Dell SonicWALL Secure Mobile Access SMA 8.1 XSS And WAF CSRF

Summary Keep up with the demands of today’s remote workforce. Enable secure mobile access to critical apps and data without compromising security. Choose from a variety of scalable secure mobile access SMA appliances and intuitive Mobile Connect apps to fit every size business and budget...

Telesquare SKT LTE Router SDT-CS3B1 WebDAV HTTP Methods Arbitrary File Events

Summary We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G LTE wireless communication based LTE router product. Description WebDAV is enabled with directory listing and dangerous HTTP methods allowed: PROPFIND, DELETE, MKCOL, PUT, MOVE, COPY, PROPPATCH, LOCK and UNLOCK. The HTTP PUT metho...

Xerox DC260 EFI Fiery Controller Webtools 2.0 Arbitrary File Disclosure

Summary Drive production profitability with Fiery servers and workflow products. See which Fiery digital front end is right for your current or future print engines and business needs. Manage all your printers from a single screen using this intuitive print job management interface. Description...

ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions

Summary ZKTime.Net V3.0 is a new generation time attendance management software. Meanwhile, it integrates with time attendance and access control system. Some frequently used functions such as attendance reports, device management and employee management can be managed directly on the home page...

Asus_GlobalWirteOverflow

Vulnerability: Global buffer overflow in networkmap ------------------------------------------ Exploitation: Can write data at any address in heap ------------------------------------------ Vendor of Product: Asus wireless router ------------------------------------------ Affected Products and...

MacOS/iOS kernel double free due to incorrect API usage in flow divert socket option handling(CVE-2017-13867)

SOFLOWDIVERTTOKEN is a socket option on the SOLSOCKETlayer. It's implemented by flowdiverttokensetstruct socket so, struct sockopt sopt in flowdivert.c. The relevant code is: error = sooptgetmsopt, &token; if error goto done; error = sooptmcopyinsopt, token; if error goto done; ... done: if token...

vBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion(CVE-2017-17672)

Vulnerability Summary The following advisory describes a unauthenticated deserialization vulnerability that leads to arbitrary delete files and, under certain circumstances, code execution found in vBulletin version 5. vBulletin, also known as vB, is “a widespread proprietary Internet forum...

Serviio PRO 1.8 DLNA Media Streaming Server REST API Arbitrary Code Execution

Summary Serviio is a free media server. It allows you to stream your media files music, video or images to renderer devices e.g. a TV set, Bluray player, games console or mobile phone on your connected home network. Description The version of Serviio installed on the remote Windows host is affect...

Microsoft Edge: Chakra: JIT: Inline::InlineCallApplyTarget_Shared doesn't return the return instruction(CVE-2017-11841)

Here's a snippet of Inline::Optimize. FOREACHINSTREDITINGinstr, instrNext, func-mheadInstr switch instr-mopcode case Js::OpCode::Label: ... if instr-AsLabelInstr-misForInExit Assertthis-currentForInDepth != 0; // The PoC hits this this-currentForInDepth--; break; case...

Microsoft IE11: use-after-free in jscript!JsErrorToString(CVE-2017-11810)

There is a use-after-free in jscript.dll library that can be exploited in IE11. jscript.dll is an old JavaScript library that was used in IE 8 and back. However, IE11 can still load it if put into IE8 compatibility mode and if there is a script tag that can only be understood by the older library...

Cesanta Mongoose MQTT SUBSCRIBE Multiple Topics Remote Code Execution(CVE-2017-2894)

Summary An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT...

Simple DirectMedia Layer Create RGB Surface Code Execution Vulnerability(CVE-2017-2888)

Summary An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provid...

WebKit: JSC: Incorrect optimization in BytecodeGenerator::emitGetByVal(CVE-2017-7061)

Let's start with JS code. let o = ; for let i in xx: 0 oi; 0; i-- ForInContext& context = mforInContextStacki - 1.get; if context.local != property continue; if !context.isValid break; if context.type == ForInContext::IndexedForInContextType property = staticcastcontext.index; break;...

safari10跨域漏洞

safari 10的XMLHttpRequest在null域下可以随意发起跨域请求和设置httpheader 我交到苹果的bugreport，并给apple发邮件后，他们自己悄悄把漏洞修了，连个邮件都没给我发，所以我决定公开poc 这是我在漏洞未修复前截的图： 这个漏洞可以造成同源策略绕过，随便跨域，这是我写的获取gmail数据的代码： html var serveraddress = 'http://127.0.0.1:8000/static/csrfWcn6h/' function deleteSelf let test = document.getElementById'test'...

