56796 matches found
GNU Tar GNUTYPE_NAMES远程目录遍历漏洞
GNU tar可创建和解压tar文档，并进行各种存档文件管理。 GNU tar在处理特定的记录时未能正确处理可能的符号链接，远程攻击者可能利用此漏洞在用户机器的任意位置创建文件。 tar的extract.c文件中的extractarchive函数和mangle.c文件中的extractmangle函数会处理包含有符号链接的GNUTYPENAMES记录类型。如果用户受骗打开了特制的tar文件的话，就会导致覆盖任意文件。 GNU tar 1.16 GNU tar 1.15.1 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
IrayoBlog 0.2.4 (inc/irayofuncs.php) Remote File Include Vulnerability
No description provided by source. WwW.Deltahacking.NeT Priv8 Site WwW.Deltahacking.Ir Public Site Portal Name :irayoblog-alpha-0.2.4 Class = Remote File Inclusion ; Download =http://ovh.dl.sourceforge.net/sourceforge/irayoblog/irayoblog-alpha-0.2.4.tar.gz Found by = Dr.Pantagon...
Omni-NFS Server 5.2 (nfsd.exe) Remote Stack Overflow Exploit (meta)
No description provided by source. vdxlink.pm The exploit is a part of VulnDisco Pack - use only under the license agreement specified in LICENSE.txt in your VulnDisco distribution VULNDISCO LICENSE Purchaser buys VulnDisco Pack "the Pack" and receives the right to use it under the terms of the...
Microsoft Outlook Web Access 'owalogon.asp' URL重定向漏洞
Microsoft Exchange Server是一款企业级的邮件服务程序。 Microsoft Outlook Web Access在处理URL时存在问题，远程攻击者可以利用这个漏洞重定向任意URL。 通过构建特殊URL，攻击者可以使用户重定向到任意URL，攻击者利用这个漏洞可以诱使用户访问某个页面，并可能记录密码并发送，或者下载任意文件等。 Microsoft Outlook 2003 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.microsoft.com/technet/security/ Donnie...
MS Windows (SMB) Transaction Response Handling Exploit (MS05-011)
漏洞描述：Windows SMB客户端在处理SMB响应时存在一个缓冲区溢出漏洞。恶意的SMB服务器可以利用这个漏洞在连接该服务器的SMB客户端主机上执行任意命令。MRXSMB.SYS驱动负责执行SMB客户端操作以及处理SMB服务器返回的响应。一些重要的Windows文件共享操作以及所有的RPC-over-named-pipes操作使用SMB命令Trans25h和Trans232h。一个恶意的SMB服务器通过发送特殊的Transaction响应数据可能导致一个缓冲区溢出漏洞。溢出可能发生在任何这个数据被处理的地方，例如MRXSMB.SYS或其他客户端代码中。例如，如果Trans2...
Apache OFBiz RCE漏洞（CVE-2021-26295）
...
New transferFlaw Bug Used For Possible Scam Token Listed In A Top Exchange(CVE-2018-10468)
Our automated scanning system at PeckShield discovered a new vulnerability named transferFlaw CVE-2018–10468. This particular vulnerability affects a publicly traded ERC20 token listed in a top exchange. Different from batchOverflow 1 and proxyOverflow 2 we identified before, this vulnerability...
Hacking LIFX Smart LED Light bulbs to steal WiFi Passwords
Context Information Security firm has discovered a security vulnerability in LIFX smart LED light bulbs that can be remotely controlled by mobile devices. Researchers at Context Information Security have discovered a security flaw in a WiFi enabled, smart LED light LIFX bulb that can be remotely...
D-Link DSL-6850U Multiple Vulnerabilities
Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in D-Link DSL-6850U versions BZ1.00.01 – BZ1.00.09. D-Link DSL-6850U is a router “manufactured by D-Link for Bezeq in Israel” The vulnerabilities found are: Default Credentials Remote Command Execution Credit An...
vBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion(CVE-2017-17672)
Vulnerability Summary The following advisory describes a unauthenticated deserialization vulnerability that leads to arbitrary delete files and, under certain circumstances, code execution found in vBulletin version 5. vBulletin, also known as vB, is “a widespread proprietary Internet forum...
