56796 matches found
天融信TopApp-AD /acc/network/redial_pppoe.php等多处命令执行漏洞
No description provided by source...
OurPHP filebox.php服务器端请求伪造漏洞
No description provided by source...
cacti气象图插件任意文件上传漏洞
No description provided by source...
SAP HANA hdbindexserver - Memory corruption
No description provided by source...
ruvar OA系统 bulletin_template_show.aspx 参数id SQL注入漏洞
0x01 框架概述 璐华RuvarOA机关事业版办公自动化系统是广州市璐华计算机科技有限公司专门针对我国党政机关、大型企事业单位开发，采用组件技术和Web技术相结合，基于Windows平台，构建在大型关系数据库管理系统基础上的，以行政办公为核心，以集成融通业务办公为目标，将网络与无线通讯等信息技术完美结合在一起设计而成的新型办公自动化应用系统。 该系统根据中国国情和行政管理的惯例，旨在从根本上提高办公及行政管理的效率和水平，并借助与计算机与信息科技的成果为领导和决策人员提供全面及时的决策支持服务，是颇具实用性、先进性、经济性的政府机关协同办公系统。...
phpwind V9.0 /windid/admin.php 验证码绕过漏洞
No description provided by source...
jeecms前台在/member/o_upload_image.jspx存在文件上传漏洞
No description provided by source...
Emlog 5.3.1 flash xss
No description provided by source...
Microsoft Windows Win32k 特权提升漏洞( MS15-010)
来源链接：http://www.freebuf.com/vuls/90501.html FreeBuf黑客与极客（FreeBuf.COM） 原文地址：http://hdwsec.fr/blog/CVE-2015-0057.html，编译/FB小编鸢尾 概述 这是一个use-after-free内核漏洞，它能获取一个专属的write primitive操作，之后侵染临近的一个对象。这个yields语句可以在内核空间或者用户空间随意写入。...
Coremail官网SQL注入可读全库
简要描述： coremail官网存在注入，有防护，可绕过。 详细说明： 漏洞地址：http://www.coremail.cn/gjzc2/list117.aspx?lcid=412 漏洞证明： 有防护，直接用sqlmap加个tamper=chardoubleencode.py可以跑出来。 这个是sqlmap用的payload： Place: GET Parameter: lcid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: lcid=412 AND...
某学校综合管理平台另一处Getshell漏洞
简要描述： 某学校综合管理平台另一处Getshell漏洞 详细说明： 系统名称：学校综合管理平台 厂商：上海安脉计算机科技有限公司 关键字：版权所有：上海安脉计算机科技有限公司 系统架构：ASPX+MSSQL ASP+MSSQL 漏洞成因：编辑器不规范使用（弱口令+数据库可下载） 漏洞证明： 枚举部分案例： http://anmai.net:81/PrepManage/Editor/adminlogin.asp http://jwxx.am.jsedu.sh.cn/ANMAI/PrepManage/Editor/adminlogin.asp...
Wordpress wpDataTables Plugin 1.5.3 /wpdatatables.php SQL注入漏洞
wpdatatables.php // AJAX-handlers addaction 'wpajaxgetwdtable', 'wdtgetajaxdata' ; addaction 'wpajaxnoprivgetwdtable', 'wdtgetajaxdata' ; / Handler which returns the AJAX response / function wdtgetajaxdata $id = $GET'tableid'; $tabledata = wdtgettablebyid $id ; $columndata = wdtgetcolumnsbytablei...
Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities
No description provided by source. SEC Consult Vulnerability Lab Security Advisory 20141106-0 ======================================================================= title: XXE & XSS & Arbitrary File Write vulnerabilities product: Symantec Endpoint Protection vulnerable version: 12.1.4023.4080...
