56796 matches found
FreeRDP Rdp Client License Read Challenge Packet Denial of Service Vulnerability(CVE-2017-2839)
Summary An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use ma...
WebKit: heap-buffer-overflow in WebCore::RenderSearchField::addSearchResult(CVE-2017-7049)
There is a heap buffer overflow in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function go i.value = "1"; i.type = "search"; f.submit;...
Foscam IP Video Camera Command Injection Vulnerability(CVE-2017-2847)
Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configurati...
Windows Kernel stack memory disclosure in nt!NtQueryInformationProcess(CVE-2017-8476)
We have discovered that the nt!NtQueryInformationProcess system call called with the ProcessVmCounters information class discloses portions of uninitialized kernel stack memory to user-mode clients, due to output structure alignment holes. On our test Windows 10 32-bit workstation, an example...
Joomla! Core XSS Vulnerability(CVE-2017-7985)
Joomla! is one of the world's most popular content management system CMS solutions. It enables users to build custom Web sites and powerful online applications. More than 3 percent of Web sites are running Joomla!, and it accounts for more than 9 percent of CMS market share. As of November 2016,...
Heap Overflow Vulnerability in Citrix NetScaler Gateway (CVE-2017-7219)
After presenting my findings on the Swisscom router at the CybSecConference last year, I started looking for a new product to analyze. I quickly found that it’s possible to download virtual “demo” appliances of Citrix products, so I went on to download a Netscaler VPX, which at the time was at...
Netgear R6400/R7000/R8000 - Command Injection
Author:p0wd3r,dawuknow Chong Yu 404 security lab Data: 2016-12-13 Update on 12/16 : correction of the original text in a error, thanks to @k0pwn it. 2016 12 month 7 days, foreign websites exploit-db on broke one on the NETGEAR R7000 router command injection vulnerability. Time, each passerby hors...
Schneider Electric Magelis HMI Advanced Panel denial of service vulnerability (PanelShock)
IMPROPER IMPLEMENTATION OF HTTP GET REQUEST CVE-2016-8367 / SVE-82003201 The timeout value for closing an HTTP client's requests in the Web Gate service is too long and allows a malicious attacker to open multiple connections to the targeted web server and keep them open for as long as possible b...
正方教务系统 jwggck.aspx 参数fbsj SQL注入漏洞
No description provided by source...
SAP HANA hdbindexserver - Memory corruption
No description provided by source...
用友致远A6协同系统messageViewer.jsp三处SQL注入漏洞
No description provided by source...
jcms /interface/user/out_userinfo.jsp 文件 xmlinfo 参数敏感信息泄漏漏洞
No description provided by source...
discuz 7.2 网站路径泄露漏洞
No description provided by source...
PageAdmin v3.0 /e/database/v3.mdb 数据库泄漏
PageAdmin CMS V3.0版，默认数据库地址“/e/database/v3.mdb“，默认后台地址：“/e/master/login.aspx”，由于数据库地址未做限制，导致可以下载。通过逆向管理员MD5加密算法获得md5密文，并通过md5密文可以破解管理员密码。发现非常规MD5加密，于是使用ILSPY逆向源代码，查看加密方式public string GetMd5string s MD5 mD = new MD5CryptoServiceProvider; Encoding encoding = Encoding.GetEncoding"UTF-8"; string s2 =...
Multiple EMC RSA Products ESA-2015-081 Multiple Security Vulnerabilities
受影响的产品： RSA BSAFE Micro Edition Suite MES all 4.1.x versions prior to 4.1.3 RSA BSAFE Micro Edition Suite MES all 4.0.x versions prior to 4.0.8 RSA BSAFE Crypto-C Micro Edition Crypto-C ME 4.1 RSA BSAFE Crypto-C Micro Edition Crypto-C ME all versions prior to 4.0.4 RSA BSAFE Crypto-J all versions...
