56796 matches found
ShopEx某处SQL注入（可猜测敏感信息）
简要描述： ShopEx sql注入 详细说明： 分析一下代码： ctl.cart.php: function updateCart$objType='g', $key='' $key = strreplace'@', '-', $key; $nQuantity = $POST'cartNum'$objType$key; switch$objType case 'f': $oCart-member'memberlvid' =$GLOBALS'runtime''memberlv'; $oCart-member'point' = $this-member'point'; break; cas...
Mirapoint /cgi-bin/licenses.cgi 后门漏洞
No description provided by source...
Wordpress 3.9.2 /wp-includes/formatting.php 跨站脚本漏洞
No description provided by source...
齐博地方门户鸡肋文件包含造成的高危SQL注入
简要描述： 上个漏洞（http://wooyun.org/bugs/wooyun-2014-080259）忘了说，是可以直接提升为管理的，甚至不用破hash了。 这个洞无需登录可批量，看我是如何化鸡肋为无形的。第三发，齐博一直不确认，不想再放0day了。。。 ps.齐博今天挺火的啊，据说发现了后门？我能告诉你我还发现了其他后门吗。 详细说明： 和以往的故事一样，这个故事很长。有耐心看下去的朋友，且听我娓娓道来。...
Innovaphone PBX Admin-GUI - CSRF Vulnerability
No description provided by source. Title: Innovaphone PBX Admin-GUI CSRF Impact: High CVSS2 Score: 7.8 AV:N/AC:M/Au:S/C:P/I:C/A:C/E:F/RL:U/RC:C Announced: August 21, 2014 Reporter: Rainer Giedat NSIDE ATTACK LOGIC GmbH, www.nsideattacklogic.de Products: Innovaphone PBX Administration GUI Affected...
XDCMS 3.0.1 /system/modules/xdcms_login.php SQL注入漏洞
No description provided by source...
IBM Algorithmics RICOS 4.5.0 - 4.7.0 - Multiple Vulnerabilities
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140630-0 ======================================================================= title: Multiple severe vulnerabilities product: IBM Algorithmics RICOS vulnerable...
VBZoom 1.11 Profile.PHP Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/19803/info VBZooM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an...
Android 2.0/2.1 - Use-After-Free Remote Code Execution on Webkit
No description provided by source. Exploit Title: Android 2.0/2.1 Use-After-Free Remote Code Execution on Webkit Date: 14/11/2010 Author: Itzhak Avraham, mj Tested on: Droid 2.1 CVE : CVE-2010-1807 Better exploit better rate and more flexible for changes, also shorter shellcode than what you have...
MS Windows 2000/NT 4/XP Network Share Provider SMB Request Buffer Overflow (1)
No description provided by source. source: http://www.securityfocus.com/bid/5556/info Microsoft Windows operating systems use the Server Message Block SMB protocol to support services such as file and printer sharing. A buffer overflow vulnerability has been reporting in the handling of some...
Webkit (Apple Safari < 4.1.2/5.0.2 & Google Chrome < 5.0.375.125) - Memory Corruption
No description provided by source. TITLE: WEBKIT APPLE SAFARI 4.1.2/5.0.2 & GOOGLE CHROME 5.0.375.125 MEMORY CORRUPTION VULNERABILITY TESTED OS: WINDOWS XP SP3 SEVERITY: HIGH CVE-NUMBER: CVE-2010-1813 DISCOVERED DATE: 2010-06-29 FIXED DATE: GOOGLE CHROME 2010-07-26 & APPLE SAFARI 2010-09-08 FIXED...
Zikula CMS 1.3.5 - Multiple Vulnerabilities
No description provided by source. Document Title: =============== Zikula CMS v1.3.5 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1114 Release Date: ============= 2013-10-16 Vulnerability Laboratory ID VL-ID:...
Photodex ProShow Gold/Producer 5.0.3310 & 6.0.3410 - ScsiAccess Local Privilege Escalation
No description provided by source. Exploit-DB Note: Vuln still in 6.0.3410 as well as 'Photodex ProShow Gold' Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: Photodex ProShow Producer Vendor URL: www.photodex.com Type: Incorrect Default...
Xpient Cash Drawer Operation Vulnerability
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Xpient Cash Drawer Operation Vulnerability 1. Advisory Information Title: Xpient Cash Drawer Operation Vulnerability Advisory ID: CORE-2013-0517 Advisory URL:...
Oracle Sun GlassFish Enterprise Server - Stored XSS Vulnerability
No description provided by source. Sense of Security - Security Advisory - SOS-11-009 Release Date. 19-Jul-2011 Last Update. - Vendor Notification Date. 23-Mar-2011 Product. Oracle Sun GlassFish Enterprise Server Platform. Java EE Affected versions. 2.1.1 v2.1 Patch069.102 Patch12 build b31g-fcs...