Supesite 注入一枚 (可提升自己为管理)
简要描述： Supesite 注入出的密码 基本都破不出来 如果能够直接提升自己为管理员 或者 自己修改管理的密码那就再好不过了。 忙里偷闲。 详细说明： 在index.php中 if$SGET'action' != 'index' ifempty$channels'menus'$SGET'action''upnameid' && $channels'menus'$SGET'action''upnameid' != 'news' $scriptfile = SROOT.'./'.$SGET'action'.'.php'; else $scriptfile =...
espcms sql注入漏洞
简要描述： 刚刚看了 espcms的官网 发现2014-09-16 16:58:17更新了,下了份看下，发现这上面的几个漏洞完全没修复啊..上次提交了个漏洞只给了5rank..敢给多点么.这次和上次那个相似,怕你们只修复一处,这处也提交下。 详细说明： 在order.php inordersave中 365-367行附近 foreach $did as $key = $value $value = intval$value; $oprice$key = floatval$oprice$key; $bprice$key = floatval$bprice$key;...
亿邮邮件系统SQL导致批量GetShell（无需登录）
简要描述： 亿邮邮件系统SQL导致批量GetShell（至少几百个单位） 详细说明： 漏洞文件：\php\bill\printaddfeelog.php 执行任意SQL命令，且不受GPC影响。 默认MYSQL都是有权限导出文件权限的，可以导出一句话后门。 query$sql; ? 利用代码： POST /php/bill/printaddfeelog.php HTTP/1.1 Content-Length: 140 Host: mail.sihs.edu.cn User-Agent: Mozilla/5.0 Windows; U; Windows NT 6.2; zh-CN;...
LANDesk Management Gateway 'gsb/drivers.php'代码注入漏洞
No description provided by source. 1. Advisory Information Title: Landesk OS command injection Advisory Id: CORE-2010-1018 Advisory URL: http://www.coresecurity.com/content/landesk-os-command-injection-vulnerability Date published: 2010-11-10 Date of last update: 2010-11-10 Vendors contacted:...
Open&Compact FTP Server 1.2 (Gabriel's FTP Server) - Auth Bypass & Directory Traversal SAM Retrieval Exploit
No description provided by source. !/usr/bin/python Exploit Title: Open&Compact Ftp Server = 1.2 Auth bypass & directory traversal sam retrieval Date: Aug 7, 2013 By Wireghoul - http://www.justanotherhacker.com Based on Serge Gorbunov's auth bypass http://www.exploit-db.com/exploits/13932/ Softwa...
DMXReady PayPal Store Manager <= 1.1 Contents Change Vulnerability
No description provided by source. Title : DMXReady PayPal Store Manager = 1.1 Remote Contents Change Vulnerability Author : ajann from Turkey Contact : : S.Page : http://www.dmxready.com $$ : 129.97 $ Dork : inurl:incpaypalstoremanager.asp DorkEx :...
Tandberg E, EX and C Series Endpoints Default Credentials for Root Account
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Default Credentials for Root Account on Tandberg E, EX and C Series Endpoints Advisory ID: cisco-sa-20110202-tandberg Revision 1.0 For Public Release 2011 February 2 1600 UTC GMT...
Litespeed Technologies Web Server Remote Poison null byte Exploit
No description provided by source. Litespeed Technologies Web Server Remote Poison null byte Zero-Day discovered and exploited by Kingcope in June 2010 google gives me over 9million hits Example exploit session: %nc 192.168.2.19 80 HEAD / HTTP/1.0 HTTP/1.0 200 OK Date: Sun, 13 Jun 2010 00:10:38 G...
Washington University wu-ftpd 2.5 .0 message Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/726/info There is a buffer overflow in wu-ftpd message file expansions which may be remotely exploitable. In situations where the message file can be written to in some way remotely by regular or anonymous users, this may...
ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow FreeBSD', 'Description' = %q This module...
Webcam Corp Webcam Watchdog 1.0/1.1/3.63 Web Server Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9351/info A problem has been identified in the handling of remote web requests by the Webcam Watchdog software. Because of this, it may be possible for a remote attacker to gain unauthorized access to a vulnerable system...