用友致远A6协同办公系统存在一处DBA权限SQL注入漏洞
简要描述： RT 详细说明： 漏洞位于：/yyoa/checkWaitdo.jsp文件中 % uName = request.getParameter"userID";//接收参数 // System.out.printlnuName; if uName != "null" Connection con = ConnectionPoolBean.getConnection; //System.out.println"手动检查的结果中有问题的记录:"; boolean l = false; try uID = XiaoxsDbHelper.getIntcon, "select id fro...
53kf大量Memcached未授权访问
简要描述： 53kf大量memcached 未授权访问，泄露敏感信息 详细说明： 100多个地址，大量未授权访问，泄露敏感信息 漏洞证明： passport.53kf.com vip.53kf.com blog.53kf.com cx.53kf.com s.53kf.com v6.53kf.com zz.53kf.com 1.53kf.com 8.53kf.com t7.53kf.com t6.53kf.com t3.53kf.com t2.53kf.com t5.53kf.com t4.53kf.com t9.53kf.com t8.53kf.com t1.53kf.com...
某学校综合管理系统通用SQL注入漏洞
简要描述： 某学校综合管理系统通用SQL注入漏洞 详细说明： 系统名称：学校综合管理平台 厂商：上海安脉计算机科技有限公司 关键字：版权所有：上海安脉计算机科技有限公司 系统架构：ASPX+MSSQL 漏洞文件：OA/usecar/carStat.aspx 注入参数：startdate 枚举部分案例： http://anmai.net:81/OA/usecar/carStat.aspx http://jwxx.am.jsedu.sh.cn/ANMAI/OA/usecar/carStat.aspx http://bssyxxgl.eicbs.com/OA/usecar/carStat.as...
某在线培训系统通用SQL注入漏洞
简要描述： 捡漏不易 详细说明： 捡漏一处： 该系统主要针对网上学习的。数据库里面包含有很多老师、学生的个人信息。 漏洞类型：SQL注入 危害度：高危 漏洞位置：WebOrg/UserRegist.aspx 参数：USERNAME 厂商：上海天柏信息科技有限公司 厂商网站：http://www.timber2005.com/ 漏洞证明： 关键字：inurl:webOrg 可自由构造 部分案例： http://webcourse.vixue.net/WebOrg/UserRegist.aspx http://www.gxkjks.com/WebOrg/UserRegist.aspx...
嘉缘人才系统SQL注入漏洞
简要描述： RT 详细说明： 在common/comment.php中 requiredirnameFILE.'/../config.inc.php'; !isset$db&&$db=connectdb; requireonceFRROOT.'/inc/paylog.inc.php'; if!$cfg'comment'=='1'echo "alert'本站未开启评论功能！';window.close;";exit; $submit=isset$POST'Submit'?$POST'Submit':''; if$submit if$cfg'comment' if$anonymous...
MS14-060 Microsoft Windows OLE Package Manager Code Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::FILEFORMAT include...
Drupal Core <= 7.32 - SQL Injection (#2)
No description provided by source. !/usr/bin/python Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 Inspired by yukyuk's P.o.C https://www.reddit.com/user/fyukyuk Tested on Drupal 7.31 with BackBox 3.x This material is intended for educational purposes only and t...
pageadmin ViewState缺陷导致sql注入
简要描述： 此处省略50万条网站信息 1、.............. 2、.............. .............. 50.、http://www.pageadmin.net 影响页面甚多，还望厂商以及各站长能逐一检查 听说咱们出新功能了 乌云新增刷乌云币功能 连接http://zone.wooyun.org/content/16138 特地来试试好不好使 另外所用到的工具同样在“测试代码”中提供下载地址 详细说明： 具体分析： 1、查找一个动态页面 例如： /e/aspx/dataselect.aspx 参数：...
espcms sql注入漏洞
简要描述： 刚刚看了 espcms的官网 发现2014-09-16 16:58:17更新了,下了份看下，发现这上面的几个漏洞完全没修复啊..上次提交了个漏洞只给了5rank..敢给多点么.这次和上次那个相似,怕你们只修复一处,这处也提交下。 详细说明： 在order.php inordersave中 365-367行附近 foreach $did as $key = $value $value = intval$value; $oprice$key = floatval$oprice$key; $bprice$key = floatval$bprice$key;...
