Microsoft Windows事件系统数组索引验证权限提升漏洞（MS08-049）

BUGTRAQ ID: 30586 CVECAN ID: CVE-2008-1456 Microsoft Windows是微软发布的非常流行的操作系统。 Microsoft Windows事件系统在调用函数指针数组时没有正确地验证索引范围，导致远程权限提升漏洞。成功利用此漏洞的攻击者可以完全控制受影响的系统。攻击者随后可安装程序；查看、更改或删除数据；或者创建拥有完全管理权限的新帐户。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Vista SP1 Microsoft Windows Vista...

QEMU安全绕过漏洞

BUGTRAQ ID: 30604 CVE ID：CVE-2008-1945 CNCVE ID：CNCVE-20081945 QEMU是一款面向完整PC系统的开源仿真器。 QEMU不正确限制对部分功能的访问，本地攻击者可以利用漏洞绕过安全限制，执行未授权攻击。 QEMU没有正确处理针对可移动媒介的更改，允许客户操作系统用户通过使用diskformat读取宿主OS上的任意文件。通过在-usbdevice选项的参数可修改磁盘映像头字段数据而识别为不同的格式来读取文件。 MandrakeSoft Linux Mandrake 2008.1 x8664 MandrakeSoft Linux...

Camera Life 'sitemap.xml.php' SQL注入漏洞

BUGTRAQ ID: 30369 CNCAN ID：CNCAN-2008072802 Camera Life是一款基于PHP的WEB应用程序。 Camera Life不正确过滤用户提交的WEB数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息。 问题是'sitemap.xml.php'脚本对用户提交给'id'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或数据库 Camera Life Camera Life 2.6.2 目前没有解决方案提供： http://fdcl.sourceforge.net/...

Firefox CSSValue数组数据结构远程代码执行漏洞

BUGTRAQ ID: 29802 CVECAN ID: CVE-2008-2785 Firefox是一款流行的开源WEB浏览器。 Mozilla的内部CSSValue数组数据结构对CSS对象的引用计数器使用了过小的变量， 如果攻击者对常见的CSS对象创建了大量引用的话，当浏览器试图释放仍在使用的CSS对象时计数器会被溢出，导致拒绝服务或在用户机器上执行任意指令。 Mozilla Firefox 3.0.1 Mozilla ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mozilla.org/ RedHat ------...

Linux Kernel 2.6.x chown() Group Ownership Alteration Exploit

No description provided by source. / $Id: raptorchown.c,v 1.1 2004/12/04 14:44:38 raptor Exp $ raptorchown.c - syschown missing DAC controls on Linux Copyright c 2004 Marco Ivaldi [email protected] Unknown vulnerability in Linux kernel 2.x may allow local users to modify the group ID of file...

VMware HGFS文件系统堆溢出漏洞

CVECAN ID: CVE-2008-2098 VMWare是一款虚拟PC软件，允许在一台机器上同时运行两个或多个Windows、DOS、LINUX系统。 VMware的主机访客文件系统（HGFS）共享文件夹功能允许用户在Guest操作系统与承载该系统的非虚拟化主机操作系统之间传输数据。VMware的HGFS功能存在堆溢出漏洞，如果VMware系统共享了至少一个文件夹的话（非默认），就可能触发这个溢出，非特权的Guest进程可以在主机上以vmx进程的权限执行任意代码。 VMWare VMWare Workstation 6.x VMWare ACE 2.x VMWare Player...

Vortex CMS (index.php pageid) Blind SQL Injection Exploit

No description provided by source. ?php iniset"maxexecutiontime",0; printr' Vortex CMS - Blind SQL Injection Exploit Vulnerability discovered by: LidlosesAuge Exploit coded by: LidlosesAuge Greetz to: -=Player=- , Suicide, g4ms3, enco GPM, Free-Hack &n...

