56796 matches found
Photodex ProShow Gold/Producer 5.0.3310 & 6.0.3410 - ScsiAccess Local Privilege Escalation
No description provided by source. Exploit-DB Note: Vuln still in 6.0.3410 as well as 'Photodex ProShow Gold' Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: Photodex ProShow Producer Vendor URL: www.photodex.com Type: Incorrect Default...
Xpient Cash Drawer Operation Vulnerability
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Xpient Cash Drawer Operation Vulnerability 1. Advisory Information Title: Xpient Cash Drawer Operation Vulnerability Advisory ID: CORE-2013-0517 Advisory URL:...
Oracle Sun GlassFish Enterprise Server - Stored XSS Vulnerability
No description provided by source. Sense of Security - Security Advisory - SOS-11-009 Release Date. 19-Jul-2011 Last Update. - Vendor Notification Date. 23-Mar-2011 Product. Oracle Sun GlassFish Enterprise Server Platform. Java EE Affected versions. 2.1.1 v2.1 Patch069.102 Patch12 build b31g-fcs...
FreePBX <= 2.8.0 Recordings Interface Allows Remote Code Execution
No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2010-005: FreePBX recordings interface allows remote code execution https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt Published: 2010-09-23 Version: 1.0 Vendor: FreePBX http://www.freepbx.org/ Product:...
Apache + PHP 5.x (< 5.3.12 & < 5.4.2) - Remote Code Execution
No description provided by source. !/usr/bin/env python ap-unlock-v2.py - apache + php 5. rem0te c0de execution 0day better version NOTE: - quick'n'dirty VERY UGLYY C=000DEEE IZ N0T MY STYLE : - for connect back shell start netcat/nc and bind port on given host:port - is ip-range scanner not is...
MS11-080 AfdJoinLeaf Privilege Escalation
No description provided by source. MS11-080 - CVE-2011-2005 Afd.sys Privilege Escalation Exploit Author: [email protected] - Matteo Memelli Spaghetti & Pwnsauce yuck! 0xbaadf00d Elwood@mac&cheese.com Thx to dookielifesaver2000ca, dijital1 and ronin for helping out! To my Master Shifu muts: "So...
DX Studio Player < 3.0.29.1 Firefox plug-in Command Injection Vuln
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ DX Studio Player Firefox plug-in command injection 1. Advisory Information Title: DX Studio Player Firefox plug-in command injectio...
Linux group_info refcounter - Overflow Memory Corruption
No description provided by source. / DoS poc for CVE-2014-2851 Linux groupinfo refcounter overflow memory corruption https://lkml.org/lkml/2014/4/10/736 @Tohmaxx - http://thomaspollet.blogspot.be If the app doesn't crash your system, try a different count argv1 Execution takes a while because 2^3...
HP Data Protector EXEC_BAR Remote Command Execution
No description provided by source. import argparse import socket Exploit Title: HP Data Protector EXECBAR Remote Command Execution Exploit Author: Chris Graham @cgrahamseven CVE: CVE-2013-2347 Date: February 14, 2014 Vendor Homepage: www.hp.com Version: 6.10, 6.11, 6.20 Tested On: Windows Server...
MayGion IP Cameras Firmware 09.27 - Multiple Vulnerabilities
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...
Adobe Flash Player 11.3 Font Parsing Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
@lex Guestbook <= 4.0.2 - Remote Command Execution Exploit
No description provided by source. !/usr/bin/php ?php // | | header @lex Guestbook = 4.0.2 Remote Command Execution Exploit | header ======================================================== | status Retrieving the administrator password | sploit AdminUsername::root | sploit AdminPassword::toor |...
Adobe Flash Player Object Type Confusion
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
Java Applet JAX-WS Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class...
Blender 2.34, 2.35a, 2.4, 2.49b .blend File Command Injection
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Blender .blend Project Arbitrary Command Execution 1. Advisory Information Title: Blender .blend Project Arbitrary Command Executio...
