56796 matches found
Zikula CMS 1.3.5 - Multiple Vulnerabilities
No description provided by source. Document Title: =============== Zikula CMS v1.3.5 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1114 Release Date: ============= 2013-10-16 Vulnerability Laboratory ID VL-ID:...
Naxtor Shopping Cart 1.0 Shop_Display_Products.PHP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14456/info Naxtor Shopping Cart is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitati...
Commercial Interactive Media SCOOP! 2.3 prePurchaserRegistration.asp Invalid Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/16015/info Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...
Nvidia (nvsvc) Display Driver Service - Local Privilege Escalation
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex' require 'msf/core/post/common' require 'msf/core/post/windows/priv' require...
UseBB 1.0.7 install/upgrade-0-3.php PHP_SELF Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/24990/info UseBB is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in...
TechSmith Snagit 10 (Build 788) DLL Hijacking Exploit (dwmapi.dll)
No description provided by source. / TechSmith Snagit 10 Build 788 Dll Hijacking Exploit By: Encrypt3d.M!nd Date: 25\8\2010 Download: http://www.techsmith.com/download/snagittrial.asp Details: Compile the following code and rename it to dwmapi.dl and place file with one of the affected types in t...
Android Zygote - Socket Vulnerability Fork bomb Attack
No description provided by source. BootReceiver.java / Android Application that performs the fork bomb attack http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3918 Further informations can be found at http://www.ai-lab.it/bugAndroid/bugAndroid.html @author Luca Verderame...
mnoGoSearch 3.3.12 (search.cgi) - Arbitrary File Read
No description provided by source. ----------------------------------------------------------- PT-2013-17 Positive Technologies Security Advisory Arbitrary Files Reading in mnoGoSearch ----------------------------------------------------------- --- Vulnerable software mnoGoSearch Version: 3.3.12...
Acoustica MP3 Audio Mixer 2.471 Extended M3U directives SEH
No description provided by source. Exploit Title: Acoustica MP3 Audio Mixer 2.471 Extended M3U directives SEH Date: September 8 2010 Author: Carlos Hollmann Software Link: http://www.acoustica.com/downloading.asp?p=1 Version: 2.471 Tested on: Windows xp sp3 running on VMware Fusion 3.1 and...
ProFTPD 1.2.7 - 1.2.9rc2 Remote Root & brute-force Exploit
No description provided by source. / ProFTPd 1.2.7 - 1.2.9rc2 remote r00t exploit -------------------------------------------- By Haggis This exploit builds on the work of bkbll to create a working, brute-force remote exploit for the \n procesing bug in ProFTPd. Tested on SuSE 8.0, 8.1 and RedHat...
HP OpenView NNM getnnmdata.exe CGI Invalid Hostname Remote Code Execution
No description provided by source. Exploit Title: HP OpenView NNM getnnmdata.exe CGI Invalid Hostname Remote Code Execution Date: 2010.07.02 Author: S2 Crew Hungary Software Link: hp.com Version: 7.53 Tested on: Windows 2003 CVE: CVE-2010-1555 Code : !/usr/bin/python import struct import socket...
Coppermine Photo Gallery <= 1.4.20 (IMG) Privilege Escalation Exploit
No description provided by source. !/usr/bin/perl inphex - inphex0 at gmail dot com based on http://milw0rm.com/exploits/8114 - found by StAkeR In case this does not work check out posLine 80 and find another value for it use IO::Socket; use LWP::UserAgent; use LWP::Simple; use HTTP::Cookies; $1 ...
Interactivefx.ie CMS SQL Injection Vulnerability
No description provided by source. ================================================ Interactivefx.ie CMS SQL Injection Vulnerability ================================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ ...
Adobe Reader and Acrobat
No description provided by source. Author : Ahmed Obied [email protected] This program generates a PDF file that exploits a vulnerability CVE-2009-4324 in Adobe Reader and Acrobat. The generated PDF file was tested using Adobe Reader 9.2.0 on Windows XP SP3. The exploit's payload spawns the...
