56796 matches found
Foscam IP Video Camera CGIProxy.fcgi SMTP Test User Parameter Configuration Command Injection Vulnerability(CVE-2017-2842)
Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...
Ledger CLI Account Directive Use-After-Free Vulnerability(CVE-2017-2808)
Summary An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger th...
WebKit: use-after-free in WebCore::RenderObject with accessibility enabled(CVE-2017-7046)
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector simply opening the...
VirtualBox: unprivileged host user -> host kernel privesc via ALSA config（ CVE-2017-3576）
This is another way to escalate from an unprivileged userspace process into the VirtualBox process, which has an open file descriptor to the privileged device /dev/vboxdrv and can use that to compromise the host kernel. The issue is that, for VMs with ALSA audio, the privileged VM host process...
Windows Kernel stack memory disclosure in win32kfull!SfnINLPUAHDRAWMENUITEM (CVE-2017-0167)
We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 10 indirectly through the win32k! NtUserPaintMenuBar system call, or more specifically, through the user32! fnINLPUAHDRAWMENUITEM user-mode callback 107 on Windows...
2017 Visual Studio Code Workspace settings code execution
The following issue constitutes an arbitrary code execution vulnerability in Visual Studio Code herein referred to as "Code". Users should upgrade to Code 1.9.0 or later. says: Visual Studio Code is a source code editor developed by Microsoft for Windows, Linux and macOS. It includes support for...
Android Arbitrary class loading and instantiation in protobuf parcelable "javanano" compiler
The protobuf library includes the "javanano" compiler, commonly used in many Android applications due to its tiny resource footprint. The "javanano" compiler supports a variety of Android-specific compilation flags which can be used to modify the generated message classes. One such compilation fl...
天融信TopApp-AD /acc/network/redial_pppoe.php等多处命令执行漏洞
No description provided by source...
用友GRP-U8财务管理软件 /R9iPortal/cm/cm_info_list.jsp文件itype_id参数SQL注入漏洞
No description provided by source...
dedecms v5.7缓存文件data/cache/typename.inc导致任意代码执行（有条件）
No description provided by source...
用友GRP-U8 系统登陆处参数UserNameText 存在SQL注入
No description provided by source...
用友优普U8系统 /Server/CmxGetAppNameByUserName.php等2处 SQL注入漏洞
0x01漏洞简介 用友优普U8系统在以下2处存在SQL注入漏洞： 1/Server/CmxGetAppNameByUserName.php 参数User 2/Server/CmxCS.php 参数pgid 远程攻击者无需登陆，可以利用该漏洞执行SQL指令。 0x02漏洞利用 1sql注入1 sqlmap.py -u "...:8080/Server/CmxCS.php?pgid=CSRemove" --dbms mysql --technique T --cookie "RASAdminUserInfoUserName=1" --data "CSID=1&CSID=1" -p CSID ...
CMSTOP媒体云 /gallery/index/list 任意文件上传
No description provided by source...
SAP HANA hdbindexserver - Memory corruption
No description provided by source...
shop7z 商城系统在/Advsearchadmin.asp 处参数kindnum存在SQL注入漏洞
0x01漏洞简介 shop7z商城系统在Advsearchadmin.asp 处的参数kindnum由于过滤不严，存在kindnumSQL注入漏洞。远程攻击者可以利用该漏洞执行任意SQL指令。 0x02漏洞分析 Advsearchadmin.asp代码如下： kindnum=trimrequest"kindnum" pipai=trimrequest"pipai" model=trimrequest"model" productname=trimrequest"productname" price11=trimrequest"price11"...
B&B ELECTRONICS XR5i v2E/XR5i v2/XR5i/XR5i SL 弱口令
参考链接: http://www.cd.lucom.de/vpn-industrie-router/dokumentation/handbuch/xr5iv2e-guide.pdf...
青果软件手机APP掌上校园某处XSS盲打以打到后台和cookies
简要描述： 提交的没通过，说是要完整的问题复现也是醉了。。。。。在提交一次 详细说明： 漏洞利用代码： 这是同IP的网站的确隶属于湖南青果软件有限公司： 漏洞证明： 漏洞证明 https://images.seebug.org/upload/201511/101343187fd9a31ae8eea7f5a2...
金蝶销管家逻辑缺陷重置任意用户密码(工作人员账户测试/秒改)
简要描述： 可绕过验证码直接修改用户密码。 详细说明： 0x1:先信息收集一些工作人员的账户用来测试，来证明漏洞的危害性。 13580111111 13752248075 13456231475 13456879564 15578945623 13456231245 13456231245 13648776985 13400002111 13625668852 15018517663 15915533696 13888888888 13456789123 18090700000 13165454756 13654213923 13654213923 13760368754...