Aerospike Database Server Index Name Code Execution Vulnerability(CVE-2016-9052)

Summary An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow in the function assindexsimatchbyiname resulting in remote code execution. An attacker ca...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Command Injection Vulnerability(CVE-2017-2845)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SMTP configuration tes...

Gdk-Pixbuf TIFF tiff_image_parse Code Execution Vulnerability(CVE-2017-2870)

Summary An exploitable integer overflow vulnerability exists in the tiffimageparse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this...

SQL Injection(CVE-2017-12650) and CSRF(CVE-2017-12651) Security Vulnerability in Loginizer

As part of a vulnerability research project for our WordPress Security Scanner at WPcans.com, we have been auditing popular WordPress plugins looking for security issues. While auditing the WordPress plugin Loginizer, we discovered a SQL Injection vulnerability and a Cross-Site Request Forgery...

Foscam IP Video Camera Command Injection Vulnerability(CVE-2017-2847)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configurati...

Windows Kernel stack memory disclosure in win32k!ClientPrinterThunk(CVE-2017-8475)

We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 7 other platforms untested indirectly through the win32k!NtGdiOpenDCW system call. The analysis shown below was performed on Windows 7 32-bit. The full stack trace...

Heap Overflow Vulnerability in Citrix NetScaler Gateway (CVE-2017-7219)

After presenting my findings on the Swisscom router at the CybSecConference last year, I started looking for a new product to analyze. I quickly found that it’s possible to download virtual “demo” appliances of Citrix products, so I went on to download a Netscaler VPX, which at the time was at...

macOS iBooks Parsing a maliciously crafted iBooks file lead to local file disclosure（CVE-2017-2426）

On a previous post about ePub parsers This book reads you - exploiting services and readers that support the ePub book format, I mentioned using scripting capabilities in ePub to perform local attacks against users. Apple just released a fix for one issue I reported last year in iBooks that allow...

2017 Visual Studio Code Workspace settings code execution

The following issue constitutes an arbitrary code execution vulnerability in Visual Studio Code herein referred to as "Code". Users should upgrade to Code 1.9.0 or later. says: Visual Studio Code is a source code editor developed by Microsoft for Windows, Linux and macOS. It includes support for...

Ubuntu Apport < 2.20.4 Code Execution on Ubuntu Desktop（CVE-2016-9949）

This research was inspired by Chris Evan’s great work on exploiting client-side file format parsing bugs in the gstreamer media library on Ubuntu. We will look for other default file handlers on Ubuntu which may be vulnerable to exploitation. I’m not a binary exploitation guru like Chris so inste...

万户ezOffice协同办公管理平台Voituregetsource.jsp svoitureid参数存在sql注入漏洞

No description provided by source...

dedecms v5.7缓存文件data/cache/typename.inc导致任意代码执行（有条件）

No description provided by source...

E-TILLER期刊采编系统/ch/reader/wait_published_articles.aspx等8处 POST注入漏洞

No description provided by source...

用友优普U8系统 /Server/CmxGetAppNameByUserName.php等2处 SQL注入漏洞

0x01漏洞简介 用友优普U8系统在以下2处存在SQL注入漏洞： 1/Server/CmxGetAppNameByUserName.php 参数User 2/Server/CmxCS.php 参数pgid 远程攻击者无需登陆，可以利用该漏洞执行SQL指令。 0x02漏洞利用 1sql注入1 sqlmap.py -u "...:8080/Server/CmxCS.php?pgid=CSRemove" --dbms mysql --technique T --cookie "RASAdminUserInfoUserName=1" --data "CSID=1&CSID=1" -p CSID ...

CMSTOP媒体云 /gallery/index/list 任意文件上传

No description provided by source...

用友致远A6协同系统 /yyoa/ext/trafaxserver/ExtnoManage/setextno.jsp 文件 user_ids 参数SQL注入漏洞

No description provided by source...

