56796 matches found
Visual Tools DVR VX16 未授权命令注入
...
Foxit Reader 远程代码执行漏洞（CVE-2021-31473）
...
Unauthenticated Privileged Directory Traversal in IPConfigure Orchid Core VMS(CVE-2018-10956)
Affected Software: IPConfigure Orchid Core VMS All versions 2.0.6, tested on Linux and Windows Vulnerability: Unauthenticated Privileged Directory Traversal CVE: CVE-2018-10956 Impact: Arbitrary File Read Access Metasploit module:...
Canon LBP6650/LBP3370/LBP3460/LBP7750C - Authenticaton Bypass(CVE-2018-11692)
Description : An issue was discovered on Canon LBP6650, LBP3370, LBP3460, LBP7750C printers. It is possible for a remote unauthenticated attacker to bypass the Administrator Mode authentication without a password at any URL of the device that requires authentication. PoC : Start searching for Can...
New multiOverflow Bug Identified in Multiple ERC20 Smart Contracts (CVE-2018-10706)
Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow, proxyOverflow, transferFlaw, ownerAnyone. Some of them could be used by attackers to generate tokens out of nowhere while others can be used to steal tokens from...
SQLi, XSS zero-days expose Belkin IoT devices, Android smartphones
LONDON, UK – Research director Scott Tenaglia and lead research engineer Joe Tanen detailed the vulnerabilities during their ‘Breaking BHAD: Abusing Belkin Home Automation devices’ talk at the Black Hat Europe conference in London last Friday. The zero-day flaws specifically relate to Belkin’s...
D-Link DSL-6850U Multiple Vulnerabilities
Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in D-Link DSL-6850U versions BZ1.00.01 – BZ1.00.09. D-Link DSL-6850U is a router “manufactured by D-Link for Bezeq in Israel” The vulnerabilities found are: Default Credentials Remote Command Execution Credit An...
MacOS/iOS kernel double free due to incorrect API usage in flow divert socket option handling(CVE-2017-13867)
SOFLOWDIVERTTOKEN is a socket option on the SOLSOCKETlayer. It's implemented by flowdiverttokensetstruct socket so, struct sockopt sopt in flowdivert.c. The relevant code is: error = sooptgetmsopt, &token; if error goto done; error = sooptmcopyinsopt, token; if error goto done; ... done: if token...
Pomelo Admin Console Web存在任意文件写入漏洞
...
ZTE ZXDSL Configuration Reset
Vulnerability Summary The following advisory describes a configuration reset vulnerability found in ZTE ZXDSL 831CII version 6.2. ZXDSL 831CII is “an ADSL access device to support multiple line modes. It supports ADSL2/ADSL2+ and is backward compatible to ADSL, even offers auto-negotiation...
libxls xls_getfcell Code Execution Vulnerability(CVE-2017-2919)
Summary An exploitable stack based buffer overflow vulnerability exists in the xlsgetfcell function of libxls 1.3.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability. Tested Version...
Microsoft IE11: use-after-free in jscript!JsErrorToString(CVE-2017-11810)
There is a use-after-free in jscript.dll library that can be exploited in IE11. jscript.dll is an old JavaScript library that was used in IE 8 and back. However, IE11 can still load it if put into IE8 compatibility mode and if there is a script tag that can only be understood by the older library...
Wordpress SQLi — PoC
In order to understand the writing here, you need to read the previous explanation https://medium.com/websec/wordpress-sqli-bbb2afcc8e94. If you got it, then we can jump to the part and solve the question e.g. how to update / insert our sql payload into thumbnailid post meta. PoC start - Login to...
Circle with Disney Apid Use-Between-Reallocs Information Disclosure Vulnerability(CVE-2017-12083)
Summary An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivit...
Apache OpenOffice DOC ImportOldFormatStyles Code Execution Vulnerability(CVE-2017-12608)
Summary An exploitable out-of-bounds write vulnerability exists in the WW8RStyle::ImportOldFormatStyles functionality of Apache OpenOffice 4.1.3. A specially crafted doc file can cause a out-of-bounds write resulting in arbitrary code execution. An attacker can send/provide malicious doc file to...
7zip UDF CInArchive::ReadFileItem Code Execution Vulnerability(CVE-2016-2335)
Summary An out of bound read vulnerability exists in the CInArchive::ReadFileItem method functionality of 7zip for handling UDF files that can lead to denial of service or code execution. Tested Versions 7-Zip 32 15.05 beta 7-Zip 64 9.20 Product URLs http://www.7-zip.org/ Details...