Squirrelmail 1.4.x Redirect.PHP Local File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/18231/info SquirrelMail is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. A successful exploit may allow unauthorized users to view files and to execute local script...
Luca Deri ntop 1.2 a7-9/1.3.1 - Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1576/info ntop is a network usage monitoring tool for unix systems. It can be invoked at the console or as a server daemon, presenting statistics information via http with the -w parameter. In this mode, it is vulnerable ...
Powered by iNetScripts: Shell Upload Vulnerability
No description provided by source. ==================================================== Powered by iNetScripts: Shell Upload Vulnerability ==================================================== Contact :Sec-q8 [email protected] Published: 2010-04-25 Home : http://Sec-Senter.com/vb ========= Exploi...
galleria Mambo Module <= 1.0b Remote File Include Vulnerability
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register class TestPOCPOCBase: vulID = '63674' ssvid version = '1.0' author = '皮皮' vulDate = '2006-07-03' createDate = '2015-12-24...
Max's Image Uploader Shell Upload Vulnerability
PHP F1 Max's Image Uploader 1.0版本的maxImageUpload/index.php中存在无限制文件上传漏洞。 当Apache未被设置来处理具有pjpeg或jpeg扩展名的拟态文件时，远程攻击者可以通过上传具有一个pjpeg或jpeg扩展名的文件，执行任意代码，并借助对original/的一个直接请求来访问该文件。 问题在maxImageUpload.class.php中的 function uploadImage $result = true; if !isset$POST'submitBtn' $this-showUploadForm; else $m...
MS IIS 4.0/5.0 and PWS Extended Unicode Directory Traversal Vulnerability (5)
No description provided by source. source: http://www.securityfocus.com/bid/1806/info Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot ../ directory traversal exploitation if extended UNICODE character representations are used in substitution for / and . Unauthenticated users may acces...
Yealink VoIP Phone SIP-T38G - Remote Command Execution
No description provided by source. Title: Yealink VoIP Phone SIP-T38G Remote Command Execution Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5758 Description: Using cgiServer.exx we are ab...
Joomla Mosets Tree <= 1.0 - Remote File Include Vulnerability
No description provided by source. !!!!!!!!!WWW.SiBERSAVASCiLAR.COM!!!!!!!!! -------------------------------------------------------------------------------- Title : Joomla Mosets Tree = 1.0 Remote File Include Vulnerability...
BBS E-Market Professional bf_130 (1.3.0) - Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11146/info BBS E-Market Professional is reported to be affected by a remote file include vulnerability that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable system...
Invision Power Board <= 3.3.4 "unserialize()" PHP Code Execution
No description provided by source. ?php / ---------------------------------------------------------------- Invision Power Board = 3.3.4 unserialize PHP Code Execution ---------------------------------------------------------------- author..............: Egidio Romano aka EgiX mail...................
MS FrontPage 98 Server Extensions for IIS,MS InterDev 1.0 Filename Obfuscation
No description provided by source. source: http://www.securityfocus.com/bid/1108/info Two dlls dvwssr.dll and mtd2lv.dll included with the FrontPage 98 extensions for IIS and shipped as part of the NT Option Pack include an obfuscation string that manipulates the name of requested files. Knowing...
Sun Java Runtime and Development Kit <= 6 Update 10 - Calendar Deserialization Exploit
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
bitweaver 2.8.1 - Multiple Vulnerabilities
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2012-016: Multiple Vulnerabilities in Bitweaver Published: 10/23/2012 Version: 1.0 Vendor: Bitweaver http://www.bitweaver.org/ Product: Bitweaver Version affected: 2.8.1 and earlier versions Product description: Bitweav...
PHPDug 2.0.0 - Multiple Vulnerabilities
No description provided by source. Vulnerability ID: HTB22971 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpdug.html Product: PHPDug Vendor: Kubelabs.com http://www.kubelabs.com/ Vulnerable Version: 2.0.0 and probably prior versions Vendor Notification: 21 April 2011 Vulnerability Type:...
Adobe Flash Player AVM Verification Logic Array Indexing Code Execution
No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit...