SugarCRM Community Edition RSS模块信息泄露漏洞

BUGTRAQ ID: 28981 SugarCRM是开源的客户关系管理系统。 SugarCRM没有正确地验证对RSS模块的输入便用于在cache/feeds目录中生成缓存文件，远程攻击者可能利用此漏洞在系统上创建文件。 RSS模块允许SugarCRM用户向个人RSS列表添加RSS源，但没有正确地过滤URL变量值，因此用户可以输入任意URI值。在这种情况下，SugarCRM可能无法在列表中显示新的RSS源，但应用程序会以所输入URL的md5哈希为文件名在cache/feeds目录中创建本地文件。 SugarCRM SugarCRM Community Edition 5.0 SugarC...

Titan FTP Server USER/PASS命令远程堆溢出漏洞

BUGTRAQ ID: 27568 CVECAN ID: CVE-2008-0702,CVE-2008-0725 Titan FTP Server是一款FTP服务程序。 Titan FTP Server处理超长命令请求时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 如果向Titan FTP Server的FTP服务和管理服务提交了超长的USER或PASS命令的话，就可能触发堆溢出，导致执行任意指令。 South River Technologies Titan FTP Server 3.21 临时解决方法：...

phpMyAdmin DB_Create.PHP多个输入验证漏洞

BUGTRAQ ID: 26512 CVE ID:CVE-2007-5976 CVE-2007-5977 CNCVE ID:CNCVE-20075977 phpMyAdmin是一款基于WEB的MySQL管理程序。 phpMyAdmin DBCreate.PHP存在多个输入验证问题，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 问题是由于DBCreate.PHP对参数缺少充分过滤，提交恶意脚本代码作为参数数据，并诱使用户解析，可导致恶意脚本代码在目标用户浏览器上执行。 RedHat Fedora 7 0 phpMyAdmin phpMyAdmin 2.11.1 phpMyAdmi...

Public Media Manager newstopic_inc.php远程文件包含漏洞

Public Media Manager是一款基于PHP的WEB应用程序。 Public Media Manager不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是由于'newstopicinc.php'脚本对用户提交的'indir'参数缺少过滤，指定远程服务器上的任意文件作为包含对象，可导致以以WEB权限执行任意命令。 Public Media Manager Public Media Manager 1.3 目前没有解决方案提供： http://pmm-cms.sourceforge.net/...

Mac OS X <= 10.4.8 pppd Plugin Loading Privilege Escalation Exploit

No description provided by source. Mac OS X = 10.4.8 pppd Plugin Loading Privilege Escalation Exploit http://www.milw0rm.com/sploits/05252007-osxpppd.tar sebug.net...

cpCommerce <= 1.1.0 (category.php id_category) SQL Injection Exploit

No description provided by source. ?/ Exploit Name: cpCommerce = 1.1.0 category.php idcategory Remote SQL Injection Exploit Autor: Kacper Contact: [email protected] Homepage: http://www.rahim.webd.pl/ Irc: irc.milw0rm.com:6667 devilteam Pozdro dla wszystkich z kanalu IRC oraz forum DEVIL TEAM...

SunLight CMS Root参数多个远程文件包含漏洞

SunLight CMS是一款基于PHP的WEB应用程序。 SunLight CMS不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是多个脚本对用户提交的'root'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 SunLight CMS 5.3 目前没有解决方案提供： http://sunlight.profitux.cz/ http://www.example.com/path/modules/startup.php?root=Sh3LL Script...

BBSXP 论坛程序存在文件上传漏洞

文件保存类型是通过FileMIME判断FileMIME="image/pjpeg" 也就是说上传类型要是图片 然后第一段代码 if FileExt="asa" or FileExt="asp" or FileExt="cdx" or FileExt="cer" then error2"对不起，管理员设定本论坛不允许上传 "&FileExt&" 格式的文件" 的意思是：出错时候检查后缀.如果后缀是asa或者asp或者cdx或者cer的时候他就会提示错误。然后FileExt=文件后缀...