Ruby WIN32OLE ole_invoke and ole_query_interface Type Confusion Vulnerabilities(CVE-2016-2336)
DESCRIPTION Type Confusion exists in two methods of Ruby's WIN32OLE class, oleinvoke and olequeryinterface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution. TESTED VERSIONS Ruby 2.3.0 dev Ruby 2.2.2 PRODUCT URLs https://www.ruby-lang.or...
Adobe Flash Player Infinite Recursion Arbitrary Read Access Violation(CVE-2016-4132)
SUMMARY A potentially exploitable read access violation vulnerability exists in the a way Adobe Flash Player handles infinitely recursive calls. A specially crafted ActionScript code can cause a read access violation which can potentially be further abused. To trriger this vulnerability user...
Moxa AWK-3131A Web Application systemlog.log Information Disclosure Vulnerability(CVE-2016-8725)
Summary An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A wireless access point running firmware 1.1. Retrieving a specific URL without authentication can reveal sensitive information to an attacker. Tested Versions Moxa AWK-3131...
Foscam IP Video Camera CGIProxy.fcgi DNS2 Address Configuration Command Injection Vulnerability(CVE-2017-2848)
Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configurati...
Lexmark LibISYSpdf Image Rendering DCTStream::getBlock() Code Execution Vulnerability(CVE-2017-2822)
Summary An exploitable code execution vulnerability exists in the image rendering functionality of Lexmark Perceptive Document Filters 11.3.0.2400. A specifically crafted PDF can cause a function call on a corrupted DCTStream to occur, resulting in user controlled data being written to the stack....
Microsoft Internet Explorer Remote Code Execution Vulnerability(CVE-2017-8618)
There is a type confusion issue related to how some arithmetic operations are performed in VBScript. To illustrate, see the following simplified code of VbsVarMod static unsigned char resultlookuptable1818 = ... void VbsVarModVAR v1, VAR v2 VAR arithv1 = v1-PvarGetArithVal; VAR arithv2 =...
Apple iOS / MacOS Netagent Kernel Memory Disclosure(CVE-2017-2507)
iOS/MacOS kernel memory disclosure due to lack of bounds checking in netagent socket option handling netagentctlsetopt is the setsockopt handler for netagent control sockets. Options of type NETAGENTOPTIONTYPEREGISTER are handled by netagenthandleregistersetopt. Here's the code: static errnot...
OnePlus 3/3T OxygenOS Unauthorized Flash Dumping via fastboot(CVE-2017-5625)
Products OnePlus 3T OnePlus 3 Vulnerable Version OxygenOS 4.0.2 and earlier Mitigation Install OxygenOS 4.0.3 or later Summary A physical attacker, PC malware / malicious charger having ADB or fastboot access to the device can cause a locked bootloader to partially dump the content of an arbitrar...
XNU kernel UaF due to lack of locking in set_dp_control_port (CVE-2016-7644)
setdpcontrolport is a MIG method on the hostprivport so this bug is a root-kernel escalation. kernreturnt setdpcontrolport hostprivt hostpriv, ipcportt controlport if hostpriv == HOSTPRIVNULL return KERNINVALIDHOST; if IPVALIDdynamicpagercontrolport ipcportreleasesenddynamicpagercontrolport;...
AMF3 Java implementations Improper Restriction of XML External Entity Reference ('XXE')
A detailed analysis of the reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers allow the external entity references XXEs from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose...
Elevation of privilege vulnerability in Qualcomm crypto engine driver(CVE-2017-0576)
No description provided by source. include include include include include include include include include include / PoC By Scott Bauer Bug found by derrek / static const char dev = "/dev/qce"; define QCEDEVMAXKEYSIZE 64 define QCEDEVMAXIVSIZE 32 define QCEDEVMAXBUFFERS 16 struct bufinfo union...
GitLab permission leak Vulnerability, CVE-2017-0882）
Information Disclosure in Issue and Merge Request Trackers During an internal code review a critical vulnerability in the GitLab Issue and Merge Request trackers was discovered. This vulnerability could allow a user with access to assign ownership of an issue or merge request to another user to...
