bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
1191 commits 1 branch 0 tags 351 MiB
Commit graph

486 commits

Author SHA1 Message Date
Offensive Security
6624e39c26 DB: 2017-04-05 
31 new exploits

macOS/iOS Kernel 10.12.3 (16D32) - 'bpf' Heap Overflow

macOS/iOS Kernel 10.12.3 (16D32) - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption

macOS Kernel 10.12.2 (16C67) - Memory Disclosure Due to Lack of Bounds Checking in AppleIntelCapriController::getDisplayPipeCapability
macOS Kernel 10.12.3 (16D32) - Use-After-Free Due to Double-Release in posix_spawn
macOS/iOS Kernel 10.12.3 (16D32) - SIOCSIFORDER Socket ioctl Memory Corruption Due to Bad Bounds Checking
macOS Kernel 10.12.3 (16D32) - 'audit_pipe_open' Off-by-One Memory Corruption
macOS/iOS Kernel 10.12.3 (16D32) - Bad Locking in necp_open Use-After-Free

macOS Kernel 10.12.2 (16C67) - 'AppleIntelCapriController::GetLinkConfig' Code Execution Due to Lack of Bounds Checking
Broadcom Wi-Fi SoC - Heap Overflow in _wlc_tdls_cal_mic_chk_ Due to Large RSN IE in TDLS Setup Confirm Frame
Apple WebKit 10.0.2 - HTMLInputElement Use-After-Free
Apple WebKit - 'RenderLayer' Use-After-Free
Apple WebKit - Negative-Size memmove in HTMLFormElement
Apple WebKit - 'FormSubmission::create' Use-After-Free
Apple WebKit - 'ComposedTreeIterator::traverseNextInShadowTree' Use-After-Free
Apple WebKit - 'table' Use-After-Free
Apple WebKit - 'WebCore::toJS' Use-After-Free

macOS/iOS Kernel 10.12.3 (16D32) - Double-Free Due to Bad Locking in fsevents Device

Bluecoat ASG 6.6/CAS 1.3 - Privilege Escalation (Metasploit)

Bluecoat ASG 6.6/CAS 1.3 - OS Command Injection (Metasploit)

Broadcom Wi-Fi SoC - TDLS Teardown Request Remote Heap Overflow Exploit

SolarWinds LEM 6.3.1 - Remote Code Execution (Metasploit)

Logsign 4.4.2 / 4.4.137 - Remote Command Injection (Metasploit)

Broadcom Wi-Fi SoC - 'dhd_handle_swc_evt' Heap Overflow

Pixie 1.0.4 - Arbitrary File Upload
Apple Webkit - Universal Cross-Site Scripting by Accessing a Named Property from an Unloaded Window
Apple WebKit 10.0.2(12602.3.12.0.1) - 'disconnectSubframes' Universal Cross-Site Scripting
Apple WebKit 10.0.2(12602.3.12.0.1_ r210800) - 'constructJSReadableStreamDefaultReader' Type Confusion
Apple WebKit 10.0.2(12602.3.12.0.1) - 'Frame::setDocument (1)' Universal Cross-Site Scripting
Apple Webkit - 'JSCallbackData' Universal Cross-Site Scripting
Maian Uploader 4.0 - 'index.php' keywords Parameter Cross-Site Scripting
Maian Uploader 4.0 - admin/index.php keywords Parameter Cross-Site Scripting
Maian Uploader 4.0 - admin/inc/header.php Multiple Parameter Cross-Site Scripting
Maian Uploader 4.0 - 'keywords' Parameter Cross-Site Scripting
Maian Uploader 4.0 - 'index.php' Cross-Site Scripting
Maian Uploader 4.0 - 'header.php' Cross-Site Scripting
Maian Uploader 4.0 - 'user' Parameter SQL Injection
Maian Survey 1.1 - 'survey' Parameter SQL Injection
Maian Greetings 2.1 - 'cat' Parameter SQL Injection
 2017-04-05 05:01:18 +00:00
Offensive Security
8ce122cbaf DB: 2017-04-04 
3 new exploits

BackBox OS - Denial of Service

Apache Tomcat 6/7/8/9 - Information Disclosure

Zyxel_ EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection
 2017-04-04 05:01:25 +00:00
Offensive Security
0320cba051 DB: 2017-04-02 
6 new exploits

Microsoft Internet Explorer 11 - Crash PoC (1)
Microsoft Internet Explorer 11 - Crash (PoC) (1)

Microsoft Windows SQL Server - Denial of Service Remote Exploit (MS03-031)
Microsoft Windows SQL Server - Remote  Denial of Service (MS03-031)

Microsoft Exchange Server 2000 - XEXCH50 Heap Overflow PoC (MS03-046)
Microsoft Exchange Server 2000 - XEXCH50 Heap Overflow (PoC) (MS03-046)

Microsoft Windows - MSDTC Service Remote Memory Modification PoC (MS05-051)
Microsoft Windows - MSDTC Service Remote Memory Modification (PoC) (MS05-051)

Microsoft Windows Media Player 7.1 < 10 - BMP Heap Overflow PoC (MS06-005) (1)
Microsoft Windows Media Player 7.1 < 10 - BMP Heap Overflow (PoC) (MS06-005) (1)

Microsoft Windows - '.png' File IHDR Block Denial of Service PoC (1)
Microsoft Windows - '.png' IHDR Block Denial of Service (PoC) (1)

Microsoft Windows - '.png' File IHDR Block Denial of Service PoC (3)
Microsoft Windows - '.png' IHDR Block Denial of Service (PoC) (3)

Microsoft Windows - '.png' File IHDR Block Denial of Service PoC (2)
Microsoft Windows - '.png' IHDR Block Denial of Service (PoC) (2)

Apple Airport - 802.11 Probe Response Kernel Memory Corruption PoC (Metasploit)
Apple Airport - 802.11 Probe Response Kernel Memory Corruption (PoC) (Metasploit)

Microsoft Windows - DNS Resolution Remote Denial of Service PoC (MS06-041)
Microsoft Windows - DNS Resolution Remote Denial of Service (PoC) (MS06-041)

Microsoft Excel - Malformed Palette Record Denial of Service PoC (MS07-002)
Microsoft Excel - Malformed Palette Record Denial of Service (PoC) (MS07-002)

BaoFeng2 - 'mps.dll' ActiveX Multiple Remote Buffer Overflow PoCs
BaoFeng2 - 'mps.dll' ActiveX Multiple Remote Buffer Overflow (PoCs)

Visual Basic - 'vbe6.dll' Local Stack Overflow PoC / Denial of Service
Visual Basic - 'vbe6.dll' Local Stack Overflow (PoC) / Denial of Service

freeSSHd 1.2.1 - Remote Stack Overflow PoC Authenticated
freeSSHd 1.2.1 - Authenticated Remote Stack Overflow (PoC)

Microsoft Internet Explorer GDI+ - PoC (MS08-052)
Microsoft Internet Explorer GDI+ - (PoC) (MS08-052)

Microsoft Windows - GDI+ PoC (MS08-052) (2)
Microsoft Windows - GDI+ (PoC) (MS08-052) (2)
Microsoft Windows - InternalOpenColorProfile Heap Overflow PoC (MS08-046)
GuildFTPd 0.999.8.11/0.999.14 - Heap Corruption PoC/Denial of Service
Microsoft Windows - InternalOpenColorProfile Heap Overflow (PoC) (MS08-046)
GuildFTPd 0.999.8.11/0.999.14 - Heap Corruption (PoC) / Denial of Service

Apple Safari - 'ARGUMENTS' Array Integer Overflow PoC (New Heap Spray)
Apple Safari - 'ARGUMENTS' Array Integer Overflow (PoC) (New Heap Spray)

Adobe Acrobat Reader - JBIG2 Local Buffer Overflow PoC (2)
Adobe Acrobat Reader - JBIG2 Local Buffer Overflow (PoC) (2)

eZip Wizard 3.0 - Local Stack Buffer Overflow PoC (SEH)
eZip Wizard 3.0 - Local Stack Buffer Overflow (PoC) (SEH)

Chasys Media Player 1.1 - '.pls' Local Buffer Overflow PoC (SEH)
Chasys Media Player 1.1 - '.pls' Local Buffer Overflow (PoC) (SEH)

Mozilla Firefox XSL - Parsing Remote Memory Corruption PoC (1)
Mozilla Firefox XSL - Parsing Remote Memory Corruption (PoC) (1)

Mozilla Firefox XSL - Parsing Remote Memory Corruption PoC (2)
Mozilla Firefox XSL - Parsing Remote Memory Corruption (PoC) (2)

Microsoft Internet Explorer - EMBED Memory Corruption PoC (MS09-014)
Microsoft Internet Explorer - EMBED Memory Corruption (PoC) (MS09-014)

DigiMode Maya 1.0.2 - '.m3u' / '.m3l' Buffer Overflow PoCs
DigiMode Maya 1.0.2 - '.m3u' / '.m3l' Buffer Overflow (PoCs)

AIMP 2.51 build 330 - ID3v1/ID3v2 Tag Remote Stack Buffer Overflow PoC (SEH)
AIMP 2.51 build 330 - ID3v1/ID3v2 Tag Remote Stack Buffer Overflow (PoC) (SEH)

MySQL 5.0.45 - Authenticated COM_CREATE_DB Format String PoC
MySQL 5.0.45 - Authenticated COM_CREATE_DB Format String (PoC)

otsAV DJ/TV/Radio - Multiple Local Heap Overflow PoCs
otsAV DJ/TV/Radio - Multiple Local Heap Overflow (PoCs)

JetAudio 7.5.3 COWON Media Center - '.wav' Crash
Streaming Audio Player 0.9 - (skin) Local Stack Overflow PoC (SEH)
Soritong MP3 Player 1.0 - (SKIN) Local Stack Overflow PoC (SEH)
Streaming Audio Player 0.9 - 'skin' Local Stack Overflow (PoC)  (SEH)
Soritong MP3 Player 1.0 - 'SKIN' Local Stack Overflow (PoC) (SEH)

Tuniac 090517c - '.m3u' Local File Crash (PoC)

HTML Email Creator & Sender 2.3 - Local Buffer Overflow PoC (SEH)
HTML Email Creator & Sender 2.3 - Local Buffer Overflow (PoC) (SEH)
PPstream 2.6.86.8900 - PPSMediaList ActiveX Remote Buffer Overflow PoC (1)
PPstream 2.6.86.8900 - PPSMediaList ActiveX Remote Buffer Overflow PoC (2)
PPstream 2.6.86.8900 - PPSMediaList ActiveX Remote Buffer Overflow (PoC) (1)
PPstream 2.6.86.8900 - PPSMediaList ActiveX Remote Buffer Overflow (PoC) (2)

BigAnt Server 2.50 SP6 - '.zip' Local Buffer Overflow PoC (2)
BigAnt Server 2.50 SP6 - '.zip' Local Buffer Overflow (PoC) (2)

Eureka Email Client 2.2q - PoC Buffer Overflow
Eureka Email Client 2.2q - Buffer Overflow (PoC)

Microsoft Windows 7 / Server 2008 R2 - Remote Kernel Crash
Microsoft Windows 7 / 2008 R2 - Remote Kernel Crash

Picpuz 2.1.1 - Buffer Overflow Denial of Service/PoC
Picpuz 2.1.1 - Buffer Overflow Denial of Service (PoC)

Total MultiMedia Features - Denial of Service PoC for Sony Ericsson Phones
Total MultiMedia Features -  Sony Ericsson Phones Denial of Service (PoC)

Mozilla Firefox 3.6 - (XML parser) Memory Corruption PoC/Denial of Service
Mozilla Firefox 3.6 - (XML parser) Memory Corruption (PoC) / Denial of Service

iPhone FTP Server (WiFi FTP) by SavySoda - Denial of Service/PoC
iPhone FTP Server (WiFi FTP) by SavySoda - Denial of Service (PoC)

RCA DCM425 Cable Modem - micro_httpd Denial of Service/PoC
RCA DCM425 Cable Modem - 'micro_httpd' Denial of Service (PoC)

Free MP3 CD Ripper 2.6 - '.wav' PoC
Free MP3 CD Ripper 2.6 - '.wav' (PoC)

Anyzip 1.1 - '.zip' PoC (SEH)
Anyzip 1.1 - '.zip' (PoC) (SEH)

Microsoft Windows - SMB Client-Side Bug PoC (MS10-006)
Microsoft Windows - SMB Client-Side Bug (PoC) (MS10-006)

Webby WebServer - PoC SEH control
Webby WebServer - SEH Control (PoC)

FreeBSD 8.0 ftpd - off-by one PoC (FreeBSD-SA-10:05)
FreeBSD 8.0 ftpd (FreeBSD-SA-10:05) - Off- By One (PoC)

Microsoft Windows Vista/Server 2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free
Microsoft Windows Vista/2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free

AoAAudioExtractor 2.0.0.0 - ActiveX PoC (SEH)
AoAAudioExtractor 2.0.0.0 - ActiveX (PoC) (SEH)

Mozilla Firefox - Memory Corruption PoC (Simplified)
Mozilla Firefox - (Simplified) Memory Corruption (PoC)

Microsoft Windows - Win32k Pointer Dereferencement PoC (MS10-098)
Microsoft Windows - Win32k Pointer Dereferencement (PoC) (MS10-098)

Elecard MPEG Player 5.7 - Local Buffer Overflow PoC (SEH)
Elecard MPEG Player 5.7 - Local Buffer Overflow (PoC) (SEH)

Microsoft Windows XP - WmiTraceMessageVa Integer Truncation PoC (MS11-011)
Microsoft Windows XP - WmiTraceMessageVa Integer Truncation (PoC) (MS11-011)

Real player 14.0.2.633 - Buffer Overflow / Denial of ServiceExploit
Real player 14.0.2.633 - Buffer Overflow / Denial of Service
IrfanView 4.28 - .ICO With Transparent Colour Denial of Service / Remote Denial of Service
IrfanView 4.28 - .ICO Without Transparent Colour Denial of Service / Remote Denial of Service
IrfanView 4.28 - '.ICO' With Transparent Colour Denial of Service / Remote Denial of Service
IrfanView 4.28 - '.ICO' Without Transparent Colour Denial of Service / Remote Denial of Service

Microsoft Windows Vista/Server 2008 - 'nsiproxy.sys' Local Kernel Denial of Service
Microsoft Windows Vista/2008 - 'nsiproxy.sys' Local Kernel Denial of Service

D-Link DSL-2650U - Denial of Service/PoC
D-Link DSL-2650U - Denial of Service (PoC)

Microsoft Windows - '.fon' Kernel-Mode Buffer Overrun PoC (MS11-077)
Microsoft Windows - '.fon' Kernel-Mode Buffer Overrun (PoC) (MS11-077)

Opera 11.52 - PoC Denial of Service
Opera 11.52 - Denial of Service (PoC)

Microsoft Win32k - Null Pointer De-reference PoC (MS11-077)
Microsoft Win32k - Null Pointer De-reference (PoC) (MS11-077)

Microsoft Windows - 'afd.sys' PoC (MS11-046)
Microsoft Windows - 'afd.sys' (PoC) (MS11-046)

Microsoft Windows XP - Keyboard Layouts Pool Corruption LPE PoC (MS12-034)
Microsoft Windows XP - Keyboard Layouts Pool Corruption LPE (PoC) (MS12-034)

Wyse - Machine Remote Power off (DOS) without any Privilege (Metasploit)
Wyse - Unauthenticated Machine Remote Power Off )Denial of Service) (Metasploit)

Microsoft Windows Server 2000/NT 4.0 - TCP/IP Printing Service Denial of Service
Microsoft Windows NT 4/2000 - TCP/IP Printing Service Denial of Service

Pure-FTPd 1.0.21 (CentOS 6.2 / Ubuntu 8.04) - Crash PoC (Null Pointer Dereference)
Pure-FTPd 1.0.21 (CentOS 6.2 / Ubuntu 8.04) - Null Pointer Dereference Crash (PoC)
FreeBSD 2.x / HP-UX 9/10/11 / kernel 2.0.3 / Windows NT 4.0/Server 2003 / NetBSD 1 - 'land.c' loopback Denial of Service (1)
FreeBSD 2.x / HP-UX 9/10/11 / kernel 2.0.3 / Windows NT 4.0/Server 2003 / NetBSD 1 - 'land.c' loopback Denial of Service (2)
FreeBSD 2.x / HP-UX 9/10/11 / kernel 2.0.3 / Windows NT 4.0/Server 2003 / NetBSD 1 - 'land.c' loopback Denial of Service (3)
FreeBSD 2.x / HP-UX 9/10/11 / kernel 2.0.3 / Windows NT 4.0/Server 2003 / NetBSD 1 - 'land.c' loopback Denial of Service (4)
FreeBSD 2.x / HP-UX 9/10/11 / kernel 2.0.3 / Windows NT 4.0/Server 2003 / NetBSD 1 - 'land.c' loopback Denial of Service (5)
FreeBSD 2.x / HP-UX 9/10/11 / Kernel 2.0.3 / Windows NT 4.0/Server 2003 / NetBSD 1 - 'land.c' loopback Denial of Service (1)
FreeBSD 2.x / HP-UX 9/10/11 / Kernel 2.0.3 / Windows NT 4.0/Server 2003 / NetBSD 1 - 'land.c' loopback Denial of Service (2)
FreeBSD 2.x / HP-UX 9/10/11 / Kernel 2.0.3 / Windows NT 4.0/Server 2003 / NetBSD 1 - 'land.c' loopback Denial of Service (3)
FreeBSD 2.x / HP-UX 9/10/11 / Kernel 2.0.3 / Windows NT 4.0/Server 2003 / NetBSD 1 - 'land.c' loopback Denial of Service (4)
FreeBSD 2.x / HP-UX 9/10/11 / Kernel 2.0.3 / Windows NT 4.0/Server 2003 / NetBSD 1 - 'land.c' loopback Denial of Service (5)

Microsoft Windows Server 2000/NT - Terminal Server Service RDP Denial of Service
Microsoft Windows NT / 2000 - Terminal Server Service RDP Denial of Service
Microsoft Windows Server 2000/NT 4 - TCP Stack Denial of Service (1)
Microsoft Windows Server 2000/NT 4 - TCP Stack Denial of Service (2)
Microsoft Windows NT 4/2000 - TCP Stack Denial of Service (1)
Microsoft Windows NT 4/2000 - TCP Stack Denial of Service (2)
Microsoft Windows Server 2000/NT 4/XP - Network Share Provider SMB Request Buffer Overflow (1)
Microsoft Windows Server 2000/NT 4/XP - Network Share Provider SMB Request Buffer Overflow (2)
Microsoft Windows XP/2000/NT 4 - Network Share Provider SMB Request Buffer Overflow (1)
Microsoft Windows XP/2000/NT 4 - Network Share Provider SMB Request Buffer Overflow (2)

Microsoft PoCket Internet Explorer 3.0 - Denial of Service
Microsoft Pocket Internet Explorer 3.0 - Denial of Service

Microsoft Windows - HWND_BROADCAST PoC (MS13-005)
Microsoft Windows - HWND_BROADCAST (PoC) (MS13-005)

Boilsoft RM TO MP3 Converter 1.72 - '.wav' Crash PoC
Boilsoft RM TO MP3 Converter 1.72 - '.wav' Crash (PoC)

Apple Safari 3 for Windows - Document.Location Denial of Service
Apple Safari 3 for Windows - 'Document.Location' Denial of Service

PotPlayer 1.5.42509 Beta - Denial of Service (Integer Division by Zero Exploit)
PotPlayer 1.5.42509 Beta - Integer Division by Zero Denial of Service

Apple Safari 3.0.x - for Windows Document.Location.Hash Buffer Overflow
Apple Safari 3.0.x for Windows - 'Document.Location.Hash' Buffer Overflow

Android Web Browser - GIF File Heap Based Buffer Overflow
Google Android Web Browser - '.GIF' File Heap Based Buffer Overflow

Android Web Browser - BMP File Integer Overflow
Google Android Web Browser - '.BMP' File Integer Overflow

Gold MP4 Player 3.3 - Buffer Overflow PoC (SEH)
Gold MP4 Player 3.3 - Buffer Overflow (PoC) (SEH)

Microsoft Windows Server 2003/Vista - 'UnhookWindowsHookEx' Local Denial of Service
Microsoft Windows Vista/2003 - 'UnhookWindowsHookEx' Local Denial of Service

Microsoft Internet Explorer 8 / 9 / 10 - CInput Use-After-Free Crash PoC (MS14-035)
Microsoft Internet Explorer 8 / 9 / 10 - CInput Use-After-Free Crash (PoC) (MS14-035)

Microsoft Internet Explorer 9/10 - CFormElement Use-After-Free and Memory Corruption PoC (MS14-035)
Microsoft Internet Explorer 9/10 - CFormElement Use-After-Free and Memory Corruption (PoC) (MS14-035)

Microsoft Internet Explorer - Memory Corruption PoC (MS14-029)
Microsoft Internet Explorer - Memory Corruption (PoC) (MS14-029)

UniPDF 1.1 - Crash (PoC) (SEH)

Brasero CD/DVD Burner 3.4.1 - '.m3u' Buffer Overflow Crash (PoC)

Microsoft Windows - 'HTTP.sys' PoC (MS15-034)
Microsoft Windows - 'HTTP.sys' (PoC) (MS15-034)

UniPDF 1.2 - 'xml' Buffer Overflow Crash (PoC)

Microsoft Internet Explorer 11 - Crash PoC (2)
Microsoft Internet Explorer 11 - Crash (PoC) (2)

Apple macOS/IOS 10.12.2(16C67) - mach_msg Heap Overflow
Apple macOS/IOS 10.12.2 (16C67) - 'mach_msg' Heap Overflow

QNX RTOS 6.3.0 - Insecure rc.local Permissions Plus System Crash
QNX RTOS 6.3.0 - Insecure 'rc.local' Permissions System Crash / Privilege Escalation
Microsoft Windows - NtClose DeadLock PoC (MS06-030)
Microsoft Windows XP/2000 - 'Mrxsmb.sys' Privilege Escalation PoC (MS06-030)
Microsoft Windows - NtClose DeadLock (PoC) (MS06-030)
Microsoft Windows XP/2000 - 'Mrxsmb.sys' Privilege Escalation (PoC) (MS06-030)

PHP 5.2.0 / PHP with PECL ZIP 1.8.3 - zip:// URL Wrapper Buffer Overflow
PHP 5.2.0 / PHP with PECL ZIP 1.8.3 - 'zip://' URL Wrapper Buffer Overflow

Apache Tomcat (Windows) - runtime.getRuntime().exec() Privilege Escalation
Apache Tomcat (Windows) - 'runtime.getRuntime().exec()' Privilege Escalation

Atomix Virtual Dj Pro 6.0 - Stack Buffer Overflow PoC (SEH)
Atomix Virtual Dj Pro 6.0 - Stack Buffer Overflow (PoC) (SEH)

Streaming Audio Player 0.9 - (skin) Local Stack Overflow (SEH)
Streaming Audio Player 0.9 - 'skin' Local Stack Overflow (SEH)

