56796 matches found
phpwind 8.x全版本存储型xss漏洞（捡的）
简要描述： rt 详细说明： 在某个学校读书，然后某个学校的论坛是用phpwind 8.7的，在wooyun搜到一个储存型漏洞， 祸不单行的事情又发生了，因为phpwind已经是9.0版本了，去看了下9.0版本没发现有这个功能，所以自评rank2分。不知道能过审核不！ WooYun: phpwind 8.x全版本存储型XSS 这个漏洞 imghttp://pic1.sc.chinaz.com/files/pic/pic9/201404/apic493.jpg';alert/xss////img 在个人空间有个日志功能，在日志内容插入此代码也可以xss 8.x版本都存在吧。 漏洞证明： -...
Microsoft XP SP3 - BthPan.sys Arbitrary Write Privilege Escalation
No description provided by source. """ Title: Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation Advisory ID: KL-001-2014-002 Publication Date: 2014-07-18 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt 1. Vulnerability Details Affected Vendor:...
shop7z 注入漏洞2
简要描述： shop7z 注入漏洞2 详细说明： News.asp 漏洞证明： 测试 192.168.236.131/news.asp?lid=1' http://www.shop7z.com/Demo/news.asp?lid=1%27...
RoundCube 0.3.1 XRF/SQL injection
No description provided by source. Exploit Title: RoundCube 0.3.1 SQL injection Date: 10/10/2011 Author: Smith Falcon Software Link: http://roundcube.net/download Version: 0.3.1 Tested on: Linux timezone= is vulnerable to SQL Union Injection. POST data in http://site.com/roundcube/index.php...
greeting card Remote Upload Vulnerability
No description provided by source. Exploit Title: greeting card Remote Upload Vulnerability Date: 04/06/2010 Author: Mr.Benladen Software Link: N/A Version: 2004/2008 Tested on: Linux/unix CVE : if exists Code : N/A Email : [email protected] Mr.Benladen cr3w Dork : Send amazing greetings to yo...
KingView 6.5.3 SCADA HMI Heap Overflow PoC
No description provided by source. Exploit Title: KingView 6.53 SCADA HMI Heap Overflow PoC Date: 9/28/2010 Author: Dillon Beresford Software Link: http://download.kingview.com/software/kingview%20English%20Version/kingview6.53EN.rar Version: 6.53 English Tested on: Windows XP SP1 works on SP2 an...
HP OpenView NNM 7.53 OvJavaLocale - Buffer Overflow Vulnerability
No description provided by source. HP OPENVIEW NNM OVJAVALOCALE BUFFER OVERFLOW VULNERABILITY 1. ADVISORY INFORMATION Title: HP OpenView NNM OvJavaLocale Buffer Overflow Vulnerability Advisory Id: CORE-2010-0608 Advisory URL: http://www.coresecurity.com/content/hp-nnm-ovjavalocale-buffer-overflow...
KDE KDELibs 4.3.3 - Remote Array Overrun
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE KDELibs 4.3.3 Remote Array Overrun Arbitrary code execution Author: Maksymilian Arciemowicz and sp3x http://SecurityReason.com Date: - - Dis.: 07.05.2009 - - Pub.: 20.11.2009 CVE: CVE-2009-0689 Risk: High Remote:...
ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow FreeBSD', 'Description' = %q This module...
dompdf 0.6.0 (dompdf.php, read param) - Arbitrary File Read
No description provided by source. Vulnerability title: Arbitrary file read in dompdf CVE: CVE-2014-2383 Vendor: dompdf Product: dompdf Affected version: v0.6.0 Fixed version: v0.6.1 partial fix Reported by: Alejo Murillo Moyas Details: An arbitrary file read vulnerability is present on dompdf.ph...
MS Excel Malformed FEATHEADER Record Exploit (MS09-067)
No description provided by source. MS Excel Malformed FEATHEADER Record Exploit CVE-2009-3129, MS09-067, OSVDB-59860 Vulnerble application MS office 2003/2007 Tested on XP SP2 - MS Ofice 2003 v. 11.5604.5606 Sean Larsson - Original Discovery !/usr/bin/python import sys import zlib Allwin WinExec...
Pandora FMS <= 3.1 Authentication Bypass
No description provided by source. + Introduction Pandora FMS for Pandora Flexible Monitoring System is a software solution for monitoring computer networks. It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers, applicatio...
