56796 matches found
Progress OpenEdge 11.2 - Directory Traversal
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = 'SSV-87398' vul ID version = '1' author = 'fenghh' vulDate = '2014-10-31' createDate =...
Mulesoft ESB Runtime 3.5.1 - Privilege Escalation Vulnerability
No description provided by source. Mulesoft ESB Runtime 3.5.1 Authenticated Privilege Escalation → Remote Code Execution Mulesoft ESB Runtime 3.5.1 allows any arbitrary authenticated user to create an administrator user due to a lack of permissions check in the handler/securityService.rpc endpoin...
Free WMA MP3 Converter 1.8 (.wav) - Buffer Overflow
No description provided by source. !/usr/bin/env python Free WMA MP3 Converter 1.8 Buffer Overflow Version:1.8 Build 20140226 Author:metacom Date:10.23.2014 Download:http://www.eusing.com/freewmaconverter/mp3wmaconverter.htm Tested on:Win7-En 32bit - Win8.1-DE 64bit import struct def...
Folder Plus 2.5.1 iOS - Persistent XSS Vulnerability
No description provided by source. Document Title: =============== Folder Plus v2.5.1 iOS - Persistent Item Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1348 Release Date: ============= 2014-10-24 Vulnerability Laboratory ID VL-ID:...
Drupal Core <= 7.32 - SQL Injection (#1)
No description provided by source...
某学科竞赛系统存在SQL注入漏洞
简要描述： RT 详细说明： 南京先极科技有限公司的学科竞赛系统存在SQL注入漏洞 前人也有提交这个公司的，我就写5个案例 注入连接：MoreNews.aspx?NewsType=DongTai 案例： mask 区域 1.http://.. /xkjs/MoreNews.aspx?NewsType=TongZhi mask 区域 1.http://.. /js/MoreNews.aspx?NewsType=TongZhi mask 区域 1.http://.. /xkjs/MoreNews.aspx?NewsType=TongZhi mask 区域 1.http://...
vBulletin Tapatalk - Blind SQL Injection
No description provided by source. !/usr/bin/env python -- coding: utf-8 -- ''' @author: tintinweb 0x721427D8 ''' import urllib2, urllib import xmlrpclib,re, urllib2,string,itertools,time from distutils.version import LooseVersion class Exploitobject: def initself, target, debug=0 :...
Croogo 2.0.0 - Multiple Stored XSS Vulnerabilities
No description provided by source. Croogo 2.0.0 Multiple Stored XSS Vulnerabilities Vendor: Fahad Ibnay Heylaal Product web page: http://www.croogo.org Affected version: 2.0.0 Summary: Croogo is a free, open source, content management system for PHP, released under The MIT License. It is powered...
Drupal Core <= 7.32 - SQL Injection (#2)
No description provided by source. !/usr/bin/python Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 Inspired by yukyuk's P.o.C https://www.reddit.com/user/fyukyuk Tested on Drupal 7.31 with BackBox 3.x This material is intended for educational purposes only and t...
Mouse Media Script 1.6 0 - Stored XSS Vulnerability
No description provided by source. Exploit Title: Mouse Media Script Stored XSS Vulnerability Google Dork: "is your best source of fun." inurl:/view/popular Date: 04-10-2014 Exploit Author: Halil Dalabasmaz Version: v1.6 Software Link: http://codecanyon.net/item/mouse-media-script/7773254 Softwar...
Aireplay-ng 1.2 beta3 - "tcp_test" Length Parameter Stack Overflow
No description provided by source. / Exploit Title: Aireplay "tcptest" Length Parameter Inconsistency Date: 10/3/2014 Exploit Author: Nick Sampanis Vendor Homepage: http://www.aircrack-ng.org/ Version: Aireplay-ng 1.2 beta3 Tested on: Kali Linux 1.0.9 x64 CVE : CVE-2014-8322 Description: Affected...
Bosch Security Systems DVR 630/650/670 Series - Multiple Vulnerabilities
No description provided by source. :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2014-10-01 Bosch Security Systems DVR 630/650/670 Series Multiple Vulnerabilities Device: "Th...
Who's Who Script - CSRF Exploit (Add Admin Account)
No description provided by source. Title : Who's Who Script CSRF Exploit Add Admin Account Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Date : 30.10.2014 Demo : http://demo.phpscriptlerim.com/free/whoswho/ Download1 :...
BiWEB最新商城版搜索型注入多枚
简要描述： BiWEB最新商城版搜索型注入多枚 详细说明： 在wooyun上看到了有人提了BiWEB的一个XSS漏洞： WooYun: BIWEB商城版XSS盲打cookie ，也有人提了SQL注入，我也来找找它的漏洞吧。去官网下BiWEB商城版最新的5.8.4来看看。发现BiWEB有多处搜索，都存在注入漏洞。 看看搜索处是怎么处理的。BiWEB首先对GET和POST进行了过滤，/config/filtrate.inc.php 这里就先不说这种过滤的脑残之处了。 继续往下看，BiWEB有所有搜索处都存在同样的注入问题。举一例来说。/search.php 无关代码...