DMXReady Member Directory Manager <= 1.1 - SQL Injection Vulnerability
No description provided by source. Title : DMXReady Member Directory Manager = 1.1 SQL Injection Vulnerability Author : ajann Contact : : S.Page : http://www.dmxready.com $$ : 99.97 $ Dork : inurl:incmemberdirectorymanager.asp DorkEx :...
myPHPNuke 1.8.8 Links.php Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6892/info Reportedly, myPHPNuke 'links.php' does not adequately filter HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code...
Linux Kernel < 2.6.31-rc7 - AF_IRDA 29-Byte Stack Disclosure Exploit
No description provided by source. / cve-2009-3002.c Linux Kernel 2.6.31-rc7 AFIRDA getsockname 29-Byte Stack Disclosure Jon Oberheide [email protected] http://jon.oberheide.org Information: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3002 The Linux kernel before 2.6.31-rc7 does not...
MS11-080 AfdJoinLeaf Privilege Escalation
No description provided by source. MS11-080 - CVE-2011-2005 Afd.sys Privilege Escalation Exploit Author: [email protected] - Matteo Memelli Spaghetti & Pwnsauce yuck! 0xbaadf00d Elwood@mac&cheese.com Thx to dookielifesaver2000ca, dijital1 and ronin for helping out! To my Master Shifu muts: "So...
Linux Kernel < 2.6.16.18 - (Netfilter NAT SNMP Module) Remote DoS Exploit
No description provided by source. / ecl-nf-snmpwn.c - 30/05/06 Alex Behar [email protected] Yuri Gushin [email protected] A patch review we did on the 2.6.16.17-18 Linux kernel source tree revealed a restructuring of code in the snmpparsemangle and the snmptrapdecode functions. After further...
Joomla Component JContentSubscription 1.5.8 - Multiple RFI Vulns
No description provided by source. JContentSubscription Joomla Component 1.5.8 Multiply Remote File Include Vulnerability Component : comjcs version 1.5.8 - payable component Dicovered by : NoGe Contact : [email protected]...
Java Applet JAX-WS Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class...
MS WINS ECommEndDlg Input Validation Error
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MS WINS ECommEndDlg Input Validation Error 1. Advisory Information Title: MS WINS ECommEndDlg Input Validation Error Advisory ID: CORE-2011-0526 Advisory URL:...
Adobe Flash Player Regular Expression Heap Overflow
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::BrowserExploitServer def...
逐浪cms两处文件上传漏洞（有服务器环境限制）
简要描述： 也是要结合iis6的解析漏洞，不知道这两处跟之前提交的会不会重复 详细说明： 由于官网不是iis6的环境 我本地进行测试 第一处 http://127.0.0.1/Plugins/ckfinder/ckfinder.html 在左边文件夹Files下新建字幕了1.asp 然后点击1.asp目录然后上传图片木马3.gif 然后右键查看文件 就可以看到文件地址了 文件地址 http://127.0.0.1/UploadFiles/files/1.asp/3.GIF 第二处 http://127.0.0.1/plugins/imageupload.aspx protected vo...
Apache Xalan-Java FEATURE_SECURE_PROCESSIN属性处理安全绕过漏洞
CVE ID:CVE-2014-0107 Apache Xalan-Java是一个使用Java和C++来实现XSLT库的项目。 Apache Xalan-Java处理部分输出属性时存在错误，允许攻击者利用漏洞绕过安全处理特性FEATURESECUREPROCESSING，可访问受限属性或加载任意受限类。 0 Apache Xalan-Java 2.7.0 用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞： https://issues.apache.org/jira/browse/XALANJ-2435...
Microsoft Windows Security Account Manager Remote协议安全限制绕过漏洞
BUGTRAQ ID: 66012 CVECAN ID: CVE-2014-0317 Windows是一款由美国微软公司开发的窗口化操作系统。 Security Account Manager Remote SAMR协议没有正确验证用户锁定状态，在实现上存在安全功能绕过漏洞。 0 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2003 厂商补丁： Microsoft ---------...
