------------------------ This is a Public Exploit. 22/10/2007...
mxBB Module mx_glance 2.3.3 Remote File Include Vulnerability
No description provided by source. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + mxBB Module mxglance 2.3.3 Remote File Include Vulnerability + + + + Discovered by bd0rk || SOH-Crew + + + + www.soh-crew.it.tt + + + + The german Coding and IT-Security Ressource + + +...
CA ARCserve Backup多个远程溢出及目录遍历漏洞
BUGTRAQ ID: 24348 CVECAN ID: CVE-2007-3216,CVE-2007-5003,CVE-2007-5004,CVE-2007-5005,CVE-2007-5006 ARCServe Backup for Laptops and Desktops L&D是适用于中小业务的ARCServe Backup备份工具版本。 ARCserve L&D在处理RPC接口上的畸形请求数据时存在漏洞，远程攻击者可能利用此漏洞控制服务器或执行目录遍历。 ARCserve L&D使用TCP/1900端口做为RPC接口管理ARCserve L&D服务器，正常的通讯示例如下：...
PHP <= 4.4.7 / 5.2.3 MySQL/MySQLi Safe Mode Bypass Vulnerability
No description provided by source. Affected Products: = PHP 5.2.3 = PHP 4.4.7 Authors: Mattias Bengtsson [email protected] Philip Olausson [email protected] Reported: 2007-06-05 Released: 2007-08-30 CVE: CVE-2007-3997 Issue: A vulnerability exists in PHP's MySQL and MySQLi extenstions which can be use...
Microsoft Windows GDI AttemptWrite函数远程堆溢出漏洞（MS07-046）
BUGTRAQ ID: 25302 CVECAN ID: CVE-2007-3034 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的图形设备接口（GDI）的GDI32函数AttemptWrite处理Windows元文件时可能会出现整数溢出，远程攻击者可能利用此漏洞提升自己的权限。 如下反汇编所示，很多GDI32 API函数都会调用AttemptWrite，如CreateMetaFileW。 77F4B519 mov esi, ebp+0Ch ; reported size of record in bytes ... ; user-controlle...
Freetype TT_Load_Simple_Glyph() TTF文件处理整数溢出漏洞
FreeType是一个流行的字体函数库。 Freetype的truetype/ttgload.c文件中TTLoadSimpleGlyph函数处理畸形TTF图形时存在有符/无符转换错误，如果用户受骗打开了设置有负数npoints值的畸形TTF图形的话，就可能触发整数溢出和堆溢出，导致执行任意指令。 FreeType FreeType = 2.3.4 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Katalog Plyt Audio (pl) <= 1.0 Remote SQL Injection Exploit
No description provided by source. ? / Author: Kacper Contact: [email protected] Homepage: http://www.rahim.webd.pl/ Irc: irc.milw0rm.com:6667 devilteam Pozdro dla wszystkich z kanalu IRC oraz forum DEVIL TEAM. Katalog Plyt Audio pl = 1.0 Remote SQL Injection Exploit script download:...
Hotmail and Windows Live Mail XSS Vulnerabilities
Hotmail's filter identifies "expression" syntax in a CSS attribute. According to Hasegawa Yosuke's posthttp://archive.openmya.devnull.jp/2006.08/msg00369.html, in some character encodingse.g. GB2312, we can substitute some special double-byte chars for the corresponding chars in "expression"...
PHPProfiles远程文件包含漏洞
PHPProfiles是一款基于PHP的WEB应用程序。 PHPProfiles不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于多个脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 phpProfiles phpProfiles 3.1.2b phpProfiles phpProfiles 2.1 http://sourceforge.net/project/showfiles.php?groupid=176310...
OpenLDAP <= 2.4.3 (KBIND) Remote Buffer Overflow Exploit
No description provided by source. / openldap-kbind-p00f.c - OpenLDAP kbind remote exploit Only works on servers compiled with --enable-kbind enable LDAPv2+ Kerberos IV bind deprecated no by Solar Eclipse [email protected] Shoutouts to LSD for their l33t asm code and to all 0dd people...
IrayoBlog 0.2.4 (inc/irayofuncs.php) Remote File Include Vulnerability
No description provided by source. WwW.Deltahacking.NeT Priv8 Site WwW.Deltahacking.Ir Public Site Portal Name :irayoblog-alpha-0.2.4 Class = Remote File Inclusion ; Download =http://ovh.dl.sourceforge.net/sourceforge/irayoblog/irayoblog-alpha-0.2.4.tar.gz Found by = Dr.Pantagon...