Grandstream HT701 IP analog telephone adapter background of the weak password vulnerability
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.api.request import req from pocsuite.api.poc import register from pocsuite.api.poc import Output, POCBase import re class TestPOCPOCBase: vulID = '' ssvid version = '1.0' author = 'Hcamael' vulDate = '2016-11-11'...
ImageMagick popen_utf8函数命令注入漏洞
Author: niubl 知道创宇404安全实验室 一、漏洞概要 i. 漏洞描述 ImageMagick是一款使用量很广的图片处理程序，很多厂商都调用了这个程序进行图片处理，包括图片的伸缩、切割、水印、格式转换等等。我发现当用户传入一个包含|竖线的文件名的时候，就有可能触发命令注入漏洞。 ii. 漏洞影响 ImageMagick在处理文件名时会调用OpenBlob函数，在OpenBlob函数中，代码2484行，判断文件名是否以|竖线开头，如果是，那么他会调用popoenutf8函数处理文件名，代码如图：...
XYCMS广告设计中心网站系统 v3.0 view_detail.asp参数id SQL注入漏洞
0x01漏洞简介 XYCMS广告设计中心网站系统采用asp+access架构，其在/viewdetail.asp处对参数id过滤不严格，导致出现SQL注入漏洞。远程攻击者可以利用该漏洞执行SQL指令。 0x02漏洞详情 该系统默认存在一个管理员数据表adminuser，该表包含管理员名称字段admin和密码 md5加密字段password，远程攻击者可以结合union方式获取敏感信息，登陆后台，上传shell。 0x03修复方案 过滤。...
正方教务系统 jwggck.aspx 参数fbsj SQL注入漏洞
No description provided by source...
Moxa NPort's web console! 未授权访问
No description provided by source...
用友致远A6协同系统 /yyoa/ext/trafaxserver/ExtnoManage/setextno.jsp 文件 user_ids 参数SQL注入漏洞
No description provided by source...
jeecms前台在/member/o_upload_image.jspx存在文件上传漏洞
No description provided by source...
PycURL远程代码执行漏洞
简要描述： 利用pycurl上传文件时，如果文件内容是unicode类型，那么会产生Use After Free漏洞 详细说明： 文件名： pycurl\src\easy.c 如果setopt给定的FORMBUFFERPTR的内容是Unicode，如 curl.setoptpycurl.HTTPPOST, 'field2', pycurl.FORMBUFFER, 'uploaded.file', pycurl.FORMBUFFERPTR, u'test', 那么会进入如下流程: 代码1571行会先把unicode转换成str，ostr和olen，分别是str的字符串指针和长度...
WordPress Work The Flow File Upload 2.5.2 - Arbitrary File Upload Vulnerability
漏洞类型： 文件上传漏洞 漏洞概述： Work the flow是一个基于HTML5的Wordpress插件，它主要向用户提供文件上传功能。但是由于插件开发作者没有对上传文件进行足够的检查导致插件存在文件上传漏洞。 漏洞分析： 漏洞存在于插件“work-the-flow-file-upload\public\assets\jQuery-File-Upload-9.5.0\server\php”目录下UploadHandler.php文件中的UploadHandler类。 下面我们看看漏洞形成的原因： 1、UploadHandler类未经验证初始化。...
WordPress <= 4.3.0 跨站脚本漏洞
WordPress 在编辑文章内容时允许使用简码（shorcodes）来表示资源（图片，链接等）。WordPress 中开启了白名单机制去过滤 HTML 标签，只有在白名单规则里的标签，才允许被使用，并且会使用专用脚本 "KSES" 去检测和过滤这些 HTML 标签。这里需要说明的是，WordPress 对 HTML 标签的检测和过滤发生在将内容插入数据库时，而简码的解析渲染发生在将内容输出到页面时，下面简单用例子说明一下两个处理过程的差别，编辑文章插入内容为：TEST!!!caption width="1" caption='a href="'...