Huawei E355信息泄漏和跨站请求伪造漏洞
Bugtraq ID:66017 CVE ID:CVE-2013-6031 Huawei E355是一款家用SOHO路由器设备。 Huawei E355存在信息泄漏和跨站请求伪造漏洞，通过直接访问/api脚本，攻击者可利用漏洞获取敏感信息。此外构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 0 Huawei E355 目前没有详细解决方案提供： http://www.huawei.com/ This module requires Metasploit: http//metasploit.com/download Current source:...
Schneider Electric Telvent SAGE 3030 RTU远程拒绝服务漏洞
BUGTRAQ ID: 65262 CVECAN ID: CVE-2013-6143 Telvent SAGE 3030 RTU是工业数据通信设备。 Telvent SAGE 3030 RTU C3413-500-001D3P4、C3413-500-001F0PB处理某些输入时，DNP3服务存在错误，可导致崩溃，造成拒绝服务。 0 Schneider Electric Telvent SAGE 3030 RTU C3413-500-001F0PB Schneider Electric Telvent SAGE 3030 RTU C3413-500-001D3P4 厂商补丁：...
SiteServer 3.6.4 background_contentsGroup.aspx SQL注入漏洞
SiteServer 3.6.4 /siteserver/cms/backgroundcontentsGroup.aspx文件使用了位于/Bin/SiteServer.CMS.dll代码，在接收GroupName参数没有合适过滤，导致SQL注入漏洞。 0 SiteServer 3.6.4 升级到官方最新版： http://www.siteserver.cn...
DedeCMS 5.7 /include/dialog/config.php 跨站脚本漏洞
No description provided by source...
laoy8 2.5 /Editor/asp/config.asp 代码执行漏洞
No description provided by source...
MongoDB权限提升漏洞(CVE-2013-4650)
CVE ID: CVE-2013-4650 MongoDB是一个高性能，开源，无模式的文档型数据库，是当前NoSql数据库中比较热门的一种 MongoDB处理权限检查存在一个安全漏洞，允许借助任意数据库中的system用户名来获得内部系统权限 0 MongoDB 2.4.0-2.4.4 MongoDB 2.5.0 厂商解决方案 MongoDB 2.4.5或2.5.1已经修复此漏洞，建议用户下载更新： http://www.mongodb.org...
WordPress 3.5.1 crypt_private()远程拒绝服务漏洞(CVE-2013-2173)
No description provided by source...
JBoss Enterprise Application Platform安全绕过漏洞
CVE ID:CVE-2012-4550 JBOSS是一个基于J2EE的开放源代码的应用服务器。 当使用基于角色的授权用于Enterprise Java Beans EJB访问时，必须使用JACC权限来判断访问；但是存在一个安全漏洞没有调用配置的授权模块JACC, XACML等，使得JACC权限没有用来判断EJB访问，允许远程攻击者获得对EJB的未授权访问。 0 JBoss Enterprise Application Platform 即JBoss EAP或JBEAP 6.0.1之前版本 厂商解决方案 JBoss Enterprise Application Platform...
OpenLDAP LDAP搜索请求远程拒绝服务漏洞
BUGTRAQ ID: 52404 CVECAN ID: CVE-2012-1164 OpenLDAP是一款开放源代码的轻量级目录访问协议（LDAP）实现。 OpenLDAP在实现上存在远程拒绝服务漏洞，攻击者可利用此漏洞使受影响slapd服务器崩溃，造成拒绝服务。 0 OpenLDAP 2.4.30 厂商补丁： OpenLDAP -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.openldap.org/software/release/changes.html...
SHOPEX 4.8.5 注入漏洞以及后台拿SHELL
简要描述： SHOPEX 4.8.5 注入漏洞以及后台拿SHELL shopex很久没有更新了啊亲，非得每次出漏洞了才更新一下下吗？ wooyun提示：漏洞在上报乌云之前已经在外界披露，请紧急处理 详细说明： SHOPEX 4.8.5 注入漏洞以及后台拿SHELL 漏洞文件： 漏洞核心函数 \core\modelv5\trading\mdl.goods.php 漏洞代码： None 拿shell方法…. 第一步 页面管理 修改模版 然后选一个XML编辑 开始用 live http 抓包 你们懂的 然后把第一个POST包给抓出来 然后改包 包要这么改 我研究了半天 尼玛的菊花红...