Postfix 1.1.x Denial of Service Vulnerabilities (1)
No description provided by source. source: http://www.securityfocus.com/bid/8333/info Debian has reported two vulnerabilities in the Postfix mail transfer agent. The first vulnerability, CAN-2003-0468, can allow for an adversary to bounce-scan a private network. It has also been reported that thi...
ES CmS 0.1 - SQL Injection Vulnerability
No description provided by source. ? Exploit Title: ES CmS 0.1 Sql Injection Vulnerability Google Dork: inurl:/page.php?id= Date: 2012 Exploit Author: MR.XpR Software Link: http://es-cms.com , http://sourceforge.net/projects/escms/files/esCMS Alpha/0.1/escmsalphav01.zip Version: v.0.1 Tested on: ...
Roundcube Webmail 0.8.0 - Stored XSS
No description provided by source. !/usr/bin/python ''' Exploit Title: Roundcube Webmail Stored XSS. Date: 14/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://roundcube.net Software Link:...
DFD Cart 1.1 - Multiple Remote File Inclusion Vulnerabilities
No description provided by source. DFD Cart 1.1 Multiple Remote File Inclusion Vulnerabilities Vulnerability Type: Remote File Inclusion Vulnerable file: /dfdcart/app.lib/product.control/core.php/product.control.config.php Exploit URL:...
AWStats (6.0-6.2) configdir Remote Command Execution Exploit (c code)
No description provided by source. / AwStats exploit by Thunder, [email protected] This exploit makes use of the remote command execution bug discovered in AwStats ver 6.2 and below. The bug resides in the awstats.pl perl script. The script does not sanitise correctly the user input for the...
XMB Forum 1.6 Magic Lantern Cross Site Scripting Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/4721/info XMB Forum 1.6 Magic Lantern is a web-based discussion forum. It is vulnerable to a number of cross-site scripting issues because of improper filtering of user input. 1. The first involves 'member.php'; submittin...
Microsoft IIS 4.0,Microsoft JET 3.5/3.5.1 Database Engine VBA Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/286/info Microsoft's JET database engine feature allows the embedding of Visual Basic for Application in SQL string expressions and the lack of metacharacter filtering by many web applications may allow remote users to...
Dotproject 2.0 /modules/projects/gantt.php dPconfig[root_dir] Parameter Remote File Inclusion
No description provided by source...
D-Link DSR Router Series - Remote Root Shell Exploit
No description provided by source. !/usr/bin/python CVEs: CVE-2013-5945 - Authentication Bypass by SQL-Injection CVE-2013-5946 - Privilege Escalation by Arbitrary Command Execution Vulnerable Routers: D-Link DSR-150 Firmware v1.08B44 D-Link DSR-150N Firmware v1.05B64 D-Link DSR-250 and DSR-250N...
CUPS 1.1.x HPGL File Processor Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11968/info CUPS is reported prone to a remote buffer overflow vulnerability. The issue is reported to exist in the 'hpgl-input.c' source file and is because of a lack of sufficient boundary checks performed on data...
Final Draft 8 Multiple Stack Buffer Overflows
No description provided by source. Name : Final Draft 8 Multiple Stack Buffer Overflows Vendor Website : http://www.finaldraft.com/index.php Date Released : 29/11/2011 Affected Software : Final Draft 8.02 Researcher : Nick Freeman [email protected] Description...
Kayako eSupport <= 2.3.1 (subd) Remote File Inclusion Vulnerability
No description provided by source. Script: Kayako eSupport = 2.3.1 Vendor: Kayako www.kayako.com Discovered: beford xbefordx gmail com Comments: It seems like the vendor silently fixed the issue in the current version more like since v2.3.5 withouth warning users of previous versions, noobs...
D3Jeeb Pro 3 catogary.php catid Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/16853/info D3Jeeb is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation...
KVM "complete_emulated_mmio()"内存破坏漏洞
CVE ID:CVE-2014-0049 Linux Kernel是一款开源的操作系统。 由于处理重复模拟推送时"completeemulatedmmio"方法中的错误，可导致内存破坏。 0 KVM Kernel-based Virtual Machine 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a08d3b3b...
