56796 matches found
Insteon Hub HTTPExecuteGet Firmware Update Information Leak Vulnerability(CVE-2017-14443)
Summary An exploitable information leak vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly checks the number of GET parameters supplied, leading to an arbitrarily controlled information leak on the whole device memory. An attacker can sen...
TP-Link TL-WR840N/TL-WR841N - Authenticaton Bypass
Title: TP-Link Multiple RouterTL-WR840N and TL-WR841N Unauthenticated Router Access Vulnerability Author: BlackFog Team Date: 27 May 2018 Website: SecureLayer7.net Contact: [email protected] Version: 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n Hardware: TL-WR841N v13 00000013 Version : Firmwar...
DJI Spark hijacking
It is no pleasant experience at all for anyone to get the valuable property bought with the money you have earned with your blood, sweat, and tears stolen by some unknown cybercriminal. The Internet of Things IoT is developing with the rapid pace, and the devices that can be controlled remotely...
zzcms 8.2 任意用户密码修改
zzcms 8.2 任意用户密码修改 漏洞描述 zzcms是一款企业建站程序。 zzcms 8.2版本/one/getpassword.php文件存在漏洞，攻击者可利用该漏洞修改任意用户密码。 漏洞分析 /one/getpassword.php文件第 73行，触发漏洞的关键代码。 elseif$action=="step3" && @$SESSION'username'!='' $passwordtrue = isset$POST'password'?$POST'password':""; $password=md5trim$passwordtrue; query"update...
ZKTeco ZKAccess Professional 3.5.3 Insecure File Permissions
Summary ZKAccess 3.5 is a desktop software which is suitable for small and medium businesses application. Compatible with all ZKAccess standalone reader controllers, the software can simultaneously manage access control and generate attendance report. The brand new flat GUI design and humanized...
WebKit: out-of-bounds read in WebCore::SimpleLineLayout::RunResolver::runForPoint(CVE-2017-13784)
There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==30436==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000560c48 at pc...
Microsoft Edge: Chakra: JIT: Incorrect integer overflow check in Lowerer::LowerBoundCheck(CVE-2017-11861)
Here's a snippet of the method. void Lowerer::LowerBoundCheckIR::Instr const instr ... ifrightOpnd-IsIntConstOpnd IntConstType newOffset; if!IntConstMath::Addoffset, rightOpnd-AsIntConstOpnd-GetValue, &newOffset --- a offset = newOffset; rightOpnd = nullptr; offsetOpnd = nullptr; ... if!rightOpnd...
Foscam IP Video Camera webService oray.com DDNS Client Code Execution Vulnerability(CVE-2017-2854)
Summary An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating...
Foscam IP Video Camera UPnP Discovery Code Execution Vulnerability(CVE-2017-2879)
Summary An exploitable buffer overflow vulnerability exists in the UPnP implementation used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted UPnP discovery response can cause a buffer overflow resulting in overwriting arbitrary data. An attacker needs ...
Circle with Disney Rclient SSH Persistent Remote Access Vulnerability(CVE-2017-12084)
Summary A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker send an API call to enable the SSH server. Tested...
Circle with Disney libbluecoat.so SSL TLD MITM Vulnerability(CVE-2017-2913)
Summary An exploitable vulnerability exists in filtering functionality of Circle with Disney. SSL certificates for specific domain names can cause the Bluecoat library to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate to trigger this...
Hopper Disassembler ELF Section Header Size Code Execution Vulnerability(CVE-2016-8390)
Summary An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper App. A specially crafted ELF file can cause attacker controlled pointer arithmetic resulting in a partially controlled out of bounds write. An attacker can craft an ELF file with...
Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution
Description: The remote code execution is a combination of 4 different vulnerabilities: CVE-2017-11151 allows remote attackers to upload arbitrary files to the specified directories. CVE-2017-11152 allows remote attackers to log in with a fake authentication mechanism. CVE-2017-11153 allows remot...
Aerospike Database Server Set Name Code Execution Vulnerability(CVE-2016-9054)
Summary An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow in the function assindexsimatchlistbysetbinid resulting in remote code execution. An...
