56796 matches found
CPP-Ethereum JSON-RPC admin_nodeInfo improper authorization Vulnerability(CVE-2017-12113)
Summary An exploitable improper authorization vulnerability exists in adminnodeInfo API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to...
WebKit: out-of-bounds read in WebCore::SimpleLineLayout::RunResolver::runForPoint(CVE-2017-13784)
There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==30436==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000560c48 at pc...
Network Time Protocol Forced Interleaved Time Spoofing Vulnerability(CVE-2016-1548)
SUMMARY It is possible to change the time of an ntpd client or deny service to an ntpd client by forcing it to change from basic client/server mode to interleaved symmetric mode. An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-dst...
Google Nexus 9 SensorHub Firmware Downgrade Vulnerability(CVE-2017-0582)
Product Google Nexus 9 Vulnerable Version Nexus 9 Android Builds before N4F27B - May 2017, i.e. before bootloader 3.50.0.0143. Mitigation Install N4F27B or later bootloader version 3.50.0.0143. Technical Details The Nexus 9 device contains a SoC manufactured by Cywee which implements a “Sensor...
Joomla! Core XSS Vulnerability(CVE-2017-7985)
Joomla! is one of the world's most popular content management system CMS solutions. It enables users to build custom Web sites and powerful online applications. More than 3 percent of Web sites are running Joomla!, and it accounts for more than 9 percent of CMS market share. As of November 2016,...
Heap Overflow Vulnerability in Citrix NetScaler Gateway (CVE-2017-7219)
After presenting my findings on the Swisscom router at the CybSecConference last year, I started looking for a new product to analyze. I quickly found that it’s possible to download virtual “demo” appliances of Citrix products, so I went on to download a Netscaler VPX, which at the time was at...
Zabbix Proxy Server SQL Database Write Vulnerability (CVE-2017-2825)
Official patch earlier to fix the vulnerabilities: the Zabbix code execution vulnerability DETAILS One of the Trapper requests made by the Zabbix proxy is the ìproxy configî request, which allows a proxy to request its own proxy configuration from the Zabbix Server or any other Zabbix Proxyís...
RoundCube Webmail mail <1.0.5 body stored XSS（CVE-2015-1433）
RoundCube Webmail is a foreign use of a wide an open source php e-mail system, the meaning is still quite large. roundcube webmail official website: , download the latest version. /program/lib/Roundcube/rcubewashtml.php this file is actually a rich text filter class class rcubewashtml it. roundcu...
Schneider Electric Magelis HMI Advanced Panel denial of service vulnerability (PanelShock)
IMPROPER IMPLEMENTATION OF HTTP GET REQUEST CVE-2016-8367 / SVE-82003201 The timeout value for closing an HTTP client's requests in the Web Gate service is too long and allows a malicious attacker to open multiple connections to the targeted web server and keep them open for as long as possible b...
Django CSRF Bypass (CVE-2016-7401)
Author: p0wd3r 知道创宇404安全实验室 Date: 2016-09-28 0x00 漏洞概述 1.漏洞简介 Django是一个由Python写成的开源Web应用框架。在两年前有研究人员在hackerone上提交了一个利用Google Analytics来绕过Django的CSRF防护机制的漏洞CSRF protection bypass on any Django powered site via Google Analytics，通过该漏洞，当一个网站使用了Django作为Web框架并且设置了Django的CSRF防护机制，同时又使用了Google...
OurPHP filebox.php服务器端请求伪造漏洞
No description provided by source...
cacti气象图插件任意文件上传漏洞
No description provided by source...
SAP HANA hdbindexserver - Memory corruption
No description provided by source...
双杨OA /ispirit/go.php 文件 LOGIN_UID 参数SQL注入漏洞
No description provided by source...
用友致远A6协同系统messageViewer.jsp三处SQL注入漏洞
No description provided by source...
phpwind V9.0 /windid/admin.php 验证码绕过漏洞
No description provided by source...
Emlog 5.3.1 flash xss
No description provided by source...
Microsoft Windows Win32k 特权提升漏洞( MS15-010)
来源链接：http://www.freebuf.com/vuls/90501.html FreeBuf黑客与极客（FreeBuf.COM） 原文地址：http://hdwsec.fr/blog/CVE-2015-0057.html，编译/FB小编鸢尾 概述 这是一个use-after-free内核漏洞，它能获取一个专属的write primitive操作，之后侵染临近的一个对象。这个yields语句可以在内核空间或者用户空间随意写入。...
致远软件某网站漏洞合集
简要描述： 致远软件某网站漏洞合集，能不能给20rank 详细说明： 致远软件自助服务网站 问题如下： SQL注入 问吧管理员弱口令 任意文件上传 漏洞证明： SQL注入证明------------开始 注入点为 http://support.seeyon.com/ask/base/QuestionHandler.ashx?callback=jsonp1428044230217&mode=list&title=ceshi 注入类型 获取数据库列表 SQL注入证明------------结束 问吧管理员弱口令证明------------开始 后台地址...
Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities
No description provided by source. SEC Consult Vulnerability Lab Security Advisory 20141106-0 ======================================================================= title: XXE & XSS & Arbitrary File Write vulnerabilities product: Symantec Endpoint Protection vulnerable version: 12.1.4023.4080...
新云cms建站系统存在ewebeditor上传和iis解析漏洞可批量getshell
简要描述： 详细说明： 新云cms建站系统存在ewebeditor上传和iis解析漏洞，可批量getshell. 利用ewebeditor上传漏洞可以新建一个1.asp的文件夹，再配合iis的解析漏洞就可以成功的拿到shell. 可通过谷歌获得大量的漏洞网站，关键字如下： inurl:Showservices.asp?id= inurl:showkbxx.asp?id= None...
espcms sql注入漏洞
简要描述： 刚刚看了 espcms的官网 发现2014-09-16 16:58:17更新了,下了份看下，发现这上面的几个漏洞完全没修复啊..上次提交了个漏洞只给了5rank..敢给多点么.这次和上次那个相似,怕你们只修复一处,这处也提交下。 详细说明： 在order.php inordersave中 365-367行附近 foreach $did as $key = $value $value = intval$value; $oprice$key = floatval$oprice$key; $bprice$key = floatval$bprice$key;...
Java MixerSequencer Object GM_Song Structure Handling Vulnerability
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
Washington University wu-ftpd 2.5 .0 message Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/726/info There is a buffer overflow in wu-ftpd message file expansions which may be remotely exploitable. In situations where the message file can be written to in some way remotely by regular or anonymous users, this may...
Linux Kernel 2.4/2.6 - sock_sendpage() ring0 Root Exploit (Simple Version)
No description provided by source. / 0x82-CVE-2009-2692 Linux kernel 2.4/2.6 32bit socksendpage local ring0 root exploit simple ver Tested RedHat Linux 9.0, Fedora core 411, Whitebox 4, CentOS 4.x. -- Discovered by Tavis Ormandy and Julien Tinnes of the Google Security Team. spender and venglin's...
CMS Balitbang 3.3 Arbitary File Upload Vulnerability
No description provided by source. =================================================================== CMS Balitbang v.3.3 Arbitary file upload vulnerability =================================================================== Software: CMS Balitbang Vendor: www.kajianwebsite.org Vuln Type: Arbita...
WonderWare SuiteLink 2.0 - Remote Denial of Service Exploit (meta)
No description provided by source. $Id: suitlink.rb $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
Man Command -H Flag Local Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/23355/info The 'man' command is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using it in a memory copy operation. NOTE: Presumably, this issue is...
php blue dragon cms 3.0.0 - Remote File Inclusion Vulnerability
No description provided by source. // Exploit Name: Php Blue Dragon CMS 3.0.0 Remote File Inclusion Vulnerability //Script Homepage: http://phpbluedragon.pl/ // Autor: Kacper [email protected] // Autor Homepage: devilteam.eu | kacper.bblog.pl //Pozdrawiam wszystkich ludzi z DEVIL TEAM, Zaprasza...
ASX to MP3 Converter 3.1.2.1 - SEH Exploit (Multiple OS, DEP and ASLR Bypass)
No description provided by source. Exploit Title: ASX to MP3 Converter v3.1.2.1 SEH Exploit Multiple OS, DEP and ASLR Bypass Date: July 13, 2010 Author: Node Software Link: http://www.mini-stream.net/downloads/ASXtoMP3Converter.exe Version: Mini-Stream Software ASX to MP3 Converter...
XLineSoft ASPRunner 1.0/2.x [TABLE-NAME]_edit.asp SQL Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/10799/info ASPRunner is reported prone to multiple vulnerabilities. The reported issues include SQL injection, cross-site scripting, information disclosure and unauthorized access to database files. ASPRunner versions 2.4...
PHP/FI 1.0/FI 2.0/FI 2.0 b10 mylog/mlog Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/713/info The PHP/FI package which was originally written by Rasmus Lerdorf is an is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features...
Clicky Web Pseudo-frames 1.0 - Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4756/info Pseudo-frames is an application written in PHP and is maintained by Clicky Web. Pseudo-frames permit remote file including. As a result, a remote attacker may include an arbitrary file located on a remote host. ...
PhpMyDesktop/Arcade 1.0 Final - (phpdns_basedir) RFI Vulnerability
No description provided by source. Name : PhpMyDesktop|arcade 1.0 Final phpdnsbasedir Remote File Include Download From : http://mesh.dl.sourceforge.net/sourceforge/pmd-arcade/pmdarcade10final.zip Found By : RoMaNcYxHaCkEr Home Page : Not Yet : Google Dork : Powered by phpMyDesktop|arcade v1.0...
Interactivefx.ie CMS SQL Injection Vulnerability
No description provided by source. ================================================ Interactivefx.ie CMS SQL Injection Vulnerability ================================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ ...
Sun Java JRE AWT setDiffICM Buffer Overflow
No description provided by source. $Id: javasetdifficmbof.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms ...
TechSmith Snagit 10 (Build 788) DLL Hijacking Exploit (dwmapi.dll)
No description provided by source. / TechSmith Snagit 10 Build 788 Dll Hijacking Exploit By: Encrypt3d.M!nd Date: 25\8\2010 Download: http://www.techsmith.com/download/snagittrial.asp Details: Compile the following code and rename it to dwmapi.dl and place file with one of the affected types in t...
Fake Identd 0.9/1.x Client Query Remote Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5351/info Fake Identd is an open source Ident server designed to return the same information to all incoming requests. It is implemented by Tomi Ollila, and available for Linux and a number of other Unix based operating...
Franklin Fueling TS-550 evo 2.0.0.6833 - Multiple Vulnerabilities
No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2014-001: Multiple Vulnerabilities in Franklin Fueling's TS-550 evo Published: 01/03/2014 Version: 1.0 Vendor: Franklin Fueling Systems http://www.franklinfueling.com/ Product: TS-550 evo device Version affected:...
MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
WANGKONGBAO CNS-1000 UTM IPS-FW Directory Traversal
No description provided by source. Exploit Title: WANGKONGBAO CNS-1000 and 1100 Network Security Platform UTM Directory Traversal Date: 7/2/2012 Exploit Author: Dillon Beresford Vendor Homepage: http://www.wangkongbao.com/products.html Version: CNS-1000 and 1100 The issue is in the...
coppermine photo gallery <= 1.4.22 Multiple Vulnerabilities
No description provided by source. Author: girex Site: http://girex.altervista.org/ CMS: Coppermine Photo Gallery = 1.4.22 Coppermine Foto Gallery suffers from different vulnerabilities. There is a Local File Inclusion and a Blind SQL Injection working with registerglobals = On and magicquotesgpc...
Sophos Web Protection Appliance - Multiple Vulnerabilities
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Sophos Web Protection Appliance Multiple Vulnerabilities 1. Advisory Information Title: Sophos Web Protection Appliance Multiple Vulnerabilities Advisory ID: CORE-2013-0809 Advisory URL:...
HP Data Protector 6.20 EXEC_CMD Buffer Overflow Vulnerability
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - Corelabs Advisory http://corelabs.coresecurity.com/ HP Data Protector EXECCMD Buffer Overflow Vulnerability 1. Advisory Information Title: HP Data Protector EXECCMD Buffer Overflow...
Anymacro 邮件系统最新版SQL注入漏洞造成邮件泄露（通杀所有邮件服务器）
简要描述： 疯狗叔叔、Finger xsser ，我还有几枚怎么不帮我审核了？ 详细说明： 疯狗叔叔、Finger xsser ，我还有几枚怎么不帮我审核了？ 0x001 背景 anymacro已经被列入奖励名单了。 0x001 背景 anymacro是国内较流行的一家企业级邮箱系统，客户主要为教育/政府机构。 今天所发现的SQL注入影响所有Anymacro所有邮件系统。 例如近期项目，都是超大企业或者是单位： 安宁中标中国航天科技集团邮件系统建设项目 安宁承接中国海关总署邮件系统项目 安宁中标中国社科院邮件系统项目 安宁中标中国外交部邮件系统建设项目 安宁中标中国光大银行邮件系统项目...
Linux Kernel 'handle_rx()'函数拒绝服务漏洞
Bugtraq ID:66678 CVE ID:CVE-2014-0077 Linux Kernel是Linux操作系统的内核。 Linux kernel在handlerx函数处理较大数据包时存在拒绝服务漏洞，攻击者可利用此漏洞使受影响应用崩溃。 0 Linux kernel 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://www.kernel.org/...
Apache Xalan-Java FEATURE_SECURE_PROCESSIN属性处理安全绕过漏洞
CVE ID:CVE-2014-0107 Apache Xalan-Java是一个使用Java和C++来实现XSLT库的项目。 Apache Xalan-Java处理部分输出属性时存在错误，允许攻击者利用漏洞绕过安全处理特性FEATURESECUREPROCESSING，可访问受限属性或加载任意受限类。 0 Apache Xalan-Java 2.7.0 用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞： https://issues.apache.org/jira/browse/XALANJ-2435...
Symantec Endpoint Protection Manager XML外部实体注入漏洞
BUGTRAQ ID: 65466 CVECAN ID: CVE-2013-5014 Symantec Endpoint Protection SEP是由Symantec Corporation开发的新一代反病毒和防火墙产品。 Symantec Endpoint Protection Manager 11.0、Symantec Endpoint Protection Center Small Business Edition 12.0、Symantec Endpoint Protection Manager...
vTiger CRM SOAP AddEmailAttachment任意文件上传漏洞
BUGTRAQ ID：61558 CVE ID：CVE-2013-3214 vtiger CRM是一套基于Web以销售能力自动化SFA为主的客户关系管理系统CRM 。 vtiger CRM /soap/vtigerolservice.php所定义的AddEmailAttachment SOAP方法不正确过滤通过"filedata"和"filename"参数提交的输入，允许攻击者利用漏洞写/覆盖任意文件，并以WEB权限执行。 0 vtiger vtiger CRM 5.0.0 - 5.4.0 厂商补丁： vtiger ----- 用户可参考如下厂商提供的安全补丁以修复此漏洞：...