LibRPM查询报告任意代码执行漏洞
RPM软件包管理器（RPM）是一款功能强大的命令行软件包管理系统，可用于安装、卸载、核实、查询和更新计算机软件包。 RPM库在处理查询报告时存在漏洞，某些畸形RPM软件包可能导致函数库崩溃或导致执行恶意指令。 如果用户受骗查询了特制的RPM软件包的话，就可能导致以用户的权限执行任意指令。 RPM RPM Package Manager = 4.4.9 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.rpm.org/...
MS Messenger Denial of Service Exploit (MS03-043) (linux ver)
漏洞描述：Microsoft Windows是微软开发的视窗操作系统，Windows Messenger服务用于服务器与客户端之间互相发送一些短消息。Microsoft Windows Messenger服务存在堆溢出问题，远程攻击者可以利用这个漏洞以系统权限在目标机器上执行任意指令。 问题存在于Messenger服务程序的search-by-name函数中，攻击者提交特定序列的字符串给这个函数可造成堆溢出，精心构建提交数据可能以系统权限在目标机器上执行任意指令。...
泛微OA weaver.common.Ctrl 任意文件上传漏洞
...
Foxit Reader 远程代码执行漏洞（CVE-2021-31473）
...
Insteon Hub HTTPExecuteGet Parameters Extraction Code Execution Vulnerability(CVE-2017-14446)
Summary An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation unsafely extracts parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HTTP GET request to trigger...
MacOS/iOS kernel heap overflow due to lack of lower size check in getvolattrlist(CVE-2018-4243)
getvolattrlist takes a user controlled bufferSize argument via the fgetattrlist syscall. When allocating a kernel buffer to serialize the attr list to there's the following comment: / Allocate a target buffer for attribute results. Note that since we won't ever copy out more than the caller...
Canon LBP6650/LBP3370/LBP3460/LBP7750C - Authenticaton Bypass(CVE-2018-11692)
Description : An issue was discovered on Canon LBP6650, LBP3370, LBP3460, LBP7750C printers. It is possible for a remote unauthenticated attacker to bypass the Administrator Mode authentication without a password at any URL of the device that requires authentication. PoC : Start searching for Can...
Adobe Acrobat Reader DC Net.Discovery.queryServices Remote Code Execution Vulnerability(CVE-2018-4996)
Summary A specific Javascript script embedded in a PDF file can lead to a pointer to previously freed object to be reused when opening a PDF document in Adobe Acrobat Reader DC 2018.009.20044. With careful memory manipulation, this can potentially lead to sensitive memory disclosure or arbitrary...
libxls read_MSAT Code Execution Vulnerability(CVE-2017-2897)
Summary An exploitable out-of-bounds write vulnerability exists in the readMSAT function of libxls 1.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability. Tested Versions libxls 1.4...
Foscam IP Video Camera webService dyndns.com DDNS Client Code Execution Vulnerability(CVE-2017-2856)
Summary An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating...
Wordpress SQLi — PoC
In order to understand the writing here, you need to read the previous explanation https://medium.com/websec/wordpress-sqli-bbb2afcc8e94. If you got it, then we can jump to the part and solve the question e.g. how to update / insert our sql payload into thumbnailid post meta. PoC start - Login to...
Foscam IP Video Camera WebService CGI Parameter Code Execution Vulnerability(CVE-2017-2805)
Summary An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simp...
Chrome Universal XSS using an intercepted native function (CVE-2016-1672)
VULNERABILITY DETAILS The fix for the issue 546677 is insufficient to protect against overriding the internal extensions code -- it is still possible to take over the built-in extension system with a combination of getters and setters. This allows web content to gain access to native functions th...
AMF3 Java implementations Improper Control of Dynamically-Managed Code Resources
Details reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this...
MacOS kernel memory disclosure due to lack of bounds checking in AppleIntelCapriController::getDisplayPipeCapability(CVE-2017-2489)
MacOS kernel memory disclosure due to lack of bounds checking in AppleIntelCapriController::getDisplayPipeCapability Selector 0x710 of IntelFBClientControl ends up in AppleIntelCapriController::getDisplayPipeCapability. This method takes a structure input and output buffer. It reads an attacker...
Elevation of privilege vulnerability in Qualcomm crypto engine driver(CVE-2017-0576)
No description provided by source. include include include include include include include include include include / PoC By Scott Bauer Bug found by derrek / static const char dev = "/dev/qce"; define QCEDEVMAXKEYSIZE 64 define QCEDEVMAXIVSIZE 32 define QCEDEVMAXBUFFERS 16 struct bufinfo union...
