56796 matches found
Xerox DC260 EFI Fiery Controller Webtools 2.0 Arbitrary File Disclosure
Summary Drive production profitability with Fiery servers and workflow products. See which Fiery digital front end is right for your current or future print engines and business needs. Manage all your printers from a single screen using this intuitive print job management interface. Description...
Windows: Uninitialized variable in jscript!JsArraySlice(CVE-2017-11855)
There is an uninitialized variable vulnerability in jscript.dll. This issue could potentially be exploited through multiple vectors: - By opening a malicious web page in Internet Explorer. - currently untested An attacker on the local network could exploit this issue by posing as a WPAD Web Proxy...
vBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion(CVE-2017-17672)
Vulnerability Summary The following advisory describes a unauthenticated deserialization vulnerability that leads to arbitrary delete files and, under certain circumstances, code execution found in vBulletin version 5. vBulletin, also known as vB, is “a widespread proprietary Internet forum...
DblTek Multiple Vulnerabilities
Vulnerabilities summary The following advisory describes 2 two vulnerabilities found in DblTek webserver. DBL is “specialized in VoIP products, especially GoIPs. We design, develop, manufacture, and sell our products directly and via distributors to customers. Our GoIP models now cover 1, 4, 8, 1...
Foscam IP Video Camera webService dyndns.com DDNS Client Code Execution Vulnerability(CVE-2017-2856)
Summary An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating...
Disclosure: WordPress WPDB SQL Injection - Technical
Today, a significant SQL-Injection vulnerability was fixed in WordPress 4.8.3. Before reading further, if you haven’t updated yet stop right now and update. The foundations of this vulnerability was reported via Hacker-One on September 20th, 2017. This post will detail the technical vulnerability...
Ruby TclTkIp ip_cancel_eval Type Confusion Vulnerabilities(CVE-2016-2337)
DESCRIPTION Type Confusion exists in canceleval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution. TESTED VERSIONS Ruby 2.3.0 dev Ruby 2.2.2 Tcl/Tk8.6 or later PRODUCT URLs https://www.ruby-lang.org DETAILS...
Apple Image I/O API Tiled TIFF Remote Code Execution Vulnerability(CVE-2016-4631)
SUMMARY An exploitable heap based buffer overflow exists in the handling of TIFF images on Apple OS X and iOS operating systems. A crafted TIFF document can lead to a heap based buffer overflow resulting in remote code execution. This vulnerability can be triggered via malicious web page, MMS...
WebKit: JSC: Incorrect for-in optimization #2(CVE-2017-7117)
No description provided by source. The following PoC bypasses the fix for the https://www.seebug.org/vuldb/ssvid-96629. PoC: function f let o = ; for let i in xx: 0 for i of 0 printoi; f;...
Apple Safari uxss(CVE-2017-7089)
CVE-2017-7089 Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: A logic issue existed in the handling of the parent-tab. This issue was addressed with improved state management. Safari 10 Local SOP bypass html function Pewvar...
ansible-vault Yaml Load Code Execution Vulnerability
Summary An exploitable vulnerability exists in the yaml loading functionality of ansible-vault. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability. Tested Versions ansible-vault...
Aerospike Database Server Index Name Code Execution Vulnerability(CVE-2016-9052)
Summary An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow in the function assindexsimatchbyiname resulting in remote code execution. An attacker ca...
Moxa AWK-3131A Web Application Cross-Site Request Forgery Vulnerability(CVE-2016-8718)
Summary An exploitable Cross-Site Request Forgery vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted form can trick a client into making an unintentional request to the web server which will be treated as an...
Moxa AWK-3131A Web Application onekey Information Disclosure Vulnerability(CVE-2016-0241)
Summary An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Retrieving a series of URLs without authentication can reveal sensitive configuration and system information to an attacker. Tested Versions Moxa...
Foscam IP Video Camera CGIProxy.fcgi SMTP Test Password Parameter Configuration Command Injection Vulnerability(CVE-2017-2843)
Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...