大汉版通JIS统一身份认证系统某处泄漏用户密码及一处跳转漏洞
简要描述： 可获取所有用户的用户信息（包含密码），另外附送一个跳转的漏洞。 详细说明： 获取用户密码的问题主要是产生在接口上的，这接口过于开放了……跳转就没什么可说的了。 先发跳转： http://management.ysx.gov.cn/jis/check/zx.jsp?url=http://www.baidu.com 自定义url参数即可。 漏洞证明： 接口的问题产生在jis/interface/offer.jsp http://management.ysx.gov.cn/jis/interface/offer.jsp?flag=user...
Cisco WebEx Meeting Center移动设备浏览器重定向跨站脚本漏洞
Bugtraq ID:64275 CVE ID:CVE-2013-6962 Cisco WebEx是一款网络会议解决方案。 在处理如何把移动设备浏览器重定向Cisco WebEx Meeting Center站点的移动版本时存在漏洞，允许未验证远程攻击者进行跨站脚本攻击。攻击者构建恶意URI，诱使用户解析，当恶意数据被查看时可获取敏感信息或者劫持用户会话。 0 Cisco WebEx Meeting Center 厂商补丁： Cisco ----- 用户可参考如下厂商提供的安全公告获得补丁信息：...
Cisco WebEx Training Center开放重定向漏洞
Bugtraq ID:64285 CVE ID:CVE-2013-6966 Cisco WebEx Training Center是一款互动式培训解决方案，可开展电子教学。 Cisco WebEx Training Center存在开放重定向漏洞，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可重定向用户到攻击者指定WEB站点，进行网络钓鱼等攻击。 0 Cisco WebEx Training Center 厂商补丁： Cisco ----- 用户可参考如下厂商提供的安全公告获得补丁信息：...
ActiveMQ Cron Jobs CVE-2013-1879 HTML注入漏洞
Bugtraq ID:61142 CVE ID:CVE-2013-1879 Apache ActiveMQ是一款开源消息总线，支持JMS1.1和J2EE 1.4规范的JMS Provider实现 Apache ActiveMQ处理cron作业时没有对用户提交的某些参数进行过滤，允许攻击者利用漏洞注入任意HTML和脚本代码，当恶意数据被查看时，可获取用户敏感信息或劫持用户会话 0 Apache ActiveMQ 5.8.0 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息： https://issues.apache.org/jira/browse/AMQ-4397...
用友软件开发管理平台IIS写权限导致可获取服务器webshell
简要描述： 见说明 详细说明： http://ufsdp-borrow.ufsoft.com.cn/cmd.asp http://ufsdp-borrow.ufsoft.com.cn/1937cN.txt 漏洞证明：...
cURL/libcURL 'curl_easy_unescape()'堆内存破坏漏洞
BUGTRAQ ID: 60737 CVECAN ID: CVE-2013-2174 cURL是命令行传输文件工具，支持FTP、FTPS、HTTP、HTTPS、GOPHER、TELNET、DICT、FILE和LDAP。 cURL 7.7 - 7.30.0版本内的函数"curleasyunescape"lib/escape.c将URL编码的字符串解码为原始二进制数据时出现边界错误，此漏洞可被利用造成堆缓冲区溢出，导致任意代码执行。 0 cURL 7.x 临时解决方法： 建议您采取以下措施以降低威胁： 升级到curl/libcurl 7.31.0 应用补丁，重建libcurl...
phpMyAdmin 'filename_template' 远程代码执行(CVE-2013-3239)
BUGTRAQ ID: 59465 CVECAN ID: CVE-2013-3239 phpmyadmin是MySQL数据库的在线管理工具，主要功能包括在线创建数据表、运行SQL语句、搜索查询数据以及导入导出数据等。 phpMyAdmin 3.5.x、4.x在配置了SaveDir目录后，通过导出文件文件名的双扩展名，经过身份验证的远程用户可以执行任意代码，导致Apache HTTP服务器将此文件解释为可执行文件。例如：.php.sql文件名。 0 phpMyAdmin 3.x phpMyAdmin 3.5.x 厂商补丁： phpMyAdmin ----------...