Foscam IP Video Camera webService oray.com DDNS Client Code Execution Vulnerability(CVE-2017-2854)
Summary An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating...
Circle with Disney Apid Use-Between-Reallocs Information Disclosure Vulnerability(CVE-2017-12083)
Summary An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivit...
Apache OpenOffice DOC ImportOldFormatStyles Code Execution Vulnerability(CVE-2017-12608)
Summary An exploitable out-of-bounds write vulnerability exists in the WW8RStyle::ImportOldFormatStyles functionality of Apache OpenOffice 4.1.3. A specially crafted doc file can cause a out-of-bounds write resulting in arbitrary code execution. An attacker can send/provide malicious doc file to...
Ruby WIN32OLE ole_invoke and ole_query_interface Type Confusion Vulnerabilities(CVE-2016-2336)
DESCRIPTION Type Confusion exists in two methods of Ruby's WIN32OLE class, oleinvoke and olequeryinterface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution. TESTED VERSIONS Ruby 2.3.0 dev Ruby 2.2.2 PRODUCT URLs https://www.ruby-lang.or...
Adobe Flash Player Infinite Recursion Arbitrary Read Access Violation(CVE-2016-4132)
SUMMARY A potentially exploitable read access violation vulnerability exists in the a way Adobe Flash Player handles infinitely recursive calls. A specially crafted ActionScript code can cause a read access violation which can potentially be further abused. To trriger this vulnerability user...
FreeImage Library XMP Image Handling Code Execution Vulnerability(CVE-2016-5684)
Summary An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library. A specially crafted XMP file can cause an arbitrary memory overwrite resulting in code execution. An attacker can provide a malicious image to trigger this...
ansible-vault Yaml Load Code Execution Vulnerability
Summary An exploitable vulnerability exists in the yaml loading functionality of ansible-vault. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability. Tested Versions ansible-vault...
Libbpg BGP image decoding Code Execution Vulnerability(CVE-2016-8710)
Summary An exploitable heap write out of bounds vulnerability exists in the decoding of BPG images in libbpg library. A crafted BPG image decoded by libbpg can cause an integer underflow vulnerability causing an out of bounds heap write leading to remote code execution. This vulnerability can be...
Moxa AWK-3131A Web Application onekey Information Disclosure Vulnerability(CVE-2016-0241)
Summary An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Retrieving a series of URLs without authentication can reveal sensitive configuration and system information to an attacker. Tested Versions Moxa...
Moxa AWK-3131A Web Application systemlog.log Information Disclosure Vulnerability(CVE-2016-8725)
Summary An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A wireless access point running firmware 1.1. Retrieving a specific URL without authentication can reveal sensitive information to an attacker. Tested Versions Moxa AWK-3131...
Foscam IP Video Camera CGIProxy.fcgi SMTP Test Password Parameter Configuration Command Injection Vulnerability(CVE-2017-2843)
Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...
Gdk-Pixbuf TIFF tiff_image_parse Code Execution Vulnerability(CVE-2017-2870)
Summary An exploitable integer overflow vulnerability exists in the tiffimageparse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this...
Windows Kernel stack memory disclosure in win32k!NtGdiMakeFontDir(CVE-2017-8477)
We have discovered that the win32k!NtGdiMakeFontDir system call discloses large portions of uninitialized kernel stack memory to user-mode clients. The attached proof of concept code which is specific to Windows 7 32-bit works by first filling a large portion of the kernel stack with a controlled...
Windows Kernel stack memory disclosure in nt!NtQueryInformationProcess(CVE-2017-8476)
We have discovered that the nt!NtQueryInformationProcess system call called with the ProcessVmCounters information class discloses portions of uninitialized kernel stack memory to user-mode clients, due to output structure alignment holes. On our test Windows 10 32-bit workstation, an example...
Windows Kernel stack memory disclosure in nt!NtQueryInformationTransaction(CVE-2017-8480)
We have discovered that the nt!NtQueryInformationTransaction system call called with the 1 information class discloses portions of uninitialized kernel stack memory to user-mode clients, on Windows 7 to Windows 10. The specific name of the 1 information class or the layout of the corresponding...