Drupal 7.x 核心路径泄露漏洞
BUGTRAQ ID: 53454 Drupal是一款开放源码的内容管理平台。 Drupal 7.14之前版本在实现上存在路径泄露漏洞，通过错误信息中泄露安装路径的index.php的q参数，includes/bootstrap.inc内的requestpath函数可允许远程攻击者获取敏感信息。 0 Drupal 7.x 厂商补丁： Drupal ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.drupal.org/ http://localhost/?q=x ------------------------------------...
PHP 5.3.x目录遍历漏洞
BUGTRAQ ID: 53403 CVE ID: CVE-2012-1172 PHP是一种HTML内嵌式的语言，PHP与微软的ASP颇有几分相似，都是一种在服务器端执行的嵌入HTML文档的脚本语言，语言的风格有类似于C语言，现在被很多的网站编程人员广泛的运用。 PHP在实现上存在目录遍历漏洞，远程攻击者可利用带有目录遍历序列的特制请求检索、破坏或上传任意位置上的任意文件。 0 PHP 5.3.x 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.php.net...
PHP 5.3.8 'tidy_diagnose()'空指针引用拒绝服务漏洞
Bugtraq ID: 51992 CVE ID：CVE-2012-0781 PHP是一种HTML内嵌式的语言 PHP 5.3.8中的tidydiagnose函数不正确过滤特制的输入，远程攻击者可以利用漏洞向应用程序提交恶意输入使Tidy::diagnose对非法对象进行操作，可触发空指针引用而使应用程序崩溃 0 PHP 5.3.8 厂商解决方案 PHP ----- 用户可参考如下供应商提供安全公告获得补丁信息： http://svn.php.net/viewvc?view=revision&revision=319254 Red Hat Enterprise Linux...
Adobe Reader U3D数据处理代码执行漏洞
BUGTRAQ ID: 50922 CVE ID: CVE-2011-2462 Adobe Reader也被称为Acrobat Reader是美国Adobe公司开发的一款优秀的PDF文档阅读软件。Acrobat是1993年推出针对企业、技术人员和创意专业人士的系列产品，使智能文档的传送和协作更为灵活、可靠和安全。 Adobe Acrobat和Reader在处理U3D数据中包含的畸形结构时存在内存破坏漏洞，攻击者可利用此漏洞造成崩溃并完全控制受影响系统 Adobe Reader 9.x Adobe Reader 10.x 临时解决方法：...
Android 'vold'释放后使用本地特权提升漏洞
Bugtraq ID: 50598 CVE ID：CVE-2011-4123 Open Handset Alliance Android是一款超过30家科技与移动电话公司所组成的团体开发的免费的移动电话平台。 在Android平台上"log"组的本地用户向vold "volume daemon"发送畸形消息，可触发基于栈的缓冲区溢出。通过释放任意堆对象触发释放后使用错误，可在所有Froyo 2.2.x和Gingerbread 2.4.x设备上提升特权。不过看起来在Honeycomb 3.x中已经得到修补。 Open Handset Alliance Android 2.3.5 Open...
Apple QuickTime 7.7.1之前版本视频文件处理远程代码执行漏洞
BUGTRAQ ID: 50400 CVE ID: CVE-2011-3248 QuickTime是由苹果电脑所开发的一种多媒体架构，能够处理许多的数字视频、媒体段落、音效、文字、动画、音乐格式，以及交互式全景影像的数项类型。 Apple QuickTime 7.7.1之前版本在处理特制视频文件时存在签名问题导致的远程代码执行漏洞，攻击者可利用此漏洞以当前用户权限执行任意代码。 Apple QuickTime Player 7.x 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://support.apple.com/...