Windows Kernel stack memory disclosure in nt!NtQueryInformationTransaction(CVE-2017-8480)
We have discovered that the nt!NtQueryInformationTransaction system call called with the 1 information class discloses portions of uninitialized kernel stack memory to user-mode clients, on Windows 7 to Windows 10. The specific name of the 1 information class or the layout of the corresponding...
DedeCMS stored xss vulnerability
Vulnerability description: Dedecms is an open source PHP open source website management system. Dedecms member function shopsdelivery. in php des parameters there is stored XSS vulnerability, the attacker may exploit the vulnerability to obtain the users cookie. Test environment: DedeCMS-V5...
Metasploit Weekly Release Static secret_key_base pre-auth 远程代码执行漏洞
Author: Justin Steven OVE ID: OVE-20160904-0002 Private disclosure date: 2016-09-04 Public disclosure date: 2016-09-19 Vendor advisory: https://community.rapid7.com/community/metasploit/blog/2016/09/15/important-security-fixes-in-metasploit-4120-2016091401 Affected versions: Metasploit...
TaoCMS v2.5Beta4 Comment.php 存在储存型xss漏洞(可打后台)
No description provided by source...
用友致远A6协同系统messageViewer.jsp三处SQL注入漏洞
No description provided by source...
jcms /interface/user/out_userinfo.jsp 文件 xmlinfo 参数敏感信息泄漏漏洞
No description provided by source...
Joomla! 3.4.6-3.4.x 目录遍历漏洞
本地包含： http://www.site.com/components/comdocman/dl2.php?archive=0&file=LDF 先通过本地包含漏洞查看物理路径，然后在configuration.php 数据库配置文件中，使用base64目录遍历payload 如： http://www.site.com/components/comdocman/dl2.php?archive=0&file=Li4vLi4vLi4vLi4vLi4vLi4vLi4vdGFyZ2V0L3d3dy9jb25maWd1cmF0aW9uLnBocA==...
discuz 7.2 网站路径泄露漏洞
No description provided by source...
kindeditor<=4.1.5文件上传漏洞
漏洞描述漏洞存在于kindeditor编辑器里，你能上传.txt和.html文件，支持php/asp/jsp/asp.net漏洞存在于小于等于kindeditor4.1.5编辑器中关键字： allinurl:/examples/uploadbutton.html allinurl:/php/uploadjson.php / .asp /...
Windows ATMFD.DLL CFF table (ATMFD+0x3440b / ATMFD+0x3440e) Invalid Memory Access
CVE-2015-2460We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: ---PAGEFAULTINNONPAGEDAREA 50Invalid system memory was referenced. This cannot be protected by try-except,it must be protected by a Probe...
PageAdmin v3.0 /e/database/v3.mdb 数据库泄漏
PageAdmin CMS V3.0版，默认数据库地址“/e/database/v3.mdb“，默认后台地址：“/e/master/login.aspx”，由于数据库地址未做限制，导致可以下载。通过逆向管理员MD5加密算法获得md5密文，并通过md5密文可以破解管理员密码。发现非常规MD5加密，于是使用ILSPY逆向源代码，查看加密方式public string GetMd5string s MD5 mD = new MD5CryptoServiceProvider; Encoding encoding = Encoding.GetEncoding"UTF-8"; string s2 =...
DESTOON sql注入漏洞
简要描述： DESTOON sql注入漏洞 详细说明： 一枚二次注入,因为使用了dhtmlspecialchars导致防注入失效。可以任意数据。 先来看留言模块： \module\extend\comment.inc.php $item = $db-getone"SELECT title,linkurl,username,status FROM ".gettable$mid." WHERE itemid=$itemid"; //从数据库中取出对于模块的发布数据 $item or exit; $item'status' 2 or exit; $linkurl =...
某在线培训系统Base64编码后通用SQL盲注漏洞
简要描述： RT 详细说明： 接上一个洞： WooYun: 某在线培训系统通用SQL注入漏洞 厂商：上海天柏信息科技有限公司 http://www.timber2005.com/Productsy.html （客户案例及试用） 天柏在线培训系统（网校版） 漏洞地址： http://px2.timber2005.com/WebPage/kccontent.aspx?tid=NDAyMA==&cid=Mjk= 参数cid存在注入 tid和cid都采用了base64的编码，因此提交的时候需要对参数进行编码 提交： 29 and 1=1 编码后： MjkgYW5kIDE9MQ== 页面正常...