金蝶OA办公系统 /kingdee/custom/ 目录4处 SQL注入漏洞

No description provided by source...

Emerson Liebert IntelliSlot Web Card 弱口令

参考链接: http://www.emersonnetworkpower.com/documentation/en-us/products/monitoring/documents/sl-52615.pdf...

discuz 7.2 网站路径泄露漏洞

No description provided by source...

科信邮件系统 (KXmail)/prog/get_composer_att.php 任意文件下载漏洞

No description provided by source...

kindeditor<=4.1.5文件上传漏洞

漏洞描述漏洞存在于kindeditor编辑器里，你能上传.txt和.html文件，支持php/asp/jsp/asp.net漏洞存在于小于等于kindeditor4.1.5编辑器中关键字： allinurl:/examples/uploadbutton.html allinurl:/php/uploadjson.php / .asp /...

Coremail一处存储型跨站脚本（有触发条件）

简要描述： Coremail一处存储型跨站脚本漏洞，已申请CVE编号：CVE-2015-6942 详细说明： 影响版本：XT3.0 其他版本未测试 测试步骤： 1.首先创建一个带有超链接的doc文档，超链接为"javascript:alert" 2.创建一封邮件并上传附件，然后发送给需要攻击的用户可发送给任意用户。 3.受害者如果在WebMail里打开邮件并在线预览doc文档时，点击超链接，即可执行攻击代码。 4.重新将文档中的超链接换成location.href方式获取Cookie的超连接的即可...

金蝶销管家逻辑缺陷重置任意用户密码(工作人员账户测试/秒改)

简要描述： 可绕过验证码直接修改用户密码。 详细说明： 0x1:先信息收集一些工作人员的账户用来测试，来证明漏洞的危害性。 13580111111 13752248075 13456231475 13456879564 15578945623 13456231245 13456231245 13648776985 13400002111 13625668852 15018517663 15915533696 13888888888 13456789123 18090700000 13165454756 13654213923 13654213923 13760368754...

某在线培训系统Base64编码后通用SQL盲注漏洞

简要描述： RT 详细说明： 接上一个洞： WooYun: 某在线培训系统通用SQL注入漏洞 厂商：上海天柏信息科技有限公司 http://www.timber2005.com/Productsy.html （客户案例及试用） 天柏在线培训系统（网校版） 漏洞地址： http://px2.timber2005.com/WebPage/kccontent.aspx?tid=NDAyMA==&cid=Mjk= 参数cid存在注入 tid和cid都采用了base64的编码，因此提交的时候需要对参数进行编码 提交： 29 and 1=1 编码后： MjkgYW5kIDE9MQ== 页面正常...

JEECMS一处通用越权第四弹(可删除订单取消订单)

简要描述： 111 详细说明： ID1和ID2各自去买一个自己喜欢的东西，就是没有TT，真可惜啊-。- 我们修改一下ID，然后把自己吓一跳吧，。。 我们这些做测试的简直可以上星光大道了，引用刘谦那句话，接下来就是见证奇迹的时候了 白帽子都是魔术师-。- test7取消订单，然后会增加一个删除按钮，然后删除抓包改ID，发包，删除成功 漏洞证明： ID1和ID2各自去买一个自己喜欢的东西，就是没有TT，真可惜啊-。- 我们修改一下ID，然后把自己吓一跳吧，。。 我们这些做测试的简直可以上星光大道了，引用刘谦那句话，接下来就是见证奇迹的时候了 白帽子都是魔术师-。-...

53kf大量Memcached未授权访问

简要描述： 53kf大量memcached 未授权访问，泄露敏感信息 详细说明： 100多个地址，大量未授权访问，泄露敏感信息 漏洞证明： passport.53kf.com vip.53kf.com blog.53kf.com cx.53kf.com s.53kf.com v6.53kf.com zz.53kf.com 1.53kf.com 8.53kf.com t7.53kf.com t6.53kf.com t3.53kf.com t2.53kf.com t5.53kf.com t4.53kf.com t9.53kf.com t8.53kf.com t1.53kf.com...