Jenkins remote code execution vulnerability (CVE-2017-2608)
No description provided by source...
Git 版本<=2.7.1 远程代码执行漏洞
参考来源： http://seclists.org/oss-sec/2016/q1/645 Hello, original report describing the overflow is here http://pastebin.com/UX2P2jjg On 11/02/2016 16:50, Jeff King wrote this on the git security mailing list: On Thu, Feb 11, 2016 at 02:31:49PM +0100, 'Laël Cellier' via Git Security wrote: Ok the bug...
Jenkins 低权限用户 API 服务调用 可致远程命令执行
漏洞演示 将 Jenkins 跑起来后，在低权限用户下构造 XML 文档： hashCode open /Applications/Calculator.app false 0 0 0 start 1 发送 Payload 至接口 http://...:8080/jenkins/createItem?name=knownsec： 成功后服务端会运行 计算器 程序。 漏洞影响 影响版本： 1.650 （1.650版本已修复该问题） 从zoomeye.org上搜索设备指纹“Jenkins” 从搜索的结果来看，约存在20000个潜在受到影响的目标。 相关链接...
jcms /interface/user/out_userinfo.jsp 文件 xmlinfo 参数敏感信息泄漏漏洞
No description provided by source...
Joomla! 3.4.6-3.4.x 目录遍历漏洞
本地包含： http://www.site.com/components/comdocman/dl2.php?archive=0&file=LDF 先通过本地包含漏洞查看物理路径，然后在configuration.php 数据库配置文件中，使用base64目录遍历payload 如： http://www.site.com/components/comdocman/dl2.php?archive=0&file=Li4vLi4vLi4vLi4vLi4vLi4vLi4vdGFyZ2V0L3d3dy9jb25maWd1cmF0aW9uLnBocA==...
FE协作办公平台 /servlet/ChangeBGServlet 任意文件上传漏洞
漏洞文件：/servlet/ChangeBGServlet漏洞参数：skinName影响版本：FE5.5.2及以下版本代码片段： public void doGetHttpServletRequest request, HttpServletResponse response throws ServletException, IOException String savePath = getServletConfig.getServletContext.getRealPath""; String themeDir =...
Discuz!论坛CSRF一处
简要描述： Discuz!论坛CSRF一处 详细说明： 测试版本：x3.2，论坛需要开启广播功能（全局--站点功能）。 当访问一个url时，可取消收听指定用户 http://127.0.0.1/dz/home.php?mod=spacecp&ac=follow&op=del&fuid=用户id 没有token验证。 漏洞证明： 收听一个用户，确定该用户的uid，比方说是1 访问如下第三方也没就可取消啊收听...
KingCms最新版目录遍历及任意文件读取漏洞（无需截断）
简要描述： KingCms最新版目录遍历及任意文件读取漏洞（无需截断） 详细说明： 朋友的公司想购买kingcms的授权，让我帮忙看下。发现kingcms很长一段时间没更新了，憋了一段时间放出了最新版的k92014-12-13更新，官网下下来学习一下。 在wooyun上看到了几个漏洞，如： WooYun: kingcms最新版sql注入漏洞 问题出在这里：/api/conn.php 先首需要说明的是，这里的目录遍历与文件读取并不是因为服务器配置不当等引起的，而是该cms的某些函数没过过滤+使用不当引起的。 0x00：先来看看如何目录遍历的。 无关代码 $get=$GET;...
万户OA某页面通用性SQL注入（又影响N个政府网和医疗机构）
简要描述： 其实我一直琢磨，之前发的那个，为什么有一部分不能注入，后来找了找，发现不能注入的都是oracle数据库，很好奇。。。然后……就发现了这个通用注入。。例子中，涉及淮北市卫生局，内蒙古海勃湾区市政府、怀远县政府等多家政府单位和医疗机构。在注入时貌似有些限制，凌晨1:45了，就不继续测试了，该睡觉了。。 详细说明： 万户OA协同管理系统，存在POST注入 问题链接：defaultroot/mobile/index.jsp 该登陆框，username处没有做过滤，导致了POST注入 详细看图吧。。。 漏洞证明：...
Drupal /xmlrpc.php 拒绝服务漏洞 poc
早在2012 年 12 月 17 日一些采用 PHP 的知名博客程序 WordPress被曝光存在严重的漏洞，该漏洞覆盖WordPress 全部已发布的版本（包括WordPress 3.8.1）。该漏洞的 WordPress 扫描工具也在很多论坛和网站发布出来。工具可以利用 WordPress 漏洞来进行扫描，也可以发起DDoS 攻击。经过测试，漏洞影响存在 xmlrpc.php 文件的全部版本。 Pingback 是三种类型的反向链接中的一种，当有人链接或者盗用作者文章时来通知作者的一种方法。可以让作者了解和跟踪文章被链接或被转载的情况。一些全球最受欢迎的 blog 系统比如...