FreePBX <= 2.8.0 Recordings Interface Allows Remote Code Execution
No description provided by source. Trustwave's SpiderLabs Security Advisory TWSL2010-005: FreePBX recordings interface allows remote code execution https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt Published: 2010-09-23 Version: 1.0 Vendor: FreePBX http://www.freepbx.org/ Product:...
Apache + PHP 5.x (< 5.3.12 & < 5.4.2) - Remote Code Execution
No description provided by source. !/usr/bin/env python ap-unlock-v2.py - apache + php 5. rem0te c0de execution 0day better version NOTE: - quick'n'dirty VERY UGLYY C=000DEEE IZ N0T MY STYLE : - for connect back shell start netcat/nc and bind port on given host:port - is ip-range scanner not is...
MS11-080 AfdJoinLeaf Privilege Escalation
No description provided by source. MS11-080 - CVE-2011-2005 Afd.sys Privilege Escalation Exploit Author: [email protected] - Matteo Memelli Spaghetti & Pwnsauce yuck! 0xbaadf00d Elwood@mac&cheese.com Thx to dookielifesaver2000ca, dijital1 and ronin for helping out! To my Master Shifu muts: "So...
DX Studio Player < 3.0.29.1 Firefox plug-in Command Injection Vuln
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ DX Studio Player Firefox plug-in command injection 1. Advisory Information Title: DX Studio Player Firefox plug-in command injectio...
Linux group_info refcounter - Overflow Memory Corruption
No description provided by source. / DoS poc for CVE-2014-2851 Linux groupinfo refcounter overflow memory corruption https://lkml.org/lkml/2014/4/10/736 @Tohmaxx - http://thomaspollet.blogspot.be If the app doesn't crash your system, try a different count argv1 Execution takes a while because 2^3...
HP Data Protector EXEC_BAR Remote Command Execution
No description provided by source. import argparse import socket Exploit Title: HP Data Protector EXECBAR Remote Command Execution Exploit Author: Chris Graham @cgrahamseven CVE: CVE-2013-2347 Date: February 14, 2014 Vendor Homepage: www.hp.com Version: 6.10, 6.11, 6.20 Tested On: Windows Server...
MayGion IP Cameras Firmware 09.27 - Multiple Vulnerabilities
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...
Adobe Flash Player 11.3 Font Parsing Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
@lex Guestbook <= 4.0.2 - Remote Command Execution Exploit
No description provided by source. !/usr/bin/php ?php // | | header @lex Guestbook = 4.0.2 Remote Command Execution Exploit | header ======================================================== | status Retrieving the administrator password | sploit AdminUsername::root | sploit AdminPassword::toor |...
Adobe Flash Player Object Type Confusion
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
Squirrelmail 1.4.x Redirect.PHP Local File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/18231/info SquirrelMail is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. A successful exploit may allow unauthorized users to view files and to execute local script...
Luca Deri ntop 1.2 a7-9/1.3.1 - Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1576/info ntop is a network usage monitoring tool for unix systems. It can be invoked at the console or as a server daemon, presenting statistics information via http with the -w parameter. In this mode, it is vulnerable ...
Powered by iNetScripts: Shell Upload Vulnerability
No description provided by source. ==================================================== Powered by iNetScripts: Shell Upload Vulnerability ==================================================== Contact :Sec-q8 [email protected] Published: 2010-04-25 Home : http://Sec-Senter.com/vb ========= Exploi...
galleria Mambo Module <= 1.0b Remote File Include Vulnerability
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register class TestPOCPOCBase: vulID = '63674' ssvid version = '1.0' author = '皮皮' vulDate = '2006-07-03' createDate = '2015-12-24...
Max's Image Uploader Shell Upload Vulnerability
PHP F1 Max's Image Uploader 1.0版本的maxImageUpload/index.php中存在无限制文件上传漏洞。 当Apache未被设置来处理具有pjpeg或jpeg扩展名的拟态文件时，远程攻击者可以通过上传具有一个pjpeg或jpeg扩展名的文件，执行任意代码，并借助对original/的一个直接请求来访问该文件。 问题在maxImageUpload.class.php中的 function uploadImage $result = true; if !isset$POST'submitBtn' $this-showUploadForm; else $m...
Java Applet JAX-WS Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class...
MS IIS 4.0/5.0 and PWS Extended Unicode Directory Traversal Vulnerability (5)
No description provided by source. source: http://www.securityfocus.com/bid/1806/info Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot ../ directory traversal exploitation if extended UNICODE character representations are used in substitution for / and . Unauthenticated users may acces...
Yealink VoIP Phone SIP-T38G - Remote Command Execution
No description provided by source. Title: Yealink VoIP Phone SIP-T38G Remote Command Execution Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5758 Description: Using cgiServer.exx we are ab...
Joomla Mosets Tree <= 1.0 - Remote File Include Vulnerability
No description provided by source. !!!!!!!!!WWW.SiBERSAVASCiLAR.COM!!!!!!!!! -------------------------------------------------------------------------------- Title : Joomla Mosets Tree = 1.0 Remote File Include Vulnerability...