某学校综合管理平台另一处Getshell漏洞

简要描述： 某学校综合管理平台另一处Getshell漏洞 详细说明： 系统名称：学校综合管理平台 厂商：上海安脉计算机科技有限公司 关键字：版权所有：上海安脉计算机科技有限公司 系统架构：ASPX+MSSQL ASP+MSSQL 漏洞成因：编辑器不规范使用（弱口令+数据库可下载） 漏洞证明： 枚举部分案例： http://anmai.net:81/PrepManage/Editor/adminlogin.asp http://jwxx.am.jsedu.sh.cn/ANMAI/PrepManage/Editor/adminlogin.asp...

ECStore开源网店系统任意文件修改漏洞可拿shell

简要描述： 模板编辑中的文件编辑功能，对可编辑的文件限制不严，导致可以修改系统中存在的任意文件 详细说明： 文件编辑功能中选择要修改的文件，这里选图片（模板文件也可以），然后上传图片时将filename参数设置为网站的任意php文件，如/index.php或/config/config.php，将图片内容设置为shell内容。。。。 post数据如下： POST /index.php/shopadmin/index.php?app=site&ctl=adminexplorertheme&act=saveimage HTTP/1.1 Host: shop.xxx.com...

强智教务系统通用型文件上传（getshell）

简要描述： 任意上传getshell 详细说明： 看见前人提交了一个 WooYun: 强智教务系统通杀Getshell提权服务器内网渗透 ，我也来提交一下。。。 1，任意文件上传 漏洞文件 /jwgl/jxjh/JxjhXGBc.asp 部分源码如下： 文件上传 - 长沙市强科技发展有限责任公司·版权所有 0 then '如果出错 select case upfile.err case 1 Response.Write "你没有上传数据呀???是不是搞错了??" case 2 Response.Write "你上传的文件超出我们的限制,最大10M" end select else %...

KesionCMS X1 /KS_Data/KesionCMSX1.mdb 数据库发现漏洞

默认的数据库文件在KSData目录下的 KesionCMSX1.mdb，攻击者可以直接下载。漏洞利用过程访问地址http://127.0.0.1/KSData/KesionCMSX1.mdb !/usr/bin/env python coding=utf-8 test: import urllib2 from comm import cmdline from comm import generic pocinfo = 'VulId' : '1503', webvul的ID号 'Name' : 'KesionCMS X1 /KSData/KesionCMSX1.mdb 数据库发现漏洞...

逐浪CMS 任意文件下载+任意文件删除（无需登录）

简要描述： 逐浪最新版 任意文件删除 任意文件下载 详细说明： 在此请求逐浪cms 重视每个白帽子提交的漏洞 不要老是漏洞忽略 地址 http://demo.zoomla.cn/USER/Develop%5CSiteAdmin/BackupSite.aspx 源码如下 protected void PageLoadobject sender, EventArgs e this.MU = this.BU.GetLogin; if base.Request.QueryString"status" == "del" //任意文件删除...

DouPHP SQL注入一枚

简要描述： 注入 详细说明： 依然是getip的问题， guestbook.php:102行 if $rec == 'insert' / 跨站请求伪造CSRF的防御 / if $firewall-checktoken$POST'token' / html安全过滤器 / $POST = $firewall-doufilter$POST; $ip = $dou-getip; $addtime = time; $vcode = $check-iscaptcha$POST'vcode' ? strtoupper$POST'vcode' : ''; / 检查IP是否频繁留言 /...

FOSCAM IP-Cameras Improper Access Restrictions

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...

Linux Kernel - Sendpage Local Privilege Escalation

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require...

Comcast DOCSIS 3.0 Business Gateways Multiple Vulnerabilities

No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2011-002: Vulnerabilities in Comcast DOCSIS 3.0 Business Gateways D3G-CCR https://www.trustwave.com/spiderlabs/advisories/TWSL2011-002.txt Published: 2011-02-04 Version: 1.0 Vendor: Comcast http://comcast.com Product:...

Linux Kernel < 2.6.31-rc7 - AF_IRDA 29-Byte Stack Disclosure Exploit

No description provided by source. / cve-2009-3002.c Linux Kernel 2.6.31-rc7 AFIRDA getsockname 29-Byte Stack Disclosure Jon Oberheide [email protected] http://jon.oberheide.org Information: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3002 The Linux kernel before 2.6.31-rc7 does not...