Adobe Reader and Acrobat
No description provided by source. Author : Ahmed Obied [email protected] This program generates a PDF file that exploits a vulnerability CVE-2009-4324 in Adobe Reader and Acrobat. The generated PDF file was tested using Adobe Reader 9.2.0 on Windows XP SP3. The exploit's payload spawns the...
Mozilla Firefox CSS - font-face Remote Code Execution Vulnerability
No description provided by source. ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moabu-15-mozilla-firefox-css-font-face-remote-code-execution-vulnerability/...
zenphoto 0.9/1.0 index.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/17779/info Zenphoto is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...
CMS Made Simple <= 1.6.2 - Local File Disclosure Vulnerability
No description provided by source. CMS Made Simple = 1.6.2 Class: LFI Reported: 29/07/2009 Public release: 10/08/2009 Remote: Yes DORK: This site is powered by CMS Made Simple version 1. Site: http://www.cmsmadesimple.org/ Download:...
Wordpress Spider Catalog Plugin 1.4.6 - Multiple Vulnerabilities
No description provided by source. waraxe-2013-SA105 - Multiple Vulnerabilities in Spider Catalog Wordpress Plugin =================================================================================== Author: Janek Vind waraxe Date: 22. May 2013 Location: Estonia, Tartu Web:...
SAP Netweaver Dispatcher Multiple Vulnerabilities
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ SAP Netweaver Dispatcher Multiple Vulnerabilities 1. Advisory Information Title: SAP Netweaver Dispatcher Multiple Vulnerabilities Advisory ID: CORE-2012-0123 Advisory URL:...
Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability
No description provided by source. ScanAlert Security Advisory - http://www.scanalert.com Directory Listing in Apache Tomcat 5.x.x Date: 07/21/2006 Vendor: Apache Package: Tomcat Versions: 5.x.x 5.0.28, 5.5.12, 5.5.9, and 5.5.7 . Confirmed Credit: ScanAlert.s Enterprise Services Team. Overview:...
Huawei E355信息泄漏和跨站请求伪造漏洞
Bugtraq ID:66017 CVE ID:CVE-2013-6031 Huawei E355是一款家用SOHO路由器设备。 Huawei E355存在信息泄漏和跨站请求伪造漏洞，通过直接访问/api脚本，攻击者可利用漏洞获取敏感信息。此外构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 0 Huawei E355 目前没有详细解决方案提供： http://www.huawei.com/ This module requires Metasploit: http//metasploit.com/download Current source:...
部分万户EIP v3.0 未授权访问导致任意上传和路径泄露
简要描述： 万户EIP v3.0 任意上传和路径泄露 详细说明： 今天在对时代传媒集团渗透的过程中发现的这个问题，并通过google发现是通用型的 时代传媒http://www.chinatmg.com 首先是用工具跑出了源码http://www.chinatmg.com/chinatmg.rar 艹，居然近400mb，面对渣渣的网速我想还是算了，把资源留给迅雷云播同志，管理员显然安全意识不足，不如找找有没有其他的收获 然后首先发现几个目录的遍历： http://www.chinatmg.com/whirsystem/module/...
Adobe Flash Player及AIR远程内存破坏漏洞(CVE-2013-5330)(apsb13-26)
BUGTRAQ ID: 63680 CVECAN ID: CVE-2013-5330 Adobe Flash Player是一个集成的多媒体播放器。Adobe AIR 运行时能让开发人员将相同的代码打包到 iPhone、iPad、Kindle Fire、Nook Tablet 和其它 Android 设备的本机应用程序中。 Adobe Flash Player及AIR在实现上存在内存破坏导致的远程代码执行漏洞，成功利用后可能会使远程攻击者完全控制受影响系统。受影响版本包括： Adobe Flash Player versions 11.9.900.117 for...
Apusic 弱密码漏洞
apusic的全部版本里默认情况下， 可用弱口令登录，从而导致攻击者可据此信息进行后续攻击。 所有版本...