BBS E-Market Professional bf_130 (1.3.0) - Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11146/info BBS E-Market Professional is reported to be affected by a remote file include vulnerability that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable system...
Invision Power Board <= 3.3.4 "unserialize()" PHP Code Execution
No description provided by source. ?php / ---------------------------------------------------------------- Invision Power Board = 3.3.4 unserialize PHP Code Execution ---------------------------------------------------------------- author..............: Egidio Romano aka EgiX mail...................
MS FrontPage 98 Server Extensions for IIS,MS InterDev 1.0 Filename Obfuscation
No description provided by source. source: http://www.securityfocus.com/bid/1108/info Two dlls dvwssr.dll and mtd2lv.dll included with the FrontPage 98 extensions for IIS and shipped as part of the NT Option Pack include an obfuscation string that manipulates the name of requested files. Knowing...
bitweaver 2.8.1 - Multiple Vulnerabilities
No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2012-016: Multiple Vulnerabilities in Bitweaver Published: 10/23/2012 Version: 1.0 Vendor: Bitweaver http://www.bitweaver.org/ Product: Bitweaver Version affected: 2.8.1 and earlier versions Product description: Bitweav...
PHPDug 2.0.0 - Multiple Vulnerabilities
No description provided by source. Vulnerability ID: HTB22971 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinphpdug.html Product: PHPDug Vendor: Kubelabs.com http://www.kubelabs.com/ Vulnerable Version: 2.0.0 and probably prior versions Vendor Notification: 21 April 2011 Vulnerability Type:...
Adobe Flash Player AVM Verification Logic Array Indexing Code Execution
No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit...
zenphoto 0.9/1.0 index.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/17779/info Zenphoto is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...
Mozilla Firefox CSS - font-face Remote Code Execution Vulnerability
No description provided by source. ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moabu-15-mozilla-firefox-css-font-face-remote-code-execution-vulnerability/...
CMS Made Simple <= 1.6.2 - Local File Disclosure Vulnerability
No description provided by source. CMS Made Simple = 1.6.2 Class: LFI Reported: 29/07/2009 Public release: 10/08/2009 Remote: Yes DORK: This site is powered by CMS Made Simple version 1. Site: http://www.cmsmadesimple.org/ Download:...
Wordpress Spider Catalog Plugin 1.4.6 - Multiple Vulnerabilities
No description provided by source. waraxe-2013-SA105 - Multiple Vulnerabilities in Spider Catalog Wordpress Plugin =================================================================================== Author: Janek Vind waraxe Date: 22. May 2013 Location: Estonia, Tartu Web:...
SAP Netweaver Dispatcher Multiple Vulnerabilities
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ SAP Netweaver Dispatcher Multiple Vulnerabilities 1. Advisory Information Title: SAP Netweaver Dispatcher Multiple Vulnerabilities Advisory ID: CORE-2012-0123 Advisory URL:...
Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability
No description provided by source. ScanAlert Security Advisory - http://www.scanalert.com Directory Listing in Apache Tomcat 5.x.x Date: 07/21/2006 Vendor: Apache Package: Tomcat Versions: 5.x.x 5.0.28, 5.5.12, 5.5.9, and 5.5.7 . Confirmed Credit: ScanAlert.s Enterprise Services Team. Overview:...
Huawei E355信息泄漏和跨站请求伪造漏洞
Bugtraq ID:66017 CVE ID:CVE-2013-6031 Huawei E355是一款家用SOHO路由器设备。 Huawei E355存在信息泄漏和跨站请求伪造漏洞，通过直接访问/api脚本，攻击者可利用漏洞获取敏感信息。此外构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 0 Huawei E355 目前没有详细解决方案提供： http://www.huawei.com/ This module requires Metasploit: http//metasploit.com/download Current source:...
Wordpress WP-Cron Dashboard插件跨站脚本漏洞
CVE ID:CVE-2013-6991 WordPress是一款内容管理系统。 由于"procname" HTTP POST参数传递到"/wp-admin/tools.php"脚本的参数未能充分过滤用户提供的数据， 远程攻击者可以欺骗登录的管理员访问恶意链接，在受影响网站的浏览器上下文中执行任意HTML和脚本代码。 0 Wordpress WP-Cron Dashboard=1.1.5 厂商未提供官方的更新补丁，用户可使用非官方补丁： https://www.htbridge.com/advisory/HTB23189-patch.zip The exploitation exampl...
Apusic 弱密码漏洞
apusic的全部版本里默认情况下， 可用弱口令登录，从而导致攻击者可据此信息进行后续攻击。 所有版本...
Apache ActiveMQ web demos多个跨站脚本漏洞(CVE-2012-6092)
CVE ID:CVE-2012-6092 Apache ActiveMQ是一款开源消息总线，支持JMS1.1和J2EE 1.4规范的JMS Provider实现。 Apache ActiveMQ web demos存在多个跨站脚本漏洞，允许远程攻击者通过PortfolioPublishServlet.java的refresh参数也即/demo/portfolioPublish或Market Data...