Fully Modded PHPBB2 PHPBB_Root_Path远程文件包含漏洞

Fully Modded PHPBB2是一款基于PHP的WEB应用程序。 Fully Modded PHPBB2不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是WEB脚本对用户提交的'PHPBBRootPath'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Fully Modded phpBB2 目前没有解决方案提供： http://phpbbfm.net/support/indexfm.php http://www.sebug.net/show-exp-364.html...

OpenSurveyPilot Group.Inc.PHP远程文件包含漏洞

OpenSurveyPilot是一款基于PHP的WEB应用程序。 OpenSurveyPilot不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Group.Inc.PHP'脚本对用户提交的'cfgPathToProjectAdmin'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 OpenSurveyPilot 1.2.1 目前没有解决方案提供： http://sourceforge.net/projects/osp/...

Wordpress 2.1.2 (xmlrpc) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w Wordpress 2.1.2 SQL Injection POC Credits: [email protected] Thanks to ferruh [email protected] improving my exploitation skills website:www.notsosecure.com Wordpress version 2.1.2 is vulnerable to sql injection. This POC works when...

Active Link Engine (default.asp catid) Remote SQL Injection Vulnerability

No description provided by source. Title : Active Link Engine Remote SQL Injection Vulnerability Author : CyberGhost My Web Site : http://aspspider.org/cgsecurity Demo Page : http://www.activewebsoftwares.com/demoactivelinkengine Script Page :...

Hotmail and Windows Live Mail XSS Vulnerabilities

Hotmail's filter identifies "expression" syntax in a CSS attribute. According to Hasegawa Yosuke's posthttp://archive.openmya.devnull.jp/2006.08/msg00369.html, in some character encodingse.g. GB2312, we can substitute some special double-byte chars for the corresponding chars in "expression"...

CA eTrust Security Command Center and eTrust Audit 存在多个漏洞

CA eTrust Security Command Center eSCC和eTrust Audit是CA产品安全命令执行和审核程序。 CA eTrust Security Command Center eSCC和eTrust Audit存在多个安全问题，远程攻击者可以利用漏洞获得敏感信息，执行任意文件删除或者重播攻击。 第一个问题是允许攻击者发现在windows平台上的web服务器路径信息，此漏洞影响eTrust Security Command Center Server 1.0, r8, r8 SP1 CR1, 和r8 SP1 CR2版本。...

GNU Tar GNUTYPE_NAMES远程目录遍历漏洞

GNU tar可创建和解压tar文档，并进行各种存档文件管理。 GNU tar在处理特定的记录时未能正确处理可能的符号链接，远程攻击者可能利用此漏洞在用户机器的任意位置创建文件。 tar的extract.c文件中的extractarchive函数和mangle.c文件中的extractmangle函数会处理包含有符号链接的GNUTYPENAMES记录类型。如果用户受骗打开了特制的tar文件的话，就会导致覆盖任意文件。 GNU tar 1.16 GNU tar 1.15.1 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

IrayoBlog 0.2.4 (inc/irayofuncs.php) Remote File Include Vulnerability

No description provided by source. WwW.Deltahacking.NeT Priv8 Site WwW.Deltahacking.Ir Public Site Portal Name :irayoblog-alpha-0.2.4 Class = Remote File Inclusion ; Download =http://ovh.dl.sourceforge.net/sourceforge/irayoblog/irayoblog-alpha-0.2.4.tar.gz Found by = Dr.Pantagon...

Omni-NFS Server 5.2 (nfsd.exe) Remote Stack Overflow Exploit (meta)

No description provided by source. vdxlink.pm The exploit is a part of VulnDisco Pack - use only under the license agreement specified in LICENSE.txt in your VulnDisco distribution VULNDISCO LICENSE Purchaser buys VulnDisco Pack "the Pack" and receives the right to use it under the terms of the...