Zabbix Proxy Server SQL Database Write Vulnerability (CVE-2017-2825)
Official patch earlier to fix the vulnerabilities: the Zabbix code execution vulnerability DETAILS One of the Trapper requests made by the Zabbix proxy is the ìproxy configî request, which allows a proxy to request its own proxy configuration from the Zabbix Server or any other Zabbix Proxyís...
MacOS/iOS kernel uaf due to bad locking in necp_open (CVE-2017-2478)
necpopen is a syscall used to obtain a new necp file descriptor The necp file's fp's fgdata points to a struct necpfddata allocated on the heap. Here's the relevant code from necpopen: error = fallocp, &fp, &fd, vfscontextcurrent; --------------------- a if error != 0 goto done; if fddata =...
Netgear R6400/R7000/R8000 - Command Injection
Author:p0wd3r,dawuknow Chong Yu 404 security lab Data: 2016-12-13 Update on 12/16 : correction of the original text in a error, thanks to @k0pwn it. 2016 12 month 7 days, foreign websites exploit-db on broke one on the NETGEAR R7000 router command injection vulnerability. Time, each passerby hors...
TaoCMS v2.5Beta4 Comment.php 存在储存型xss漏洞(可打后台)
No description provided by source...
用友GRP-U8 系统登陆处参数UserNameText 存在SQL注入
No description provided by source...
E-TILLER期刊采编系统/ch/reader/wait_published_articles.aspx等8处 POST注入漏洞
No description provided by source...
正方教务系统 jwggck.aspx 参数fbsj SQL注入漏洞
No description provided by source...
SAP HANA hdbindexserver - Memory corruption
No description provided by source...
phpwind V9.0 /windid/admin.php 验证码绕过漏洞
No description provided by source...
jcms /interface/user/out_userinfo.jsp 文件 xmlinfo 参数敏感信息泄漏漏洞
No description provided by source...
Zblog 2.0 /zb_install/index.php 本地文件包含漏洞
问题出现在zbinstall/index.php中 $zbloglang=&$zbp-option'ZCBLOGLANGUAGEPACK'; //首先定义zbloglang ifisset$POST'zbloglang'$zbloglang=$POST'zbloglang';//如果设置了post的 就用post传递来的做这变量了。 因为zblog防止sql注入都是通过在查询函数的时候 不采用拼接 所以他们也没对post转义 这样是注入少了 但是也造成了这里的漏洞。 $zbp-LoadLanguage'system','',$zbloglang;//跟跟跟...
DESTOON sql注入漏洞
简要描述： DESTOON sql注入漏洞 详细说明： 一枚二次注入,因为使用了dhtmlspecialchars导致防注入失效。可以任意数据。 先来看留言模块： \module\extend\comment.inc.php $item = $db-getone"SELECT title,linkurl,username,status FROM ".gettable$mid." WHERE itemid=$itemid"; //从数据库中取出对于模块的发布数据 $item or exit; $item'status' 2 or exit; $linkurl =...
致远软件某网站漏洞合集
简要描述： 致远软件某网站漏洞合集，能不能给20rank 详细说明： 致远软件自助服务网站 问题如下： SQL注入 问吧管理员弱口令 任意文件上传 漏洞证明： SQL注入证明------------开始 注入点为 http://support.seeyon.com/ask/base/QuestionHandler.ashx?callback=jsonp1428044230217&mode=list&title=ceshi 注入类型 获取数据库列表 SQL注入证明------------结束 问吧管理员弱口令证明------------开始 后台地址...
用友致远A6协同办公系统存在一处DBA权限SQL注入漏洞
简要描述： RT 详细说明： 漏洞位于：/yyoa/checkWaitdo.jsp文件中 % uName = request.getParameter"userID";//接收参数 // System.out.printlnuName; if uName != "null" Connection con = ConnectionPoolBean.getConnection; //System.out.println"手动检查的结果中有问题的记录:"; boolean l = false; try uID = XiaoxsDbHelper.getIntcon, "select id fro...
53kf大量Memcached未授权访问
简要描述： 53kf大量memcached 未授权访问，泄露敏感信息 详细说明： 100多个地址，大量未授权访问，泄露敏感信息 漏洞证明： passport.53kf.com vip.53kf.com blog.53kf.com cx.53kf.com s.53kf.com v6.53kf.com zz.53kf.com 1.53kf.com 8.53kf.com t7.53kf.com t6.53kf.com t3.53kf.com t2.53kf.com t5.53kf.com t4.53kf.com t9.53kf.com t8.53kf.com t1.53kf.com...