Windows Kernel stack memory disclosure in win32k!NtGdiMakeFontDir(CVE-2017-8477)
We have discovered that the win32k!NtGdiMakeFontDir system call discloses large portions of uninitialized kernel stack memory to user-mode clients. The attached proof of concept code which is specific to Windows 7 32-bit works by first filling a large portion of the kernel stack with a controlled...
Windows Kernel stack memory disclosure in nt!NtQueryInformationProcess(CVE-2017-8476)
We have discovered that the nt!NtQueryInformationProcess system call called with the ProcessVmCounters information class discloses portions of uninitialized kernel stack memory to user-mode clients, due to output structure alignment holes. On our test Windows 10 32-bit workstation, an example...
WebKit: UXSS via CachedFrameBase::restore
This is similar to the case https://bugs.chromium.org/p/project-zero/issues/detail?id=1151. But this time, javascript handlers may be fired in FrameLoader::open. void FrameLoader::openCachedFrameBase& cachedFrame ... cleardocument, true, true, cachedFrame.isMainFrame; Click anywhere... function...
Chrome Universal XSS using an intercepted native function (CVE-2016-1672)
VULNERABILITY DETAILS The fix for the issue 546677 is insufficient to protect against overriding the internal extensions code -- it is still possible to take over the built-in extension system with a combination of getters and setters. This allows web content to gain access to native functions th...
OS Command Injection Vulnerability in ASG and CAS (CVE-2016-9091)
The Advanced Secure Gateway ASG and Content Analysis System CAS management consoles provide a web UI for appliance administrators to manage and monitor the respective appliance. Each management console provides limited functionality to administrators and does not provide them with access to the...
LastPass: domain regex doesn't handle data and other pseudo-url schemes
I previously found a design flaw in lastpass that affected the 4.x branch of lastpass issue 884. They confirmed the vulnerability, but explained that most of their users use an older branch from addons.mozilla.org. I took a look at the addons.mozilla.org version 3.3.2 as of this writing, and...
启明星辰网御&天清汗马安全集中管理系统MgmtCenter_login.action_username参数sql注入
No description provided by source...
Phpwind GET型CSRF任意代码执行 漏洞
来源链接：http://www.wooyun.org/bugs/wooyun-2016-01758150-tsina-1-93389-397232819ff9a47a7b7e80a40613cfe1 这个洞其实很有意思，最可惜的地方就是其触发位置在后台，否则它将是一个绝无仅有的好洞。 0x01 后台反序列化位置 首先纵览整个phpwindv9，反序列化的位置很多，但基本都是从数据库里取出的，很难完全控制序列化字符串。 最后，找到三处： 可恶的是，三处都在后台的Task模块下。Task模块是『任务中心』功能，只有能进入后台的用户才可以访问： 随便打开一个，...
Emlog 5.3.1 flash xss
No description provided by source...
Windows 权限提升漏洞 CVE-2015-6132
No description provided by source...
Apple iOS CFNetwork cookie改写漏洞
No description provided by source...
Android Stagefright Media Playback Engine 远程代码执行漏洞
No description provided by source. !/usr/bin/env python Joshua J. Drake @jduck of ZIMPERIUM zLabs Shout outs to our friends at Optiv formerly Accuvant Labs C Joshua J. Drake, ZIMPERIUM Inc, Mobile Threat Protection, 2015 www.zimperium.com Exploit for RCE Vulnerability CVE-2015-1538 1 Integer...
网康VPN设备6.3.1越权访问
网康vpn设备虽然设置了授权访问，但是大部分页面可以越权绕过访问。1，https://xx.xx.xx.x/vpnweb/bulletin.php?para=admin/index.php绕过认证直接访问后台认证，使用burp抓包，得到url地址!网康vpn设备设计缺陷，可以远程直接重启。直接访问vpn设备的地址https://xxx.xx.xx.xx//admin/devicestatus.php点击重启，直接可以重启设备！影响的型号为6.3.1版本...
cmstop媒体云SQL注入漏洞
简要描述： 媒体云真是方便，直接注册就建立一个网站了，但是如果云出了漏洞呢？ 详细说明： CmsTop 媒体云 作为媒体云时代的开创者，思拓合众颠覆了传统的软件采购和项目外包模式，与传媒集团建立战略合作伙伴关系，以互联网思维和云计算技术为基础整合集团、区域和行业内的媒体及政务新媒体资源，共同建设和运营媒体云。 想象是美好的，现实呢，现实是，媒体云后台管理存在sql注入漏洞 我们随便注册一个账号（http://www.cmstop.cn/），然后访问用户功能 http://site.cmstop.cn//member/index/index?state=enable...