MIPS Little Endian Reverse Shell Shellcode (Linux)
No description provided by source. MIPS Little Endian Reverse Shell ASM File and Assembled Shellcode Written by Jacob Holcomb, Security Analyst @ Independent Security Evaluators Blog: http://infosec42.blogspot.com Company Website: http://securityevaluators.com .data .bss .text .globl start start:...
dompdf 0.6.0 (dompdf.php, read param) - Arbitrary File Read
No description provided by source. Vulnerability title: Arbitrary file read in dompdf CVE: CVE-2014-2383 Vendor: dompdf Product: dompdf Affected version: v0.6.0 Fixed version: v0.6.1 partial fix Reported by: Alejo Murillo Moyas Details: An arbitrary file read vulnerability is present on dompdf.ph...
ImageVue 2.0 - Remote Admin Login Exploit
No description provided by source. Author: Sora Software Link: http://www.imagevuex.com/ Version: 2.0 Tested on: Windows and Linux --------------------------------- / ImageVue 2.0 Remote Admin Login Exploit Created by Sora Contact: vhr95zw at hotmail.com / + Google Dork: inurl:/admin/ ImageVue +...
Multiple Vendor ICMP Implementation Malformed Path MTU DoS
No description provided by source. source: http://www.securityfocus.com/bid/13124/info Multiple vendor implementations of TCP/IP Internet Control Message Protocol ICMP are reported prone to several denial-of-service attacks. ICMP is employed by network nodes to determine certain automatic actions...
Parallels H-Sphere 3.0/3.1 'login.php' Multiple Cross Site Scripting Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/31256/info H-Sphere is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the...
RoundCube Webmail <= 0.2b Remote Code Execution Exploit
No description provided by source. !/bin/sh I was hoping the PoC would not appear so soon, but now that it is out, i thought i might as well publish my real exploit. Hunger http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5619 FOR LEARNING PURPOSES ONLY! PHP echoiniget'disablefunctions';...
MCFileManager Plugin for TinyMCE 3.2.2.3 - Arbitrary File Upload Vulnerability
No description provided by source. ============================================== File Upload Vulnerability Plugins tinymce ============================================== http://tinymce.moxiecode.com/pluginsfilemanager.php Major version 3 Minor version 2.2.3 Author : Vladimir Vorontsov Contact :...
PHPGroupWare 0.9.14 Tables_Update.Inc.PHP Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/12074/info phpGroupWare is prone to a remote file include vulnerability, potentially allowing the execution of malicious PHP code. This would occur in the context of the affected web server. The tablesupdate.inc.php scrip...
Joomla! <= 3.0.2 (highlight.php) PHP Object Injection Vulnerability
No description provided by source. ------------------------------------------------------------------- Joomla! = 3.0.2 highlight.php PHP Object Injection Vulnerability ------------------------------------------------------------------- - Software Link: http://www.joomla.org/ - Affected Versions:...
GL-SH Deaf Forum 6.5.5 Cross-Site Scripting Vulnerability and Arbitrary File Upload Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/29849/info GL-SH Deaf Forum is prone to a cross-site scripting vulnerability and an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage the cross-site...
ApPHP MicroBlog 1.0.1 - Remote Command Execution Exploit
No description provided by source. !/usr/bin/python import random import hashlib import urllib from base64 import b64encode as b64 import sys import re Exploit Title: Python exploit for ApPHP MicroBlog 1.0.1 Free Version - RCE Exploit Author: LOTFREE Version: ApPHP MicroBlog 1.0.1 Free Version...
Windows NT - User Mode to Ring 0 Escalation Vulnerability
No description provided by source. Microsoft Windows NT GP Trap Handler Allows Users to Switch Kernel Stack ------------------------------------------------------------------------- CVE-2010-0232 In order to support BIOS service routines in legacy 16bit applications, the Windows NT Kernel support...
CKEditor 4.0.1 - Multiple Vulnerabilities
No description provided by source. =========================================== Vulnerable Software: ckeditor 4.0.1 standard Download: http://download.cksource.com/CKEditor/CKEditor/CKEditor%204.0.1/ckeditor4.0.1standard.zip Vulns: Full Path Disclosure && XSS...