Tuniac 090517c - '.m3u' Local File Crash (PoC)

Audio Workstation 6.4.2.4.3 - '.pls' Buffer Overflow (Metasploit) (1)
Audio Workstation 6.4.2.4.3 - '.pls' Buffer Overflow (Metasploit)

Xenorate 2.50 - '.xpl' Universal Local Buffer Overflow (SEH) (Metasploit) (1)
Xenorate 2.50 - '.xpl' Universal Local Buffer Overflow (SEH) (Metasploit)

Mini-stream 3.0.1.1 - Buffer Overflow (Metasploit) (1)
Mini-stream 3.0.1.1 - Buffer Overflow (Metasploit)

Media Jukebox 8.0.400 - Buffer Overflow (SEH) (Metasploit)

Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (3)
Microsoft HTML Help Workshop 4.74 - '.hhp' Index Buffer Overflow (Metasploit) (3)

Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (2)
Xenorate 2.50 - '.xpl' Universal Local Buffer Overflow (SEH) (Metasploit) (2)
Microsoft HTML Help Workshop 4.74 - '.hhp' Cotent Buffer Overflow (Metasploit) (2)

Audio Workstation 6.4.2.4.3 - '.pls' Buffer Overflow (Metasploit) (2)

Mini-stream 3.0.1.1 - Buffer Overflow (Metasploit) (2)

Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (4)
Microsoft HTML Help Workshop 4.74 - '.hhp' compiled Buffer Overflow (Metasploit) (4)

Magix Musik Maker 16 - '.mmm' Stack Buffer Overflow (without egg-hunter) (Metasploit)
Magix Musik Maker 16 - '.mmm' Stack Buffer Overflow (Without Egg-Hunter) (Metasploit)

PHP 5.3.6 - Buffer Overflow PoC (ROP)
PHP 5.3.6 - Buffer Overflow (ROP) (PoC)

Microsoft Windows Server 2000/NT 4 - DLL Search Path
Microsoft Windows NT 4/2000 - DLL Search Path

Microsoft Windows Server 2000/NT 4 - NTFS File Hiding
Microsoft Windows NT 4/2000 - NTFS File Hiding

Microsoft Windows Server 2000/NT 4.0 - Process Handle Local Privilege Elevation
Microsoft Windows NT 4/2000 - Process Handle Local Privilege Elevation
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (1)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (2)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (3)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (4)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (5)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (6)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (7)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (8)
Microsoft Windows XP/2000/NT 4 - Window Message Subsystem Design Error (1)
Microsoft Windows XP/2000/NT 4 - Window Message Subsystem Design Error (2)
Microsoft Windows XP/2000/NT 4 - Window Message Subsystem Design Error (3)
Microsoft Windows XP/2000/NT 4 - Window Message Subsystem Design Error (4)
Microsoft Windows XP/2000/NT 4 - Window Message Subsystem Design Error (5)
Microsoft Windows XP/2000/NT 4 - Window Message Subsystem Design Error (6)
Microsoft Windows XP/2000/NT 4 - Window Message Subsystem Design Error (7)
Microsoft Windows XP/2000/NT 4 - Window Message Subsystem Design Error (8)
Microsoft Windows Server 2000/NT 4/XP - NetDDE Privilege Escalation (1)
Microsoft Windows Server 2000/NT 4/XP - NetDDE Privilege Escalation (2)
Microsoft Windows XP/2000/NT 4 - NetDDE Privilege Escalation (1)
Microsoft Windows XP/2000/NT 4 - NetDDE Privilege Escalation (2)

Microsoft Windows Server 2000/NT 4 - Local Descriptor Table Privilege Escalation (MS04-011)
Microsoft Windows NT 4/2000 - Local Descriptor Table Privilege Escalation (MS04-011)

Microsoft Windows Server 2000/NT 4 - POSIX Subsystem Buffer Overflow Privilege Escalation (MS04-020)
Microsoft Windows NT 4/2000 - POSIX Subsystem Buffer Overflow Privilege Escalation (MS04-020)

PHP 4.x/5.0/5.1 with Sendmail Mail Function - additional_parameters Argument Arbitrary File Creation
PHP 4.x/5.0/5.1 with Sendmail Mail Function - 'additional_parameters' Argument Arbitrary File Creation

Mozilla Firefox 5.0 < 15.0.1 - __exposedProps__ XCS Code Execution (Metasploit)

Microsoft Windows Server 2003/2008/XP/Vista - WMI Service Isolation Privilege Escalation
Microsoft Windows XP/Vista/2003/2008 - WMI Service Isolation Privilege Escalation

Adobe Reader for Android - addJavascriptInterface Exploit (Metasploit)
Adobe Reader for Android - 'addJavascriptInterface' Exploit (Metasploit)

UniPDF 1.1 - Crash PoC (SEH overwritten)

Brasero CD/DVD Burner 3.4.1 - 'm3u' Buffer Overflow Crash (PoC)

UniPDF 1.2 - 'xml' Buffer Overflow Crash (PoC)

Microsoft Windows - 'CNG.SYS' Kernel Security Feature Bypass PoC (MS15-052)
Microsoft Windows - 'CNG.SYS' Kernel Security Feature Bypass (PoC) (MS15-052)

Android - get_user/put_user Exploit (Metasploit)
Google Android - get_user/put_user Exploit (Metasploit)

Microsoft Windows 7 < 10 / Server 2008 < 2012 R2 (x86/x64) - Privilege Escalation (MS16-032) (PowerShell)
Microsoft Windows 7 < 10 / 2008 < 2012 R2 (x86/x64) - Privilege Escalation (MS16-032) (PowerShell)

Microsoft Windows 7 < 10 / Server 2008 < 2012 (x86/x64) - Privilege Escalation (MS16-032) (C#)
Microsoft Windows 7 < 10 / 2008 < 2012 (x86/x64) - Privilege Escalation (MS16-032) (C#)

Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)
Adobe Flash Player - Nellymoser Audio Decoding Buffer Overflow (Metasploit) (2)
Mozilla Firefox 5.0 < 15.0.1 - __exposedProps__ XCS Code Execution (Metasploit)
Google Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)

MOXA MediaDBPlayback - ActiveX Control Buffer Overflow (Metasploit)

MOXA Device Manager Tool 2.1 - Buffer Overflow (Metasploit)

ProFTPd 1.2.9rc2 - ASCII File Remote Code Execution
ProFTPd 1.2.9 rc2 - ASCII File Remote Code Execution (1)

Veritas Backup Exec - Remote File Access Exploit (Windows) (Metasploit)
Novell ZENworks 6.5 - Desktop/Server Management Remote Stack Overflow (Metasploit)
MDaemon 8.0.3 - IMAPD CRAM-MD5 Authentication Overflow (Metasploit) (1)
Novell eDirectory 8.7.3 - iMonitor Remote Stack Overflow (Metasploit)
Novell ZENworks 6.5 - Desktop/Server Management Remote Stack Overflow (Metasploit)
MDaemon 8.0.3 - IMAPD CRAM-MD5 Authentication Overflow (Metasploit)
Novell eDirectory 8.7.3 - iMonitor Remote Stack Overflow (Metasploit)

Microsoft Windows Media Player 7.1 < 10 - BMP Heap Overflow PoC (MS06-005) (2)
Microsoft Windows Media Player 7.1 < 10 - BMP Heap Overflow (PoC) (MS06-005) (2)

Ultr@VNC 1.0.1 - client Log::ReallyPrint Buffer Overflow
Ultr@VNC 1.0.1 - 'client Log::ReallyPrint' Buffer Overflow

Sybase EAServer 5.2 - (WebConsole) Remote Stack Overflow (Metasploit)
Broadcom Wireless Driver - Probe Response SSID Overflow (Metasploit) (1)
D-Link DWL-G132 - Wireless Driver Beacon Rates Overflow (Metasploit) (1)
Broadcom Wireless Driver - Probe Response SSID Overflow (Metasploit)
D-Link DWL-G132 - Wireless Driver Beacon Rates Overflow (Metasploit)

ProFTPd 1.2.9 rc2 - ASCII File Remote Code Execution
ProFTPd 1.2.9 rc2 - ASCII File Remote Code Execution (2)

Microsoft Internet Explorer 7 - Arbitrary File Rewrite PoC (MS07-027)
Microsoft Internet Explorer 7 - Arbitrary File Rewrite (PoC) (MS07-027)

CCProxy 6.2 - Telnet Proxy Ping Overflow (Metasploit) (1)
CCProxy 6.2 - Telnet Proxy Ping Overflow (Metasploit)

ImageStation - 'SonyISUpload.cab 1.0.0.38' ActiveX Buffer Overflow
ImageStation - 'SonyISUpload.cab' 1.0.0.38 ActiveX Buffer Overflow

IntelliTamper 2.0.7 - (html parser) Remote Buffer Overflow
IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow

Microsoft XML Core Services DTD - Cross-Domain Scripting PoC (MS08-069)
Microsoft XML Core Services DTD - Cross-Domain Scripting (PoC) (MS08-069)

Microsoft Internet Explorer 7 (Windows 2003 SP2) - Memory Corruption PoC (MS09-002)
Microsoft Internet Explorer 7 (Windows 2003 SP2) - Memory Corruption (PoC) (MS09-002)

Apple Mac OSX - Java applet Remote Deserialization Remote PoC (2)
Apple Mac OSX - Java applet Remote Deserialization Remote (PoC) (2)

Microsoft Windows live messenger plus! fileserver 1.0 - Directory Traversal
Microsoft Windows Live Messenger Plus! Fileserver 1.0 - Directory Traversal

JetAudio 7.5.3 COWON Media Center - '.wav' Crash

DistCC Daemon - Command Execution (Metasploit) (1)
DistCC Daemon - Command Execution (Metasploit)
Apple QuickTime RTSP 10.4.0 < 10.5.0 (OSX) - Content-Type Overflow (Metasploit)
mDNSResponder 10.4.0 / 10.4.8 (OSX) - UPnP Location Overflow (Metasploit)
Apple QuickTime RTSP 10.4.0 < 10.5.0 (OSX) - Content-Type Overflow (Metasploit)
mDNSResponder 10.4.0 / 10.4.8 (OSX) - UPnP Location Overflow (Metasploit)

Wyse Rapport Hagent Fake Hserver - Command Execution (Metasploit) (1)
Wyse Rapport Hagent Fake Hserver - Command Execution (Metasploit)

Veritas NetBackup - Remote Command Execution (Metasploit) (1)
Veritas NetBackup - Remote Command Execution (Metasploit)

Pegasus Mail Client 4.51 - PoC Buffer Overflow
Pegasus Mail Client 4.51 - Buffer Overflow (PoC)

Irix LPD tagprinter - Command Execution (Metasploit) (1)
Irix LPD tagprinter - Command Execution (Metasploit)

Xtacacsd 4.1.2 - report() Buffer Overflow (Metasploit) (1)
Xtacacsd 4.1.2 - 'report()' Buffer Overflow (Metasploit)

Novell iPrint Client - ActiveX Control call-back-url Buffer Overflow (Metasploit) (1)
Novell iPrint Client - ActiveX Control call-back-url Buffer Overflow (Metasploit)

Trend Micro Internet Security Pro 2010 - ActiveX extSetOwner() Remote Code Execution (Metasploit) (2)
Trend Micro Internet Security Pro 2010 - ActiveX extSetOwner() Remote Code Execution (Metasploit)

Tandberg E & EX & C Series Endpoints - Default Credentials for Root Account
Tandberg E & EX & C Series Endpoints - Default Root Account Credentials

Wyse Rapport Hagent Fake Hserver - Command Execution (Metasploit) (2)

Veritas NetBackup - Remote Command Execution (Metasploit) (2)

Samba 2.2.2 < 2.2.6 - 'nttrans' Buffer Overflow (Metasploit) (2)
Samba 2.2.2 < 2.2.6 - 'nttrans' Buffer Overflow (Metasploit) (1)
D-Link DWL-G132 - Wireless Driver Beacon Rates Overflow (Metasploit) (2)
Broadcom Wireless Driver - Probe Response SSID Overflow (Metasploit) (2)

CA BrightStor ARCserve Tape Engine - 0x8A Buffer Overflow (Metasploit) (1)
CA BrightStor ARCserve Tape Engine - 0x8A Buffer Overflow (Metasploit)

MDaemon 8.0.3 - IMAPD CRAM-MD5 Authentication Overflow (Metasploit) (2)

Novell iPrint Client - ActiveX Control call-back-url Buffer Overflow (Metasploit) (2)

Trend Micro Internet Security Pro 2010 - ActiveX extSetOwner() Remote Code Execution (Metasploit) (1)

CCProxy 6.2 - Telnet Proxy Ping Overflow (Metasploit) (2)

httpdx - tolog() Function Format String (Metasploit) (1)
httpdx - 'tolog()' Function Format String (Metasploit) (1)

Novell ZENworks Configuration Management 10.2.0 - Remote Execution (Metasploit) (1)
Novell ZENworks Configuration Management 10.2.0 - Remote Execution (Metasploit)

httpdx - tolog() Function Format String (Metasploit) (2)
httpdx - 'tolog()' Function Format String (Metasploit) (2)

Irix LPD tagprinter - Command Execution (Metasploit) (2)

Xtacacsd 4.1.2 - report() Buffer Overflow (Metasploit) (2)

DistCC Daemon - Command Execution (Metasploit) (2)
HP Data Protector Client 6.11 - EXEC_SETUP Remote Code Execution PoC (ZDI-11-056)
HP Data Protector Client 6.11 - EXEC_CMD Remote Code Execution PoC (ZDI-11-055)
HP Data Protector Client 6.11 - 'EXEC_SETUP' Remote Code Execution (PoC)
HP Data Protector Client 6.11 - 'EXEC_CMD' Remote Code Execution (PoC)

Mozilla Firefox 3.6.16 - mChannel Use-After-Free (Metasploit) (1)
Mozilla Firefox 3.6.16 (Windows) - mChannel Use-After-Free (Metasploit) (1)

Opera 10/11 - (bad nesting with frameset tag) Memory Corruption (Metasploit)
Opera 10/11 - Bad Nesting with Frameset Tag Memory Corruption (Metasploit)

Mozilla Firefox 3.6.16 - mChannel Use-After-Free (Metasploit) (2)
Mozilla Firefox 3.6.16 (OSX) - mChannel Use-After-Free (Metasploit) (2)

HP SiteScope - Remote Code Execution (Metasploit) (1)
HP SiteScope (Linux/Windows) - Remote Code Execution (Metasploit)

Microsoft Windows Server 2000/NT 4/XP - Help Facility ActiveX Control Buffer Overflow
Microsoft Windows XP/2000/NT 4 - Help Facility ActiveX Control Buffer Overflow

Microsoft Windows Server 2000/NT 4 Media Services - 'nsiislog.dll' Remote Buffer Overflow
Microsoft Windows NT 4/2000 - Media Services 'nsiislog.dll' Remote Buffer Overflow

thttpd 2.2x - defang Remote Buffer Overflow
thttpd 2.2x - 'defang' Remote Buffer Overflow

Novell ZENworks Configuration Management 10.2.0 - Remote Execution (Metasploit) (2)
Novell ZENworks Configuration Management 10 SP3 / 11 SP2 - Remote Execution (Metasploit)

Dovecot with Exim - sender_address Parameter Remote Command Execution
Dovecot with Exim - 'sender_address' Parameter Remote Command Execution

HP SiteScope - Remote Code Execution (Metasploit) (2)
HP SiteScope (Windows) - Remote Code Execution (Metasploit)

Western Digital Arkeia - Remote Code Execution (Metasploit) (1)
Western Digital Arkeia < 10.0.10 - Remote Code Execution (Metasploit)

CA BrightStor ARCserve Tape Engine - 0x8A Buffer Overflow (Metasploit) (2)

Mozilla Firefox 5.0 < 15.0.1 - __exposedProps__ XCS Code Execution (Metasploit)

Adobe Flash Player - Nellymoser Audio Decoding Buffer Overflow (Metasploit) (1)
Adobe Flash Player - Nellymoser Audio Decoding Buffer Overflow (Metasploit)

Western Digital Arkeia - Remote Code Execution (Metasploit) (2)
Western Digital Arkeia < 11.0.12 - Remote Code Execution (Metasploit)

Samba 2.2.2 < 2.2.6 - 'nttrans' Buffer Overflow (Metasploit) (1)

E-Uploader Pro 1.0 - Image Upload with Code Execution
E-Uploader Pro 1.0 - Image Upload / Code Execution

ASPapp Knowledge Base - 'CatId' Parameter SQL Injection
ASPapp Knowledge Base - 'CatId' Parameter SQL Injection (1)

ASPapp KnowledgeBase - 'catid' Parameter SQL Injection
ASPapp Knowledge Base - 'CatId' Parameter SQL Injection (2)

ea-gBook 0.1 - Remote Command Execution with Remote File Inclusion (c99)
ea-gBook 0.1 - Remote Command Execution / Remote File Inclusion (c99)

Flatchat 3.0 - 'pmscript.php with' Local File Inclusion
Flatchat 3.0 - 'pmscript.php' Local File Inclusion

Joomla! Component huruhelpdesk - SQL Injection
Joomla! Component Huru Helpdesk - SQL Injection (1)

PGAUTOPro - SQL Injection / Cross-Site Scripting
PGAUTOPro - SQL Injection / Cross-Site Scripting (1)

Joomla! Component Huru Helpdesk - SQL Injection
Joomla! Component Huru Helpdesk - SQL Injection (2)

SoftwareDEP Classified Script 2.5 - SQL Injection
SoftwareDEP Classified Script 2.5 - SQL Injection (1)

WordPress Plugin pay with tweet 1.1 - Multiple Vulnerabilities
WordPress Plugin Pay with Tweet 1.1 - Multiple Vulnerabilities

Software DEP Classified Script 2.5 - SQL Injection
SoftwareDEP Classified Script 2.5 - SQL Injection (2)
Virtual Programming VP-ASP 5.00 - shopexd.asp SQL Injection (1)
Virtual Programming VP-ASP 5.00 - shopexd.asp SQL Injection (2)
Virtual Programming VP-ASP 5.00 - 'shopexd.asp' SQL Injection (1)
Virtual Programming VP-ASP 5.00 - 'shopexd.asp' SQL Injection (2)

OnlineArts DailyDose 1.1 - Denial of Servicee.pl Remote Command Execution
OnlineArts DailyDose 1.1 - 'dose.pl' Remote Command Execution
PHPOpenChat 2.3.4/3.0.1 - PoC_loginform.php phpbb_root_path Parameter Remote File Inclusion
PHPOpenChat 2.3.4/3.0.1 - PoC.php Remote File Inclusion
PHPOpenChat 2.3.4/3.0.1 - 'poc_loginform.php' phpbb_root_path Parameter Remote File Inclusion
PHPOpenChat 2.3.4/3.0.1 - 'poc.php' Remote File Inclusion

ActiveNews Manager - 'articleId' Parameter SQL Injection
ActiveNews Manager - 'articleId' Parameter SQL Injection (1)

Active News Manager - 'articleId' Parameter SQL Injection
ActiveNews Manager - 'articleId' Parameter SQL Injection (2)

Sagem Fast 3304-V2 - Authentication Bypass
Sagem Fast 3304-V2 - Authentication Bypass (1)

PG Auto Pro - SQL Injection / Cross-Site Scripting
PGAUTOPro - SQL Injection / Cross-Site Scripting (2)

Sagem FAST3304-V2 - Authentication Bypass
Sagem FAST3304-V2 - Authentication Bypass (2)

Trend Micro - Multiple HTTP Problems with CoreServiceShell.exe
Trend Micro - 'CoreServiceShell.exe' Multiple HTTP Issues

phpATM 1.32 - Arbitrary File Upload / Remote Command Execution (Windows Servers)
phpATM 1.32 (Windows) - Arbitrary File Upload / Remote Command Execution

Seagate Business NAS - Unauthenticated Remote Command Execution (Metasploit)
 2017-04-02 05:01:18 +00:00
Offensive Security
6d17bc529d DB: 2017-03-31 
4 new exploits

dBpowerAMP Audio Player Release 2 - '.m3u' Buffer Overflow (PoC)
dBpowerAMP Audio Player 2 - '.m3u' Buffer Overflow (PoC)

Spider Solitaire -  Denial of Service (PoC)
Spider Solitaire - Denial of Service (PoC)

Baby FTP Server 1.24 - Denial of Service
Baby FTP Server 1.24 - Denial of Service (1)

Baby FTP server 1.24 - Denial of Service
Baby FTP server 1.24 - Denial of Service (2)

Google Android -  Unprotected MSRs in EL1 RKP Privilege Escalation
Google Android - Unprotected MSRs in EL1 RKP Privilege Escalation

Evostream Media Server 1.7.1  (x64) - Denial of Service
Evostream Media Server 1.7.1 (x64) - Denial of Service

Cerberus FTP Server  8.0.10.1 - Denial of Service
Cerberus FTP Server 8.0.10.1 - Denial of Service

Apple macOS/IOS 10.12.2(16C67) - mach_msg Heap Overflow

Apache < 2.0.64  / < 2.2.21 mod_setenvif - Integer Overflow
Apache < 2.0.64 / < 2.2.21 mod_setenvif - Integer Overflow

Solaris 10 sysinfo() - Local Kernel Memory Disclosure
Solaris 10 sysinfo() - Local Kernel Memory Disclosure (1)

Solaris 10 sysinfo(2) - Local Kernel Memory Disclosure
Solaris 10 sysinfo(2) - Local Kernel Memory Disclosure (2)

Xenorate 2.50 - '.xpl' Universal Local Buffer Overflow (SEH) (Metasploit)
Xenorate 2.50 - '.xpl' Universal Local Buffer Overflow (SEH) (Metasploit) (1)
Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) -  (Sendmail) Capabilities Privilege Escalation(1)
Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) -  (Sendmail 8.10.1) Capabilities Privilege Escalation (2)
Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) - (Sendmail) Capabilities Privilege Escalation(1)
Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) - (Sendmail 8.10.1) Capabilities Privilege Escalation (2)

Linux Kernel 3.13 -  (SGID) Privilege Escalation (PoC)
Linux Kernel 3.13 - (SGID) Privilege Escalation (PoC)

Linux espfix64 -  (Nested NMIs Interrupting) Privilege Escalation
Linux espfix64 - (Nested NMIs Interrupting) Privilege Escalation
Microsoft Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (2) (MS16-008)
Microsoft Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (1) (MS16-008)
Microsoft Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (MS16-008) (2)
Microsoft Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (MS16-008) (1)
Forticlient 5.2.3 Windows 10 x64 (Pre Anniversary) - Privilege Escalation
Forticlient 5.2.3 Windows 10 x64 (Post Anniversary) - Privilege Escalation
Forticlient 5.2.3 (Windows 10 x64 Pre Anniversary) - Privilege Escalation
Forticlient 5.2.3 (Windows 10 x64 Post Anniversary) - Privilege Escalation