PayPal Inc BB #85 MB iOS 4.6 - Auth Bypass Vulnerability
No description provided by source. Document Title: =============== PayPal Inc BB 85 MB iOS 4.6 - Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=895 PayPal Security UID: Vxda0S Video:...
ManageEngine OpManager, Social IT Plus and IT360 - Multiple Vulnerabilities
No description provided by source. Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 27/09/2014 1 and 2,...
Dell EqualLogic Storage - Directory Traversal
No description provided by source. Exploit Title: Remote Directory Traversal exploit for Dell EqualLogic 6.0 Storage Date: 09/2013 Exploit Author: Mauricio Pampim Corr�a Vendor Homepage: www.dell.com Version: 6.0 Tested on: Equipment Model Dell EqualLogic PS4000 CVE : CVE-2013-3304 The malicious...
Windows OLE Package Manager SandWorm Exploit
No description provided by source. !/usr/bin/env python import os import zipfile import sys ''' Full Exploit: http://www.exploit-db.com/sploits/35019.tar.gz Very quick and ugly SandWorm CVE-2014-4114 exploit builder Exploit Title: CVE-2014-4114 SandWorm builder Built to run on: Linux/MacOSX Date:...
ZTE Modem ZXDSL 531BIIV7.3.0f_D09_IN - Stored XSS Vulnerability
No description provided by source. Exploit Title: ZTE Modem Stored XSS Vulnerability Date: 30-10-2014 Exploit Author: Ravi Rajput aka Gr3y n00b IHT team Version: ZXDSL 531BIIV7.3.0fD09IN Software Link:http://wwwen.zte.com.cn Tested on : Windows 7 code : GET...
Drupal < 7.32 Pre Auth SQL Injection
No description provided by source. ?php // // / / / // / / // \ / / /// / / / / / / / / / // / / / , / // / // / / / / // / / / // ////||//// ///// /// // Poc for Drupal Pre Auth SQL Injection - c 2014 SektionEins // // created by Stefan Horst [email protected] // and Stefan Esser...
Feng Office 1.7.4 - Arbitrary File Upload
No description provided by source...
Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/exploit/local/windowskernel' require 'rex' class Metasploit3 Msf::Exploit::Local Rank =...
Windows TrackPopupMenu Win32k NULL Pointer Dereference
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 Msf::Exploit::Local Rank =...
Password Manager Pro / Pro MSP - Blind SQL Injection
No description provided by source. Authenticated blind SQL injection in Password Manager Pro / Pro MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 08/11/2014 / Last updated:...
MAARCH 1.4 - SQL Injection
No description provided by source. / Exploit Title: Maarch 1.4 SQL Injection Google Dork: intext:"Maarch Maerys Archive v2.1 logo" Date: 29/10/2014 Exploit Author: Adrien Thierry Exploit Advisory: http://asylum.seraum.com/Security-Alert-GED-ECM-Maarch-Critical-Vulnerabilities.html Vendor Homepage...
Feng Office 1.7.4 - Cross Site Scripting Vulnerabilities
No description provided by source...
Comodo Internet Security - HIPS/Sandbox Escape PoC
No description provided by source. Exploit: http://www.joxeankoret.com/download/comodosandboxescape/sandboxtest1.tar.gz Mirror: www.exploit-db.com/sploits/sandboxtest1.tar.gz Video: http://www.joxeankoret.com/download/comodosandboxescape/video/sandboxescape1.htm...
Linux PolicyKit Race Condition Privilege Escalation
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class Metasploit4 Msf::Exploit::Local Rank = GreatRanking include Msf::Exploit::EXE include Msf::Post::File include...
Xerox Multifunction Printers (MFP) "Patch" DLM Vulnerability
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::Tcp def initializeinfo =...
i.Hex 0.98 - Local Crash PoC
No description provided by source. !/usr/bin/python Exploit Title:i.Hex Local Crash Poc Homepage:http://www.memecode.com/ihex.php Software Link:www.memecode.com/data/ihex-win32-v0.98.exe Version:i.Hex-v0.98 Win32 Release Description:i.Hex is a small and free graphical Hex Editor for Windows...
Visual Mining NetCharts Server Remote Code Execution
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...
Change CMS 3.6.8 - Multiple CSRF Vulnerabilities
No description provided by source. Exploit Title: RBS Change Complet Open Source multiple CSRF vulnerabilities POST and GET Date: 10/10/2014 Exploit Author: KrustyHack Vendor Homepage: http://www.rbschange.fr/ Software Link:...