金蝶某主机Mysql弱密码泄露部分员工信息
简要描述： 金蝶某主机mysql弱密码,泄露部分员工信息。 详细说明： mysql -uroot -p123456 -h218.244.150.94 漏洞证明： mysql show databases; +--------------------+ | Database | +--------------------+ | informationschema | | aucp | | jiradb | | mysql | | performanceschema | | pss | | scrumdb | | test | +--------------------+...
ESPCMS 6.2 /interface/order.php SQL注入漏洞
No description provided by source...
蝉知企业门户系统 v3.3csrf修改管理员密码
简要描述： 蝉知企业门户系统 v3.3csrf修改管理员密码 详细说明： 蝉知企业门户系统 v3.3最新版本 存在csrf漏洞 而且我测试的时候发现，即使修改了密码，管理员也不会马上需要重新登陆，所以配合我的回旋镖，可以达到神不知鬼不觉的修改其管理密码 接下来，我就来详细的演示漏洞过程 漏洞证明： 1、我们进入后台，发现没有添加管理员，那么我们来尝试一下修改管理员密码 很有意思，我们发现修改管理员的密码，不需要验证原密码好危险撒！ 那我们再来抓包截断看看有没有token之类的验证 2、用burpsuite截断 我的小伙伴们都惊呆了 有木有？？ 没有验证，就两个password...
嘉缘人才系统SQL注入漏洞
简要描述： RT 详细说明： 在common/comment.php中 requiredirnameFILE.'/../config.inc.php'; !isset$db&&$db=connectdb; requireonceFRROOT.'/inc/paylog.inc.php'; if!$cfg'comment'=='1'echo "alert'本站未开启评论功能！';window.close;";exit; $submit=isset$POST'Submit'?$POST'Submit':''; if$submit if$cfg'comment' if$anonymous...
汇文Libsys图书管理系统全版本权限绕过+Getshell
简要描述： RT 详细说明： 由于一个很低级的代码错误，导致可以登录Libsys任意图书系统后台，并且由于代码未做过滤可直接getshell。 漏洞证明： 该图书管理系统的用户量很大，全国很大一部分院校都在使用此系统。经测试3.5-5.0版本都存在此漏洞，因为存在getshell 和脱裤的风险，因此危害比较大。 官网部分用户列表： 我这里以最新的5.0版简单的作下分析,： 先看看存在漏洞的文件：admin/login.php sessionstart ; if isset $REQUEST'username' $strUser = trim $REQUEST'username' ;...
Wordpress wpDataTables Plugin 1.5.3 /wpdatatables.php SQL注入漏洞
wpdatatables.php // AJAX-handlers addaction 'wpajaxgetwdtable', 'wdtgetajaxdata' ; addaction 'wpajaxnoprivgetwdtable', 'wdtgetajaxdata' ; / Handler which returns the AJAX response / function wdtgetajaxdata $id = $GET'tableid'; $tabledata = wdtgettablebyid $id ; $columndata = wdtgetcolumnsbytablei...
espcms sql注入漏洞
简要描述： 刚刚看了 espcms的官网 发现2014-09-16 16:58:17更新了,下了份看下，发现这上面的几个漏洞完全没修复啊..上次提交了个漏洞只给了5rank..敢给多点么.这次和上次那个相似,怕你们只修复一处,这处也提交下。 详细说明： 在order.php inordersave中 365-367行附近 foreach $did as $key = $value $value = intval$value; $oprice$key = floatval$oprice$key; $bprice$key = floatval$bprice$key;...
F5 BIG-IP SQL注入漏洞
No description provided by source. SEC Consult Vulnerability Lab Security Advisory 20130122-1 ======================================================================= title: SQL Injection product: F5 BIG-IP vulnerable version: =11.2.0 fixed version: 11.2.0 HF3 11.2.1 HF3 CVE number: CVE-2012-3000...