F5 BIG-IP SQL注入漏洞
No description provided by source. SEC Consult Vulnerability Lab Security Advisory 20130122-1 ======================================================================= title: SQL Injection product: F5 BIG-IP vulnerable version: =11.2.0 fixed version: 11.2.0 HF3 11.2.1 HF3 CVE number: CVE-2012-3000...
Tandberg E, EX and C Series Endpoints Default Credentials for Root Account
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Default Credentials for Root Account on Tandberg E, EX and C Series Endpoints Advisory ID: cisco-sa-20110202-tandberg Revision 1.0 For Public Release 2011 February 2 1600 UTC GMT...
DMXReady PayPal Store Manager <= 1.1 Contents Change Vulnerability
No description provided by source. Title : DMXReady PayPal Store Manager = 1.1 Remote Contents Change Vulnerability Author : ajann from Turkey Contact : : S.Page : http://www.dmxready.com $$ : 129.97 $ Dork : inurl:incpaypalstoremanager.asp DorkEx :...
Comcast DOCSIS 3.0 Business Gateways Multiple Vulnerabilities
No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2011-002: Vulnerabilities in Comcast DOCSIS 3.0 Business Gateways D3G-CCR https://www.trustwave.com/spiderlabs/advisories/TWSL2011-002.txt Published: 2011-02-04 Version: 1.0 Vendor: Comcast http://comcast.com Product:...
Joomla Component JContentSubscription 1.5.8 - Multiple RFI Vulns
No description provided by source. JContentSubscription Joomla Component 1.5.8 Multiply Remote File Include Vulnerability Component : comjcs version 1.5.8 - payable component Dicovered by : NoGe Contact : [email protected]...
FOSCAM IP-Cameras Improper Access Restrictions
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...
Washington University wu-ftpd 2.5 .0 message Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/726/info There is a buffer overflow in wu-ftpd message file expansions which may be remotely exploitable. In situations where the message file can be written to in some way remotely by regular or anonymous users, this may...
Manhali 1.8 - Local File Inclusion Vulnerability
No description provided by source. Exploit Title: Manhali v1.8 Local File Inclusion Vulnerability Date: 20/09/2012 Author: L0n3ly-H34rT Contact: [email protected] My Site: http://se3c.blogspot.com/ Vendor Link: http://www.manhali.com/ Software Link:...
Oracle Application Framework Diagnostic Mode Bypass Vulnerability
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2012-023: Oracle Application Framework Diagnostic Mode Bypass Vulnerability Published: 1/15/2013 Version: 1.0 Vendor: Oracle www.oracle.com Product: Oracle Application Framework Version affected: 11.5.10.2, 12.0.6, 12.1...
Clicky Web Pseudo-frames 1.0 - Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4756/info Pseudo-frames is an application written in PHP and is maintained by Clicky Web. Pseudo-frames permit remote file including. As a result, a remote attacker may include an arbitrary file located on a remote host. ...
php blue dragon cms 3.0.0 - Remote File Inclusion Vulnerability
No description provided by source. // Exploit Name: Php Blue Dragon CMS 3.0.0 Remote File Inclusion Vulnerability //Script Homepage: http://phpbluedragon.pl/ // Autor: Kacper [email protected] // Autor Homepage: devilteam.eu | kacper.bblog.pl //Pozdrawiam wszystkich ludzi z DEVIL TEAM, Zaprasza...
Oracle Outside In MDB - File Parsing Stack Based Buffer Overflow PoC
No description provided by source. !/usr/bin/python Exploit Title: Oracle Outside In MDB File Parsing Stack Based Buffer Overflow PoC Date: 16th January 2014 PoC Author: Citadelo Vendor Homepage: http://www.oracle.com Software Link: http://www.oracle.com/us/technologies/embedded/025613.htm Versio...
vsftpd FTP Server 2.0.5 - 'deny_file' Option Remote Denial of Service Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/29322/info The 'vsftpd' FTP server is prone to a remote denial-of-service vulnerability because it fails to free allocated memory. Successfully exploiting this issue allows remote attackers to crash the affected...