Commercial Interactive Media SCOOP! 2.3 prePurchaserRegistration.asp Invalid Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/16015/info Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...
DMXReady Member Directory Manager <= 1.1 - SQL Injection Vulnerability
No description provided by source. Title : DMXReady Member Directory Manager = 1.1 SQL Injection Vulnerability Author : ajann Contact : : S.Page : http://www.dmxready.com $$ : 99.97 $ Dork : inurl:incmemberdirectorymanager.asp DorkEx :...
odlican.net cms 1.5 - Remote File Upload Vulnerability
漏洞分析 upload.php php if isset$POST'pokreni' $targetpath = "files/"; $targetpath = $targetpath . basename $FILES'uploadedfile''name'; ifmoveuploadedfile$FILES'uploadedfile''tmpname', $targetpath echo "Datoteka ". basename $FILES'uploadedfile''name'. " je snimljena na server"; else echo "Došlo je...
TechSmith Snagit 10 (Build 788) DLL Hijacking Exploit (dwmapi.dll)
No description provided by source. / TechSmith Snagit 10 Build 788 Dll Hijacking Exploit By: Encrypt3d.M!nd Date: 25\8\2010 Download: http://www.techsmith.com/download/snagittrial.asp Details: Compile the following code and rename it to dwmapi.dl and place file with one of the affected types in t...
PhpMyDesktop/Arcade 1.0 Final - (phpdns_basedir) RFI Vulnerability
No description provided by source. Name : PhpMyDesktop|arcade 1.0 Final phpdnsbasedir Remote File Include Download From : http://mesh.dl.sourceforge.net/sourceforge/pmd-arcade/pmdarcade10final.zip Found By : RoMaNcYxHaCkEr Home Page : Not Yet : Google Dork : Powered by phpMyDesktop|arcade v1.0...
Interactivefx.ie CMS SQL Injection Vulnerability
No description provided by source. ================================================ Interactivefx.ie CMS SQL Injection Vulnerability ================================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ ...
Guru Penny Auction Pro 3.0 - Blind SQL Injection Vulnerability
No description provided by source. / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...
Microsoft IIS 4.0,Microsoft JET 3.5/3.5.1 Database Engine VBA Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/286/info Microsoft's JET database engine feature allows the embedding of Visual Basic for Application in SQL string expressions and the lack of metacharacter filtering by many web applications may allow remote users to...
Sun Java JRE AWT setDiffICM Buffer Overflow
No description provided by source. $Id: javasetdifficmbof.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms ...
ASX to MP3 Converter 3.1.2.1 - SEH Exploit (Multiple OS, DEP and ASLR Bypass)
No description provided by source. Exploit Title: ASX to MP3 Converter v3.1.2.1 SEH Exploit Multiple OS, DEP and ASLR Bypass Date: July 13, 2010 Author: Node Software Link: http://www.mini-stream.net/downloads/ASXtoMP3Converter.exe Version: Mini-Stream Software ASX to MP3 Converter...
Fake Identd 0.9/1.x Client Query Remote Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5351/info Fake Identd is an open source Ident server designed to return the same information to all incoming requests. It is implemented by Tomi Ollila, and available for Linux and a number of other Unix based operating...
XLineSoft ASPRunner 1.0/2.x [TABLE-NAME]_edit.asp SQL Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/10799/info ASPRunner is reported prone to multiple vulnerabilities. The reported issues include SQL injection, cross-site scripting, information disclosure and unauthorized access to database files. ASPRunner versions 2.4...
OpenSSL < 0.9.8i DTLS ChangeCipherSpec Remote DoS Exploit
No description provided by source. / cve-2009-1386.c OpenSSL 0.9.8i DTLS ChangeCipherSpec Remote DoS Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1386 OpenSSL would SegFault if the DTLS server receives a...
Man Command -H Flag Local Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/23355/info The 'man' command is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using it in a memory copy operation. NOTE: Presumably, this issue is...