Apache ActiveMQ web demos多个跨站脚本漏洞(CVE-2012-6092)
CVE ID:CVE-2012-6092 Apache ActiveMQ是一款开源消息总线，支持JMS1.1和J2EE 1.4规范的JMS Provider实现。 Apache ActiveMQ web demos存在多个跨站脚本漏洞，允许远程攻击者通过PortfolioPublishServlet.java的refresh参数也即/demo/portfolioPublish或Market Data...
Microsoft Internet Explorer 不明细节远程代码执行漏洞(CVE-2013-2551)
No description provided by source...
Linux Kernel 'cdc-wdm' USB设备驱动程序堆缓冲区溢出漏洞
BUGTRAQ ID: 58510 CVECAN ID: CVE-2013-1860 Linux Kernel是Linux操作系统的内核。 Linux kernel的USB CDC WDM驱动程序在实现上存在堆缓冲区溢出漏洞，未授权的本地用户可利用此漏洞造成内核崩溃或提升其权限。要利用此漏洞需要物理接触系统或插入随机USB设备。 0 Linux kernel 3.x Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/...
DedeCMS 5.7 /include/shopcar.class.php 后门
No description provided by source...
Linux Kernel 空指针引用拒绝服务漏洞(CVE-2012-5517)
Bugtraq ID:56527 CVE ID:CVE-2012-5517 Linux是一款开源的操作系统。 处理新节点热添加hot-added内存扩展到其他节点管理区链表zonelist时存在一个空指针应用漏洞，允许非特权本地用户利用此漏洞使系统崩溃。 0 Linux kernel 2.6.x 用户可参考如下厂商提供的安全公告获得补丁信息： http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=08dff7b7d629807dbb1f398c68dd9cd58dd657a1...
Ruby on Rails 'strip_tags()'跨站脚本执行漏洞
BUGTRAQ ID: 54957 CVE ID: CVE-2012-3465 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails 3.0.17之前的3.x版本、3.1.8之前的3.1.x版本、3.2.8之前的3.2.x版本内actionpack/lib/actionview/helpers/sanitizehelper.rb在实现上存在XSS漏洞，可允许远程攻击者通过畸形HTML标记注入任意Web脚本或HTML。 0 Ruby on Rails Ruby on Rails 3.x...
cmseasy xss+后台getshell
简要描述： xss盗取 cookie进后台，某处可注入代码，传webshell 详细说明： 1:页面搜索位置出现xss未进行任何过滤,本来应该是反射型的xss，但后台的 "热门搜索词" 功能记录了用户搜索的所有记录； 当管理员查看 内容-热门搜索词 版块时，被xss攻击盗cookie； 2:利用盗取的cookie进后台，进入 模板-当前模板编辑 模块； 在模板编辑处任何一个html文件插入php可执行代码 ；再次访问首页，出现phpinfo 页面； 由于我测试的版本是4.8,wooyun前几天也报了一个搜索型xss，应该跟我的一样吧; 不过看官方的xss补丁，只适用于5.x的升级；...
Microsoft IE OnBeforeDeactivate事件远程代码执行漏洞 (MS12-037)
CVE ID: CVE-2012-1878 Microsoft Internet Explorer是微软公司推出的一款网页浏览器。 IE访问已经删除的对象时存在远程代码执行漏洞，攻击者可利用当前用户权限执行任意代码以破坏内存。 0 Microsoft Internet Explorer 9.x Microsoft Internet Explorer 8.x Microsoft Internet Explorer 7.x Microsoft Internet Explorer 6.x 临时解决方法： 如果您不能立刻安装补丁或者升级，SEBUG建议您采取以下措施以降低威胁：...
WordPress wpStoreCart 2.5.29 Shell Upload
No description provided by source. Description : Wordpress Plugins - wpStoreCart Arbitrary File Upload Vulnerability Version : 2.5.27 - 2.5.29 Link : http://wordpress.org/extend/plugins/wpstorecart/ Plugins : http://downloads.wordpress.org/plugin/wpstorecart.2.5.29.zip Date : 03-06-2012 Google Do...