网康VPN设备6.3.1越权访问
网康vpn设备虽然设置了授权访问，但是大部分页面可以越权绕过访问。1，https://xx.xx.xx.x/vpnweb/bulletin.php?para=admin/index.php绕过认证直接访问后台认证，使用burp抓包，得到url地址!网康vpn设备设计缺陷，可以远程直接重启。直接访问vpn设备的地址https://xxx.xx.xx.xx//admin/devicestatus.php点击重启，直接可以重启设备！影响的型号为6.3.1版本...
cmstop媒体云SQL注入漏洞
简要描述： 媒体云真是方便，直接注册就建立一个网站了，但是如果云出了漏洞呢？ 详细说明： CmsTop 媒体云 作为媒体云时代的开创者，思拓合众颠覆了传统的软件采购和项目外包模式，与传媒集团建立战略合作伙伴关系，以互联网思维和云计算技术为基础整合集团、区域和行业内的媒体及政务新媒体资源，共同建设和运营媒体云。 想象是美好的，现实呢，现实是，媒体云后台管理存在sql注入漏洞 我们随便注册一个账号（http://www.cmstop.cn/），然后访问用户功能 http://site.cmstop.cn//member/index/index?state=enable...
Coremail官网SQL注入可读全库
简要描述： coremail官网存在注入，有防护，可绕过。 详细说明： 漏洞地址：http://www.coremail.cn/gjzc2/list117.aspx?lcid=412 漏洞证明： 有防护，直接用sqlmap加个tamper=chardoubleencode.py可以跑出来。 这个是sqlmap用的payload： Place: GET Parameter: lcid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: lcid=412 AND...
某网店系统存在越权漏洞(任意用户信息修改)
简要描述： 某网店系统存在越权漏洞任意用户信息修改 详细说明： 账号 A id=375 账号 B id=376 越权修改账号a的信息 成功修改 demo演示站点呢 一样可以修改收货地址 账号A id=362 账号B id=363 img src="https://images.seebug.org/upload/201504/07000058fd624e353d682fc05a6b2efead0a6338.jpg" alt="2.jpg" width="600" onerror=...
致远软件某网站漏洞合集
简要描述： 致远软件某网站漏洞合集，能不能给20rank 详细说明： 致远软件自助服务网站 问题如下： SQL注入 问吧管理员弱口令 任意文件上传 漏洞证明： SQL注入证明------------开始 注入点为 http://support.seeyon.com/ask/base/QuestionHandler.ashx?callback=jsonp1428044230217&mode=list&title=ceshi 注入类型 获取数据库列表 SQL注入证明------------结束 问吧管理员弱口令证明------------开始 后台地址...
某在线培训系统通用SQL注入漏洞
简要描述： 捡漏不易 详细说明： 捡漏一处： 该系统主要针对网上学习的。数据库里面包含有很多老师、学生的个人信息。 漏洞类型：SQL注入 危害度：高危 漏洞位置：WebOrg/UserRegist.aspx 参数：USERNAME 厂商：上海天柏信息科技有限公司 厂商网站：http://www.timber2005.com/ 漏洞证明： 关键字：inurl:webOrg 可自由构造 部分案例： http://webcourse.vixue.net/WebOrg/UserRegist.aspx http://www.gxkjks.com/WebOrg/UserRegist.aspx...
大汉网络JCMS任意文件下载
简要描述： 大汉网络文件遍历 详细说明： 漏洞Url： /jcms/m5e/module/voting/down.jsp?filename=a.txt&pathfile=/etc/passwd 下载文件： root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin...
TurboMail邮件系统伪造邮件漏洞,可实施邮件钓鱼
简要描述： TurboMail邮件系统存在邮件伪造漏洞，可实施邮件钓鱼攻击.. 详细说明： TurboMail邮件系统在发送邮件时没有对邮件协议的From字段进行有效验证，发件人可以伪造任意用户进行发送邮件，达到邮件欺骗攻击的目的，可以用来进行邮件钓鱼等。 TurboMail邮件系统下载链接：http://www.turbomail.org/download.html 测试环境：Win2003 + turbomailwin520.exe 漏洞证明： 本地安装Windows版本的TurboMail邮件系统...
phpwind 8.x全版本存储型xss漏洞（捡的）
简要描述： rt 详细说明： 在某个学校读书，然后某个学校的论坛是用phpwind 8.7的，在wooyun搜到一个储存型漏洞， 祸不单行的事情又发生了，因为phpwind已经是9.0版本了，去看了下9.0版本没发现有这个功能，所以自评rank2分。不知道能过审核不！ WooYun: phpwind 8.x全版本存储型XSS 这个漏洞 imghttp://pic1.sc.chinaz.com/files/pic/pic9/201404/apic493.jpg';alert/xss////img 在个人空间有个日志功能，在日志内容插入此代码也可以xss 8.x版本都存在吧。 漏洞证明： -...