万户OA未修补漏洞致多个政府&集团OA中招
简要描述： 该漏洞在7月份已经有人在wooyun报了，可修补效果几乎为0。 详细说明： 瘦蛟舞 提交的漏洞地址： WooYun: 万户OA任意文件上传导致代码执行（多处总结） 漏洞还是瘦蛟舞（http://www.wooyun.org/whitehats/%E7%98%A6%E8%9B%9F%E8%88%9E）提交的漏洞。 于是用google搜索：inurl:7001/defaultroot 有324条记录。 随便测其中一个上传： 被改名的文件名直接返回到页面： 然后访问：...
齐博地方门户鸡肋文件包含造成的高危SQL注入
简要描述： 上个漏洞（http://wooyun.org/bugs/wooyun-2014-080259）忘了说，是可以直接提升为管理的，甚至不用破hash了。 这个洞无需登录可批量，看我是如何化鸡肋为无形的。第三发，齐博一直不确认，不想再放0day了。。。 ps.齐博今天挺火的啊，据说发现了后门？我能告诉你我还发现了其他后门吗。 详细说明： 和以往的故事一样，这个故事很长。有耐心看下去的朋友，且听我娓娓道来。...
TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities
No description provided by source. Title: TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities Date: 30.06.14 Vendor: TP-LINK Affected versions: TL-WR841N / TL-WR841ND Tested on: Firmware Version - 3.13.27 Build 121101 Rel.38183n, Hardware Version - WR841N v8 00000000 at Linux...
shop7 价格处注入
简要描述： price.asp 文件注入 详细说明： price.asp文件 96行 if kind"" then sql="select pkid,model,productname,smallpicpath,price1,price"&session"customkind"&",kindname,pipai,addtime from viewproduct where kind like '"&kind&"%' and updown='1' order by pkid desc" else sql="select...
IBM Algorithmics RICOS 4.5.0 - 4.7.0 - Multiple Vulnerabilities
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140630-0 ======================================================================= title: Multiple severe vulnerabilities product: IBM Algorithmics RICOS vulnerable...
ImageVue 2.0 - Remote Admin Login Exploit
No description provided by source. Author: Sora Software Link: http://www.imagevuex.com/ Version: 2.0 Tested on: Windows and Linux --------------------------------- / ImageVue 2.0 Remote Admin Login Exploit Created by Sora Contact: vhr95zw at hotmail.com / + Google Dork: inurl:/admin/ ImageVue +...
@lex Guestbook <= 4.0.2 - Remote Command Execution Exploit
No description provided by source. !/usr/bin/php ?php // | | header @lex Guestbook = 4.0.2 Remote Command Execution Exploit | header ======================================================== | status Retrieving the administrator password | sploit AdminUsername::root | sploit AdminPassword::toor |...
TechSmith Snagit 10 (Build 788) DLL Hijacking Exploit (dwmapi.dll)
No description provided by source. / TechSmith Snagit 10 Build 788 Dll Hijacking Exploit By: Encrypt3d.M!nd Date: 25\8\2010 Download: http://www.techsmith.com/download/snagittrial.asp Details: Compile the following code and rename it to dwmapi.dl and place file with one of the affected types in t...
Naxtor Shopping Cart 1.0 Shop_Display_Products.PHP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14456/info Naxtor Shopping Cart is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitati...
bitweaver 2.8.1 - Multiple Vulnerabilities
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2012-016: Multiple Vulnerabilities in Bitweaver Published: 10/23/2012 Version: 1.0 Vendor: Bitweaver http://www.bitweaver.org/ Product: Bitweaver Version affected: 2.8.1 and earlier versions Product description: Bitweav...
frontaccounting 1.12 build 31 - Remote File Inclusion Vulnerability
0x01漏洞简介 FrontAccounting 1.12 Build 31的config.php中存在PHP远程文件包含漏洞。远程攻击者可以借助pathtoroot参数中的一个URL，执行任意PHP代码。 0x02漏洞分析 漏洞代码位于config.php文件中，如下所示： includeonce$pathtoroot . "/configdb.php"; includeonce$pathtoroot . "/includes/lang/language.php"; 参数$pathtoroot没有进行正确的处理，导致了文件包含漏洞的产生。 0x03漏洞利用...
myPHPNuke 1.8.8 Links.php Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6892/info Reportedly, myPHPNuke 'links.php' does not adequately filter HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code...
Webkit (Apple Safari < 4.1.2/5.0.2 & Google Chrome < 5.0.375.125) - Memory Corruption
No description provided by source. TITLE: WEBKIT APPLE SAFARI 4.1.2/5.0.2 & GOOGLE CHROME 5.0.375.125 MEMORY CORRUPTION VULNERABILITY TESTED OS: WINDOWS XP SP3 SEVERITY: HIGH CVE-NUMBER: CVE-2010-1813 DISCOVERED DATE: 2010-06-29 FIXED DATE: GOOGLE CHROME 2010-07-26 & APPLE SAFARI 2010-09-08 FIXED...
odlican.net cms 1.5 - Remote File Upload Vulnerability
漏洞分析 upload.php php if isset$POST'pokreni' $targetpath = "files/"; $targetpath = $targetpath . basename $FILES'uploadedfile''name'; ifmoveuploadedfile$FILES'uploadedfile''tmpname', $targetpath echo "Datoteka ". basename $FILES'uploadedfile''name'. " je snimljena na server"; else echo "Došlo je...