Ruby on Rails Active Record组件SQL注入漏洞(CVE-2012-6496)
CVE ID:CVE-2012-6496 Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails Active Record组件存在一个SQL注入漏洞，允许攻击者利用"findby"方法进行SQL注入攻击，可获得敏感信息或控制应用系统。 0 Ruby on Rails 3.0.x Ruby on Rails 3.1.x Ruby on Rails 3.2.x 厂商解决方案 Ruby on Rails 3.0.18，3.1.9和3.2.10已经修复此漏洞，建议用户下载使用： http://www.ruby-lang.org...
Ruby on Rails 'authenticate_or_request_with_http_digest'方法拒绝服务漏洞
BUGTRAQ ID: 54704 CVE ID: CVE-2012-3424 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails 3.0.16、3.1.7、3.2.7之前版本在使用了"withhttpdigest" 控制器助手方法的actionpack/lib/actioncontroller/metal/httpauthentication.rb中存在错误，可被恶意用户利用造成拒绝服务。 0 Ruby on Rails 3.2.x Ruby on Rails 3.1.x Ruby ...
nginx 'ngx_http_mp4_module.c'缓冲区溢出漏洞
BUGTRAQ ID: 52999 CVE ID: CVE-2012-2089 nginx是一款使用非常广泛的高性能Web服务器。 nginx在ngxhttpmp4module的实现上存在缓冲区溢出漏洞，攻击者可利用此漏洞执行任意代码。 0 nginx 1.1.17 nginx 1.0.9 nginx 1.0.8 nginx 1.0.14 厂商补丁： Igor Sysoev ----------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://nginx.net/...
Linux kernel 2.6.x KVM create_pit_timer()函数本地拒绝服务漏洞
BUGTRAQ ID: 51172 CVE ID: CVE-2011-4622 Linux是自由电脑操作系统内核。 Linux Kernel在createpittimer的实现上存在本地拒绝服务漏洞，KVM 83的arch/x86/kvm/i8254.c中的createpittimer函数在irqchip不可用时没有正确处理PIT IRQ，本地攻击者可利用定时器通过此漏洞造成内核崩溃，拒绝服务合法用户。 0 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.or...
Safari SVG DOM processing PoC
No description provided by source. / Exploit Title: CVE-2011-0222 Safari SVG DOM processing PoC Date: 2011-07-25 Author: Nikita Tarakanov CISS Research Team, Alex Bazhanyuk CISS Research Team Software Link: http://www.apple.com/au/safari/download/ Version: prior to 5.0.6, 5.1 Tested on: Win XP SP...
Microsoft Forefront Threat Management Gateway (TMG)防火墙客户端内存破坏漏洞
Bugtraq ID: 48181 CVE ID：CVE-2011-1889 Microsoft Forefront Threat Management Gateway可以安装在DirectAccess服务器上，提供额外保护和其他Forefront TMG功能。 NSPLookupServiceNext函数存在一个边界错误，提交通过TMG防火墙客户端的特殊请求可破坏内存，成功利用漏洞可执行任意代码。 Microsoft Forefront Threat Management Gateway 2010 Client 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息：...
Oracle GlassFish Server Administration Console Authentication Bypass
No description provided by source. Oracle GlassFish Server Administration Console Authentication Bypass 1. Advisory Information Title: Oracle GlassFish Server Administration Console Authentication Bypass Advisory ID: CORE-2010-1118 Advisory URL:...
Check Point SSL VPN On-Demand应用程序远程代码执行漏洞
Bugtraq ID: 47695 CVE ID：CVE-2011-1827 SNX SecureWorkSpace和Endpoint Security On-Demand可从Connectra或security gateways下载的客户端，可实现按需远程连接。它们可使用Check Point Deployment Agent Java applet或ActiveX控件配置在浏览中。 应用程序SSL网络扩展器SNX, SecureWorkSpace和Endpoint Security On-Demand通过浏览器配置时，容易受到恶意网站的攻击，导致在末端用户机器上执行任意恶意代码。...