某在线培训系统通用SQL注入漏洞
简要描述： 捡漏不易 详细说明： 捡漏一处： 该系统主要针对网上学习的。数据库里面包含有很多老师、学生的个人信息。 漏洞类型：SQL注入 危害度：高危 漏洞位置：WebOrg/UserRegist.aspx 参数：USERNAME 厂商：上海天柏信息科技有限公司 厂商网站：http://www.timber2005.com/ 漏洞证明： 关键字：inurl:webOrg 可自由构造 部分案例： http://webcourse.vixue.net/WebOrg/UserRegist.aspx http://www.gxkjks.com/WebOrg/UserRegist.aspx...
嘉缘人才系统SQL注入漏洞
简要描述： RT 详细说明： 在common/comment.php中 requiredirnameFILE.'/../config.inc.php'; !isset$db&&$db=connectdb; requireonceFRROOT.'/inc/paylog.inc.php'; if!$cfg'comment'=='1'echo "alert'本站未开启评论功能！';window.close;";exit; $submit=isset$POST'Submit'?$POST'Submit':''; if$submit if$cfg'comment' if$anonymous...
汇文Libsys图书管理系统全版本权限绕过+Getshell
简要描述： RT 详细说明： 由于一个很低级的代码错误，导致可以登录Libsys任意图书系统后台，并且由于代码未做过滤可直接getshell。 漏洞证明： 该图书管理系统的用户量很大，全国很大一部分院校都在使用此系统。经测试3.5-5.0版本都存在此漏洞，因为存在getshell 和脱裤的风险，因此危害比较大。 官网部分用户列表： 我这里以最新的5.0版简单的作下分析,： 先看看存在漏洞的文件：admin/login.php sessionstart ; if isset $REQUEST'username' $strUser = trim $REQUEST'username' ;...
Drupal Core <= 7.32 - SQL Injection (#2)
No description provided by source. !/usr/bin/python Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 Inspired by yukyuk's P.o.C https://www.reddit.com/user/fyukyuk Tested on Drupal 7.31 with BackBox 3.x This material is intended for educational purposes only and t...
F5 BIG-IP SQL注入漏洞
No description provided by source. SEC Consult Vulnerability Lab Security Advisory 20130122-1 ======================================================================= title: SQL Injection product: F5 BIG-IP vulnerable version: =11.2.0 fixed version: 11.2.0 HF3 11.2.1 HF3 CVE number: CVE-2012-3000...
Dew-NewPHPLinks 2.1b (index.php) - SQL Injection Vulnerability
No description provided by source. Dew-NewPHPLinks v.2.1b index.php Sql Injection Vulnerability ====================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.dew-code.com/ .:. Dork : Powered By Dew-NewPHPLinks v.2.1b .:...
Comcast DOCSIS 3.0 Business Gateways Multiple Vulnerabilities
No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2011-002: Vulnerabilities in Comcast DOCSIS 3.0 Business Gateways D3G-CCR https://www.trustwave.com/spiderlabs/advisories/TWSL2011-002.txt Published: 2011-02-04 Version: 1.0 Vendor: Comcast http://comcast.com Product:...
MIPS Little Endian Reverse Shell Shellcode (Linux)
No description provided by source. MIPS Little Endian Reverse Shell ASM File and Assembled Shellcode Written by Jacob Holcomb, Security Analyst @ Independent Security Evaluators Blog: http://infosec42.blogspot.com Company Website: http://securityevaluators.com .data .bss .text .globl start start:...
ImageVue 2.0 - Remote Admin Login Exploit
No description provided by source. Author: Sora Software Link: http://www.imagevuex.com/ Version: 2.0 Tested on: Windows and Linux --------------------------------- / ImageVue 2.0 Remote Admin Login Exploit Created by Sora Contact: vhr95zw at hotmail.com / + Google Dork: inurl:/admin/ ImageVue +...
Adobe Flash Player Regular Expression Heap Overflow
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::BrowserExploitServer def...