PhotoPost PHP 4.6.5 (ecard.php) SQL Injection Vulnerability
No description provided by source. PhotoPost PHP 4.6.5 ecard.php?ecard SQL Injection Vulnerability Author : CoBRa21 Author Web Page : http://www.ipbul.org Dork: Powered by: PhotoPost PHP 4.6.5 Sql Injection: http://localhost/path/ecard.php?ecard=418337 Sql...
Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability
No description provided by source. ScanAlert Security Advisory - http://www.scanalert.com Directory Listing in Apache Tomcat 5.x.x Date: 07/21/2006 Vendor: Apache Package: Tomcat Versions: 5.x.x 5.0.28, 5.5.12, 5.5.9, and 5.5.7 . Confirmed Credit: ScanAlert.s Enterprise Services Team. Overview:...
SpagoBI 4.0 - Persistent XSS Vulnerability
No description provided by source. 01. Advisory Information Title: Persistent Cross-Site Scripting XSS in SpagoBI Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: High 02. Vulnerability Information CVE...
Microsoft Windows ndproxy.sys - Local Privilege Escalation
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex' class Metasploit3 Msf::Exploit::Local Rank = AverageRanking include Msf::Post::File include...
Oracle Application Framework Diagnostic Mode Bypass Vulnerability
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2012-023: Oracle Application Framework Diagnostic Mode Bypass Vulnerability Published: 1/15/2013 Version: 1.0 Vendor: Oracle www.oracle.com Product: Oracle Application Framework Version affected: 11.5.10.2, 12.0.6, 12.1...
Powered by iNetScripts: Shell Upload Vulnerability
No description provided by source. ==================================================== Powered by iNetScripts: Shell Upload Vulnerability ==================================================== Contact :Sec-q8 [email protected] Published: 2010-04-25 Home : http://Sec-Senter.com/vb ========= Exploi...
PHPDug 2.0.0 - Multiple Vulnerabilities
No description provided by source. Vulnerability ID: HTB22971 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpdug.html Product: PHPDug Vendor: Kubelabs.com http://www.kubelabs.com/ Vulnerable Version: 2.0.0 and probably prior versions Vendor Notification: 21 April 2011 Vulnerability Type:...
vKios <= 2.0.0 (products.php cat) Remote SQL Injection Exploit
No description provided by source. !/usr/bin/perl Indonesian Newhack Security Advisory ------------------------------------ vKios = 2.0.0 products.php cat Remote SQL Injection Exploit Waktu : Feb 8 2008 10:00PM Software : vKios Versi : = 2.0.0 Vendor : http://www.vkios.com/...
CKEditor 4.0.1 - Multiple Vulnerabilities
No description provided by source. =========================================== Vulnerable Software: ckeditor 4.0.1 standard Download: http://download.cksource.com/CKEditor/CKEditor/CKEditor%204.0.1/ckeditor4.0.1standard.zip Vulns: Full Path Disclosure && XSS...
QT-cute QuickTalk Guestbook 1.6 - Multiple Cross-Site Scripting Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/29013/info QT-cute QuickTalk Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script...
Apple QuickTime 7.2/7.3 - RSTP Response Universal Exploit (win/osx)
No description provided by source. Copyright C 2007 Subreption LLC. All rights reserved. Visit http://blog.subreption.com for exploit development notes. References: http://www.milw0rm.com/exploits/4648 original Microsoft Windows code http://www.milw0rm.com/exploits/4651 recent Microsoft Windows...
XMB <= 1.9.6 Final basename() Remote Command Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo XMB = 1.9.6 Final basename 'langfilenew' arbitrary local inclusion / remote commands xctn\n; echo by rgod [email protected]\n; echo site: http://retrogod.altervista.org\n; echo dork: \Powered by XMB\n\n; / works...
FOSCAM IP-Cameras Improper Access Restrictions
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...
CMS Balitbang 3.3 Arbitary File Upload Vulnerability
No description provided by source. =================================================================== CMS Balitbang v.3.3 Arbitary file upload vulnerability =================================================================== Software: CMS Balitbang Vendor: www.kajianwebsite.org Vuln Type: Arbita...
AutoLinks 2.1 Pro Al_initialize.PHP Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14686/info AutoLinks Pro is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrar...