56796 matches found
PHP FOpen Safe_Mode限制绕过漏洞
PHP是一款开放源代码的网络编程语言。 PHP存在安全模式绕过问题，远程攻击者可以利用漏洞写文件到其他未授权位置，建立文件并执行。 在PHP 5.2.0中可使用写模式绕过safemode，fopen函数描述如下： - -845-845--- Code from PHP520 ext/standard/file.c START stream = phpstreamopenwrapperexfilename, mode, useincludepath ? USEPATH : 0 | ENFORCESAFEMODE | REPORTERRORS, NULL, context; -...
Novell Netmail NMAP服务STOR命令远程溢出漏洞
Novell NetMail是基于Internet标准消息和安全协议的邮件和日历系统。 NetMail中绑定到TCP 689端口的NMAP服务（nmapd.exe）在处理STOR命令时存在缓冲区溢出漏洞，如果攻击者能够向该命令发送特定参数的话，就可以触发这个溢出，导致执行任意指令。 Novell NetMail 3.52 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://secure-support.novell.com/KanisaPlatform/Publishing/134/3096026f.SALPublic.html...
Headline Portal Engine HPEInc远程文件包含漏洞
Headline Portal Engine是一款基于PHP的WEB应用程序。 Headline Portal Engine不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于多个脚本对用户提交的'HPEinc'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Headline Headline Portal Engine 0.7 Headline Headline Portal Engine 0.6.5 Headline Headline Portal Engine 0.6.1 Headline...
DieselScript Smart Traffic Index.PHP远程文件包含漏洞
DieselScript Smart Traffic是一款基于PHP的WEB应用程序。 DieselScript Smart Traffic不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'index.php'脚本对用户提交的'src'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 DieselScripts Smart Traffic http://www.dieselscripts.com/ http://www.example.com/Script...
Tiny Web图库图象参数远程文件包含漏洞
Tiny Web Gallery是一款基于PHP的图库程序。 Tiny Web Gallery不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是\'image.php\'、\'image.php2\'脚本对用户提交的\'image\'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Tiny Web Gallery 1.5 http://www.tinywebgallery.com/en/index.htm...
JustSystems多个产品缓冲区溢出漏洞
JustSystems是日本的一家软件公司，产品包括多种日文输入和处理工具。 JustSystems的多个产品中存在缓冲区溢出漏洞，如果用户受骗打开了特制文档的话，就会触发这个溢出，导致执行任意指令。 JustSystems Ichitaro viewer 4.0 JustSystems Ichitaro 2005 JustSystems Ichitaro 2004 JustSystems Hanako viewer 1.0 JustSystems Hanako 2006 JustSystems Hanako 2005 JustSystems Hanako 2004 JustSystem...
Mac OS X DS_Store Arbitrary File Overwrite Exploit
No description provided by source. !/usr/bin/perl OSX Finder DSStore arbitrary file overwrite exploit. root version vade79 - [email protected] fakehalo/realhalo this will create a directory called "xfinder" in your home directory, once the root user has modified that directory using Finder in almost...
MS Windows WebDAV Remote PoC Exploit
No description provided by source. // / IIS 5.0 WebDAV -Proof of concept- / / Bug: CAN-2003-0109 / / By Roman Medina-Heigl Hernandez / / aka RoMaNSoFt [email protected] / / Madrid, 23.Mar.2003 / / ================================= / / Public release. Version 1. / / -------------------------------...
Linux Kernel 2.6.13 <= 2.6.17.4 sys_prctl() Local Root Exploit
No description provided by source. // / Local r00t Exploit for: / / Linux Kernel PRCTL Core Dump Handling / / BID 18874 / CVE-2006-2451 / / Kernel 2.6.x = 2.6.13 && 2.6.17.4 / / By: / / - dreyer [email protected] main PoC code / / - RoMaNSoFt [email protected] local root code / / 10.Jul.2006 / //...
BLOG:CMS <= 4.0.0k Remote SQL Injection Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "BLOG:CMS = 4.0.0k sql injection/admin credentials disclosure exploit\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork: "Powered by BLOG:CMS"|"Powered by...
MS Windows (SMB) Transaction Response Handling Exploit (MS05-011)
漏洞描述：Windows SMB客户端在处理SMB响应时存在一个缓冲区溢出漏洞。恶意的SMB服务器可以利用这个漏洞在连接该服务器的SMB客户端主机上执行任意命令。MRXSMB.SYS驱动负责执行SMB客户端操作以及处理SMB服务器返回的响应。一些重要的Windows文件共享操作以及所有的RPC-over-named-pipes操作使用SMB命令Trans25h和Trans232h。一个恶意的SMB服务器通过发送特殊的Transaction响应数据可能导致一个缓冲区溢出漏洞。溢出可能发生在任何这个数据被处理的地方，例如MRXSMB.SYS或其他客户端代码中。例如，如果Trans2...
MS Internet Explorer Object Data Remote Exploit (M03-032)
CVE-ID：CVE-2003-0701CNNVD-ID：CNNVD-200308-125漏洞影响范围：•Microsoft Internet Explorer 5.01 •Microsoft Internet Explorer 5.5 •Microsoft Internet Explorer 6.0 •Microsoft Internet Explorer 6.0 for Windows Server 2003 解决方案：官方已发布升级补丁，请立即升级到最新版本。 titleby malware M03-032 Exploit/title script language=vbs...
Sollae Systems (Serial-Ethernet-Module/Remote-I/O-Device-Server etc.) Telnet-Service Unauthorized access
3,200 Sollae Systems Serial-Ethernet-Module/Remote-I/O-Device-Server etc. Telnet-Service had Exposed on the internet : https://www.zoomeye.org/searchResult?q=%22Sollae%20Systems%22%20%2Bport:%2223%22&t=all There are 1,300 in 2018,Almost in Korea. Most devices do not require password authenticatio...
DJI Spark hijacking
It is no pleasant experience at all for anyone to get the valuable property bought with the money you have earned with your blood, sweat, and tears stolen by some unknown cybercriminal. The Internet of Things IoT is developing with the rapid pace, and the devices that can be controlled remotely...
Windows Kernel 64-bit pool memory disclosure via REG_RESOURCE_LIST registry values (videoprt.sys descriptors)(CVE-2018-0899)
We have discovered a Windows kernel memory disclosure vulnerability through the body of "AllocConfig" registry values of type REGRESOURCELIST corresponding to devices handled by videoprt.sys, which can be found under HKLM\SYSTEM\CurrentControlSet\Enum\\Control\AllocConfig. The vulnerability...
Chromium: Information disclosure via "memory_instrumentation::mojom::Coordinator" interface in "resource_coordinator" service(CVE-2018-6080)
VULNERABILITY DETAILS The "memoryinstrumentation::mojom::Coordinator" mojo interface is exposed by the "resourcecoordinator" service, running under the browser process. The interface requires the "app" capability https://cs.chromium.org/chromium/src/services/resourcecoordinator/manifest.json?l=8,...
Asus Unauthenticated LAN Remote Command Execution
Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE POWERFUL USER-FRIENDLY INTERFACE – The enhanced ASUSWRT...
Microsoft Edge: Chakra: Deferred parsing makes wrong scopes #2(CVE-2018-0775)
Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to issue 1310 . PoC: // Enable the flag using '\n'.repeat0x1000 evalfunction f with function printf; ; ; + '\n'.repeat0x1000; PoC 2: // ./ch poc.js -ForceDeferParse functio...
Microsoft Edge: Chakra: Incorrect scope handling(CVE-2018-0774)
PoC: function funcarg = function printfunc; // SetHasOwnLocalInClosure should be called for the param scope in the PostVisitFunction function. printfunc; function func ; Chakra fails to distinguish whether the function is referenced in the param scope and ends up to emit an invalid opcode. functi...
Microsoft Edge: Chakra: AsmJSByteCodeGenerator::EmitCall call handling bug(CVE-2018-0780)
AsmJSByteCodeGenerator::EmitCall which is used to emit call insturctions doesn't check if an array identifier is used as callee. The method handles those invalid calls in the same way it handles valid calls such as "arridx & ...". In these cases, the index register remains NoRegister which is...
ZKTeco ZKAccess Professional 3.5.3 Insecure File Permissions
Summary ZKAccess 3.5 is a desktop software which is suitable for small and medium businesses application. Compatible with all ZKAccess standalone reader controllers, the software can simultaneously manage access control and generate attendance report. The brand new flat GUI design and humanized...
Dasan Networks GPON ONT WiFi Router H64X Series System Config Download
Summary H64xx is comprised of one G-PON uplink port and four ports of Gigabit Ethernet downlink supporting 10/100/1000Base-T RJ45. It helps service providers to extend their core optical network all the way to their subscribers, eliminating bandwidth bottlenecks in the last mile. H64xx is...
ZTE ZXDSL Configuration Reset
Vulnerability Summary The following advisory describes a configuration reset vulnerability found in ZTE ZXDSL 831CII version 6.2. ZXDSL 831CII is “an ADSL access device to support multiple line modes. It supports ADSL2/ADSL2+ and is backward compatible to ADSL, even offers auto-negotiation...
IBM Domino KeyView PDF Filter Trailer ID Code Execution Vulnerability(CVE-2016-0301)
SUMMARY A heap based buffer overflow vulnerability present in KeyView PDF filter as used by Domino can lead to remote arbitrary code execution. TESTED VERSIONS KeyView 10.16 as used by IBM Domino 9.0.1 PRODUCT URLs http://www-03.ibm.com/software/products/en/ibmdomino DETAILS While parsing an ID...
Pidgin MXIT Splash Image Arbitrary File Overwrite Vulnerability(CVE-2016-4323)
DESCRIPTION A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network traffic can provide an invalid filename for a splas...
Mac OS X 10.12 isolation mechanism bypass vulnerability
Vulnerability summary Mac OS X a vulnerability exists that could allow an attacker to bypass the Apple of the isolation mechanism, without any restrictions to execute arbitrary JavaScript code. Vulnerability submitter From WeAreSegment security researcher Filippo Cavallarin to Beyond Security SSD...
Kaspersky Internet Security KLIF Driver NtAdjustTokenPrivileges_HANDLER Denial of Service(CVE-2016-4305)
Summary A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call can cause a access violation in KLIF kernel driver resulting in local denial of service. An attacker can run program from user mo...
WebKit: JSC: Incorrect for-in optimization #2(CVE-2017-7117)
No description provided by source. The following PoC bypasses the fix for the https://www.seebug.org/vuldb/ssvid-96629. PoC: function f let o = ; for let i in xx: 0 for i of 0 printoi; f;...
Foscam IP Video Camera CGIProxy.fcgi Change Username pureftpd.passwd Injection Vulnerability(CVE-2017-2850)
Summary An exploitable injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username...
Foscam IP Video Camera CGIProxy.fcgi SMTP Test Sender Parameter Configuration Command Injection Vulnerability(CVE-2017-2844)
Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...
Windows Kernel stack memory disclosure in DeviceApi(CVE-2017-8474)
We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 10 through the PiDqIrpQueryGetResult, PiDqIrpQueryCreate, PiDqQueryCompletePendedIrp IOCTLs sent to the \Device\DeviceApi device. The analysis shown below was...
海康威视 /serverLog/showFile.php 参数fileName 文件读取漏洞
No description provided by source...
万户ezOffice协同办公管理平台Voituregetsource.jsp svoitureid参数存在sql注入漏洞
No description provided by source...
shopnc /shop/index.php?act=member&op=address&inajax=1 sql注入漏洞（需要登录）
No description provided by source...
E-TILLER期刊采编系统 留言登录处/ch/guestbook/Login.aspx 参数GM_NAME POST注入漏洞
No description provided by source...
宝信建站系统 /EC/DM/ECDM0104.jsp 参数 filePath 下载漏洞
0x01 漏洞框架 相关厂商： 上海宝信软件股份有限公司 提交时间： 2015-04-26 公开时间： 2015-07-27 漏洞类型： 任意文件遍历/下载 上海宝信软件股份有限公司（简称“宝信软件”）系宝钢股份控股的软件企业，2001年4月上市，公司总部位于上海浦东张江高科技园区。...
Ruby on Rails Action View 信息泄漏
Possible Information Leak Vulnerability in Action View. There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all the scenarios. This vulnerability has been assigned the CVE...
wordpress Begin Themes go.php 参数url URL重定向漏洞
No description provided by source...
泛微oa /iweboffice/officeserver.php 任意文件上传getshell
No description provided by source...
Shop7z show_all.asp SQL注入漏洞
/showall.asp?cid=7685%20%20UNION%20SELECT%201%2C2%2C3%2C%27%21%21%21%27%2bsuser%2b%27%21%21%21%27%2C%27@%27%2bspwd%2b%27@%27%2C6%2C7%2C8%2C9%2C10%2C11%20from%20admin...
多款Huawei路由器信息泄露漏洞
Summary The CF cards on some Huawei switches and ARs contain some sensitive information in plaintext. Once an attacker gets such a CF card, it may result in the leak of sensitive information HWPSIRT-2015-07048. This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID:...
mao10cms多个漏洞打包
简要描述： 包括多个存储型XSS，越权 详细说明： 1.首先来看存储型XSS漏洞，这个漏洞的根源在于mao10cms对于富文本的过滤函数不完善，我们来看mao10cms的过滤策略。 function mcremovehtml$text, $type = 'html' if$type=='all' $text = nl2br$text; $text = realstriptags$text; $text = addslashes$text; $text = trim$text; else // 无标签格式 $texttags = ''; //只保留链接 $linktags = '';...
使用非官方渠道 Unity 开发 App 造成的后门
除了 XCode，Unity 同样也受影响，同样的手段与方法。 在./Unity/Unity.app/Contents/PlaybackEngines/iossupport/Trampoline/Libraries/libiPhone-lib-il2cpp.a 中的libiPhone-lib-il2cpp.a--master.o ,恶意代码和 xcode中的逻辑一致，上线域名是init.icloud-diagnostics.com 来自 http://weibo.com/3802345927/CBCl1irIH 我们将持续关注具体情况...
KesionCMS多个系统通用SQL注入打包 #可注入任意用户数据 demo演示
简要描述：...
蝉知企业门户系统 v3.3csrf修改管理员密码
简要描述： 蝉知企业门户系统 v3.3csrf修改管理员密码 详细说明： 蝉知企业门户系统 v3.3最新版本 存在csrf漏洞 而且我测试的时候发现，即使修改了密码，管理员也不会马上需要重新登陆，所以配合我的回旋镖，可以达到神不知鬼不觉的修改其管理密码 接下来，我就来详细的演示漏洞过程 漏洞证明： 1、我们进入后台，发现没有添加管理员，那么我们来尝试一下修改管理员密码 很有意思，我们发现修改管理员的密码，不需要验证原密码好危险撒！ 那我们再来抓包截断看看有没有token之类的验证 2、用burpsuite截断 我的小伙伴们都惊呆了 有木有？？ 没有验证，就两个password...
Wordpress 3.9.2 /wp-includes/formatting.php 跨站脚本漏洞
No description provided by source...
万户OA未修补漏洞致多个政府&集团OA中招
简要描述： 该漏洞在7月份已经有人在wooyun报了，可修补效果几乎为0。 详细说明： 瘦蛟舞 提交的漏洞地址： WooYun: 万户OA任意文件上传导致代码执行（多处总结） 漏洞还是瘦蛟舞（http://www.wooyun.org/whitehats/%E7%98%A6%E8%9B%9F%E8%88%9E）提交的漏洞。 于是用google搜索：inurl:7001/defaultroot 有324条记录。 随便测其中一个上传： 被改名的文件名直接返回到页面： 然后访问：...
Bacula-Web 5.2.10 (joblogs.php, jobid param) - SQL Injection
谷歌搜索：joblogs.php?jobid= 案例：http://cep.treslagoas.ms.gov.br/backup/joblogs.php?jobid=23154 D:\sqlmappython sqlmap.py -u http://cep.treslagoas.ms.gov.br/backup/joblogs.php ?jobid=23154 --dbs | | 1.0-dev-nongit-20150806 | -| . | | | .'| . | || |||||,| | || || http://sqlmap.org ! legal disclaimer:...