某网店系统存在越权漏洞(任意用户信息修改)
简要描述： 某网店系统存在越权漏洞任意用户信息修改 详细说明： 账号 A id=375 账号 B id=376 越权修改账号a的信息 成功修改 demo演示站点呢 一样可以修改收货地址 账号A id=362 账号B id=363 img src="https://images.seebug.org/upload/201504/07000058fd624e353d682fc05a6b2efead0a6338.jpg" alt="2.jpg" width="600" onerror=...
TurboMail 6.0.0 /nicknamelogin.jsp 登录绕过漏洞
No description provided by source...
KingCms最新版目录遍历及任意文件读取漏洞（无需截断）
简要描述： KingCms最新版目录遍历及任意文件读取漏洞（无需截断） 详细说明： 朋友的公司想购买kingcms的授权，让我帮忙看下。发现kingcms很长一段时间没更新了，憋了一段时间放出了最新版的k92014-12-13更新，官网下下来学习一下。 在wooyun上看到了几个漏洞，如： WooYun: kingcms最新版sql注入漏洞 问题出在这里：/api/conn.php 先首需要说明的是，这里的目录遍历与文件读取并不是因为服务器配置不当等引起的，而是该cms的某些函数没过过滤+使用不当引起的。 0x00：先来看看如何目录遍历的。 无关代码 $get=$GET;...
某在线培训系统通用SQL注入漏洞
简要描述： 捡漏不易 详细说明： 捡漏一处： 该系统主要针对网上学习的。数据库里面包含有很多老师、学生的个人信息。 漏洞类型：SQL注入 危害度：高危 漏洞位置：WebOrg/UserRegist.aspx 参数：USERNAME 厂商：上海天柏信息科技有限公司 厂商网站：http://www.timber2005.com/ 漏洞证明： 关键字：inurl:webOrg 可自由构造 部分案例： http://webcourse.vixue.net/WebOrg/UserRegist.aspx http://www.gxkjks.com/WebOrg/UserRegist.aspx...
大汉网络JCMS任意文件下载
简要描述： 大汉网络文件遍历 详细说明： 漏洞Url： /jcms/m5e/module/voting/down.jsp?filename=a.txt&pathfile=/etc/passwd 下载文件： root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin...
TurboMail邮件系统伪造邮件漏洞,可实施邮件钓鱼
简要描述： TurboMail邮件系统存在邮件伪造漏洞，可实施邮件钓鱼攻击.. 详细说明： TurboMail邮件系统在发送邮件时没有对邮件协议的From字段进行有效验证，发件人可以伪造任意用户进行发送邮件，达到邮件欺骗攻击的目的，可以用来进行邮件钓鱼等。 TurboMail邮件系统下载链接：http://www.turbomail.org/download.html 测试环境：Win2003 + turbomailwin520.exe 漏洞证明： 本地安装Windows版本的TurboMail邮件系统...
新云cms建站系统存在ewebeditor上传和iis解析漏洞可批量getshell
简要描述： 详细说明： 新云cms建站系统存在ewebeditor上传和iis解析漏洞，可批量getshell. 利用ewebeditor上传漏洞可以新建一个1.asp的文件夹，再配合iis的解析漏洞就可以成功的拿到shell. 可通过谷歌获得大量的漏洞网站，关键字如下： inurl:Showservices.asp?id= inurl:showkbxx.asp?id= None...