Microsoft Outlook Web Access 'owalogon.asp' URL重定向漏洞

Microsoft Exchange Server是一款企业级的邮件服务程序。 Microsoft Outlook Web Access在处理URL时存在问题，远程攻击者可以利用这个漏洞重定向任意URL。 通过构建特殊URL，攻击者可以使用户重定向到任意URL，攻击者利用这个漏洞可以诱使用户访问某个页面，并可能记录密码并发送，或者下载任意文件等。 Microsoft Outlook 2003 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.microsoft.com/technet/security/ Donnie...

Linux Kernel ZLib无效内存访问本地拒绝服务漏洞

BUGTRAQ ID: 14719 CVECAN ID: CAN-2005-2458 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的zlib例程的inflate.c中存在漏洞。如果用户打开了特制的压缩文件的话，就可能导致kernel崩溃。 Linux kernel 2.6.12.5 Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： Linux linux-2.6.12.5.tar.gz...

MS Windows (SMB) Transaction Response Handling Exploit (MS05-011)

漏洞描述：Windows SMB客户端在处理SMB响应时存在一个缓冲区溢出漏洞。恶意的SMB服务器可以利用这个漏洞在连接该服务器的SMB客户端主机上执行任意命令。MRXSMB.SYS驱动负责执行SMB客户端操作以及处理SMB服务器返回的响应。一些重要的Windows文件共享操作以及所有的RPC-over-named-pipes操作使用SMB命令Trans25h和Trans232h。一个恶意的SMB服务器通过发送特殊的Transaction响应数据可能导致一个缓冲区溢出漏洞。溢出可能发生在任何这个数据被处理的地方，例如MRXSMB.SYS或其他客户端代码中。例如，如果Trans2...

Apache OFBiz RCE漏洞（CVE-2021-26295）

...

New transferFlaw Bug Used For Possible Scam Token Listed In A Top Exchange(CVE-2018-10468)

Our automated scanning system at PeckShield discovered a new vulnerability named transferFlaw CVE-2018–10468. This particular vulnerability affects a publicly traded ERC20 token listed in a top exchange. Different from batchOverflow 1 and proxyOverflow 2 we identified before, this vulnerability...

Hacking LIFX Smart LED Light bulbs to steal WiFi Passwords

Context Information Security firm has discovered a security vulnerability in LIFX smart LED light bulbs that can be remotely controlled by mobile devices. Researchers at Context Information Security have discovered a security flaw in a WiFi enabled, smart LED light LIFX bulb that can be remotely...

D-Link DSL-6850U Multiple Vulnerabilities

Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in D-Link DSL-6850U versions BZ1.00.01 – BZ1.00.09. D-Link DSL-6850U is a router “manufactured by D-Link for Bezeq in Israel” The vulnerabilities found are: Default Credentials Remote Command Execution Credit An...

vBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion(CVE-2017-17672)

Vulnerability Summary The following advisory describes a unauthenticated deserialization vulnerability that leads to arbitrary delete files and, under certain circumstances, code execution found in vBulletin version 5. vBulletin, also known as vB, is “a widespread proprietary Internet forum...

Foscam IP Video Camera webService oray.com DDNS Client Code Execution Vulnerability(CVE-2017-2854)

Summary An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating...

Circle with Disney Apid Use-Between-Reallocs Information Disclosure Vulnerability(CVE-2017-12083)

Summary An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivit...

Simple DirectMedia Layer Create RGB Surface Code Execution Vulnerability(CVE-2017-2888)

Summary An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provid...

Apache OpenOffice DOC ImportOldFormatStyles Code Execution Vulnerability(CVE-2017-12608)

Summary An exploitable out-of-bounds write vulnerability exists in the WW8RStyle::ImportOldFormatStyles functionality of Apache OpenOffice 4.1.3. A specially crafted doc file can cause a out-of-bounds write resulting in arbitrary code execution. An attacker can send/provide malicious doc file to...