Ubuntu < 15.10 - PT Chown Arbitrary PTs Access Via UserNamespace Privilege Escalation
Ubuntu < 15.10 - PT Chown Arbitrary PTs Access Via User Namespace Privilege Escalation

Ubuntu 15.04 (Dev) - 'Upstart' Logrotation Privilege Escalation
Ubuntu 15.04 (Development) - 'Upstart' Logrotation Privilege Escalation

Linux Kernel 2.6.32 (Ubuntu 10.04) - /proc Handling SUID Privilege Escalation

Microsoft Windows Message Queuing Service - RPC Buffer Overflow (MS07-065)
Microsoft Windows Message Queuing Service - RPC Buffer Overflow (MS07-065) (1)

Microsoft Windows Message Queuing Service - RPC Buffer Overflow (MS07-065)
Microsoft Windows Message Queuing Service - RPC Buffer Overflow (MS07-065) (2)

Yahoo! Music Jukebox 2.2 - AddImage() ActiveX Remote Buffer Overflow (1)
Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (1)

dBpowerAMP Audio Player Release 2 - '.m3u' Buffer Overflow
dBpowerAMP Audio Player 2 - '.m3u' Buffer Overflow

Apache Tomcat < 6.0.18 - utf8 Directory Traversal (1)
Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC)

Mozilla Firefox 3.5 - (Font tags) Remote Heap Spray Exploit (1)
Mozilla Firefox 3.5 - (Font tags) Remote Heap Spray (1)

Mozilla Firefox 3.5 - (Font tags) Remote Heap Spray
Mozilla Firefox 3.5 - (Font tags) Remote Heap Spray (2)

EasyFTP Server 1.7.0.2 - Authenticated Buffer Overflow
EasyFTP Server 1.7.0.2 - Authenticated Buffer Overflow (1)

Apache Tomcat < 6.0.18 - utf8 Directory Traversal (2)
Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal

Trend Micro Internet Security Pro 2010 - ActiveX extSetOwner() Remote Code Execution (Metasploit)
Trend Micro Internet Security Pro 2010 - ActiveX extSetOwner() Remote Code Execution (Metasploit) (2)

Samba 2.2.2 < 2.2.6 - nttrans Buffer Overflow (Metasploit)
Samba 2.2.2 < 2.2.6 - 'nttrans' Buffer Overflow (Metasploit) (2)

EasyFTP Server 1.7.0.2 - Authenticated Buffer Overflow
EasyFTP Server 1.7.0.2 - Authenticated Buffer Overflow (2)

Microsoft Internet Explorer - SLayoutRun Use-After-Free (MS13-009) (Metasploit)
Microsoft Internet Explorer - SLayoutRun Use-After-Free (MS13-009) (Metasploit) (1)

Microsoft Internet Explorer - SLayoutRun Use-After-Free (MS13-009) (Metasploit)
Microsoft Internet Explorer - SLayoutRun Use-After-Free (MS13-009) (Metasploit) (2)

D-Link Devices - Unauthenticated Remote Command Execution (Metasploit) (2)
D-Link Devices - 'command.php' Unauthenticated Remote Command Execution (Metasploit)

D-Link Devices - Unauthenticated Remote Command Execution (Metasploit) (1)
D-Link Devices - 'tools_vct.xgi' Unauthenticated Remote Command Execution (Metasploit)

Azure Data Expert Ultimate  2.2.16 - Buffer Overflow
Azure Data Expert Ultimate 2.2.16 - Buffer Overflow

Samba 2.2.2 < 2.2.6 - 'nttrans' Buffer Overflow (Metasploit)
Samba 2.2.2 < 2.2.6 - 'nttrans' Buffer Overflow (Metasploit) (1)

Article Script 1.6.3 - 'rss.php' SQL Injection (1)
Article Script 1.6.3 - 'rss.php' SQL Injection

DBHcms 1.1.4 - Remote File Inclusion
DBHcms 1.1.4 - 'code' Remote File Inclusion

LaserNet CMS 1.5 - SQL Injection (2)
LaserNet CMS 1.5 - SQL Injection

Clever Copy 3.0 - 'postview.php' SQL Injection (1)
Clever Copy 3.0 - 'postview.php' SQL Injection

phpAuction - 'profile.php' SQL Injection
phpAuction - 'profile.php' SQL Injection (1)

Arctic Issue Tracker 2.0.0 - 'filter' Parameter SQL Injection
Arctic Issue Tracker 2.0.0 - 'filter' Parameter SQL Injection (1)

Arctic Issue Tracker 2.0.0 - 'filter' Parameter SQL Injection
Arctic Issue Tracker 2.0.0 - 'filter' Parameter SQL Injection (2)

Matterdaddy Market 1.1 - Multiple SQL Injections (1)
Matterdaddy Market 1.1 - 'index.php' Multiple SQL Injections

PHPWebGallery 1.3.4 - Blind SQL Injection
PHPWebGallery 1.3.4 - Blind SQL Injection (1)

PHPWebGallery 1.3.4 - Blind SQL Injection
PHPWebGallery 1.3.4 - Blind SQL Injection (2)

Zeeways Shaadi Clone 2.0 - Authentication Bypass
Zeeways Shaadi Clone 2.0 - Authentication Bypass (1)

Portili Personal and Team Wiki 1.14 - Multiple Vulnerabilities
Portili Personal and Team Wiki 1.14 - Multiple Vulnerabilities (1)

DBHcms 1.1.4 - Remote File Inclusion
DBHcms 1.1.4 - 'dbhcms_core_dir' Remote File Inclusion

E-book Store - Multiple Vulnerabilities (1)

Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion
Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion (1)

E-book Store - Multiple Vulnerabilities (2)
E-book Store - Multiple Vulnerabilities

Classifieds Script - SQL Injection
Classifieds Script - 'rate' SQL Injection

Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion
Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion (2)

DBHcms 1.1.4 - SQL Injection
DBHcms 1.1.4 - 'dbhcms_pid' SQL Injection

LaserNet CMS 1.5 - SQL Injection (1)

Alan Ward A-CART 2.0 - category.asp catcode Parameter SQL Injection
Alan Ward A-CART 2.0 - category.asp catcode Parameter SQL Injection (2)

Article Script 1.6.3 - 'rss.php' SQL Injection (2)

Alan Ward A-CART 2.0 - category.asp catcode Parameter SQL Injection
Alan Ward A-CART 2.0 - category.asp catcode Parameter SQL Injection (1)

Openads (PHPAdsNew) <  2.0.8 - 'lib-remotehost.inc.php' Remote File Inclusion
Openads (PHPAdsNew) < 2.0.8 - 'lib-remotehost.inc.php' Remote File Inclusion

LiveCart 1.0.1 - 'return' Parameter Cross-Site Scripting
LiveCart 1.0.1 - 'return' Parameter Cross-Site Scripting (1)

LiveCart 1.0.1 - 'return' Parameter Cross-Site Scripting
LiveCart 1.0.1 - 'return' Parameter Cross-Site Scripting (2)
Fonality trixbox 2.4.2 - Cross-Site Scripting
Fonality trixbox 2.4.2 - Cross-Site Scripting (1)
Fonality trixbox 2.4.2 - Cross-Site Scripting (2)

Clever Copy 3.0 - 'postview.php' SQL Injection (2)

phpAuction - 'profile.php' SQL Injection
phpAuction - 'profile.php' SQL Injection (2)

Zeeways Shaadi Clone 2.0 - Authentication Bypass
Zeeways Shaadi Clone 2.0 - Authentication Bypass (2)

DBHcms 1.1.4 - 'dbhcms_core_dir' Parameter Remote File Inclusion

Portili Personal and Team Wiki 1.14 - Multiple Vulnerabilities
Portili Personal and Team Wiki 1.14 - Multiple Vulnerabilities (2)

Matterdaddy Market 1.1 - Multiple SQL Injections (2)
Matterdaddy Market 1.1 - 'cat_name' Multiple SQL Injections

WordPress Plugin WP Private Messages 1.0.1 - SQL Injection
WordPress Plugin WP Private Messages 1.0.1 - SQL Injection (1)

Huawei Flybox B660 - Cross-Site Request Forgery
Huawei Flybox B660 - Cross-Site Request Forgery (1)

Huawei Flybox B660 - Cross-Site Request Forgery
Huawei Flybox B660 - Cross-Site Request Forgery (2)

Classifieds Script - SQL Injection
Classifieds Script - 'term' SQL Injection

WordPress Plugin WP Private Messages 1.0.1 - SQL Injection
WordPress Plugin WP Private Messages 1.0.1 - SQL Injection (2)
 2017-03-31 05:01:16 +00:00
Offensive Security
8e03027ae5 DB: 2017-03-30 
18 new exploits

FUSE fusermount Tool - Race Condition
Linux Kernel (Ubuntu 11.10/12.04) - binfmt_script Stack Data Disclosure
Apache 2.2 - Scoreboard Invalid Free On Shutdown
Apache < 2.0.64  / < 2.2.21 mod_setenvif - Integer Overflow

FUSE fusermount Tool - Race Condition
Ubuntu < 15.10 - PT Chown Arbitrary PTs Access Via UserNamespace Privilege Escalation
AUFS (Ubuntu 15.10) - 'allow_userns' Fuse/Xattr User Namespaces Privilege Escalation
Ubuntu 14.04/15.10 - User Namespace Overlayfs Xattr Setgid Privilege Escalation
Ubuntu 15.10 - 'USERNS ' Overlayfs Over Fuse Privilege Escalation
NTP - Privilege Escalation
Ubuntu 15.04 (Dev) - 'Upstart' Logrotation Privilege Escalation
Vm86 - Syscall Task Switch Kernel Panic / Privilege Escalation
Disk Sorter Enterprise 9.5.12 - 'Import Command' Buffer Overflow
DiskBoss Enterprise 7.8.16 - 'Import Command' Buffer Overflow
Sync Breeze Enterprise 9.5.16 - 'Import Command' Buffer Overflow

Sync Breeze Enterprise 9.5.16 - 'GET' Buffer Overflow (SEH)

Linux/x86 - execve(/bin/sh_) Shellcode (19 bytes)

Just Dial Clone Script - 'fid' SQL Injection
Just Dial Clone Script - 'fid' Parameter SQL Injection

Just Dial Clone Script - 'srch' SQL Injection
Just Dial Clone Script - 'srch' Parameter SQL Injection
Opensource Classified Ads Script - 'keyword' Parameter SQL Injection
EyesOfNetwork (EON) 5.1 - SQL Injection
 2017-03-30 05:01:15 +00:00
Offensive Security
1f8c35c0c0 DB: 2017-03-28 
25 new exploits

Samba < 3.6.2 (x86) - Denial of Serviec (PoC)
Samba < 3.6.2 (x86) - Denial of Service (PoC)
Microsoft Visual Studio 2015 update 3 - Denial of Service
Disk Sorter Enterprise 9.5.12 - Local Buffer Overflow
Apple Safari - 'DateTimeFormat.format' Type Confusion
Apple Safari - Builtin JavaScript Allows Function.caller to be Used in Strict Mode
Apple Safari - Out-of-Bounds Read when Calling Bound Function

QNAP QTS < 4.2.4 - Domain Privilege Escalation
Internet Information Services (IIS) 6.0 WebDAV - 'ScStoragePathFromUrl' Buffer Overflow
Samba 4.5.2 - Symlink Race Permits Opening Files Outside Share Directory
Github Enterprise - Default Session Secret And Deserialization (Metasploit)

B2B Alibaba Clone Script - SQL Injection
B2B Alibaba Clone Script - 'IndustryID' Parameter SQL Injection
Just Another Video Script 1.4.3 - SQL Injection
Adult Tube Video Script - SQL Injection
Alibaba Clone Script - SQL Injection
B2B Marketplace Script 2.0 - SQL Injection
Php Real Estate Property Script - SQL Injection
Courier Tracking Software 6.0 - SQL Injection
Parcel Delivery Booking Script 1.0 - SQL Injection
Delux Same Day Delivery Script 1.0 - SQL Injection
Hotel Booking Script 1.0 - SQL Injection
Tour Package Booking 1.0 - SQL Injection
Professional Bus Booking Script - 'hid_Busid' Parameter SQL Injection
CouponPHP CMS 3.1 - 'code' Parameter SQL Injection
EyesOfNetwork (EON) 5.0 - Remote Code Execution
EyesOfNetwork (EON) 5.0 - SQL Injection
Nuxeo 6.0 / 7.1 / 7.2 / 7.3 - Remote Code Execution (Metasploit)
inoERP 0.6.1 - Cross-Site Scripting / Cross-Site Request Forgery / SQL Injection / Session Fixation
 2017-03-28 05:01:16 +00:00
Offensive Security
570f8aec26 DB: 2017-03-25 
6 new exploits

wifirxpower - Local Buffer Overflow
Miele Professional PG 8528 - Directory Traversal
NETGEAR WNR2000v5 - (Un)authenticated hidden_lang_avi Stack Overflow (Metasploit)
Logsign 4.4.2 / 4.4.137 - Remote Command Injection (Metasploit)
Gr8 Tutorial Script - SQL Injection
Gr8 Gallery Script - SQL Injection
 2017-03-25 05:01:17 +00:00
Offensive Security
3ad96f313d DB: 2017-03-24 
39 new exploits

Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)
Adobe Flash Player - Nellymoser Audio Decoding Buffer Overflow (Metasploit)
Mozilla Firefox 5.0 < 15.0.1 - __exposedProps__ XCS Code Execution (Metasploit)
Mozilla Firefox < 17.0.1 - Flash Privileged Code Injection (Metasploit)
Sun Java Web Start Plugin - Command Line Argument Injection (Metasploit)
Malwarebytes Anti-Malware < 2.0.3 / Anti-Exploit < 1.03.1.1220 - Update Remote Code Execution (Metasploit)
Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) (Metasploit)
EMC Replication Manager < 5.3 - Command Execution (Metasploit)
MOXA MediaDBPlayback - ActiveX Control Buffer Overflow (Metasploit)
Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)
CA Arcserve D2D - GWT RPC Credential Information Disclosure (Metasploit)
Lenovo System Update - Privilege Escalation (Metasploit)
Firebird - Relational Database CNCT Group Number Buffer Overflow (Metasploit)
HP Intelligent Management Center < 5.0 E0102 - UAM Buffer Overflow (Metasploit)
VMware Host Guest Client Redirector - DLL Side Loading (Metasploit)
CADA 3S CoDeSys Gateway Server - Directory Traversal (Metasploit)
MOXA Device Manager Tool 2.1 - Buffer Overflow (Metasploit)

SysGauge 1.5.18 - SMTP Validation Buffer Overflow (Metasploit)
Ceragon FibeAir IP-10 - SSH Private Key Exposure (Metasploit)
ExaGrid - Known SSH Key and Default Password (Metasploit)
GIT 1.8.5.6 / 1.9.5 / 2.0.5 / 2.1.4/ 2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit)
Ruby on Rails 4.0.x / 4.1.x / 4.2.x (Web Console v2) - Whitelist Bypass Code Execution (Metasploit)
Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit)
Samba 2.2.2 < 2.2.6 - 'nttrans' Buffer Overflow (Metasploit)
SSH - User Code Execution (Metasploit)
Redmine SCM Repository - Arbitrary Command Execution (Metasploit)

Linux/x86 - Bind Shell Shellcode (42 bytes)
Linux/x86 - Bind Shell Shellcode (44 bytes)
Joomla! Component Modern Booking 1.0 - 'coupon' Parameter SQL Injection
Flippa Clone - SQL Injection
Centreon < 2.5.1 / Centreon Enterprise Server < 2.2 - SQL Injection / Command Injection (Metasploit)
D-Link/TRENDnet - NCC Service Command Injection (Metasploit)
Seagate Business NAS - Unauthenticated Remote Command Execution (Metasploit)
MantisBT 1.2.0a3 < 1.2.17 - XmlImportExport Plugin PHP Code Injection (Metasploit)
OP5 5.3.5 / 5.4.0 / 5.4.2 / 5.5.0 / 5.5.1 - 'license.php' Remote Command Execution (Metasploit)
OP5 5.3.5 / 5.4.0 / 5.4.2 / 5.5.0 / 5.5.1 - 'welcome' Remote Command Execution (Metasploit)
PHPMailer < 5.2.19 - Sendmail Argument Injection (Metasploit)
SysAid Help Desk Administrator Portal < 14.4 - Arbitrary File Upload (Metasploit)
WordPress Plugin Ninja Forms 2.9.36 < 2.9.42 - Unauthenticated File Upload (Metasploit)
SixApart MovableType < 5.2.12 - Storable Perl Code Execution (Metasploit)
WordPress Theme Holding Pattern - Arbitrary File Upload (Metasploit)
Distinct TFTP 3.10 - Writable Directory Traversal Execution (Metasploit)
 2017-03-24 05:01:16 +00:00
Offensive Security
93635f1158 DB: 2017-03-22 
1 new exploits

Joomla! Component Extra Search 2.2.8 - 'establename' Parameter SQL Injection
 2017-03-22 05:01:16 +00:00
Offensive Security
07432556e0 DB: 2017-03-21 
26 new exploits

FTPShell Client 6.53 - Local Buffer Overflow
FTPShell Client 6.53 - 'Session name' Local Buffer Overflow
FTPShell Server 6.56 - 'ChangePassword' Buffer Overflow
ExtraPuTTY 0.29-RC2 - Denial of Service
Google Nest Cam 5.2.1
 - Buffer Overflow Conditions Over Bluetooth LE
Microsoft Windows Kernel - Registry Hive Loading Crashes in nt!nt!HvpGetBinMemAlloc and nt!ExpFindAndRemoveTagBigPages (MS17-017)
Microsoft Windows - Uniscribe Font Processing Out-of-Bounds Read in usp10!otlChainRuleSetTable::rule (MS17-011)
Microsoft Windows - 'USP10!otlList::insertAt' Uniscribe Font Processing Heap-Based Buffer Overflow (MS17-011)
Microsoft Windows - Uniscribe Font Processing Heap-Based Out-of-Bounds Read/Write in 'USP10!AssignGlyphTypes' (MS17-011)
Microsoft Windows - Uniscribe Font Processing Heap-Based Memory Corruption in 'USP10!otlCacheManager::GlyphsSubstituted' (MS17-011)
Microsoft Windows - Uniscribe Font Processing Heap-Based Memory Corruption in 'USP10!MergeLigRecords' (MS17-011)
Microsoft Windows - Uniscribe Font Processing Heap-Based Buffer Overflow in 'USP10!ttoGetTableData' (MS17-011)
Microsoft Windows - Uniscribe Font Processing Heap-Based Out-of-Bounds Write in 'USP10!UpdateGlyphFlags' (MS17-011)
Microsoft Windows - Uniscribe Font Processing Heap-Based Memory Corruption Around 'USP10!BuildFSM' (MS17-011)
Microsoft Windows - Uniscribe Font Processing Buffer Overflow in 'USP10!FillAlternatesList' (MS17-011)
Microsoft Windows - Uniscribe Font Processing Multiple Heap-Based Out-of-Bounds and Wild Reads (MS17-011)
Microsoft GDI+ - 'gdiplus!GetRECTSForPlayback' Out-of-Bounds Read (MS17-013)
Microsoft Color Management Module 'icm32.dll' - 'icm32!Fill_ushort_ELUTs_from_lut16Tag' Out-of-Bounds Read (MS17-013)
Microsoft Windows - Uniscribe Heap-Based Out-of-Bounds Read in 'USP10!ScriptApplyLogicalWidth' Triggered via EMF (MS17-013)
Microsoft Color Management Module 'icm32.dll' - 'icm32!LHCalc3toX_Di16_Do16_Lut8_G32' Out-of-Bounds Read (MS17-013)
Mozilla Firefox - 'table' Use-After-Free
Microsoft Internet Explorer - 'textarea.defaultValue' Memory Disclosure (MS17-006)

HttpServer 1.0 - Directory Traversal

Cobbler 2.8.0 - Authenticated Remote Code Execution
Joomla! Component JooCart 2.x - 'product_id' Parameter SQL Injection
Joomla! Component jCart for OpenCart 2.0 - 'product_id' Parameter SQL Injection
phplist 3.2.6 - SQL Injection
D-Link DGS-1510 - Multiple Vulnerabilities
 2017-03-21 05:01:17 +00:00
Offensive Security
66117c63f5 DB: 2017-03-16 
16 new exploits

Adobe Flash - Metadata Parsing Out-of-Bounds Read
Adobe Flash - MovieClip Attach init Object Use-After-Free
Adobe Flash - ATF Thumbnailing Heap Overflow
Adobe Flash - ATF Planar Decompression Heap Overflow
Adobe Flash - AVC Header Slicing Heap Overflow
Microsoft Windows - 'LoadUvsTable()' Heap-based Buffer Overflow

USBPcap - Privilege Escalation
USBPcap 1.1.0.0 (WireShark 2.2.5) - Privilege Escalation
PCAUSA Rawether (ASUS PCE-AC56 WLAN Card Utilities Windows 10 x64) - Local Privilege Escalation
Microsoft Windows - COM Session Moniker Privilege Escalation (MS17-012)

Cisco Firepower Management Console 6.0 - Post Authentication UserAdd
Cisco Firepower Management Console 6.0 - Post Authentication UserAdd (Metasploit)
IBM WebSphere - RCE Java Deserialization (Metasploit)
Apache Struts Jakarta - Multipart Parser OGNL Injection (Metasploit)
Joomla! Component Vik Appointments 1.5 - SQL Injection
Joomla! Component Vik Rent Items 1.3 - SQL Injection
Joomla! Component Vik Rent Car 1.11 - SQL Injection
GitHub Enterprise 2.8.0 < 2.8.6 - Remote Code Execution
Steam Profile Integration 2.0.11 - SQL injection
Sitecore CMS 8.1 Update-3 - Cross-Site Scripting
 2017-03-16 05:01:20 +00:00
Offensive Security
8359f0a6a2 DB: 2017-03-14 
5 new exploits

Cerberus FTP Server  8.0.10.1 - Denial of Service

VirtualBox - Cooperating VMs can Escape from Shared Folder

Netgear R7000 and R6400 - cgi-bin Command Injection (Metasploit)

Car Workshop System - SQL Injection

Fiyo CMS 2.0.6.1 - Privilege Escalation
 2017-03-14 05:01:18 +00:00
Offensive Security
6e7ec5be32 DB: 2017-03-10 
20 new exploits

Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 - Denial of Service

Apache Struts2 - Skill Name Remote Code Execution
Apache Struts 2 - Skill Name Remote Code Execution
Linux - Reverse Shell Shellcode (65 bytes)
Linux/x86 - SELinux Permissive Mode Switcher Shellcode (45 bytes)
Linux - TCP Reverse Shell Shellcode (65 bytes)
Linux/x86 - SELinux Permissive Mode Switcher Shellcode (45 bytes)

Windows x86 - Executable Directory Search Shellcode (130 bytes)