Linux Kernel < 2.6.37-rc2 ACPI custom_method Privilege Escalation
No description provided by source. / american-sign-language.c Linux Kernel 2.6.37-rc2 ACPI custommethod Privilege Escalation Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4347 This custommethod file allows to inject...
Mozilla Firefox Modal调用跨域信息泄露漏洞
BUGTRAQ ID: 44252 CVECAN ID: CVE-2010-3178 Firefox是一款非常流行的开源WEB浏览器。 如果网页打开了新的窗口并使用javascript: URL执行modal调用，如alert，且之后将网页导航到了不同的域，则modal调用返回到窗口的打开程序就可以访问所导航到窗口中的对象。这违反了同源策略，允许用户窃取其他网站的敏感信息。 Mozilla Firefox 3.6.x Mozilla Firefox 3.5.x Mozilla Thunderbird 3.1.x Mozilla Thunderbird 3.0.x Mozilla...
Sun Java Web Server 7.0 u7 Exploit with DEP bypass
No description provided by source. Exploit Title: SJWSexv2 Date: 09/07/2010 Author: dmc Software Link: download link if available Version: 7.0 u7 Tested on: Windows XP SP3 - with and without DEP CVE : CVE-2010-0361 / Sun Java Web Server Exploit v2 Tested on: Sun Java Web Server 7.0 update 7 - XP...
Linux kernel 2.6.x nfs_wait_on_request函数本地拒绝漏洞
CVE ID: CVE-2010-1087 Linux Kernel是开放源码操作系统Linux所使用的内核 Linux Kernel的fs/nfs/pagelist.c文件中的nfswaitonrequest函数中存在拒绝服务漏洞。VM/VFS不允许mapping-aops-invalidatepage失败，但如果出现了fatal signal的话nfswbpagecancel可能会失败。由于NFS代码假设只要回写仍活动页面就会保持映射，因此可能出现拒绝服务的情况 Linux kernel 2.6.x 厂商补丁： Linux -----...
CityAdmin suffers from a remote blind SQL injection vulnerability
No description provided by source. .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Team : Sec Attack Team .:. Home : www.sec-attack.com/vb .:. Script : cityadmin .:. Download Script: http://www.redcow.ca/products/cityadmin/ .:. Bug Type : Blind Sql Injection .:. Dork : "Powered by cityadmin and Red...
Jevonweb Guestbook Remote Admin Access Exploit
No description provided by source. Vendor: http://www.jevonweb.f2s.com/ Version: 1.0 Tested on: Windows and Linux --------------------------------------- Jevonweb Guestbook Remote Admin Access Exploit Author: Sora Contact: [email protected] Google Dork: "Jevonweb Guestbook"...
Adobe Reader和Acrobat newplayer() JavaScript方式内存破坏漏洞
BUGTRAQ ID: 37331 CVE ID: CVE-2009-4324 Adobe Acrobat和Reader都是非常流行的PDF文件阅读器。 Adobe Reader和Acrobat阅读器支持JavaScript。Doc.media对象的newplayer方式存在释放后使用漏洞，可能触发可利用的内存访问破坏。远程攻击者可以通过使用ZLib压缩流的特制PDF文件来利用这个漏洞，导致执行任意代码。 Adobe Acrobat = 9.2 Adobe Reader = 9.2 临时解决方法： 禁用JavaScript。 禁止使用Doc.media.newPlayer方式。 厂商补丁...
PHP 'htmlspecialcharacters()'畸形多字节字符跨站脚本漏洞
Bugraq ID: 37389 CVE ID：CVE-2009-4142 PHP是一款流行的网络编程语言。 htmlspecialchars函数不严格检查多字节序列，远程攻击者可以利用漏洞进行跨站脚本攻击。 PHP PHP 5.2.11 PHP PHP 5.2.10 PHP PHP 5.2.9 PHP PHP 5.2.8 PHP PHP 5.2.7 PHP PHP 5.2.6 PHP PHP 5.2.5 PHP PHP 5.2.4 PHP PHP 5.2.3 PHP PHP 5.2.2 PHP PHP 5.2.1 PHP PHP 5.2 PHP...