Sun Java Applet2ClassLoader - Remote Code Execution Exploit
No description provided by source. $Id: javacodebasetrust.rb 11983 2011-03-16 05:01:29Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms ...
Debian Linux 2.1 apcd Symlink Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/958/info A vulnerability exists in the apcd package, as shipped in Debian GNU/Linux 2.1. By sending the apcd process a SIGUSR1, a file will be created in /tmp called upsstat. This file contains information about the statu...
PHPGroupWare 0.9.14 Tables_Update.Inc.PHP Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/12074/info phpGroupWare is prone to a remote file include vulnerability, potentially allowing the execution of malicious PHP code. This would occur in the context of the affected web server. The tablesupdate.inc.php scrip...
Clipbucket 2.5 - Directory Traversal
No description provided by source. Author: loneferret of Offensive Security Product: ClipBucket Version: 2.5 and maybe older versions Vendor Site: http://clip-bucket.com/ Software Download: http://sourceforge.net/projects/clipbucket/ Software description: ClipBucket is an OpenSource Multimedia...
DMXReady Contact Us Manager <= 1.1 - Remote Contents Change Vuln
No description provided by source. Title : DMXReady Contact Us Manager = 1.1 Remote Contents Change Vulnerability Author : ajann from Turkey Contact : : S.Page : http://www.dmxready.com $$ : 49.97 $ Dork : inurl:inccontactusmanager.asp DorkEx :...
dcam webcam server personal web server 8.2.5 - Directory Traversal vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9273/info It has been reported that the Personal Web Server of DCAM WebCam Server may be prone to a directory traversal vulnerability that may allow a remote attacker to traverse outside the server root directory by using...
GNU libc/regcomp(3) Multiple Vulnerabilities
No description provided by source. source: http://securityreason.com/securityalert/8003 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 GNU libc/regcomp3 Multiple Vulnerabilities Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - - Dis.: 01.10.2010 - - Pub.:...
Coppermine Photo Gallery <= 1.4.20 (IMG) Privilege Escalation Exploit
No description provided by source. !/usr/bin/perl inphex - inphex0 at gmail dot com based on http://milw0rm.com/exploits/8114 - found by StAkeR In case this does not work check out posLine 80 and find another value for it use IO::Socket; use LWP::UserAgent; use LWP::Simple; use HTTP::Cookies; $1 ...
UseBB 1.0.7 install/upgrade-0-3.php PHP_SELF Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/24990/info UseBB is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in...
MS WINS ECommEndDlg Input Validation Error
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MS WINS ECommEndDlg Input Validation Error 1. Advisory Information Title: MS WINS ECommEndDlg Input Validation Error Advisory ID: CORE-2011-0526 Advisory URL:...
Commercial Interactive Media SCOOP! 2.3 prePurchaserRegistration.asp Invalid Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/16015/info Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...
Wordpress HTML5 AV Manager Plugin 0.2.7 - Arbitrary File Upload
No description provided by source. Description : Wordpress Plugins - HTML5 AV Manager for WordPress Shell Upload Vulnerability Version : 0.2.7 Link : http://wordpress.org/extend/plugins/html5avmanager/ Plugins : http://downloads.wordpress.org/plugin/html5avmanager.0.2.7.zip Date : 26-05-2012 Goog...
MayGion IP Cameras Firmware 09.27 - Multiple Vulnerabilities
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...
amoeba cms 1.01 - Multiple Vulnerabilities
No description provided by source. !/usr/bin/python Amoeba CMS v1.01 multiple remote vulnerabilities: Vendor: http://www.amoebacms.com/ Found by: mrme Contact date: 20/12/2010 2:37pm EST SQL Injection: ============= There is quite a few instances of pre/post auth SQL Injection in the web...
CiviCRM for Joomla 4.2.2 - Remote Code Injection
No description provided by source. Exploit Title: joomla component comcivicrm remode code injection exploit Google Dork:Index of /joomla/administrator/components/comcivicrm/civicrm/packages/OpenFlashChart Date: 20/04/2013 Exploit Author: iskorpitx Vendor Homepage: http://civicrm.org Software Link...
Nvidia (nvsvc) Display Driver Service - Local Privilege Escalation
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex' require 'msf/core/post/common' require 'msf/core/post/windows/priv' require...
DMXReady Member Directory Manager <= 1.1 - SQL Injection Vulnerability
No description provided by source. Title : DMXReady Member Directory Manager = 1.1 SQL Injection Vulnerability Author : ajann Contact : : S.Page : http://www.dmxready.com $$ : 99.97 $ Dork : inurl:incmemberdirectorymanager.asp DorkEx :...
Squirrelmail 1.4.x Redirect.PHP Local File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/18231/info SquirrelMail is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. A successful exploit may allow unauthorized users to view files and to execute local script...