Apache Struts2 < 2.3.1 - Multiple Vulnerabilities
Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities
Country on Sale Script - SQL Injection
Media Search Engine Script - 'search' Parameter SQL Injection
Soundify 1.1 - 'tid' Parameter SQL Injection
BistroStays 3.0 - 'guests' Parameter SQL Injection
Nlance 2.2 - SQL Injection
Busewe 1.2 - SQL Injection
Fashmark 1.2 - 'category' Parameter SQL Injection
TradeMart 1.1 - SQL Injection
Drupal 7.x Module Services - Remote Code Execution
WordPress Plugin Mac Photo Gallery 3.0 - Arbitrary File Download
WordPress Plugin Apptha Slider Gallery 1.0 - SQL Injection
WordPress Plugin Apptha Slider Gallery 1.0 - Arbitrary File Download
WordPress Plugin PICA Photo Gallery 1.0 - SQL Injection
Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution
ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Cross-Site Scripting
ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Session Stealing
ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Remote Code Execution
FTP Voyager Scheduler 16.2.0 - Cross-Site Request Forgery
 2017-03-10 05:01:18 +00:00
Offensive Security
06a7933be4 DB: 2017-03-09 
8 new exploits

USBPcap - Privilege Escalation

Linux - Reverse Shell Shellcode (66 bytes)
Linux - Reverse Shell Shellcode (65 bytes)
Themeforest Clone Script - SQL Injection
Graphicriver Clone Script - SQL Injection
Codecanyon Clone Script - SQL Injection
Audiojungle Clone Script - SQL Injection
Videohive Clone Script - SQL Injection
Envato Clone Script - SQL Injection
Navetti PricePoint 4.6.0.0 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery
 2017-03-09 05:01:19 +00:00
Offensive Security
7fa7a111c4 DB: 2017-03-01 
5 new exploits

BlueIris 4.5.1.4 - Denial of Service
Synchronet BBS 3.16c - Denial of Service

Cisco AnyConnect Secure Mobility Client 4.3.04027 - Privilege Escalation

Linux/x86-64 - Reverse Shell Shellcode (84 bytes)

NETGEAR DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery
 2017-03-01 05:01:18 +00:00
Offensive Security
3f1035a488 DB: 2017-02-27 
2 new exploits

Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free PoC

Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free Privilege Escalation
 2017-02-27 05:01:20 +00:00
Offensive Security
3710b90d25 DB: 2017-02-24 
6 new exploits

macOS HelpViewer 10.12.1 - XSS Leads to Arbitrary File Execution and Arbitrary File Read

Linux/x86-64 - Egghunter Shellcode (38 bytes)
WordPress Plugin Mail Masta 1.0 - SQL Injection
Joomla! Component Store for K2 3.8.2 - SQL Injection
Joomla! Component UserExtranet 1.3.1 - SQL Injection
Joomla! Component MultiTier 3.1 - SQL Injection
 2017-02-24 05:01:18 +00:00
Offensive Security
c7c1c7d92e DB: 2017-02-23 
13 new exploits

EasyCom For PHP 4.0.0 - Buffer Overflow (PoC)
EasyCom For PHP 4.0.0 - Denial of Service
Google Chrome - 'layout' Out-of-Bounds Read

Shutter 0.93.1 - Code Execution

DiskSavvy Enterprise - GET Buffer Overflow (Metasploit)
Disk Savvy Enterprise - GET Buffer Overflow (Metasploit)

Disk Savvy Enterprise 9.4.18 - Buffer Overflow (SEH)
Joomla! Component ContentMap 1.3.8 - 'contentid' Parameter SQL Injection
Joomla! Component VehicleManager 3.9 - SQL Injection
Joomla! Component RealEstateManager 3.9 - SQL Injection
Joomla! Component BookLibrary 3.6.1 - SQL Injection
Joomla! Component MediaLibrary Basic 3.5 - SQL Injection
Lock Photos Album&Videos Safe 4.3 - Directory Traversal
ProjectSend r754 - Insecure Direct Object Reference
Teradici Management Console 2.2.0 - Privilege Escalation
 2017-02-23 05:01:18 +00:00
Offensive Security
ae0dd9fa7c DB: 2017-02-20 
14 new exploits

Linux - Reverse Shell Shellcode (66 bytes)

Joomla! Component com_Joomlaoc - 'id' SQL Injection
Joomla! Component Joomloc 1.0 - 'id' Parameter SQL Injection

Joomla! Component com_awdwall 1.5.4 - Local File Inclusion / SQL Injection
Joomla! Component AWDwall 1.5.4 - Local File Inclusion / SQL Injection

Joomla! Component 'com_osproperty' 2.0.2 - Unrestricted Arbitrary File Upload
Joomla! Component com_osproperty 2.0.2 - Unrestricted Arbitrary File Upload

Horde 3.3.5 - Administration Interface admin/PHPshell.php PATH_INFO Parameter Cross-Site Scripting
Horde 3.3.5 - Cross-Site Scripting
Joomla! Component Joomloc-CAT 4.1.3 - 'ville' Parameter SQL Injection
Joomla! Component Joomloc-Lite 1.3.2 - 'site_id' Parameter SQL Injection
Joomla! Component JomWALL 4.0 - 'wuid' Parameter SQL Injection
Joomla! Component OS Property 3.0.8 - SQL Injection
Joomla! Component EShop 2.5.1 - 'id' Parameter SQL Injection
Joomla! Component OS Services Booking 2.5.1 - SQL Injection
Joomla! Component Room Management 1.0 - SQL Injection
Joomla! Component Bazaar Platform 3.0 - SQL Injection
Joomla! Component Google Map Store Locator 4.4 - SQL Injection
Joomla! Component Most Wanted Real Estate 1.1.0 - SQL Injection
NETGEAR DGN2200v1/v2/v3/v4 - 'ping.cgi' Remote Command Execution
Sawmill Enterprise 8.7.9 - Authentication Bypass
PHPShell 2.4 - Session Fixation
 2017-02-20 05:01:17 +00:00
Offensive Security
2f2ccec5c2 DB: 2017-02-17 
8 new exploits

Linux - Dual/Multi mode Bind Shell Shellcode (156 bytes)

Joomla! Component 'com_spidercalendar' - SQL Injection
Joomla! Component Spider Calendar - SQL Injection

Joomla! Component 'com_spidercatalog' - 'Product_ID' Parameter SQL Injection
Joomla! Component Spider Catalog 1.1 - 'Product_ID' Parameter SQL Injection

Joomla! Component 'com_spidercalendar' - 'date' Parameter Blind SQL Injection
Joomla! Component Spider Calendar - 'date' Parameter Blind SQL Injection

Joomla! Component 'com_spidercalendar' 3.2.6 - SQL Injection
Joomla! Component Spider Calendar 3.2.6 - SQL Injection

Joomla! Component 'com_spidercontacts' 1.3.6 - 'contacts_id' Parameter SQL Injection
Joomla! Component Spider Contacts 1.3.6 - 'contacts_id' Parameter SQL Injection

Joomla! Component 'com_spiderfaq' - SQL Injection
Joomla! Component Spider FAQ - SQL Injection
Joomla! Component Spider Calendar Lite 3.2.16 - SQL Injection
Joomla! Component Spider Catalog Lite 1.8.10 - SQL Injection
Joomla! Component Spider Facebook 1.6.1 - SQL Injection
Joomla! Component Spider FAQ Lite 1.3.1 - SQL Injection
WordPress Plugin Corner Ad 1.0.7 - Cross-Site Scripting
dotCMS 3.6.1 - Blind Boolean SQL Injection
Joomla! Component JEmbedAll 1.4 - SQL Injection
 2017-02-17 05:01:19 +00:00
Offensive Security
2f4b2745b1 DB: 2017-02-15 
11 new exploits

Linux Kernel 3.10.0 (CentOS7) - Denial of Service
LG G4 - lgdrmserver Binder Service Multiple Race Conditions
LG G4 - lghashstorageserver Directory Traversal
LG G4 - Touchscreen Driver write_log Kernel Read/Write
Google Android - Inter-process munmap in android.util.MemoryIntArray
Google Android - android.util.MemoryIntArray Ashmem Race Conditions
Microsoft Edge - TypedArray.sort Use-After-Free (MS16-145)
ShadeYouVPN Client 2.0.1.11 - Privilege Escalation
ntfs-3g - Unsanitized modprobe Environment Privilege Escalation

MLdonkey 2.9.7 - HTTP DOUBLE SLASH Arbitrary File Disclosure
MLdonkey 2.9.7 - Arbitrary File Disclosure

Mldonkey 2.5 -4 - Web Interface Error Message Cross-Site Scripting
MLdonkey 2.5-4 - Cross-Site Scripting

Piwik 2.14.0 / 2.16.0 / 2.17.1 / 3.0.1 - Superuser Plugin Upload (Metasploit)

Joomla! Component NeoRecruit 1.4 - 'id' SQL Injection
Joomla! Component NeoRecruit 1.4 - 'id' Parameter SQL Injection

taifajobs 1.0 - (jobid) SQL Injection
taifajobs 1.0 - 'jobid' Parameter SQL Injection
Pyrophobia 2.1.3.1 - modules/out.php id Parameter Cross-Site Scripting
Pyrophobia 2.1.3.1 - admin/index.php Multiple Parameter Traversal Arbitrary File Access
Pyrophobia 2.1.3.1 - Cross-Site Scripting
Pyrophobia 2.1.3.1 - Traversal Arbitrary File Access

Itech B2B Script 4.29 - Multiple Vulnerabilities
 2017-02-15 05:01:16 +00:00
Offensive Security
8b6bfd7f93 DB: 2017-02-13 
19 new exploits

Cimetrics BACstac 6.2f - Privilege Escalation
Cimetrics BACnet Explorer 4.0 - XML External Entity Injection
SonicDICOM PACS 2.3.2 - Cross-Site Scripting
SonicDICOM PACS 2.3.2 - Cross-Site Request Forgery (Add Admin)
SonicDICOM PACS 2.3.2 - Privilege Escalation
Kodi 17.1 - Arbitrary File Disclosure
WhizBiz 1.9 - SQL Injection
TI Online Examination System 2.0 - SQL Injection
Viavi Real Estate - SQL Injection
Viavi Movie Review - 'id' Parameter SQL Injection
Viavi Product Review - 'id' Parameter SQL Injection
Quadz School Management System 3.1 - 'uisd' Parameter SQL Injection
Domains & Hostings Manager PRO 3.0 - 'entries' Parameter SQL Injection
Joomla! Component onisPetitions 2.5 - 'tag' Parameter SQL Injection
Joomla! Component onisQuotes 2.5 - 'tag' Parameter SQL Injection
Joomla! Component onisMusic 2 - 'tag' Parameter SQL Injection
Joomla! Component Sponsor Wall 7.0 - 'wallid' Parameter SQL Injection
Joomla! Component Vik Booking 1.7 - SQL Injection
Joomla! Component Soccer Bet 4.1.5 - 'cat' Parameter SQL Injection
 2017-02-13 05:01:18 +00:00
Offensive Security
d1a0e8f9fd DB: 2017-02-09 
3 new exploits

Zookeeper 3.5.2 - Denial of Service

Linux/x86 - Reverse TCP Alphanumeric Staged Shellcode (103 bytes)

YapBB 1.2 - (forumID) Blind SQL Injection
YapBB 1.2 - 'forumID' Parameter Blind SQL Injection

ClearBudget 0.6.1 - (Misspelled htaccess) Insecure DD
ClearBudget 0.6.1 - Insecure Database Download

phpYabs 0.1.2 - (Azione) Remote File Inclusion
phpYabs 0.1.2 - 'Azione' Parameter Remote File Inclusion

IF-CMS 2.0 - 'frame.php id' Blind SQL Injection
IF-CMS 2.0 - 'id' Parameter Blind SQL Injection
BusinessSpace 1.2 - 'id' SQL Injection
A Better Member-Based ASP Photo Gallery - 'entry' SQL Injection
BusinessSpace 1.2 - 'id' Parameter SQL Injection
A Better Member-Based ASP Photo Gallery - 'entry' Parameter SQL Injection

FlexCMS - (catId) SQL Injection
FlexCMS 2.5 - 'catId' Parameter SQL Injection
Thyme 1.3 - (export_to) Local File Inclusion
Papoo CMS 3.x - (pfadhier) Local File Inclusion
q-news 2.0 - Remote Command Execution
Potato News 1.0.0 - (user) Local File Inclusion
Thyme 1.3 - 'export_to' Parameter Local File Inclusion
Papoo CMS 3.x - 'pfadhier' Parameter Local File Inclusion
Q-News 2.0 - Remote Command Execution
Potato News 1.0.0 - Local File Inclusion

Mynews 0_10 - Authentication Bypass
Mynews 0.10 - Authentication Bypass
Muviko Video CMS - SQL Injection
Multi Outlets POS 3.1 - 'id' Parameter SQL Injection
 2017-02-09 05:01:17 +00:00
Offensive Security
2ff74c7c1b DB: 2017-02-08 
9 new exploits

Zookeeper 3.5.2 - Denial of Service
OpenBSD HTTPd < 6.0 - Memory Exhaustion Denial of Service

ThisIsWhyImBroke Clone Script 4.0.0 - 'id' Parameter SQL Injection
Fully Featured News CMS 1.0 - 'id' Parameter SQL Injection
MySQL File Uploader 1.0 - 'id' Parameter SQL Injection
Easy Support Tools 1.0 - 'stt' Parameter SQL Injection
Easy Web Search 3 - 'id' Parameter SQL Injection
FTP Made Easy PRO 1.2 - Arbitrary File Download
Easy File Uploader 1.2 - Arbitrary File Download
Responsive Filemanger <= 9.11.0 - Arbitrary File Disclosure
 2017-02-08 05:01:17 +00:00
Offensive Security
9ea9da7098 DB: 2017-02-04 
6 new exploits

APC UPS 3.7.2 - (apcupsd) Local Denial of Service
APC UPS 3.7.2 - 'apcupsd' Local Denial of Service

Microsoft Windows 7 / Server 2008R2 - Remote Kernel Crash
Microsoft Windows 7 / Server 2008 R2 - Remote Kernel Crash

Debian 9 ntfs-3g - Privilege Escalation

CUPS 1.1.x - .HPGL File Processor Buffer Overflow
CUPS 1.1.x - '.HPGL' File Processor Buffer Overflow
CUPS < 2.0.3 - Remote Command Execution
Netwave IP Camera - Password Disclosure

Itech Multi Vendor Script 6.49 - SQL Injection
Itech Multi Vendor Script 6.49 - 'pl' Parameter SQL Injection
SlimarUSER Management 1.0 - 'id' Parameter SQL Injection
Itech Multi Vendor Script 6.49 - SQL Injection
Zoneminder 1.29 / 1.30 - Cross-Site Scripting / SQL Injection / Session Fixation / Cross-Site Request Forgery
 2017-02-04 05:01:18 +00:00
Offensive Security
8290029acb DB: 2017-02-03 
12 new exploits

Microsoft Windows 2000 - RPC DCOM Interface Denial of Service
Microsoft Windows Server 2000 - RPC DCOM Interface Denial of Service

Microsoft Windows 2003/XP - Samba Share Resource Exhaustion Exploit
Microsoft Windows Server 2003/XP - Samba Share Resource Exhaustion Exploit

Microsoft Windows 2000/XP - TCP Connection Reset Remote Attack Tool
Microsoft Windows Server 2000/XP - TCP Connection Reset Remote Attack Tool

Microsoft Windows 2003/XP - Remote Denial of Service
Microsoft Windows Server 2003/XP - Remote Denial of Service

Microsoft Windows 2003/XP - IPv6 Remote Denial of Service
Microsoft Windows Server 2003/XP - IPv6 Remote Denial of Service

Microsoft Windows 2000 - UPNP (getdevicelist) Memory Leak Denial of Service
Microsoft Windows Server 2000 - UPNP (getdevicelist) Memory Leak Denial of Service

Microsoft Windows 2003 - '.EOT' Blue Screen of Death Crash
Microsoft Windows Server 2003 - '.EOT' Blue Screen of Death Crash

Microsoft Windows 2000 < 2008 - Embedded OpenType Font Engine Remote Code Execution (MS09-065) (Metasploit)
Microsoft Windows Server 2000 < 2008 - Embedded OpenType Font Engine Remote Code Execution (MS09-065) (Metasploit)

Microsoft Windows 7/2008R2 - SMB Client Trans2 Stack Overflow (MS10-020) (PoC)
Microsoft Windows 7/2008 R2 - SMB Client Trans2 Stack Overflow (MS10-020) (PoC)
Microsoft Windows 2000/XP/2003 - 'win32k.sys' SfnLOGONNOTIFY Local kernel Denial of Service
Microsoft Windows 2000/XP/2003 - 'win32k.sys' SfnINSTRING Local kernel Denial of Service
Microsoft Windows Server 2000/2003/XP - 'win32k.sys' SfnLOGONNOTIFY Local kernel Denial of Service
Microsoft Windows Server 2000/2003/XP - 'win32k.sys' SfnINSTRING Local kernel Denial of Service

Microsoft Windows 2003 - AD Unauthenticated BROWSER ELECTION Remote Heap Overflow
Microsoft Windows Server 2003 - AD Unauthenticated BROWSER ELECTION Remote Heap Overflow

Microsoft Windows 2000/95/98/ME/NT 3.5.x/Enterprise Server 4.0/Terminal Server 4.0/Workstation 4.0 Microsoft DoS Device Name - Denial of Service
Microsoft Windows Server 2000/95/98/ME/NT 3.5.x/Enterprise Server 4.0/Terminal Server 4.0/Workstation 4.0 Microsoft DoS Device Name - Denial of Service

NT 4.0 / Windows 2000 - TCP/IP Printing Service Denial of Service
Microsoft Windows Server 2000/NT 4.0 - TCP/IP Printing Service Denial of Service

Microsoft Windows 2000 - Telnet Server Denial of Service
Microsoft Windows Server 2000 - Telnet Server Denial of Service

Microsoft Windows 2000 - Telnet 'Username' Denial of Service
Microsoft Windows Server 2000 - Telnet 'Username' Denial of Service

Microsoft Windows 2000 - RunAs Service Denial of Service
Microsoft Windows Server 2000 - RunAs Service Denial of Service

Microsoft Windows 2000/NT - Terminal Server Service RDP Denial of Service
Microsoft Windows Server 2000/NT - Terminal Server Service RDP Denial of Service

Microsoft Windows 2000/XP - GDI Denial of Service
Microsoft Windows Server 2000/XP - GDI Denial of Service
Microsoft Windows 2000 - Internet Key Exchange Denial of Service (1)
Microsoft Windows 2000 - Internet Key Exchange Denial of Service (2)
Microsoft Windows Server 2000 - Internet Key Exchange Denial of Service (1)
Microsoft Windows Server 2000 - Internet Key Exchange Denial of Service (2)
Microsoft Windows 2000/NT 4 - TCP Stack Denial of Service (1)
Microsoft Windows 2000/NT 4 - TCP Stack Denial of Service (2)
Microsoft Windows Server 2000/NT 4 - TCP Stack Denial of Service (1)
Microsoft Windows Server 2000/NT 4 - TCP Stack Denial of Service (2)
Microsoft Windows 2000 - Lanman Denial of Service (1)
Microsoft Windows 2000 - Lanman Denial of Service (2)
Microsoft Windows Server 2000 - Lanman Denial of Service (1)
Microsoft Windows Server 2000 - Lanman Denial of Service (2)
Microsoft Windows 2000/NT 4/XP - Network Share Provider SMB Request Buffer Overflow (1)
Microsoft Windows 2000/NT 4/XP - Network Share Provider SMB Request Buffer Overflow (2)
Microsoft Windows Server 2000/NT 4/XP - Network Share Provider SMB Request Buffer Overflow (1)
Microsoft Windows Server 2000/NT 4/XP - Network Share Provider SMB Request Buffer Overflow (2)

Microsoft Windows 2000/2003/XP - Graphical Device Interface Library Denial of Service
Microsoft Windows Server 2000/2003/XP - Graphical Device Interface Library Denial of Service

Microsoft Windows 2000/XP - Internet Protocol Validation Remote Code Execution (1)
Microsoft Windows Server 2000/XP - Internet Protocol Validation Remote Code Execution (1)

Microsoft Windows 2000/2003/XP - MSDTC TIP Denial of Service (MS05-051)
Microsoft Windows Server 2000/2003/XP - MSDTC TIP Denial of Service (MS05-051)

Microsoft Windows 2000/2003/XP - CreateRemoteThread Local Denial of Service
Microsoft Windows Server 2000/2003/XP - CreateRemoteThread Local Denial of Service

Microsoft Windows 2000/XP - Registry Access Local Denial of Service
Microsoft Windows Server 2000/XP - Registry Access Local Denial of Service

Microsoft Windows 2000 - Multiple COM Object Instantiation Code Execution Vulnerabilities
Microsoft Windows Server 2000 - Multiple COM Object Instantiation Code Execution Vulnerabilities

Microsoft Windows XP/2003 - Explorer .WMF File Handling Denial of Service
Microsoft Windows Server 2003/XP - Explorer .WMF File Handling Denial of Service

Microsoft Windows 2003/Vista - 'UnhookWindowsHookEx' Local Denial of Service
Microsoft Windows Server 2003/Vista - 'UnhookWindowsHookEx' Local Denial of Service
Microsoft Windows 10 - SMBv3 Tree Connect (PoC)
Google Android - 'rkp_set_init_page_ro' RKP Memory Corruption
Microsoft Windows 2003 - Token Kidnapping Local Exploit (PoC)
Microsoft Windows 2003/XP - 'afd.sys' Privilege Escalation (K-plugin) (MS08-066)
Microsoft Windows Server 2003 - Token Kidnapping Local Exploit (PoC)
Microsoft Windows Server 2003/XP - 'afd.sys' Privilege Escalation (K-plugin) (MS08-066)

Microsoft Windows NT/2000/XP/2003/Vista/2008/7 - User Mode to Ring Escalation (KiTrap0D) (MS10-015)
Microsoft Windows NT/2000/2003/2008/XP/Vista/7 - User Mode to Ring Escalation (KiTrap0D) (MS10-015)

Microsoft Windows XP/2003 - 'afd.sys' Privilege Escalation (MS11-080)
Microsoft Windows Server 2003/XP - 'afd.sys' Privilege Escalation (MS11-080)

Microsoft Windows 2000/95/98/NT 4.0 - Long Filename Extension
Microsoft Windows Server 2000/95/98/NT 4.0 - Long Filename Extension

Microsoft Windows 2000 - Named Pipes Predictability
Microsoft Windows Server 2000 - Named Pipes Predictability

Microsoft Windows 2000 - Still Image Service Privilege Escalation
Microsoft Windows Server 2000 - Still Image Service Privilege Escalation

Microsoft Windows 2000/NT 4 - DLL Search Path
Microsoft Windows Server 2000/NT 4 - DLL Search Path

Microsoft Windows 2000 - Debug Registers
Microsoft Windows Server 2000 - Debug Registers

Microsoft Windows 2000 - RunAs Service Named Pipe Hijacking
Microsoft Windows Server 2000 - RunAs Service Named Pipe Hijacking

Microsoft Windows 2000/NT 4 - NTFS File Hiding
Microsoft Windows Server 2000/NT 4 - NTFS File Hiding

Microsoft Windows 2000 / NT 4.0 - Process Handle Local Privilege Elevation
Microsoft Windows Server 2000/NT 4.0 - Process Handle Local Privilege Elevation
Microsoft Windows 2000/NT 4/XP - Window Message Subsystem Design Error (1)
Microsoft Windows 2000/NT 4/XP - Window Message Subsystem Design Error (2)
Microsoft Windows 2000/NT 4/XP - Window Message Subsystem Design Error (3)
Microsoft Windows 2000/NT 4/XP - Window Message Subsystem Design Error (4)
Microsoft Windows 2000/NT 4/XP - Window Message Subsystem Design Error (5)
Microsoft Windows 2000/NT 4/XP - Window Message Subsystem Design Error (6)
Microsoft Windows 2000/NT 4/XP - Window Message Subsystem Design Error (7)
Microsoft Windows 2000/NT 4/XP - Window Message Subsystem Design Error (8)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (1)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (2)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (3)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (4)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (5)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (6)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (7)
Microsoft Windows Server 2000/NT 4/XP - Window Message Subsystem Design Error (8)
Microsoft Windows 2000/XP/NT 4 - NetDDE Privilege Escalation (1)
Microsoft Windows 2000/XP/NT 4 - NetDDE Privilege Escalation (2)
Microsoft Windows Server 2000/NT 4/XP - NetDDE Privilege Escalation (1)
Microsoft Windows Server 2000/NT 4/XP - NetDDE Privilege Escalation (2)

Microsoft Windows 2000 - Help Facility .CNT File :Link Buffer Overflow
Microsoft Windows Server 2000 - Help Facility .CNT File :Link Buffer Overflow

Microsoft Windows 2000 - RegEdit.exe Registry Key Value Buffer Overflow
Microsoft Windows Server 2000 - RegEdit.exe Registry Key Value Buffer Overflow
Microsoft Windows 2000 - CreateFile API Named Pipe Privilege Escalation (1)
Microsoft Windows 2000 - CreateFile API Named Pipe Privilege Escalation (2)
Microsoft Windows Server 2000 - CreateFile API Named Pipe Privilege Escalation (1)
Microsoft Windows Server 2000 - CreateFile API Named Pipe Privilege Escalation (2)

Microsoft Windows 2000/NT 4 - Local Descriptor Table Privilege Escalation (MS04-011)
Microsoft Windows Server 2000/NT 4 - Local Descriptor Table Privilege Escalation (MS04-011)

Microsoft Windows 2000/NT 4 - POSIX Subsystem Buffer Overflow Privilege Escalation (MS04-020)
Microsoft Windows Server 2000/NT 4 - POSIX Subsystem Buffer Overflow Privilege Escalation (MS04-020)

Microsoft Windows NT/2000/XP/2003/Vista/2008/7/8 - Local Ring Exploit (EPATHOBJ)
Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - Local Ring Exploit (EPATHOBJ)

Microsoft Windows 2000/2003/XP - Keyboard Event Privilege Escalation
Microsoft Windows Server 2000/2003/XP - Keyboard Event Privilege Escalation

Microsoft Windows 2003/XP - ReadDirectoryChangesW Information Disclosure
Microsoft Windows Server 2003/XP - ReadDirectoryChangesW Information Disclosure
Microsoft Windows XP/2003/Vista/2008 - WMI Service Isolation Privilege Escalation
Microsoft Windows XP/2003 - RPCSS Service Isolation Privilege Escalation
Microsoft Windows Server 2003/2008/XP/Vista - WMI Service Isolation Privilege Escalation
Microsoft Windows Server 2003/XP - RPCSS Service Isolation Privilege Escalation

Microsoft Windows 2000/XP/2003 - Desktop Wall Paper System Parameter Privilege Escalation
Microsoft Windows Server 2000/2003/XP - Desktop Wall Paper System Parameter Privilege Escalation

Microsoft Windows 2000/XP/2003/Vista - Double-Free Memory Corruption Privilege Escalation
Microsoft Windows Server 2000/2003/XP/Vista - Double-Free Memory Corruption Privilege Escalation

Ghostscript 9.20 - 'Filename' Command Execution

Microsoft Windows 2000 - RSVP Server Authority Hijacking (PoC)
Microsoft Windows Server 2000 - RSVP Server Authority Hijacking (PoC)

Microsoft Windows 2000/XP - RPC Remote (Non Exec Memory) Exploit
Microsoft Windows Server 2000/XP - RPC Remote (Non Exec Memory) Exploit
Microsoft Windows 2000 SP1/SP2 - isapi .printer Extension Overflow (1)
Microsoft Windows 2000 SP1/SP2 - isapi .printer Extension Overflow (2)
Microsoft Windows Server 2000 SP1/SP2 - isapi .printer Extension Overflow (1)
Microsoft Windows Server 2000 SP1/SP2 - isapi .printer Extension Overflow (2)

Microsoft Windows 2000 - WINS Remote Code Execution
Microsoft Windows Server 2000 - WINS Remote Code Execution

Microsoft Windows XP/2003 - Metafile Escape() Code Execution (Metasploit)
Microsoft Windows Server 2003/XP - Metafile Escape() Code Execution (Metasploit)
WarFTP 1.65 (Windows 2000 SP4) - (USER) Remote Buffer Overflow (Python)
WarFTP 1.65 (Windows 2000 SP4) - (USER) Remote Buffer Overflow (Perl)
WarFTP 1.65 (Windows 2000 SP4) - 'USER' Remote Buffer Overflow (Python)
WarFTP 1.65 (Windows 2000 SP4) - 'USER' Remote Buffer Overflow (Perl)

Microsoft Windows 2000 SP4 - DNS RPC Remote Buffer Overflow
Microsoft Windows Server 2000 SP4 - DNS RPC Remote Buffer Overflow

Microsoft IIS 5.0/6.0 FTP Server - Remote Stack Overflow (Windows 2000)
Microsoft IIS 5.0/6.0 FTP Server (Windows 2000) - Remote Stack Overflow

Microsoft Windows XP/2003/Vista - Metafile Escape() SetAbortProc Code Execution (MS06-001) (Metasploit)
Microsoft Windows Server 2003/XP/Vista - Metafile Escape() SetAbortProc Code Execution (MS06-001) (Metasploit)

Microsoft Internet Explorer 5 (Windows 2000/95/98/NT 4) - XML HTTP Redirect
Microsoft Internet Explorer 5 (Windows 95/98/2000/NT 4) - XML HTTP Redirect

Microsoft Index Server 2.0 / Indexing Services (Windows 2000) - Directory Traversal
Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - Directory Traversal

Cat Soft Serv-U FTP Server 2.5/a/b (Windows 2000/95/98/NT 4.0) - Shortcut Exploit
Cat Soft Serv-U FTP Server 2.5/a/b (Windows 95/98/2000/NT 4.0) - Shortcut Exploit

Microsoft Windows 2000 - Remote CPU-overload
Microsoft Windows Server 2000 - Remote CPU-overload

Microsoft Windows 2000 - telnet.exe NTLM Authentication
Microsoft Windows Server 2000 - telnet.exe NTLM Authentication

Microsoft Indexing Services (Windows 2000/NT 4.0) - '.htw' Cross-Site Scripting
Microsoft Indexing Service (Windows 2000/NT 4.0) - '.htw' Cross-Site Scripting

Microsoft Indexing Services (Windows 2000) - File Verification
Microsoft Indexing Service (Windows 2000) - File Verification
SurfControl SuperScout WebFilter for windows 2000 - File Disclosure
SurfControl SuperScout WebFilter for windows 2000 - SQL Injection
Microsoft Windows 2000/XP/NT 4 - Help Facility ActiveX Control Buffer Overflow
SurfControl SuperScout WebFilter for Windows 2000 - File Disclosure
SurfControl SuperScout WebFilter for Windows 2000 - SQL Injection
Microsoft Windows Server 2000/NT 4/XP - Help Facility ActiveX Control Buffer Overflow

Microsoft Windows 2000 - Active Directory Remote Stack Overflow
Microsoft Windows Server 2000 - Active Directory Remote Stack Overflow

Microsoft Windows 2000/NT 4 Media Services - 'nsiislog.dll' Remote Buffer Overflow
Microsoft Windows Server 2000/NT 4 Media Services - 'nsiislog.dll' Remote Buffer Overflow

Microsoft Windows 2000 - Subnet Bandwidth Manager RSVP Server Authority Hijacking
Microsoft Windows Server 2000 - Subnet Bandwidth Manager RSVP Server Authority Hijacking
Microsoft Windows 2000/2003/XP - winhlp32 Phrase Integer Overflow
Microsoft Windows 2000/2003/XP - winhlp32 Phrase Heap Overflow
Microsoft Windows Server 2000/2003/XP - winhlp32 Phrase Integer Overflow
Microsoft Windows Server 2000/2003/XP - winhlp32 Phrase Heap Overflow

Microsoft Windows 2000/XP - Internet Protocol Validation Remote Code Execution (2)
Microsoft Windows Server 2000/XP - Internet Protocol Validation Remote Code Execution (2)
Microsoft Windows 2000/2003 - Recursive DNS Spoofing (1)
Microsoft Windows 2000/2003 - Recursive DNS Spoofing (2)
Microsoft Windows Server 2000/2003 - Recursive DNS Spoofing (1)
Microsoft Windows Server 2000/2003 - Recursive DNS Spoofing (2)

Linux - Multi/Dual mode Reverse Shell Shellcode (129 bytes)
Travel Portal Script 9.33 - SQL Injection
Movie Portal Script 7.35 - SQL Injection
Itech Travel Portal Script 9.33 - SQL Injection
Itech Movie Portal Script 7.35 - SQL Injection

Auction Script 6.49 - SQL Injection
Itech Auction Script 6.49 - 'mcid' Parameter SQL Injection

Itech News Portal Script 6.28 - SQL Injection
Itech News Portal Script 6.28 - 'inf' Parameter SQL Injection

Video Sharing Script 4.94 - SQL Injection
Itech Video Sharing Script 4.94 - 'v' Parameter SQL Injection

Itech Classifieds Script 7.27 - 'pid' Parameter SQL Injection
Itech Classifieds Script 7.27 - SQL Injection

Video Sharing Script 4.94 - 'uid' Parameter SQL Injection
Itech Video Sharing Script 4.94 - SQL Injection
WordPress 4.7.0/4.7.1 - Unauthenticated Content Injection (Python)
WordPress 4.7.0/4.7.1 - Unauthenticated Content Injection (Ruby)
Itech Travel Portal Script 9.35 - SQL Injection
Property Listing Script - 'propid' Parameter Blind SQL Injection
Itech Inventory Management Software 3.77 - SQL Injection
Itech Movie Portal Script 7.37 - SQL Injection
Itech News Portal Script 6.28 - 'sc' Parameter SQL Injection
Itech Auction Script 6.49 - 'pid' Parameter SQL Injection
 2017-02-03 05:01:17 +00:00
Offensive Security
1a4e6f50a9 DB: 2017-02-01 
65 new exploits

Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow

Mercur IMAPD 5.00.14 (Windows x86) - Remote Denial of Service

PHP 5.2.0 (Windows x86) - (PHP_win32sti) Local Buffer Overflow

PHP 5.2.0 (Windows x86) - 'PHP_iisfunc.dll' Local Buffer Overflow

32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow (PoC)

Apple Safari 3.2.3 (Windows x86) - JavaScript (eval) Remote Denial of Service

Apple Safari 4.0.3 (Windows x86) - CSS Remote Denial of Service

Apple Safari 4.0.3 (Windows x86) - CSS Remote Denial of Service

ESET Smart Security 4.2 and NOD32 AntiVirus 4.2 (x32/x64) - LZH archive parsing (PoC)
ESET Smart Security 4.2 and NOD32 AntiVirus 4.2 (x86/x64) - LZH archive parsing (PoC)

Linux Kernel 2.6.x (x64) - Personality Handling Local Denial of Service

VMware Workstations 10.0.0.40273 - 'vmx86.sys' Arbitrary Kernel Read

Samba < 3.6.2 (x86) - Denial of Serviec (PoC)

Adobe Flash - Bad Dereference at 0x23c on Linux x64
Adobe Flash (Linux x64) - Bad Dereference at 0x23c

Linux (x86) - Disable ASLR by Setting the RLIMIT_STACK Resource to Unlimited

Core FTP Server 32-bit Build 587 - Heap Overflow

Windows 10 x86/x64 WLAN AutoConfig - Denial of Service (POC)
Windows 10 (x86/x64) WLAN AutoConfig - Denial of Service (POC)

RedHat 6.2 /usr/bin/rcp - SUID Privilege Escalation
RedHat 6.2 /usr/bin/rcp - 'SUID' Privilege Escalation

Setuid perl - PerlIO_Debug() Root Owned File Creation Privilege Escalation
Setuid perl - 'PerlIO_Debug()' Root Owned File Creation Privilege Escalation
Wireless Tools 26 (IWConfig) - Privilege Escalation (some setuid)
Qpopper 4.0.8 (Linux) - (poppassd) Privilege Escalation
Wireless Tools 26 (IWConfig) - Privilege Escalation
Qpopper 4.0.8 (Linux) - 'poppassd' Privilege Escalation

Navicat Premium 11.2.11 (x64) - Local Database Password Disclosure
Rocks Clusters 4.1 - (umount-loop) Privilege Escalation
Rocks Clusters 4.1 - (mount-loop) Privilege Escalation
Rocks Clusters 4.1 - 'umount-loop' Privilege Escalation
Rocks Clusters 4.1 - 'mount-loop' Privilege Escalation

PrivateTunnel Client 2.7.0 (x64) - Local Credentials Disclosure

Linux Kernel 2.4 / 2.6 (x86-64) - System Call Emulation Privilege Escalation

Postfix 2.6-20080814 - (symlink) Privilege Escalation
Postfix 2.6-20080814 - 'symlink' Privilege Escalation

Oracle Database Vault - ptrace(2) Privilege Escalation
Oracle Database Vault - 'ptrace(2)' Privilege Escalation

Linux Kernel 2.6.24_16-23 / 2.6.27_7-10 / 2.6.28.3 (Ubuntu 8.04/8.10 / Fedora Core 10 x86_64) - set_selection() UTF-8 Off-by-One Local Exploit
Linux Kernel 2.6.24_16-23 / 2.6.27_7-10 / 2.6.28.3 (Ubuntu 8.04/8.10 / Fedora Core 10 x86-64) - set_selection() UTF-8 Off-by-One Local Exploit

Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - 'ip_append_data()' Ring0 Privilege Escalation (1)
Linux Kernel < 2.6.36-rc4-git2 (x86-64) - 'ia32syscall' Emulation Privilege Escalation
Linux Kernel 2.6.27 < 2.6.36 (RedHat x86-64) - 'compat' Privilege Escalation
Linux Kernel < 2.6.36-rc4-git2 (x86-64) - 'ia32syscall' Emulation Privilege Escalation
Linux Kernel 2.6.27 < 2.6.36 (RedHat x86-64) - 'compat' Privilege Escalation

GNU C Library 2.x (libc6) - Dynamic Linker LD_AUDIT Arbitrary DSO Load (Privilege Escalation)
GNU C Library 2.x (libc6) - (Dynamic Linker LD_AUDIT Arbitrary DSO Load) Privilege Escalation

Linux Kernel < 2.6.34 (Ubuntu 10.10 x86) - 'CAP_SYS_ADMIN' Privilege Escalation (1)

Free Download Manager - Torrent Parsing Buffer Overflow (Metasploit)
Free Download Manager 3.0 Build 844 - Torrent Parsing Buffer Overflow (Metasploit)

VideoLAN VLC Client (Windows x86) - 'smb://' URI Buffer Overflow (Metasploit)

PolicyKit polkit-1 < 0.101 - Linux Privilege Escalation
PolicyKit polkit-1 < 0.101 - Privilege Escalation
Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) - Capabilities Privilege Escalation (Sendmail) (1)
Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) - Capabilities Privilege Escalation (Sendmail 8.10.1) (2)
Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) -  (Sendmail) Capabilities Privilege Escalation(1)
Linux Kernel 2.2.x 2.4.0-test1 (SGI ProPack 1.2/1.3) -  (Sendmail 8.10.1) Capabilities Privilege Escalation (2)
QNX RTOS 4.25/6.1 - phgrafxPrivilege Escalation
QNX RTOS 4.25/6.1 - phgrafx-startup Privilege Escalation
QNX RTOS 4.25/6.1 - 'phgrafx' Privilege Escalation
QNX RTOS 4.25/6.1 - 'phgrafx-startup' Privilege Escalation

Dropbox Desktop Client 9.4.49 (x64) - Local Credentials Disclosure

Microsoft Windows 10 10586 (x32/x64) / 8.1 Update 2 - NtLoadKeyEx User Hive Attachment Point Privilege Escalation (MS16-111)
Microsoft Windows 10 10586 (x86/x64) / 8.1 Update 2 - NtLoadKeyEx User Hive Attachment Point Privilege Escalation (MS16-111)

MySQL 3.23.x - mysqld Privilege Escalation
MySQL 3.23.x - 'mysqld' Privilege Escalation
Platform Load Sharing Facility 4/5/6 - EAuth Privilege Escalation
MTools 3.9.x - MFormat Privilege Escalation
Platform Load Sharing Facility 4/5/6 - 'EAuth' Privilege Escalation
MTools 3.9.x - 'MFormat' Privilege Escalation

Linux Kernel < 3.3.x < 3.7.x (Arch Linux x86-64) - 'sock_diag_handlers[]' Privilege Escalation (1)

sudo 1.8.0 < 1.8.3p1 (sudo_debug) - Privilege Escalation + glibc FORTIFY_SOURCE Bypass
sudo 1.8.0 < 1.8.3p1 (sudo_debug) - glibc FORTIFY_SOURCE Bypass + Privilege Escalation

Linux Kernel < 3.8.9 (x86-64) - 'perf_swevent_init' Privilege Escalation (2)

ZABBIX 1.1.4/1.4.2 - daemon_start Privilege Escalation
ZABBIX 1.1.4/1.4.2 - 'daemon_start' Privilege Escalation

Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.04/13.10) - 'CONFIG_X86_X32=y' Privilege Escalation (3)

LogMeIn Client 1.3.2462 (x64) - Local Credentials Disclosure

Systrace 1.x (x64) - Aware Linux Kernel Privilege Escalation

Microsoft Windows - NTUserMessageCall Win32k Kernel Pool Overflow 'schlamperei.x86.dll' (MS13-053) (Metasploit)

Linux Kernel 3.14-rc1 < 3.15-rc4 (x64) - Raw Mode PTY Local Echo Race Condition Privilege Escalation

Linux Kernel 3.2.0-23 / 3.5.0-23 (Ubuntu 12.04/12.04.1/12.04.2 x64) - 'perf_swevent_init' Privilege Escalation (3)

TeamViewer 11.0.65452 (x64) - Local Credentials Disclosure

Linux Kernel 3.13 - Privilege Escalation PoC (SGID)
Linux Kernel 3.13 -  (SGID) Privilege Escalation (PoC)

OSSEC 2.8 - hosts.deny Privilege Escalation
OSSEC 2.8 - 'hosts.deny' Privilege Escalation

Ninja Privilege Escalation Detection and Prevention System 0.1.3 - Race Condition
Ninja Privilege Escalation Detection and Prevention System 0.1.3 - Race Condition Privilege Escalation
Linux espfix64 - Privilege Escalation (Nested NMIs Interrupting)
Linux (x86) - Memory Sinkhole Privilege Escalation (PoC)
Linux espfix64 -  (Nested NMIs Interrupting) Privilege Escalation
Linux (x86) - Memory Sinkhole Privilege Escalation (PoC)

RHEL 7.0/7.1 - abrt/sosreport Privilege Escalation
RHEL 7.0/7.1 - 'abrt/sosreport' Privilege Escalation

MySQL 5.5.45 (x64) - Local Credentials Disclosure

Linux Kernel 4.4.x (Ubuntu 16.04) - 'double-fdput()' in bpf(BPF_PROG_LOAD) Privilege Escalation
Linux Kernel 4.4.x (Ubuntu 16.04) - 'double-fdput()' bpf(BPF_PROG_LOAD) Privilege Escalation

ACROS Security 0patch 2016.05.19.539 - '0PatchServicex64.exe' Unquoted Service Path Privilege Escalation

Linux Kernel 4.4.0-21 (Ubuntu 16.04 x64) - Netfilter target_offset Out-of-Bounds Privilege Escalation

Microsoft Windows 7 (x32/x64) - Group Policy Privilege Escalation (MS16-072)
Microsoft Windows 7 (x86/x64) - Group Policy Privilege Escalation (MS16-072)

Linux Kernel 2.6.32-rc1 (x86-64) - Register Leak

Linux Kernel 4.4.0 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation

Microsoft Windows 8.1 (x64) - RGNOBJ Integer Overflow (MS16-098)

Viscosity 1.6.7 - Privilege Escalation

BeroFTPD 1.3.4(1) (Linux/x86) - Remote Code Execution
BeroFTPD 1.3.4(1) (Linux x86) - Remote Code Execution

Solaris /bin/login (SPARC/x86) - Remote Code Execution

gpsdrive 2.09 (x86) - (friendsd2) Remote Format String

PrivateWire Gateway 3.7 (Windows x86) - Remote Buffer Overflow (Metasploit)

dproxy-nexgen (Linux/x86) - Buffer Overflow
dproxy-nexgen (Linux x86) - Buffer Overflow
32bit FTP (09.04.24) - 'CWD Response' Remote Buffer Overflow
32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow
32bit FTP (09.04.24) - 'CWD Response' Universal Overwrite (SEH)
32bit FTP - 'PASV' Reply Client Remote Overflow (Metasploit)
32bit FTP (09.04.24) - 'CWD Response' Remote Buffer Overflow
32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow
32bit FTP (09.04.24) - 'CWD Response' Universal Overwrite (SEH)
32bit FTP - 'PASV' Reply Client Remote Overflow (Metasploit)

Oracle 9i XDB (Windows x86) - FTP UNLOCK Overflow (Metasploit)

AASync 2.2.1.0 (Windows x86) - Stack Buffer Overflow 'LIST' (Metasploit)

32bit FTP Client - Stack Buffer Overflow (Metasploit)

Free Download Manager - Remote Control Server Buffer Overflow (Metasploit)
Free Download Manager 2.5 Build 758 - Remote Control Server Buffer Overflow (Metasploit)

Apache (Windows x86) - Chunked Encoding (Metasploit)

PeerCast 0.1216 (Windows x86) - URL Handling Buffer Overflow (Metasploit)