Ruby WIN32OLE ole_invoke and ole_query_interface Type Confusion Vulnerabilities(CVE-2016-2336)

DESCRIPTION Type Confusion exists in two methods of Ruby's WIN32OLE class, oleinvoke and olequeryinterface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution. TESTED VERSIONS Ruby 2.3.0 dev Ruby 2.2.2 PRODUCT URLs https://www.ruby-lang.or...

FreeImage Library XMP Image Handling Code Execution Vulnerability(CVE-2016-5684)

Summary An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library. A specially crafted XMP file can cause an arbitrary memory overwrite resulting in code execution. An attacker can provide a malicious image to trigger this...

ansible-vault Yaml Load Code Execution Vulnerability

Summary An exploitable vulnerability exists in the yaml loading functionality of ansible-vault. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability. Tested Versions ansible-vault...

Libbpg BGP image decoding Code Execution Vulnerability(CVE-2016-8710)

Summary An exploitable heap write out of bounds vulnerability exists in the decoding of BPG images in libbpg library. A crafted BPG image decoded by libbpg can cause an integer underflow vulnerability causing an out of bounds heap write leading to remote code execution. This vulnerability can be...

Moxa AWK-3131A Web Application onekey Information Disclosure Vulnerability(CVE-2016-0241)

Summary An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Retrieving a series of URLs without authentication can reveal sensitive configuration and system information to an attacker. Tested Versions Moxa...

Moxa AWK-3131A Web Application systemlog.log Information Disclosure Vulnerability(CVE-2016-8725)

Summary An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A wireless access point running firmware 1.1. Retrieving a specific URL without authentication can reveal sensitive information to an attacker. Tested Versions Moxa AWK-3131...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Password Parameter Configuration Command Injection Vulnerability(CVE-2017-2843)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...

Gdk-Pixbuf TIFF tiff_image_parse Code Execution Vulnerability(CVE-2017-2870)

Summary An exploitable integer overflow vulnerability exists in the tiffimageparse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this...

Windows Kernel stack memory disclosure in nt!NtQueryInformationProcess(CVE-2017-8476)

We have discovered that the nt!NtQueryInformationProcess system call called with the ProcessVmCounters information class discloses portions of uninitialized kernel stack memory to user-mode clients, due to output structure alignment holes. On our test Windows 10 32-bit workstation, an example...

Windows Kernel stack memory disclosure in win32k!NtGdiMakeFontDir(CVE-2017-8477)

We have discovered that the win32k!NtGdiMakeFontDir system call discloses large portions of uninitialized kernel stack memory to user-mode clients. The attached proof of concept code which is specific to Windows 7 32-bit works by first filling a large portion of the kernel stack with a controlled...

Windows Kernel stack memory disclosure in nt!NtQueryInformationTransaction(CVE-2017-8480)

We have discovered that the nt!NtQueryInformationTransaction system call called with the 1 information class discloses portions of uninitialized kernel stack memory to user-mode clients, on Windows 7 to Windows 10. The specific name of the 1 information class or the layout of the corresponding...

Zabbix Proxy Server SQL Database Write Vulnerability (CVE-2017-2825)

Official patch earlier to fix the vulnerabilities: the Zabbix code execution vulnerability DETAILS One of the Trapper requests made by the Zabbix proxy is the ìproxy configî request, which allows a proxy to request its own proxy configuration from the Zabbix Server or any other Zabbix Proxyís...

OS Command Injection Vulnerability in ASG and CAS (CVE-2016-9091)

The Advanced Secure Gateway ASG and Content Analysis System CAS management consoles provide a web UI for appliance administrators to manage and monitor the respective appliance. Each management console provides limited functionality to administrators and does not provide them with access to the...

Netgear R6400/R7000/R8000 - Command Injection

Author:p0wd3r,dawuknow Chong Yu 404 security lab Data: 2016-12-13 Update on 12/16 : correction of the original text in a error, thanks to @k0pwn it. 2016 12 month 7 days, foreign websites exploit-db on broke one on the NETGEAR R7000 router command injection vulnerability. Time, each passerby hors...