Apache Struts ClassLoader Manipulation Remote Code Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Apache Struts ClassLoader Manipulation Remote Code Execution', 'Description' = %q This module...
quickersite 1.8.5 - Multiple Vulnerabilities
No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: QuickerSite Multiple Vulnerabilities Vendor: www.quickersite.com Vulnerable Version: 1.8.5 Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/39 1. Description:...
PHP/FI 1.0/FI 2.0/FI 2.0 b10 mylog/mlog Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/713/info The PHP/FI package which was originally written by Rasmus Lerdorf is an is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features...
IPSwitch IMail Server <= 8.1 - Local Password Decryption Utility
No description provided by source. / IpSwitch IMail Server = ver 8.1 User Password Decryption by Adik netmaniac hotmail KG IpSwitch IMail Server uses weak encryption algorithm to encrypt its user passwords. It uses polyalphabetic Vegenere cipher to encrypt its user passwords. This encryption sche...
D3Jeeb Pro 3 catogary.php catid Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/16853/info D3Jeeb is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation...
Naxtor Shopping Cart 1.0 Shop_Display_Products.PHP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14456/info Naxtor Shopping Cart is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitati...
phpFaber TopSites Index.PHP Cross-Site Scripting Vulnerability
漏洞信息： phpfaber topsites是一个php编写的功能强大，可靠和安全的排行榜。 phpFaber TopSites存在跨站脚本攻击漏洞。 漏洞影响： phpFaber TopSites 0 漏洞详情： phpFaber TopSites中的index.php存在跨站脚本攻击漏洞。这使得远程攻击者可以借助于page参数注入任意Web脚本或HTML。 可使用以下代码进行漏洞验证： http://www.example.com/index.php?page=alert/sebug/ 解决方案：...
Daum Game 1.1.0.5 - ActiveX (IconCreate Method) Stack Buffer Overflow
No description provided by source. !-- Trustwave SpiderLabs Security Advisory TWSL2014-002: Buffer Overflow Vulnerability in DaumGame ActiveX Published: 01/07/2014 Version: 1.1 Vendor: Daum daum.net Product: Daum Game ActiveX Version affected: 1.1.0.5, 1.1.0.4 Product description: DaumGame Active...
WANGKONGBAO CNS-1000 UTM IPS-FW Directory Traversal
No description provided by source. Exploit Title: WANGKONGBAO CNS-1000 and 1100 Network Security Platform UTM Directory Traversal Date: 7/2/2012 Exploit Author: Dillon Beresford Vendor Homepage: http://www.wangkongbao.com/products.html Version: CNS-1000 and 1100 The issue is in the...
PHPSHE多处SQL注入漏洞
简要描述： 详细说明： 很早之前就发现了，到现在还没修 PHPSHE商城系统，在用户提交订单时，收获信息多处存在SQL注入，有回显，可直接获取管理员账户信息。 module/index/order.php文件： //@ 订单增加 @// case 'add': $cartinfo = cartinfounserialize$ccartlist; $infolist = $cartinfo'list'; $money = $cartinfo'money'; if isset$ppesubmit //!count$infolist && peerror'购物车商品为空'; $order =...
Linux Kernel 'handle_rx()'函数拒绝服务漏洞
Bugtraq ID:66678 CVE ID:CVE-2014-0077 Linux Kernel是Linux操作系统的内核。 Linux kernel在handlerx函数处理较大数据包时存在拒绝服务漏洞，攻击者可利用此漏洞使受影响应用崩溃。 0 Linux kernel 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://www.kernel.org/...
Apache Xalan-Java FEATURE_SECURE_PROCESSIN属性处理安全绕过漏洞
CVE ID:CVE-2014-0107 Apache Xalan-Java是一个使用Java和C++来实现XSLT库的项目。 Apache Xalan-Java处理部分输出属性时存在错误，允许攻击者利用漏洞绕过安全处理特性FEATURESECUREPROCESSING，可访问受限属性或加载任意受限类。 0 Apache Xalan-Java 2.7.0 用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞： https://issues.apache.org/jira/browse/XALANJ-2435...