CA CAM (Windows x86) - log_security() Stack Buffer Overflow (Metasploit)
Samba 3.3.12 (Linux/x86) - 'chain_reply' Memory Corruption (Metasploit)
Samba 2.2.8 (Linux x86) - 'trans2open' Overflow (Metasploit)
Samba 3.3.12 (Linux x86) - 'chain_reply' Memory Corruption (Metasploit)
Samba 2.2.8 (Linux x86) - 'trans2open' Overflow (Metasploit)

Samba 2.2.8 (*BSD x86) - 'trans2open' Overflow Exploit (Metasploit)

Webmin 0.x - RPC Function Privilege Escalation
Webmin 0.x - 'RPC' Function Privilege Escalation

Nginx 1.3.9/1.4.0 (x86) - Brute Force Remote Exploit

Nginx 1.4.0 (x64) - (Generic Linux) Remote Exploit
Nginx 1.4.0 (x64) (Generic Linux) - Remote Exploit

technote 7.2 - Remote File Inclusion
Technote 7.2 - Remote File Inclusion
JAWS 0.2/0.3 - 'index.php' gadget Parameter Traversal Arbitrary File Access
JAWS 0.2/0.3 - Cookie Manipulation Authentication Bypass
JAWS 0.2/0.3 - 'index.php' action Parameter Cross-Site Scripting
Jaws 0.2/0.3 - 'gadget' Parameter Traversal Arbitrary File Access
Jaws 0.2/0.3 - Cookie Manipulation Authentication Bypass
Jaws 0.2/0.3 - 'action' Parameter Cross-Site Scripting

JAWS 0.2/0.3/0.4 - ControlPanel.php SQL Injection
Jaws 0.2/0.3/0.4 - ControlPanel.php SQL Injection

JAWS Glossary 0.4/0.5 - Cross-Site Scripting
Jaws Glossary 0.4/0.5 - Cross-Site Scripting

JAWS 0.x - Remote File Inclusion
Jaws 0.x - Remote File Inclusion

FlatNux 2009-03-27 - Multiple Cross-Site Scripting Vulnerabilities
Flatnux 2009-03-27 - Multiple Cross-Site Scripting Vulnerabilities

Multiple Netgear Routers - Password Disclosure
Video Sharing Script 4.94 - 'uid' Parameter SQL Injection
Netman 204 - Backdoor Account / Password Reset
 2017-02-01 05:01:19 +00:00
Offensive Security
bf6526a40b DB: 2017-01-31 
39 new exploits

OpenSSL 1.1.0 - Remote Client Denial of Service

CDRTools CDRecord 2.0 - Mandrake Privilege Escalation
CDRTools CDRecord 2.0 (Mandrake / Slackware) - Privilege Escalation

RedHat 6.2 /usr/bin/rcp - SUID Privilege Escalation Exploit
RedHat 6.2 /usr/bin/rcp - SUID Privilege Escalation
BitchX 1.0c19 - Privilege Escalation (suid?)
Apache 1.3.31 (mod_include) - Local Buffer Overflow
BitchX 1.0c19 - Privilege Escalation
Apache 1.3.31 mod_include - Local Buffer Overflow

AIX 4.3/5.1 < 5.3 - lsmcode Command Execution Privilege Escalation
AIX 4.3/5.1 < 5.3 - 'lsmcode' Command Execution Privilege Escalation

Debian 2.2 - /usr/bin/pileup Privilege Escalation
Debian 2.2 /usr/bin/pileup - Privilege Escalation

Oracle 10g (Windows x86) - (PROCESS_DUP_HANDLE) Local Privilege Elevation

GIMP 2.2.14 (Windows x86) - '.ras' Download/Execute Buffer Overflow

Notepad++ 4.1 (Windows x86) - '.ruby' File Processing Buffer Overflow

IBM AIX 5.3 sp6 - ftp gets() Privilege Escalation
IBM AIX 5.3 SP6 - FTP gets() Privilege Escalation

IBM AIX 5.3.0 - setlocale() Privilege Escalation
IBM AIX 5.3.0 - 'setlocale()' Privilege Escalation

FreeBSD 6x/7 - protosw kernel Local Privilege Escalation Exploit
FreeBSD 6x/7 protosw Kernel - Privilege Escalation

PHP 5.2.9 (Windows x86) - Local Safemod Bypass Exploit

HTMLDOC 1.9.x-r1629 (Windows x86) - Local .html Buffer Overflow

(Linux Kernel 2.6.34-rc3) ReiserFS (RedHat / Ubuntu 9.10) - xattr Privilege Escalation
(Linux Kernel 2.6.34-rc3) ReiserFS (RedHat / Ubuntu 9.10) - 'xattr' Privilege Escalation

Linux Kernel 4.6.3 - 'Netfilter' Privilege Escalation (Metasploit)
Linux Kernel 4.6.3 (x86) - 'Netfilter' Privilege Escalation (Metasploit)

FreeBSD 6.4 - Netgraph Local Privilege Escalation Exploit
FreeBSD 6.4 - Netgraph Privilege Escalation

PHP 5.4.3 (Windows x86 Polish) - Code Execution

Apache (Mod_Auth_OpenID) - Session Stealing
Apache Mod_Auth_OpenID - Session Stealing

cPanel 5.0 - Openwebmail Privilege Escalation
cPanel 5.0 - 'Openwebmail' Privilege Escalation
Apache 2.0.4x (mod_php) - File Descriptor Leakage (1)
Apache 2.0.4x (mod_php) - File Descriptor Leakage (2)
Apache 2.0.4x mod_php - File Descriptor Leakage (1)
Apache 2.0.4x mod_php - File Descriptor Leakage (2)

Apache 2.0.4x (mod_perl) - File Descriptor Leakage (3)
Apache 2.0.4x mod_perl - File Descriptor Leakage (3)

cPanel 5-9 - Privilege Escalation
cPanel 5 < 9 - Privilege Escalation

Apache 1.3.x (mod_include) - Local Buffer Overflow
Apache 1.3.x mod_include - Local Buffer Overflow

IBM AIX 5.x - Diag Privilege Escalation Vulnerabilities
IBM AIX 5.x - 'Diag' Privilege Escalation

Nginx (Debian-Based + Gentoo) - 'logrotate' Local Privilege Escalation
Nginx (Debian-Based Distros + Gentoo) - 'logrotate' Privilege Escalation

Amanda 3.3.1 - amstar Command Injection Privilege Escalation
Amanda 3.3.1 - 'amstar' Command Injection Privilege Escalation
Microsoft Windows 7 SP1 (x86) - 'WebDAV' Privilege Escalation (MS16-016) (1)
Deepin Linux 15 - lastore-daemon Privilege Escalation
Microsoft Windows 7 SP1 (x86) - 'WebDAV' Privilege Escalation (MS16-016) (1)
Deepin Linux 15 - 'lastore-daemon' Privilege Escalation

Microsoft Windows - 'afd.sys' Dangling Pointer Privilege Escalation (MS14-040)
Microsoft Windows 7 (x86) - 'afd.sys' Dangling Pointer Privilege Escalation (MS14-040)

Microsoft Windows 7 (x64) - 'afd.sys' Privilege Escalation (MS14-040)
Microsoft Windows 7 (x64) - 'afd.sys' Dangling Pointer Privilege Escalation (MS14-040)

Microsoft Windows 8.1/10 (x86) - Secondary Logon Standard Handles Missing Sanitization Privilege Escalation (MS16-032)

Linux Kernel 4.6.2 (Ubuntu 16.04.1) - 'IP6T_SO_SET_REPLACE' Privilege Escalation

Microsoft Windows (x86) - 'afd.sys' Privilege Escalation (MS11-046)

Allwinner 3.4 Legacy Kernel - Local Privilege Escalation (Metasploit)
Allwinner 3.4 Legacy Kernel - Privilege Escalation (Metasploit)

Microsoft Windows (x86) - 'NDISTAPI' Privilege Escalation (MS11-062)

MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'mysql' System User Privilege Escalation / Race Condition
MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - ('mysql' System User) Privilege Escalation / Race Condition

MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'root' Privilege Escalation
MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - ('root' System User) Privilege Escalation

Linux Kernel 4.4 (Ubuntu 16.04) - BPF Local Privilege Escalation (Metasploit)
Linux Kernel 4.4 (Ubuntu 16.04) - 'BPF' Privilege Escalation (Metasploit)

Apache CouchDB 2.0.0 - Local Privilege Escalation
Apache CouchDB 2.0.0 - Privilege Escalation

Vesta Control Panel 0.9.8-16 - Local Privilege Escalation
Vesta Control Panel 0.9.8-16 - Privilege Escalation

Systemd 228 - Privilege Escalation (PoC)
Systemd 228 (SUSE 12 SP2 / Ubuntu Touch 15.04) - Privilege Escalation (PoC)

Oracle VM VirtualBox < 5.0.32 / < 5.1.14 - Privilege Escalation (PoC)

Apache 1.3.x (mod_mylo) - Remote Code Execution
Apache 1.3.x mod_mylo - Remote Code Execution

Apache 1.3.x < 2.0.48 (mod_userdir) - Remote Users Disclosure
Apache 1.3.x < 2.0.48 mod_userdir - Remote Users Disclosure

Microsoft Windows (x86) - Metafile '.emf' Heap Overflow (MS04-032)

Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Exploit (2)
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Exploit

Veritas NetBackup 6.0 (Windows x86) - (bpjava-msvc) Remote Exploit

Apache (mod_rewrite) (Windows x86) - Off-by-One Remote Overflow
Apache mod_rewrite (Windows x86) - Off-by-One Remote Overflow

3proxy 0.5.3g (Windows x86) - proxy.c logurl() Remote Buffer Overflow

Apache (mod_rewrite) 2.0.58 (Windows 2003) - Remote Overflow
Apache 2.0.58 mod_rewrite (Windows 2003) - Remote Overflow

Apache Tomcat Connector (mod_jk) - Remote Exploit (exec-shield)
Apache Tomcat Connector mod_jk - 'exec-shield' Remote Exploit

3proxy 0.5.3g (Windows x86) - logurl() Remote Buffer Overflow (Perl)

SapLPD 6.28 (Windows x86) - Remote Buffer Overflow

Apache 2.0 mod_jk2 2.0.2 (Windows x86) - Remote Buffer Overflow

Apache Tomcat Connector jk2-2.0.2 (mod_jk2) - Remote Overflow
Apache Tomcat Connector jk2-2.0.2 mod_jk2 - Remote Overflow

Apache mod_jk 1.2.19 (Windows x86) - Remote Buffer Overflow

Apache (mod_perl) - 'Apache::Status' / 'Apache2::Status' Cross-Site Scripting
Apache mod_perl - 'Apache::Status' / 'Apache2::Status' Cross-Site Scripting

Apache 2.2.14 (mod_isapi) - Dangling Pointer Remote SYSTEM Exploit
Apache 2.2.14 mod_isapi - Dangling Pointer Remote SYSTEM Exploit

Apache (mod_proxy) - Reverse Proxy Exposure (PoC)
Apache mod_proxy - Reverse Proxy Exposure (PoC)

Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Exploit (1)
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Exploit

Apache 2.2.6 (mod_negotiation) - HTML Injection and HTTP Response Splitting
Apache 2.2.6 mod_negotiation - HTML Injection and HTTP Response Splitting

Apache 7.0.x (mod_proxy) - Reverse Proxy Security Bypass
Apache 7.0.x mod_proxy - Reverse Proxy Security Bypass

Apache 2.2.15 (mod_proxy) - Reverse Proxy Security Bypass
Apache 2.2.15 mod_proxy - Reverse Proxy Security Bypass

Apache (mod_wsgi) - Information Disclosure
Apache mod_wsgi - Information Disclosure

Flatnuke 2.5.6 - Privilege Escalation / Remote Commands Execution Exploit
Flatnuke 2.5.6 - Privilege Escalation / Remote Commands Execution

phpGraphy 0.9.12 - Privilege Escalation / Commands Execution Exploit
phpGraphy 0.9.12 - Privilege Escalation / Commands Execution

PEAR 1.9.0 - Multiple Remote File Inclusion
PHP PEAR 1.9.0 - Multiple Remote File Inclusion

Pear HTTP_Upload 1.0.0b3 - Arbitrary File Upload
PHP PEAR HTTP_Upload 1.0.0b3 - Arbitrary File Upload

Radisys MRF - Command Injection
PHP PEAR 1.10.1 - Arbitrary File Download
Caregiver Script 2.57 - SQL Injection
Auction Script 6.49 - SQL Injection
Itech B2B Script 4.28 - SQL Injection
Itech Classifieds Script 7.27 - 'scat' Parameter SQL Injection
Itech Dating Script 3.26 - SQL Injection
Itech Freelancer Script 5.13 - SQL Injection
Itech Multi Vendor Script 6.49 - SQL Injection
Itech News Portal Script 6.28 - SQL Injection
Itech Real Estate Script 3.12 - SQL Injection
PHP Product Designer Script - Arbitrary File Upload
PHP Logo Designer Script - Arbitrary File Upload
Video Sharing Script 4.94 - SQL Injection
HelpDeskZ < 1.0.2 - Authenticated SQL Injection / Unauthorized File Download
Itech Classifieds Script 7.27 - 'pid' Parameter SQL Injection
Itech Dating Script 3.26 - 'send_gift.php' SQL Injection
Itech Real Estate Script 3.12 - 'id' Parameter SQL Injection
 2017-01-31 05:01:15 +00:00
Offensive Security
6df10a3616 DB: 2017-01-30 
2 new exploits

Linux - Multi/Dual mode execve(_/bin/sh__ NULL_ 0) Shellcode (37 bytes)

TrueConf Server 4.3.7 - Multiple Vulnerabilities
 2017-01-30 05:01:18 +00:00
Offensive Security
d0b74905e8 DB: 2017-01-27 
17 new exploits

Google Android - 'pm_qos' KASLR Bypass
macOS 10.12.1 / iOS 10.2 - Kernel Userspace Pointer Memory Corruption
macOS 10.12.1 / iOS Kernel - 'IOService::matchPassive' Use-After-Free
macOS 10.12.1 / iOS Kernel - 'host_self_trap' Use-After-Free
Systemd 228 - Privilege Escalation (PoC)
OpenSSH 6.8 < 6.9 - 'PTY' Privilege Escalation
Autodesk Backburner Manager 3 < 2016.0.0.2150 - Null Dereference Denial of Service
Haraka < 2.8.9 - Remote Command Execution

Linux/x86_64 - execve /bin/sh Shellcode (22 bytes)

Drupal 7.0 < 7.31 - SQL Injection (SA-CORE-2014-005) (1)
Drupal 7.0 < 7.31 - SQL Injection (1)

Drupal 7.0 < 7.31 - SQL Injection (SA-CORE-2014-005) (2)
Drupal 7.0 < 7.31 - SQL Injection (2)
Pear HTTP_Upload 1.0.0b3 - Arbitrary File Upload
KB Affiliate Referral Script 1.0 - Authentication Bypass
KB Login Authentication Script 1.1 - Authentication Bypass
KB Messages PHP Script 1.0 - Authentication Bypass
Web Based TimeSheet Script - Authentication Bypass
TM RG4332 Wireless Router - Arbitrary File Disclosure
PHPBack < 1.3.1 - SQL Injection / Cross-Site Scripting
Polycom VVX Web Interface - Change Admin Password
 2017-01-27 05:01:17 +00:00
Offensive Security
45360ed27c DB: 2017-01-26 
7 new exploits

OpenSSL ASN.1 <= 0.9.6j / 0.9.7b - Brute Forcer for Parsing Bugs
OpenSSL ASN.1 < 0.9.6j / 0.9.7b - Brute Forcer for Parsing Bugs
Inframail Advantage Server Edition 6.0 <= 6.37 - (SMTP) Buffer Overflow
Inframail Advantage Server Edition 6.0 <= 6.37 - (FTP) Buffer Overflow
Inframail Advantage Server Edition 6.0 < 6.37 - (SMTP) Buffer Overflow
Inframail Advantage Server Edition 6.0 < 6.37 - (FTP) Buffer Overflow

Blitzkrieg 2 <= 1.21 - (server/client) Denial of Service
Blitzkrieg 2 < 1.21 - (Server/Client) Denial of Service

Microsoft Windows Media Player 7.1 <= 10 - BMP Heap Overflow PoC (MS06-005) (1)
Microsoft Windows Media Player 7.1 < 10 - BMP Heap Overflow PoC (MS06-005) (1)

DESlock+ <= 3.2.6 - 'DLMFENC.sys' Local Kernel Ring0 link list zero (PoC)
DESlock+ < 3.2.6 - 'DLMFENC.sys' Local Kernel Ring0 link list zero (PoC)
DESlock+ <= 3.2.7 - Local Kernel Overflow (PoC)
DESlock+ <= 3.2.7 - Local Kernel Race Condition Denial of Service (PoC)
DESlock+ <= 3.2.7 - (probe read) Local Kernel Denial of Service (PoC)
DESlock+ < 3.2.7 - Local Kernel Overflow (PoC)
DESlock+ < 3.2.7 - Local Kernel Race Condition Denial of Service (PoC)
DESlock+ < 3.2.7 - (probe read) Local Kernel Denial of Service (PoC)

ViPlay3 <= 3.00 - '.vpl' Local Stack Overflow (PoC)
ViPlay3 < 3.00 - '.vpl' Local Stack Overflow (PoC)

Microsoft Windows 2000<2008 - Embedded OpenType Font Engine Remote Code Execution (MS09-065) (Metasploit)
Microsoft Windows 2000 < 2008 - Embedded OpenType Font Engine Remote Code Execution (MS09-065) (Metasploit)

Adobe Flash - No Checks on Vector.<uint> Capacity Field
Adobe Flash - 'uint' Capacity Field
Linux Kernel 2.6.13 <= 2.6.17.4 - 'sys_prctl()' Privilege Escalation (1)
Linux Kernel 2.6.13 <= 2.6.17.4 - 'sys_prctl()' Privilege Escalation (2)
Linux Kernel 2.6.13 <= 2.6.17.4 - 'sys_prctl()' Privilege Escalation (3)
Linux Kernel 2.6.13 <= 2.6.17.4 - 'sys_prctl()' Privilege Escalation (4)
Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Privilege Escalation (1)
Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Privilege Escalation (2)
Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Privilege Escalation (3)
Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Privilege Escalation (4)

Linux Kernel 2.6.13 <= 2.6.17.4 - 'logrotate prctl()' Privilege Escalation
Linux Kernel 2.6.13 < 2.6.17.4 - 'logrotate prctl()' Privilege Escalation
X11R6 <= 6.4 XKEYBOARD (solaris/sparc) - Local Buffer Overflow (1)
X11R6 <= 6.4 XKEYBOARD (solaris x86) - Local Buffer Overflow
X11R6 <= 6.4 XKEYBOARD (sco x86) - Local Buffer Overflow
X11R6 < 6.4 XKEYBOARD (solaris/sparc) - Local Buffer Overflow (1)
X11R6 < 6.4 XKEYBOARD (solaris x86) - Local Buffer Overflow
X11R6 < 6.4 XKEYBOARD (sco x86) - Local Buffer Overflow

X11R6 <= 6.4 XKEYBOARD (solaris/sparc) - Local Buffer Overflow (2)
X11R6 < 6.4 XKEYBOARD (solaris/sparc) - Local Buffer Overflow (2)

AtomixMP3 <= 2.3 - '.m3u' Buffer Overflow
AtomixMP3 < 2.3 - '.m3u' Buffer Overflow
Linux Kernel 2.6.17 <= 2.6.24.1 - 'vmsplice' Privilege Escalation (2)
Linux Kernel 2.6.23 <= 2.6.24 - 'vmsplice' Privilege Escalation (1)
Linux Kernel 2.6.17 < 2.6.24.1 - 'vmsplice' Privilege Escalation (2)
Linux Kernel 2.6.23 < 2.6.24 - 'vmsplice' Privilege Escalation (1)
DESlock+ <= 3.2.6 - 'LIST' Local Kernel Memory Leak (PoC)
DESlock+ <= 3.2.6 - Local Kernel Ring0 link list zero SYSTEM Exploit
DESlock+ <= 3.2.6 - 'DLMFDISK.sy's Local kernel Ring0 SYSTEM Exploit
DESlock+ < 3.2.6 - 'LIST' Local Kernel Memory Leak (PoC)
DESlock+ < 3.2.6 - Local Kernel Ring0 link list zero SYSTEM Exploit
DESlock+ < 3.2.6 - 'DLMFDISK.sy's Local kernel Ring0 SYSTEM Exploit

AtomixMP3 <= 2.3 - 'Playlist' Universal Overwrite (SEH)
AtomixMP3 < 2.3 - 'Playlist' Universal Overwrite (SEH)

Linux Kernel 2.6.18 <= 2.6.18-20 - Privilege Escalation
Linux Kernel 2.6.18 < 2.6.18-20 - Privilege Escalation

Winamp 5.05<5.13 - '.ini' Local Stack Buffer Overflow (PoC)
Winamp 5.05 < 5.13 - '.ini' Local Stack Buffer Overflow (PoC)
AhnLab V3 Internet Security 8.0 <= 1.2.0.4 - Privilege Escalation
NProtect Anti-Virus 2007 <= 2010.5.11.1 - Privilege Escalation
ESTsoft ALYac Anti-Virus 1.5 <= 5.0.1.2 - Privilege Escalation
ViRobot Desktop 5.5 and Server 3.5 <= 2008.8.1.1 - Privilege Escalation
AhnLab V3 Internet Security 8.0 < 1.2.0.4 - Privilege Escalation
NProtect Anti-Virus 2007 < 2010.5.11.1 - Privilege Escalation
ESTsoft ALYac Anti-Virus 1.5 < 5.0.1.2 - Privilege Escalation
ViRobot Desktop 5.5 and Server 3.5 < 2008.8.1.1 - Privilege Escalation

DESlock+ <= 4.1.10 - 'vdlptokn.sys' Local Kernel Ring0 SYSTEM Exploit
DESlock+ < 4.1.10 - 'vdlptokn.sys' Local Kernel Ring0 SYSTEM Exploit

PolicyKit polkit-1 <= 0.101 - Linux Privilege Escalation
PolicyKit polkit-1 < 0.101 - Linux Privilege Escalation

Linux Kernel 2.6.39 <= 3.2.2 (Gentoo / Ubuntu x86/x64) - 'Mempodipper.c' Privilege Escalation (1)
Linux Kernel 2.6.39 < 3.2.2 (Gentoo / Ubuntu x86/x64) - 'Mempodipper.c' Privilege Escalation (1)

Linux Kernel 2.4.4 <= 2.4.37.4 / 2.6.0 <= 2.6.30.4 - 'Sendpage' Privilege Escalation (Metasploit)
Linux Kernel 2.4.4 < 2.4.37.4 / 2.6.0 < 2.6.30.4 - 'Sendpage' Privilege Escalation (Metasploit)

Linux Kernel 2.6.32 <= 3.x.x (CentOS) - 'PERF_EVENTS' Privilege Escalation (1)
Linux Kernel 2.6.32 < 3.x.x (CentOS) - 'PERF_EVENTS' Privilege Escalation (1)