SharePoint 2007/2010 and DotNetNuke < 6 - File disclosure via XEE
No description provided by source. Exploit Title: File disclosure via XEE in SharePoint and DotNetNuke Date: September 15, 2011 Author: Nicolas Gregoire Version: SharePoint 2007 / 2010, DotNetNuke 6 CVE : CVE-2011-1892 poc filename: xee.xml !DOCTYPE doc !ENTITY boom SYSTEM...
TechSmith Snagit 10 (Build 788) DLL Hijacking Exploit (dwmapi.dll)
No description provided by source. / TechSmith Snagit 10 Build 788 Dll Hijacking Exploit By: Encrypt3d.M!nd Date: 25\8\2010 Download: http://www.techsmith.com/download/snagittrial.asp Details: Compile the following code and rename it to dwmapi.dl and place file with one of the affected types in t...
Sun Java JRE AWT setDiffICM Buffer Overflow
No description provided by source. $Id: javasetdifficmbof.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms ...
Franklin Fueling TS-550 evo 2.0.0.6833 - Multiple Vulnerabilities
No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2014-001: Multiple Vulnerabilities in Franklin Fueling's TS-550 evo Published: 01/03/2014 Version: 1.0 Vendor: Franklin Fueling Systems http://www.franklinfueling.com/ Product: TS-550 evo device Version affected:...
DirectShow Arbitrary Memory Overwrite Vulnerability (MS13-056)
No description provided by source. Introduction: The Microsoft DirectShow application programming interface API is a media-streaming architecture for Microsoft Windows. Using DirectShow, your applications can perform high-quality video and audio playback or capture. Overview: DirectShow in...
Nvidia (nvsvc) Display Driver Service - Local Privilege Escalation
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex' require 'msf/core/post/common' require 'msf/core/post/windows/priv' require...
vKios <= 2.0.0 (products.php cat) Remote SQL Injection Exploit
No description provided by source. !/usr/bin/perl Indonesian Newhack Security Advisory ------------------------------------ vKios = 2.0.0 products.php cat Remote SQL Injection Exploit Waktu : Feb 8 2008 10:00PM Software : vKios Versi : = 2.0.0 Vendor : http://www.vkios.com/...
Parallels H-Sphere 3.0/3.1 'login.php' Multiple Cross Site Scripting Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/31256/info H-Sphere is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the...
Fake Identd 0.9/1.x Client Query Remote Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5351/info Fake Identd is an open source Ident server designed to return the same information to all incoming requests. It is implemented by Tomi Ollila, and available for Linux and a number of other Unix based operating...
odlican.net cms 1.5 - Remote File Upload Vulnerability
漏洞分析 upload.php php if isset$POST'pokreni' $targetpath = "files/"; $targetpath = $targetpath . basename $FILES'uploadedfile''name'; ifmoveuploadedfile$FILES'uploadedfile''tmpname', $targetpath echo "Datoteka ". basename $FILES'uploadedfile''name'. " je snimljena na server"; else echo "Došlo je...
PhpLinkExchange 1.02 - XSS/Upload Vulerability
No description provided by source. PhpLinkExchange v1.02 - XSS/Upload Vulerability Discovered by : Stink' Date : 2009-12-16 Dork : PhpLinkExchange v1.02 Website Publisher : http://www.idevspot.com/PhpLinkExchange.php -- XSS in URL -- http://server/links/PhpLinkExchange/index.php?page=home&catid=X...
INSTEON Hub 2242-222 - Lack of Web and API Authentication
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2013-023: Lack of Web and API Authentication Vulnerability in INSTEON Hub Published: 8/01/13 Version: 1.0 Vendor: INSTEON http://www.INSTEON.com/ Product: Hub Version affected: 2242-222 model discontinued Product...
CMS Balitbang 3.3 Arbitary File Upload Vulnerability
No description provided by source. =================================================================== CMS Balitbang v.3.3 Arbitary file upload vulnerability =================================================================== Software: CMS Balitbang Vendor: www.kajianwebsite.org Vuln Type: Arbita...