Linux Kernel 'drivers/scsi/gdth.c' IOCTL本地特权提升漏洞
Bugtraq ID: 44648 CVE ID：CVE-2010-4157 CNCVE ID：CNCVE-20104157 Linux是一款开放源代码的操作系统。 gdthioctlalloc接收整数类型大小变量，copyfromuser接收无符长整型大小变量。gen.datalen和gen.senselen为符长整型，在x8664上长型为64位，整数为32位。 传递超大值，内存分配会截断大小为32位而分配较小的缓冲区，在copyfromuser函数中可触发内存破坏。 RedHat Enterprise MRG v1 for Red Hat Enterprise Linux versi...
phpMyAdmin数据库搜索跨站脚本执行漏洞
BUGTRAQ ID: 45100 CVE ID: CVE-2010-4329 phpMyAdmin是用PHP编写的工具，用于通过WEB管理MySQL。 phpMyAdmin由于未有效过滤用户提供的数据，所以在实现上存在跨站脚本漏洞，远程攻击者可利用此漏洞在其他访问网站的用户的浏览器中执行任意脚本代码，从而窃取基于Cookie的验证凭据，发动其他攻击。 MandrakeSoft Corporate Server 4.0 x8664 MandrakeSoft Corporate Server 4.0 phpMyAdmin phpMyAdmin 2.11 - 3.3.6 MandrakeSo...
Linux Kernel gdth实现内核内存破坏漏洞
CVE ID: CVE-2010-4157 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的gdthioctlalloc函数取值大小变量为int型，而copyfromuser函数取大小变量为无符长型。 gen.datalen和gen.senselen为无符长型，在x8664系统上长型为64位，int型为32位。如果用户传送了超长值的话，分配就会将大小截短为32位，分配过小的缓冲区，之后在执行copyfromuser时可能导致内存破坏。 Linux kernel 2.6.x 厂商补丁： Linux -----...
BlueCMS v1.6 sp1 $_SERVER注射漏洞
BlueCMS是一个地方分类信息门户专用CMS系统。 程序在使用getip函数获取客户端ip时没有严格过滤数据，导致sql注射漏洞。 //comment.php $sql = "INSERT INTO ".table'comment'." comid, postid, userid, type, mood, content, pubdate, ip, ischeckVALUES '', '$id', '$userid', '$type', '$mood', '$content', '$timestamp', '".getip."', '$ischeck'"; // 注意getip...
Joomla Component "com_dirfrm" Sql Injection Vulnerability
No description provided by source. Exploit Title : Joomla Component "comdirfrm" Sql Injection Vulnerability Date : 18 - 8 - 2010 Author : Hieuneo Vietnam Version : All Versions Tested on : Win 7 Home Dork google: inurl:"comdirfrm" Exploit:...
Microsoft Excel 0x5D record Stack Overflow Vulnerability
No description provided by source. This is an exploit for MS10-038/CVE-2010-0822 Everything is hardcoded! winxp sp3 webDEViL w3bd3vilatgmaildot.com http://krash.in/excel1.xls Office 2007 - 12.0.4518.1014 MS10-038 bulletin states that Office 2007 is not vulnerable, lol import binascii...
Apple Mac OS X HFS硬链接本地拒绝服务漏洞
BUGTRAQ ID: 39658 CVECAN ID: CVE-2010-0105 Mac OS X是苹果家族机器所使用的操作系统。 大多数现代的操作系统都不允许目录中存在硬链接以防范无限递归，但Mac操作系统的HFS文件系统实现的Time Machine备份机制在目录中使用了硬链接，本地用户可以通过执行恶意程序导致拒绝服务。 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 厂商补丁： Apple ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.apple.com...
Apache Tomcat认证头信息泄露漏洞
BUGTRAQ ID: 39635 CVE ID: CVE-2010-1157 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 BASIC和DIGEST认证的WWW-Authenticate头包含有区域名。如果web.xml中对应用指定了realm- name元素，就会使用指定的区域名，否则Tomcat就会使用以下代码段生成一个区域名： request.getServerName + ":" + request.getServerPort 在某些环境中这可能会暴露运行Tomcat机器的本地主机名或IP地址。 Apache Group Tomcat 6.0.x...
Microsoft Windows #GP陷阱处理器本地权限提升漏洞
BUGTRAQ ID: 37864 CVE ID: CVE-2010-0232 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的内核GP陷井处理例程对执行的环境做了一些不正确的假设，本地普通用户权限的攻击者可以通过伪造执行环境中的数据使操作系统在ring0层执行指定的任意指令，从而取得对系统的完全控制。此漏洞影响几乎所有的x86 32位的Windows系统。 为了在老式的16位应用中支持BIOS服务例程，Windows NT内核支持Virtual-8086模式监控代码中的BIOS调用，分两个阶段实现。当GP陷阱处理器（nt!KiTrap0D）检测到出错...