Linux Kernel 2.6.0 <= 2.6.31 - 'pipe.c' Privilege Escalation (1)
Linux Kernel 2.6.0 < 2.6.31 - 'pipe.c' Privilege Escalation (1)

Linux Kernel 3.14-rc1 <= 3.15-rc4 (x64) - Raw Mode PTY Local Echo Race Condition Privilege Escalation
Linux Kernel 3.14-rc1 < 3.15-rc4 (x64) - Raw Mode PTY Local Echo Race Condition Privilege Escalation

Linux Kernel 2.6.39 <= 3.2.2 (x86/x64) - 'Mempodipper.c' Privilege Escalation (2)
Linux Kernel 2.6.39 < 3.2.2 (x86/x64) - 'Mempodipper.c' Privilege Escalation (2)

OSSEC 2.7 <= 2.8.1 - 'diff' Command Privilege Escalation
OSSEC 2.7 < 2.8.1 - 'diff' Command Privilege Escalation
GNU Screen 4.5.0 - Privilege Escalation (PoC)
GNU Screen 4.5.0 - Privilege Escalation
Man-db 2.6.7.1 - Privilege Escalation (PoC)

e107 <= 0.6172 - 'resetcore.php' SQL Injection
e107 < 0.6172 - 'resetcore.php' SQL Injection

Microsoft Windows Media Player 7.1 <= 10 - BMP Heap Overflow PoC (MS06-005) (2)
Microsoft Windows Media Player 7.1 < 10 - BMP Heap Overflow PoC (MS06-005) (2)

Mercur Messaging 2005 <= SP4 - IMAP Remote Exploit (Egghunter)
Mercur Messaging 2005 < SP4 - IMAP Remote Exploit (Egghunter)

Mercury/32 Mail Server 3.32<4.51 - SMTP Unauthenticated EIP Overwrite
Mercury/32 Mail Server 3.32 < 4.51 - SMTP Unauthenticated EIP Overwrite

Dovecot IMAP 1.0.10 <= 1.1rc2 - Remote Email Disclosure
Dovecot IMAP 1.0.10 < 1.1rc2 - Remote Email Disclosure
Debian and Derivatives OpenSSL 0.9.8c-1 <= 0.9.8g-9 - Predictable PRNG Brute Force SSH Exploit (Perl)
Debian and Derivatives OpenSSL 0.9.8c-1 <= 0.9.8g-9 - Predictable PRNG Brute Force SSH Exploit (Ruby)
Debian and Derivatives OpenSSL 0.9.8c-1 < 0.9.8g-9 - Predictable PRNG Brute Force SSH Exploit (Perl)
Debian and Derivatives OpenSSL 0.9.8c-1 < 0.9.8g-9 - Predictable PRNG Brute Force SSH Exploit (Ruby)

Debian and Derivatives OpenSSL 0.9.8c-1 <= 0.9.8g-9 - Predictable PRNG Brute Force SSH Exploit (Python)
Debian and Derivatives OpenSSL 0.9.8c-1 < 0.9.8g-9 - Predictable PRNG Brute Force SSH Exploit (Python)

navicopa WebServer 3.0.1 - Buffer Overflow / Script Source Disclosure
Navicopa WebServer 3.0.1 - Buffer Overflow / Script Source Disclosure

NaviCopa Web Server 3.01 - Remote Buffer Overflow
NaviCopa WebServer 3.01 - Remote Buffer Overflow

Oracle Database 10.1.0.5 <= 10.2.0.4 - AUTH_SESSKEY Length Validation Remote Buffer Overflow
Oracle Database 10.1.0.5 < 10.2.0.4 - AUTH_SESSKEY Length Validation Remote Buffer Overflow

Liquid XML Studio 2010 <= 8.061970 - 'LtXmlComHelp8.dll' OpenFile() Remote Overflow
Liquid XML Studio 2010 < 8.061970 - 'LtXmlComHelp8.dll' OpenFile() Remote Overflow

TFTPD32 <= 2.21 - Long Filename Buffer Overflow (Metasploit)
TFTPD32 < 2.21 - Long Filename Buffer Overflow (Metasploit)

Mercury/32 <= 4.01b - PH Server Module Buffer Overflow (Metasploit)
Mercury/32 < 4.01b - PH Server Module Buffer Overflow (Metasploit)

Mercury/32 Mail Server <= 4.01b - LOGIN Buffer Overflow (Metasploit)
Mercury/32 Mail Server < 4.01b - LOGIN Buffer Overflow (Metasploit)

Exim4 <= 4.69 - string_format Function Heap Buffer Overflow (Metasploit)
Exim4 < 4.69 - string_format Function Heap Buffer Overflow (Metasploit)

Mozilla Firefox 7 / 8 <= 8.0.1 - nsSVGValue Out-of-Bounds Access (Metasploit)
Mozilla Firefox 7 / 8 < 8.0.1 - nsSVGValue Out-of-Bounds Access (Metasploit)

Active Collab 'chat module' <= 2.3.8 - Remote PHP Code Injection (Metasploit)
Active Collab 'chat module' < 2.3.8 - Remote PHP Code Injection (Metasploit)

Apache Struts 2.0.0 <= 2.2.1.1 - XWork 's:submit' HTML Tag Cross-Site Scripting
Apache Struts 2.0.0 < 2.2.1.1 - XWork 's:submit' HTML Tag Cross-Site Scripting

ntop/nbox 2.3 <= 2.5 - Multiple Vulnerabilities
ntop/nbox 2.3 < 2.5 - Multiple Vulnerabilities

Google Android 5.0 <= 5.1.1 - 'Stagefright' .MP4 tx3g Integer Overflow (Metasploit)
Google Android 5.0 < 5.1.1 - 'Stagefright' .MP4 tx3g Integer Overflow (Metasploit)

Mozilla Firefox < 50.0.2 - nsSMILTimeContainer::NotifyTimeChange() Remote Code Execution (Metasploit)
Mozilla Firefox < 50.0.2 - 'nsSMILTimeContainer::NotifyTimeChange()' Remote Code Execution (Metasploit)
Geutebrueck GCore 1.3.8.42/1.4.2.37 - Remote Code Execution (Metasploit)

Drupal 4.5.3 <= 4.6.1 - Comments PHP Injection
Drupal 4.5.3 < 4.6.1 - Comments PHP Injection

FCKEditor 2.0 <= 2.2 - 'FileManager connector.php' Arbitrary File Upload
FCKEditor 2.0 < 2.2 - 'FileManager connector.php' Arbitrary File Upload

RechnungsZentrale V2 <= 1.1.3 - Remote File Inclusion
RechnungsZentrale V2 < 1.1.3 - Remote File Inclusion

RsGallery2 <= 1.11.2 - 'rsgallery.html.php' File Inclusion
RsGallery2 < 1.11.2 - 'rsgallery.html.php' File Inclusion

Invision Power Board 2.1 <= 2.1.6 - SQL Injection (1)
Invision Power Board 2.1 < 2.1.6 - SQL Injection (1)

Invision Power Board 2.1 <= 2.1.6 - SQL Injection (2)
Invision Power Board 2.1 < 2.1.6 - SQL Injection (2)

vbPortal 3.0.2 <= 3.6.0 b1 - 'cookie' Remote Code Execution
vbPortal 3.0.2 < 3.6.0 b1 - 'cookie' Remote Code Execution

Wikepage Opus 10 <= 2006.2a (lng) - Remote Command Execution
Wikepage Opus 10 < 2006.2a (lng) - Remote Command Execution

e107 <= 0.75 - (GLOBALS Overwrite) Remote Code Execution
e107 < 0.75 - (GLOBALS Overwrite) Remote Code Execution

Haberx 1.02 <= 1.1 - (tr) SQL Injection
Haberx 1.02 < 1.1 - (tr) SQL Injection

PNphpBB2 <= 1.2g - 'phpbb_root_path' Parameter Remote File Inclusion
PNPHPBB2 < 1.2g - 'phpbb_root_path' Parameter Remote File Inclusion

exV2 <= 2.0.4.3 - (sort) SQL Injection
exV2 < 2.0.4.3 - (sort) SQL Injection

exV2 <= 2.0.4.3 - extract() Remote Command Execution
exV2 < 2.0.4.3 - extract() Remote Command Execution

Kietu? <= 4.0.0b2 - 'hit.php' Remote File Inclusion
Kietu? < 4.0.0b2 - 'hit.php' Remote File Inclusion

Forum82 <= 2.5.2b - (repertorylevel) Multiple File Inclusion
Forum82 < 2.5.2b - (repertorylevel) Multiple File Inclusion

e107 <= 0.75 - (e107language_e107cookie) Local File Inclusion
e107 < 0.75 - (e107language_e107cookie) Local File Inclusion

Mambo Component com_flyspray <= 1.0.1 - Remote File Disclosure
Mambo Component com_flyspray < 1.0.1 - Remote File Disclosure

PNPHPBB2 <= 1.2 - 'index.php' SQL Injection
PNPHPBB2 < 1.2 - 'index.php' SQL Injection

e107 <= 0.7.8 - (photograph) Arbitrary File Upload
e107 < 0.7.8 - (photograph) Arbitrary File Upload

EVA-Web 1.1 <= 2.2 - 'index.php3' Remote File Inclusion
EVA-Web 1.1 < 2.2 - 'index.php3' Remote File Inclusion

PNPHPBB2 <= 1.2i - 'viewforum.php' SQL Injection
PNPHPBB2 < 1.2i - 'viewforum.php' SQL Injection

WordPress 1.5.1.1 <= 2.2.2 - Multiple Vulnerabilities
WordPress 1.5.1.1 < 2.2.2 - Multiple Vulnerabilities

PNPHPBB2 <= 1.2i - 'PHPEx' Parameter Local File Inclusion
PNPHPBB2 < 1.2i - 'PHPEx' Parameter Local File Inclusion
zKup CMS 2.0 <= 2.3 - Remote Add Admin
zKup CMS 2.0 <= 2.3 - Arbitrary File Upload
zKup CMS 2.0 < 2.3 - Remote Add Admin
zKup CMS 2.0 < 2.3 - Arbitrary File Upload

GLLCTS2 <= 4.2.4 - 'detail' Parameter SQL Injection
GLLCTS2 < 4.2.4 - 'detail' Parameter SQL Injection

PHPHoo3 <= 5.2.6 - 'viewCat' Parameter SQL Injection
PHPHoo3 < 5.2.6 - 'viewCat' Parameter SQL Injection

E-Store Kit-1 <= 2 PayPal Edition - 'pid' Parameter SQL Injection
E-Store Kit-1 < 2 PayPal Edition - 'pid' Parameter SQL Injection

e107 <= 0.7.11 - Arbitrary Variable Overwriting
e107 < 0.7.11 - Arbitrary Variable Overwriting

e107 <= 0.7.13 - 'usersettings.php' Blind SQL Injection
e107 < 0.7.13 - 'usersettings.php' Blind SQL Injection
VideoScript 3.0 <= 4.0.1.50 - Official Shell Injection
VideoScript 3.0 <= 4.1.5.55 - Unofficial Shell Injection
VideoScript 3.0 < 4.0.1.50 - Official Shell Injection
VideoScript 3.0 < 4.1.5.55 - Unofficial Shell Injection

IPNPro3 <= 1.44 - Admin Password Changing Exploit
IPNPro3 < 1.44 - Admin Password Changing Exploit

PNphpBB2 <= 1.2i - (ModName) Multiple Local File Inclusion
PNPHPBB2 < 1.2i - (ModName) Multiple Local File Inclusion

WEBalbum 2.4b - 'photo.php id' Blind SQL Injection
WEBalbum 2.4b - 'id' Parameter Blind SQL Injection

e107 <= 0.7.15 - (extended_user_fields) Blind SQL Injection
e107 < 0.7.15 - (extended_user_fields) Blind SQL Injection
Alqatari group 1.0 <= 5.0 - 'id' SQL Injection
AlefMentor 2.0 <= 5.0 - 'id' SQL Injection
Alqatari group 1.0 < 5.0 - 'id' SQL Injection
AlefMentor 2.0 < 5.0 - 'id' SQL Injection

2DayBiz Matrimonial Script - smartresult.php SQL Injection
2DayBiz Matrimonial Script - 'smartresult.php' SQL Injection

fozzcom shopping<= 7.94+8.04 - Multiple Vulnerabilities
Fozzcom Shopping < 7.94 / < 8.04 - Multiple Vulnerabilities

Jcow Social Networking Script 4.2 <= 5.2 - Arbitrary Code Execution (Metasploit)
Jcow Social Networking Script 4.2 < 5.2 - Arbitrary Code Execution (Metasploit)

Concrete5 <= 5.4.2.1 - Multiple Vulnerabilities
Concrete5 < 5.4.2.1 - Multiple Vulnerabilities

CaupoShop Pro (2.x / <= 3.70) Classic 3.01 - Local File Inclusion
CaupoShop Pro (2.x < 3.70) Classic 3.01 - Local File Inclusion

Apache Struts2 <= 2.3.1 - Multiple Vulnerabilities
Apache Struts2 < 2.3.1 - Multiple Vulnerabilities

Ruslan Communications <Body>Builder - SQL Injection
Ruslan Communications <Body>Builder - Authentication Bypass
AllMyVisitors 0.x - info.inc.php Arbitrary Code Execution
AllMyLinks 0.x - footer.inc.php Arbitrary Code Execution
AllMyVisitors 0.x - 'info.inc.php' Arbitrary Code Execution
AllMyLinks 0.x - 'footer.inc.php' Arbitrary Code Execution

MyBB - 'editpost.php posthash' SQL Injection
MyBB 1.6.9 - 'editpost.php posthash' Time Based SQL Injection

CoolForum 0.5/0.7/0.8 - register.php login Parameter SQL Injection
CoolForum 0.5/0.7/0.8 - 'register.php' login Parameter SQL Injection

MyBB - Multiple Cross-Site Scripting / SQL Injection
MyBulletinBoard (MyBB) RC4 - Multiple Cross-Site Scripting / SQL Injection

4homepages 4Images 1.7 - member.php Cross-Site Scripting
4homepages 4Images 1.7 - 'member.php' Cross-Site Scripting

4Images 1.7.1 - member.php sessionid Parameter SQL Injection
4Images 1.7.1 - 'member.php' sessionid Parameter SQL Injection

Alex DownloadEngine 1.4.1 - comments.php SQL Injection
Alex DownloadEngine 1.4.1 - 'comments.php' SQL Injection

Album Photo Sans Nom 1.6 - Getimg.php Remote File Inclusion
Album Photo Sans Nom 1.6 - 'Getimg.php' Remote File Inclusion

4Images 1.7 - details.php Cross-Site Scripting
4Images 1.7 - 'details.php' Cross-Site Scripting

212Cafe Guestbook 4.00 - show.php Cross-Site Scripting
212Cafe Guestbook 4.00 - 'show.php' Cross-Site Scripting

2z Project 0.9.5 - rating.php Cross-Site Scripting
2z Project 0.9.5 - 'rating.php' Cross-Site Scripting

Openads (PHPAdsNew) <=c 2.0.8 - 'lib-remotehost.inc.php' Remote File Inclusion
Openads (PHPAdsNew) <  2.0.8 - 'lib-remotehost.inc.php' Remote File Inclusion

212Cafe WebBoard 6.30 - Read.php SQL Injection
212Cafe WebBoard 6.30 - 'Read.php' SQL Injection

PHP-Nuke Advertising Module 0.9 - modules.php SQL Injection
PHP-Nuke Advertising Module 0.9 - 'modules.php' SQL Injection

Drupal 7.0 <= 7.31 - SQL Injection (SA-CORE-2014-005) (1)
Drupal 7.0 < 7.31 - SQL Injection (SA-CORE-2014-005) (1)

Drupal 7.0 <= 7.31 - SQL Injection (SA-CORE-2014-005) (2)
Drupal 7.0 < 7.31 - SQL Injection (SA-CORE-2014-005) (2)

ManageEngine ServiceDesk Plus 9.0 (< Build 9031) - User Privileges Management
ManageEngine ServiceDesk Plus 9.0 < Build 9031 - User Privileges Management

Joomla! - 'redirect.php' SQL Injection
Joomla! 2.5.1 - 'redirect.php' Time Based SQL Injection

Plone - 'in_portal.py' <= 4.1.3 Session Hijacking
Plone - 'in_portal.py' < 4.1.3 Session Hijacking

Kaltura Community Edition <= 11.1.0-2 - Multiple Vulnerabilities
Kaltura Community Edition < 11.1.0-2 - Multiple Vulnerabilities

Skybox Platform <= 7.0.611 - Multiple Vulnerabilities
Skybox Platform < 7.0.611 - Multiple Vulnerabilities

SOLIDserver <= 5.0.4 - Local File Inclusion
SOLIDserver < 5.0.4 - Local File Inclusion

WordPress Plugin DZS Videogallery <= 8.60 - Multiple Vulnerabilities
WordPress Plugin DZS Videogallery < 8.60 - Multiple Vulnerabilities
Movie Portal Script 7.36 - Multiple Vulnerabilities
Joomla! < 2.5.2 - Admin Creation
Joomla! < 3.6.4 - Admin TakeOver
 2017-01-26 05:01:18 +00:00
Offensive Security
e96ad87c43 DB: 2017-01-23 
4 new exploits

SunOS 5.11 ICMP - Denial of Service

Microsoft Power Point 2016 - Java Code Execution
NTOPNG 2.4 Web Interface - Cross-Site Request Forgery
PageKit 1.0.10 - Password Reset
 2017-01-23 05:01:18 +00:00
Offensive Security
7c1c496c25 DB: 2017-01-17 
11 new exploits

Nofeel FTP Server 3.6 - (CWD) Remote Memory Consumption Exploit
Nofeel FTP Server 3.6 - 'CWD' Command Remote Memory Consumption

Mozilla Firefox < 50.1.0 - Use After Free
Mozilla Firefox < 50.1.0 - Use-After-Free

HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (1)
Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (1)

HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (3)
Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (3)

HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (2)
Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (2)

HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (4)
Microsoft HTML Help Workshop 4.74 - '.hhp' Buffer Overflow (Metasploit) (4)

iSelect v1.4 - Local Buffer Overflow

Word Viewer OCX 3.2 - ActiveX (Save) Remote File Overwrite
Word Viewer OCX 3.2 ActiveX - (Save) Remote File Overwrite
WinaXe Plus 8.7 - Buffer Overflow
DiskBoss Enterprise - GET Buffer Overflow (Metasploit)

Windows x64 - CreateRemoteThread() DLL Injection Shellcode (584 bytes)
Photobase 1.2 - 'Language' Local File Inclusion
Joomla! Component Portfol - (vcatid) SQL Injection
Photobase 1.2 - 'Language' Parameter Local File Inclusion
Joomla! Component Portfol 1.2 - 'vcatid' Parameter SQL Injection

dMx READY (25 - Products) Remote Database Disclosure
dMx READY (25 - Products) - Remote Database Disclosure

Joomla! Component com_gigcal (gigcal_gigs_id) 1.0 - SQL Injection
Joomla! Component GigCalendar 1.0 - SQL Injection

HSPell 1.1 - (cilla.cgi) Remote Command Execution
HSPell 1.1 - 'cilla.cgi' Remote Command Execution

PHP Photo Album 0.8b - (index.php preview) Local File Inclusion
PHP Photo Album 0.8b - 'preview' Parameter Local File Inclusion
Huawei Flybox B660 - Cross-Site Request Forgery
Business Networking Script 8.11 - SQL Injection / Cross-Site Scripting
Pirelli DRG A115 ADSL Router - Unauthenticated DNS Change
Tenda ADSL2/2+ Modem D840R - Unauthenticated DNS Change
Image Sharing Script 4.13 - Multiple Vulnerabilities
Million Pixels 3 - Authentication Bypass
ManagEnegine ADManager Plus 6.5.40 - Multiple Vulnerabilities
 2017-01-17 05:01:17 +00:00
Offensive Security
08be47d8e2 DB: 2017-01-14 
3 new exploits

Mozilla Firefox < 50.1.0 - Use After Free

Cisco Firepower Management Console 6.0 - Post Authentication UserAdd

QuoteBook - 'poll.inc' Remote Config File Disclosure
QuoteBook - Remote Config File Disclosure
PHP-Fusion Mod vArcade 1.8 - (comment_id) SQL Injection
Pizzis CMS 1.5.1 - (visualizza.php idvar) Blind SQL Injection
PHP-Fusion Mod vArcade 1.8 - 'comment_id' Parameter SQL Injection
Pizzis CMS 1.5.1 - Blind SQL Injection

Joomla! Component com_xevidmegahd - 'catid' SQL Injection
Joomla! Component com_xevidmegahd - SQL Injection

DZcms 3.1 - (products.php pcat) SQL Injection
DZcms 3.1 - SQL Injection
phpMDJ 1.0.3 - (id_animateur) Blind SQL Injection
XOOPS Module tadbook2 - 'open_book.php book_sn' SQL Injection
phpMDJ 1.0.3 - 'id_animateur' Parameter Blind SQL Injection
XOOPS Module tadbook2 - SQL Injection
PHP-Fusion Mod the_kroax - 'comment_id' Parameter SQL Injection
Social Engine - 'browse_classifieds.php s' SQL Injection
PHP-Fusion Mod the_kroax - SQL Injection
Social Engine - SQL Injection

Zeroshell 3.6.0/3.7.0 Net Services - Remote Code Execution
 2017-01-14 05:01:17 +00:00
Offensive Security
a0c8330781 DB: 2017-01-13 
13 new exploits

SeaMonkey 1.1.14 - (marquee) Denial of Service
SeaMonkey 1.1.14 - Denial of Service

Adobe Flash Player 24.0.0.186 - 'ActionGetURL2' Out-of-Bounds Memory Corruption
Adobe Flash Player 24.0.0.186 - 'ActionGetURL2' Out-of-Bounds Memory Corruption (1)

SapLPD 7.40 - Denial of Service

CoolPlayer 2.19 - (PlaylistSkin) Buffer Overflow
CoolPlayer 2.19 - 'PlaylistSkin' Buffer Overflow

Rosoft media player 4.4.4 - Buffer Overflow (SEH) (2)
Rosoft Media Player 4.4.4 - Buffer Overflow (SEH) (2)

aSc Timetables 2017 - Buffer Overflow

Nginx (Debian-Based Distributions) - 'logrotate' Local Privilege Escalation
Nginx (Debian-Based + Gentoo) - 'logrotate' Local Privilege Escalation

Cemu 1.6.4b - Information Leak + Buffer Overflow (Emulator Breakout)
Cemu 1.6.4b - Information Leak / Buffer Overflow (Emulator Breakout)

PlaySMS 0.7 - SQL Injection
PlaySms 0.7 - SQL Injection

SAP SAPLPD 6.28 - Buffer Overflow (Metasploit)
SapLPD 6.28 - Buffer Overflow (Metasploit)

Microsoft Windows Media Player 7.0 - '.wms' Arbitrary Script (MS00-090)

phpMyFamily 1.4.0 - Authentication Bypass (SQL Injection)
phpMyFamily 1.4.0 - Authentication Bypass