万户OA某页面通用性SQL注入（又影响N个政府网和医疗机构）
简要描述： 其实我一直琢磨，之前发的那个，为什么有一部分不能注入，后来找了找，发现不能注入的都是oracle数据库，很好奇。。。然后……就发现了这个通用注入。。例子中，涉及淮北市卫生局，内蒙古海勃湾区市政府、怀远县政府等多家政府单位和医疗机构。在注入时貌似有些限制，凌晨1:45了，就不继续测试了，该睡觉了。。 详细说明： 万户OA协同管理系统，存在POST注入 问题链接：defaultroot/mobile/index.jsp 该登陆框，username处没有做过滤，导致了POST注入 详细看图吧。。。 漏洞证明：...
Microsoft XP SP3 - BthPan.sys Arbitrary Write Privilege Escalation
No description provided by source. """ Title: Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation Advisory ID: KL-001-2014-002 Publication Date: 2014-07-18 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt 1. Vulnerability Details Affected Vendor:...
DouPHP SQL注入一枚
简要描述： 注入 详细说明： 依然是getip的问题， guestbook.php:102行 if $rec == 'insert' / 跨站请求伪造CSRF的防御 / if $firewall-checktoken$POST'token' / html安全过滤器 / $POST = $firewall-doufilter$POST; $ip = $dou-getip; $addtime = time; $vcode = $check-iscaptcha$POST'vcode' ? strtoupper$POST'vcode' : ''; / 检查IP是否频繁留言 /...
DataLife Engine 9.7 (preview.php) PHP Code Injection Vulnerability
No description provided by source...
Sophos Web Protection Appliance - Multiple Vulnerabilities
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Sophos Web Protection Appliance Multiple Vulnerabilities 1. Advisory Information Title: Sophos Web Protection Appliance Multiple Vulnerabilities Advisory ID: CORE-2013-0809 Advisory URL:...
SAP Netweaver Message Server Multiple Vulnerabilities
No description provided by source. 1. Advisory Information Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities Date published: 2013-02-13 Date of last update:...
Microsoft Windows Tracing Registry Key ACL Privilege Escalation Vulnerability
No description provided by source. Source: http://www.securityfocus.com/bid/42269/info Microsoft Windows is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will result in the comple...
Litespeed Technologies Web Server Remote Poison null byte Exploit
No description provided by source. Litespeed Technologies Web Server Remote Poison null byte Zero-Day discovered and exploited by Kingcope in June 2010 google gives me over 9million hits Example exploit session: %nc 192.168.2.19 80 HEAD / HTTP/1.0 HTTP/1.0 200 OK Date: Sun, 13 Jun 2010 00:10:38 G...
ASX to MP3 Converter 3.1.2.1 - SEH Exploit (Multiple OS, DEP and ASLR Bypass)
No description provided by source. Exploit Title: ASX to MP3 Converter v3.1.2.1 SEH Exploit Multiple OS, DEP and ASLR Bypass Date: July 13, 2010 Author: Node Software Link: http://www.mini-stream.net/downloads/ASXtoMP3Converter.exe Version: Mini-Stream Software ASX to MP3 Converter...
Adobe Flash Player 11.3 Font Parsing Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
Squirrelcart <= 2.2.0 (cart_content.php) Remote Inclusion Vulnerability
No description provided by source. Title : Squirrelcart = 2.2.0 Remote File Inclusion URL : http://www.ldev.com/ google Dork : inurl:/squirrelcart/ Author : OLiBekaS greetz : Skulmatic, weleh, brokencode, bigmaster and all papmahackerlink crew Exploit :...
WonderWare SuiteLink 2.0 - Remote Denial of Service Exploit (meta)
No description provided by source. $Id: suitlink.rb $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
MetaCart E-Shop V-8 StrCatalog_NAME Parameter Remote SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13377/info An SQL injection vulnerability affects MetaCart e-Shop V-8. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in SQL queries. An attacker may explo...
Daum Game 1.1.0.5 - ActiveX (IconCreate Method) Stack Buffer Overflow
No description provided by source. !-- Trustwave SpiderLabs Security Advisory TWSL2014-002: Buffer Overflow Vulnerability in DaumGame ActiveX Published: 01/07/2014 Version: 1.1 Vendor: Daum daum.net Product: Daum Game ActiveX Version affected: 1.1.0.5, 1.1.0.4 Product description: DaumGame Active...