Wordpress CP Multi View Event Calendar 1.01 /php-datafeed.php SQL注入漏洞
No description provided by source...
Enalean Tuleap 7.4.99.5 - Blind SQL Injection
No description provided by source. Vulnerability title: Tuleap = 7.4.99.5 Authenticated Blind SQL Injection in Enalean Tuleap CVE: CVE-2014-7176 Vendor: Enalean Product: Tuleap Affected version: 7.4.99.5 and earlier Fixed version: 7.5 Reported by: Jerzy Kramarz Details: SQL injection has been fou...
Another Wordpress Classifieds Plugin - SQL Injection
No description provided by source. Exploit Title: Another Wordpress Classifieds Plugin sql injection and Cross Site Scripting Author: dill download: https://wordpress.org/plugins/another-wordpress-classifieds-plugin/Client Webpage: http://awpcp.com/ SQL injection Details: The parameter...
Dell SonicWall GMS 7.2.x - Code Injection
No description provided by source. Document Title: =============== Dell SonicWall GMS v7.2.x - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1222 Release Date: ============= 2014-10-21 Vulnerability Laboratory ID VL-ID:...
vBulletin 4.x Verify Email Before Registration Plugin - SQL Injection
No description provided by source. Title: vBulletin Verify Email Before Registration Plugin - SQL Injection Date: September 19 2014 Version: Any vBulletin 4.. version which has the plugin installed. Plugin: http://www.vbulletin.org/forum/showthread.php?t=294164 Author: Dave FW/FG The vulnerabilit...
SAP Netweaver Enqueue Server - Denial of Service
No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ SAP Netweaver Enqueue Server Trace Pattern Denial of Service Vulnerability 1. Advisory Information Title: SAP Netweaver Enqueue Server Trace Pattern Denial of Service Vulnerability Advisory ID:...
Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 - (.wax) Buffer Overflow/DoS EIP Overwrite
No description provided by source. EDB Note: DoS - b0f isn't working. Title : Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 .wax Buffer Overflow Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Date : 28.10.2014 Python : V 2.7 Thks :...
CUPS Filter Bash Environment Variable Code Injection
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::HttpClient def initializeinf...
Enalean Tuleap 7.2 - XXE File Disclosure
No description provided by source. Vulnerability title: Tuleap = 7.2 External XML Entity Injection in Enalean Tuleap CVE: CVE-2014-7177 Vendor: Enalean Product: Tuleap Affected version: 7.2 and earlier Fixed version: 7.4.99.5 Reported by: Jerzy Kramarz Details: A multiple XML External Entity...
Axway Secure Transport 5.1 SP2 - Arbitary File Upload via CSRF
No description provided by source. !-- Exploit Title: Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF Exploit author: Emmanuel Law Public Disclosure Date : 20/10/14 Vendor homepage: http://www.axway.com Affected Software version: Axway Secure Transport 5.2.1 SP2 and possibly earlier...
Discuz 7.x /include/discuzcode.func.php 代码执行漏洞
No description provided by source...
Qibo Menhu V5 /hy/member/homepage_ctrl.php SQL注入漏洞
No description provided by source...
phpwind登录处可撞库可锁定他人帐号
简要描述： Phpwind在登录处可以撞库官网演示 以及锁定他人帐号，可持续批量锁定是不是很爽，未测试。。。。。 开启验证码也可绕过。 详细说明： 黑盒测试的直接说怎么用吧。 1. 我们先把所有帐号的用户提取出来。 代码如下 def getuid: con=urllib2.urlopen"http://www.phpwind.net/index.php?m=space&uid="+struid.read r=re.compile'\S+的个人空间' return r.findallcon 2. 再来做个社工库的接口，根据用户名提取密码。 def getpassname:...
知道key的情况下对ucserver进行注射
简要描述： 因为帮finger解决问题，无意中看到的漏洞。 怎么拿到key要问finger。 详细说明： 在/ucserver/control/feed.php内有一段代码： function onadd $this-load'misc'; $appid = intval$this-input'appid'; $icon = $this-input'icon'; $uid = intval$this-input'uid'; $username = $this-input'username'; $bodydata =...
DouPHP v1.1 /kindeditor/php/file_manager_json.php 备份文件发现漏洞
No description provided by source...
漫游用友集团各大系统
简要描述： 漫游用友集团各大系统 详细说明： 在一个月黑风高的夜晚，用友某员工的集团办公平台账号，悄悄地泄露了。 // Send message Transport transport=session.getTransport; transport.connect"192.168.210.160" , 25, "ch2","1r"; transport.sendMessagemessage,new Addressnew InternetAddress"[email protected]" ; transport.close;...