ACNews 1.0 - Admin Authentication Bypass (SQL Injection)
ACNews 1.0 - Authentication Bypass

ASPThai.Net Guestbook 5.5 - (Authentication Bypass) SQL Injection
ASPThai.Net Guestbook 5.5 - Authentication Bypass

PNphpBB2 <= 1.2g - 'phpbb_root_path' Remote File Inclusion
PNphpBB2 <= 1.2g - 'phpbb_root_path' Parameter Remote File Inclusion

cutenews aj-fork 167f - 'cutepath' Parameter Remote File Inclusion
CuteNews aj-fork 167f - 'cutepath' Parameter Remote File Inclusion

WSN Guest 1.21 - (comments.php id) SQL Injection
WSN Guest 1.21 - 'id' Parameter SQL Injection

PNPHPBB2 <= 1.2 - (index.php c) SQL Injection
PNPHPBB2 <= 1.2 - 'index.php' SQL Injection

PNPHPBB2 <= 1.2i - viewforum.php SQL Injection
PNPHPBB2 <= 1.2i - 'viewforum.php' SQL Injection

PNPHPBB2 <= 1.2i - (printview.php PHPEx) Local File Inclusion
PNPHPBB2 <= 1.2i - 'PHPEx' Parameter Local File Inclusion

webClassifieds 2005 - (Authentication Bypass) SQL Injection
webClassifieds 2005 - Authentication Bypass
webSPELL 4.01.02 - 'id' Remote Edit Topics
PNphpBB2 <= 12i - (ModName) Multiple Local File Inclusion
WSN Guest 1.23 - 'Search' SQL Injection
webSPELL 4.01.02 - 'id' Parameter Remote Edit Topics
PNphpBB2 <= 1.2i - (ModName) Multiple Local File Inclusion
WSN Guest 1.23 - 'Search' Parameter SQL Injection

Ayemsis Emlak Pro - (Authentication Bypass) SQL Injection
Ayemsis Emlak Pro - Authentication Bypass
Joomla! Component com_phocadocumentation - 'id' SQL Injection
phpauctionsystem - Cross-Site Scripting / SQL Injection
Joomla! Component com_phocadocumentation - 'id' Parameter SQL Injection
PHPAuctionSystem - Cross-Site Scripting / SQL Injection

RiotPix 0.61 - (forumid) Blind SQL Injection
RiotPix 0.61 - 'forumid' Parameter Blind SQL Injection

RiotPix 0.61 - (Authentication Bypass) SQL Injection
RiotPix 0.61 - Authentication Bypass
playSms 0.9.3 - Multiple Remote / Local File Inclusion
BlogHelper - 'common_db.inc' Remote Config File Disclosure
PollHelper - 'poll.inc' Remote Config File Disclosure
PlaySms 0.9.3 - Multiple Remote / Local File Inclusion
BlogHelper - Remote Config File Disclosure
PollHelper - Remote Config File Disclosure

Fast FAQs System - (Authentication Bypass) SQL Injection
Fast FAQs System - Authentication Bypass

Fast Guest Book - (Authentication Bypass) SQL Injection
Fast Guest Book - Authentication Bypass
BKWorks ProPHP 0.50b1 - (Authentication Bypass) SQL Injection
Weight Loss Recipe Book 3.1 - (Authentication Bypass) SQL Injection
BKWorks ProPHP 0.50b1 - Authentication Bypass
Weight Loss Recipe Book 3.1 - Authentication Bypass
Dark Age CMS 0.2c Beta - (Authentication Bypass) SQL Injection
Syzygy CMS 0.3 - (Authentication Bypass) SQL Injection
Dark Age CMS 0.2c Beta - Authentication Bypass
Syzygy CMS 0.3 - Authentication Bypass
eFAQ - (Authentication Bypass) SQL Injection
eReservations - (Authentication Bypass) SQL Injection
The Walking Club - (Authentication Bypass) SQL Injection
Ping IP - (Authentication Bypass) SQL Injection
eFAQ - Authentication Bypass
eReservations - Authentication Bypass
The Walking Club - Authentication Bypass
Ping IP - Authentication Bypass

ASP ActionCalendar 1.3 - (Authentication Bypass) SQL Injection
ASP ActionCalendar 1.3 - Authentication Bypass

Click&Email - (Authentication Bypass) SQL Injection
Click&Email - Authentication Bypass

Web-Calendar Lite 1.0 - (Authentication Bypass) SQL Injection
Web-Calendar Lite 1.0 - Authentication Bypass

ClickAuction - (Authentication Bypass) SQL Injection
ClickAuction - Authentication Bypass

Netartmedia Car Portal 1.0 - (Authentication Bypass) SQL Injection
Netartmedia Car Portal 1.0 - Authentication Bypass

SalesCart - (Authentication Bypass) SQL Injection
SalesCart - Authentication Bypass
WholeHogSoftware Ware Support - (Authentication Bypass) SQL Injection
WholeHogSoftware Password Protect - (Authentication Bypass) SQL Injection
WholeHogSoftware Ware Support - Authentication Bypass
WholeHogSoftware Password Protect - Authentication Bypass

ClickCart 6.0 - (Authentication Bypass) SQL Injection
ClickCart 6.0 - Authentication Bypass

Online Grades 3.2.4 - (Authentication Bypass) SQL Injection
Online Grades 3.2.4 - Authentication Bypass

MyDesing Sayac 2.0 - (Authentication Bypass) SQL Injection
MyDesing Sayac 2.0 - Authentication Bypass
AuthPhp 1.0 - (Authentication Bypass) SQL Injection
Mynews 0_10 - (Authentication Bypass) SQL Injection
BlueBird Pre-Release - (Authentication Bypass) SQL Injection
AuthPhp 1.0 - Authentication Bypass
Mynews 0_10 - Authentication Bypass
BlueBird Pre-Release - Authentication Bypass

Grestul 1.x - Authentication Bypass (via Cookie SQL Injection)
Grestul 1.x - Authentication Bypass (Cookie SQL Injection)

XGuestBook 2.0 - (Authentication Bypass) SQL Injection
XGuestBook 2.0 - Authentication Bypass

PenPal 2.0 - (Authentication Bypass) SQL Injection
PenPal 2.0 - Authentication Bypass

BannerManager 0.81 - (Authentication Bypass) SQL Injection
BannerManager 0.81 - Authentication Bypass

Free PHP Petition Signing Script - (Authentication Bypass) SQL Injection
Free PHP Petition Signing Script - Authentication Bypass
Simbas CMS 2.0 - (Authentication Bypass) SQL Injection
WebFileExplorer 3.1 - (Authentication Bypass) SQL Injection
Simbas CMS 2.0 - Authentication Bypass
WebFileExplorer 3.1 - Authentication Bypass

My Dealer CMS 2.0 - (Authentication Bypass) SQL Injection
My Dealer CMS 2.0 - Authentication Bypass

XEngineSoft PMS/MGS/NM/Ams 1.0 - (Authentication Bypass) SQL Injection
XEngineSoft PMS/MGS/NM/Ams 1.0 - Authentication Bypass

NetHoteles 2.0/3.0 - (Authentication Bypass) SQL Injection
NetHoteles 2.0/3.0 - Authentication Bypass

Tiny Blogr 1.0.0 rc4 - (Authentication Bypass) SQL Injection
Tiny Blogr 1.0.0 rc4 - Authentication Bypass

ClanTiger 1.1.1 - (Authentication Bypass) SQL Injection
ClanTiger 1.1.1 - Authentication Bypass

Hot Project 7.0 - (Authentication Bypass) SQL Injection
Hot Project 7.0 - Authentication Bypass

EZ Webitor - (Authentication Bypass) SQL Injection
EZ Webitor - Authentication Bypass

Creasito E-Commerce 1.3.16 - (Authentication Bypass) SQL Injection
Creasito E-Commerce 1.3.16 - Authentication Bypass

I-Rater Pro/Plantinum 4.0 - (Authentication Bypass) SQL Injection
I-Rater Pro/Plantinum 4.0 - Authentication Bypass

5 star Rating 1.2 - (Authentication Bypass) SQL Injection
5 star Rating 1.2 - Authentication Bypass

Tiger Dms - (Authentication Bypass) SQL Injection
Tiger Dms - Authentication Bypass
The Recipe Script 5 - (Authentication Bypass) SQL Injection / DB Backup
Realty Web-Base 1.0 - (Authentication Bypass) SQL Injection
Luxbum 0.5.5/stable - (Authentication Bypass) SQL Injection
The Recipe Script 5 - (Authentication Bypass) SQL Injection / Database Backup
Realty Web-Base 1.0 - Authentication Bypass
Luxbum 0.5.5/stable - Authentication Bypass

My Game Script 2.0 - (Authentication Bypass) SQL Injection
My Game Script 2.0 - Authentication Bypass

Submitter Script - (Authentication Bypass) SQL Injection
Submitter Script - Authentication Bypass

PHP Dir Submit - (Authentication Bypass) SQL Injection
PHP Dir Submit - Authentication Bypass

DM FileManager 3.9.2 - (Authentication Bypass) SQL Injection
DM FileManager 3.9.2 - Authentication Bypass

VICIDIAL 2.0.5-173 - (Authentication Bypass) SQL Injection
VICIDIAL 2.0.5-173 - Authentication Bypass

Article Directory - (Authentication Bypass) SQL Injection
Article Directory - Authentication Bypass

phpBugTracker 1.0.3 - (Authentication Bypass) SQL Injection
phpBugTracker 1.0.3 - Authentication Bypass

Zen Help Desk 2.1 - (Authentication Bypass) SQL Injection
Zen Help Desk 2.1 - Authentication Bypass

EgyPlus 7ml 1.0.1 - (Authentication Bypass) SQL Injection
EgyPlus 7ml 1.0.1 - Authentication Bypass

Pixelactivo 3.0 - (Authentication Bypass) SQL Injection
Pixelactivo 3.0 - Authentication Bypass

MyCars Automotive - (Authentication Bypass) SQL Injection
MyCars Automotive - Authentication Bypass

Zip Store Chat 4.0/5.0 - (Authentication Bypass) SQL Injection
Zip Store Chat 4.0/5.0 - Authentication Bypass

AlumniServer 1.0.1 - (Authentication Bypass) SQL Injection
AlumniServer 1.0.1 - Authentication Bypass

ForumPal FE 1.1 - (Authentication Bypass) SQL Injection
ForumPal FE 1.1 - Authentication Bypass

Opial 1.0 - (Authentication Bypass) SQL Injection
Opial 1.0 - Authentication Bypass

webLeague 2.2.0 - (Authentication Bypass) SQL Injection
webLeague 2.2.0 - Authentication Bypass

AnotherPHPBook (APB) 1.3.0 - (Authentication Bypass) SQL Injection
AnotherPHPBook (APB) 1.3.0 - Authentication Bypass

SaphpLesson 4.0 - (Authentication Bypass) SQL Injection
SaphpLesson 4.0 - Authentication Bypass

Limny 1.01 - (Authentication Bypass) SQL Injection
Limny 1.01 - Authentication Bypass

Magician Blog 1.0 - (Authentication Bypass) SQL Injection
Magician Blog 1.0 - Authentication Bypass

AW BannerAd - (Authentication Bypass) SQL Injection
AW BannerAd - Authentication Bypass

Ajax Short URL Script - (Authentication Bypass) SQL Injection
Ajax Short URL Script - Authentication Bypass
TT Web Site Manager 0.5 - (Authentication Bypass) SQL Injection
SimpleLoginSys 0.5 - (Authentication Bypass) SQL Injection
TT Web Site Manager 0.5 - Authentication Bypass
SimpleLoginSys 0.5 - Authentication Bypass

Questions Answered 1.3 - (Authentication Bypass) SQL Injection
Questions Answered 1.3 - Authentication Bypass

Blink Blog System - (Authentication Bypass) SQL Injection
Blink Blog System - Authentication Bypass

MOC Designs PHP News 1.1 - (Authentication Bypass) SQL Injection
MOC Designs PHP News 1.1 - Authentication Bypass

PHotoLa Gallery 1.0 - (Authentication Bypass) SQL Injection
PHotoLa Gallery 1.0 - Authentication Bypass

PHPCityPortal - (Authentication Bypass) SQL Injection
PHPCityPortal - Authentication Bypass

Logoshows BBS 2.0 - (Authentication Bypass) SQL Injection
Logoshows BBS 2.0 - Authentication Bypass

SmilieScript 1.0 - (Authentication Bypass) SQL Injection
SmilieScript 1.0 - Authentication Bypass

humanCMS - (Authentication Bypass) SQL Injection
humanCMS - Authentication Bypass

Three Pillars Help Desk 3.0 - (Authentication Bypass) SQL Injection
Three Pillars Help Desk 3.0 - Authentication Bypass

AdsDX 3.05 - (Authentication Bypass) SQL Injection
AdsDX 3.05 - Authentication Bypass

Nephp Publisher Enterprise 4.5 - (Authentication Bypass) SQL Injection
Nephp Publisher Enterprise 4.5 - Authentication Bypass

W3infotech - (Authentication Bypass) SQL Injection
W3infotech - Authentication Bypass

Real Estate Portal X.0 - (Authentication Bypass) SQL Injection
Real Estate Portal X.0 - Authentication Bypass

PHP Inventory 1.2 - Remote Authentication Bypass (SQL Injection)
PHP Inventory 1.2 - Authentication Bypass

SitePal 1.1 - (Authentication Bypass) SQL Injection
SitePal 1.1 - Authentication Bypass

JM CMS 1.0 <= 1.0 - (Authentication Bypass) SQL Injection
JM CMS 1.0 - Authentication Bypass

Pre Hospital Management System - (Authentication Bypass) SQL Injection
Pre Hospital Management System - Authentication Bypass

Digiappz Freekot - (Authentication Bypass) SQL Injection
Digiappz Freekot - Authentication Bypass

Omnistar Affiliate - (Authentication Bypass) SQL Injection
Omnistar Affiliate - Authentication Bypass

PRE HOTELS&RESORTS MANAGEMENT SYSTEM - (Authentication Bypass) SQL Injection
PRE HOTELS&RESORTS MANAGEMENT SYSTEM - Authentication Bypass

Advance Biz Limited 1.0 - (Authentication Bypass) SQL Injection
Advance Biz Limited 1.0 - Authentication Bypass
e-topbiz banner exchange PHP - (Authentication Bypass) SQL Injection
e-topbiz Slide Popups 1 PHP - (Authentication Bypass) SQL Injection
e-topbiz banner exchange PHP - Authentication Bypass
e-topbiz Slide Popups 1 PHP - Authentication Bypass

Freewebscript'z Games - (Authentication Bypass) SQL Injection
Freewebscript'z Games - Authentication Bypass

DZOIC Handshakes - Authentication Bypass (SQL Injection)
DZOIC Handshakes - Authentication Bypass

DZOIC ClipHouse - Authentication Bypass (SQL Injection)
DZOIC ClipHouse - Authentication Bypass

PHP Car Rental-Script - (Authentication Bypass) SQL Injection
PHP Car Rental-Script - Authentication Bypass
Zen Tracking 2.2 - (Authentication Bypass) SQL Injection
Baal Systems 3.8 - (Authentication Bypass) SQL Injection
Zen Tracking 2.2 - Authentication Bypass
Baal Systems 3.8 - Authentication Bypass

Killmonster 2.1 - (Authentication Bypass) SQL Injection
Killmonster 2.1 - Authentication Bypass

Rostermain 1.1 - (Authentication Bypass) SQL Injection
Rostermain 1.1 - Authentication Bypass

NewsLetter Tailor - (Authentication Bypass) SQL Injection
NewsLetter Tailor - Authentication Bypass

WSN Guest 1.02 - (orderlinks) SQL Injection
WSN Guest 1.02 - 'orderlinks' Parameter SQL Injection

Project Man 1.0 - (Authentication Bypass) SQL Injection
Project Man 1.0 - Authentication Bypass

Uiga Fan Club 1.0 - (Authentication Bypass) SQL Injection
Uiga Fan Club 1.0 - Authentication Bypass

HazelPress Lite 0.0.4 - (Authentication Bypass) SQL Injection
HazelPress Lite 0.0.4 - Authentication Bypass

Majoda CMS - (Authentication Bypass) SQL Injection
Majoda CMS - Authentication Bypass

4x CMS r26 - (Authentication Bypass) SQL Injection
4x CMS r26 - Authentication Bypass
Satellite-X 4.0 - (Authentication Bypass) SQL Injection
Huron CMS 8 11 2007 - (Authentication Bypass) SQL Injection
Satellite-X 4.0 - Authentication Bypass
Huron CMS 8 11 2007 - Authentication Bypass

Zyke CMS 1.1 - (Authentication Bypass) SQL Injection
Zyke CMS 1.1 - Authentication Bypass

Online University - (Authentication Bypass) SQL Injection
Online University - Authentication Bypass

Online Job Board - (Authentication Bypass) SQL Injection
Online Job Board - Authentication Bypass

JE CMS 1.0.0 - Authentication Bypass (via SQL Injection)
JE CMS 1.0.0 - Authentication Bypass

ExtCalendar2 - (Authentication Bypass/Cookie) SQL Injection
ExtCalendar2 - (Authentication Bypass / Cookie) SQL Injection

SN News 1.2 - '/admin/loger.php' Authentication Bypass (SQL Injection)
SN News 1.2 - '/admin/loger.php' Authentication Bypass

RTTucson Quotations Database Script - (Authentication Bypass) SQL Injection
RTTucson Quotations Database Script - Authentication Bypass

PlaySms - 'index.php' Cross-Site Scripting
PlaySms 0.8 - 'index.php' Cross-Site Scripting

Practico CMS 13.7 - Authentication Bypass (SQL Injection)
Practico CMS 13.7 - Authentication Bypass

Airbnb Clone Script - Arbitrary File Upload

Milw0rm Clone Script 1.0 - (Authentication Bypass) SQL Injection
Milw0rm Clone Script 1.0 - Authentication Bypass

PHPCollab CMS 2.5 - (emailusers.php) SQL Injection
PHPCollab CMS 2.5 - 'emailusers.php' SQL Injection

My link trader 1.1 - 'id' Parameter SQL Injection
My Link Trader 1.1 - 'id' Parameter SQL Injection
b2evolution 6.8.2 - Arbitrary File Upload
Job Portal Script 9.11 - Authentication Bypass
Online Food Delivery 2.04 - Authentication Bypass
iTechscripts Freelancer Script 5.11 - 'sk' Parameter SQL Injection
D-Link DIR-615 - Multiple Vulnerabilities
School Management Software 2.75 - SQL Injection
Penny Auction Script - Arbitrary File Upload
ECommerce-TIBSECART - Arbitrary File Upload
ECommerce-Multi-Vendor Software - Arbitrary File Upload
 2017-01-13 05:01:18 +00:00
Offensive Security
3617e005f6 DB: 2017-01-12 
16 new exploits

VMware 2.5.1 - (VMware-authd) Remote Denial of Service
VMware 2.5.1 - 'VMware-authd' Remote Denial of Service
Adobe Flash Player 24.0.0.186 - 'ActionGetURL2' Out-of-Bounds Memory Corruption
Adobe Flash Player 24.0.0.186 - 'ActionGetURL2' Out-of-Bounds Memory Corruption (2)
Boxoft Wav 1.0 - Buffer Overflow
VideoLAN VLC Media Player 2.2.1 - 'DecodeAdpcmImaQT' Buffer Overflow

EleCard MPEG PLAYER - '.m3u' Local Stack Overflow
Elecard MPEG Player - '.m3u' Local Stack Overflow

Microsoft Windows Kernel - 'win32k.sys' 'NtSetWindowLongPtr' Privilege Escalation (MS16-135)
Microsoft Windows Kernel - 'win32k.sys' 'NtSetWindowLongPtr' Privilege Escalation (MS16-135) (1)

Boxoft WAV to MP3 Converter - convert Feature Buffer Overflow
Boxoft WAV to MP3 Converter - 'convert' Buffer Overflow
Microsoft Windows Kernel - 'win32k.sys' 'NtSetWindowLongPtr' Privilege Escalation (MS16-135) (2)
Microsoft Windows 8.1 (x64) - RGNOBJ Integer Overflow (MS16-098)
Cemu 1.6.4b - Information Leak + Buffer Overflow (Emulator Breakout)
Firejail - Privilege Escalation

McAfee Virus Scan Enterprise for Linux - Remote Code Execution
McAfee Virus Scan Enterprise for Linux 1.9.2 < 2.0.2 - Remote Code Execution

Ansible 2.1.4 / 2.2.1 - Command Execution

Eggblog < 3.07 - Remote SQL Injection / Privilege Escalation
EggBlog < 3.07 - Remote SQL Injection / Privilege Escalation

PowerClan 1.14a - (footer.inc.php) Remote File Inclusion
PowerClan 1.14a - 'footer.inc.php' Remote File Inclusion

Eggblog 3.1.0 - Cookies SQL Injection
EggBlog 3.1.0 - Cookies SQL Injection

eggBlog 4.0 - SQL Injection
EggBlog 4.0 - SQL Injection

2Capsule - 'sticker.php id' SQL Injection
2Capsule - SQL Injection

ASPThai.Net WebBoard 6.0 - (bview.asp) SQL Injection
ASPThai.Net WebBoard 6.0 - SQL Injection
Memberkit 1.0 - Remote Arbitrary .PHP File Upload
phpScribe 0.9 - (user.cfg) Remote Config Disclosure
Memberkit 1.0 - Arbitrary File Upload
phpScribe 0.9 - 'user.cfg' Remote Config Disclosure

PowerClan 1.14a - (Authentication Bypass) SQL Injection
PowerClan 1.14a - Authentication Bypass

Webspell 4 - (Authentication Bypass) SQL Injection
webSPELL 4 - Authentication Bypass

eggBlog 4.1.1 - Local Directory Traversal
EggBlog 4.1.1 - Local Directory Traversal

Travel Portal Script Admin Password Change - Cross-Site Request Forgery
Travel Portal Script - Cross-Site Request Forgery (Admin Password Change)

eggBlog 4.1.2 - Arbitrary File Upload
EggBlog 4.1.2 - Arbitrary File Upload
Eggblog 2.0 - blog.php id Parameter SQL Injection
Eggblog 2.0 - topic.php message Parameter Cross-Site Scripting
EggBlog 2.0 - 'id' Parameter SQL Injection
EggBlog 2.0 - 'message' Parameter Cross-Site Scripting

PowerClan 1.14 - member.php SQL Injection
PowerClan 1.14 - 'member.php' SQL Injection
SoftBizScripts Dating Script 1.0 - featured_photos.php browse Parameter SQL Injection
SoftBizScripts Dating Script 1.0 - products.php cid Parameter SQL Injection
SoftBizScripts Dating Script 1.0 - 'index.php' cid Parameter SQL Injection
SoftBizScripts Dating Script 1.0 - news_desc.php id Parameter SQL Injection
SoftBizScripts Dating Script 1.0 - 'featured_photos.php' SQL Injection
SoftBizScripts Dating Script 1.0 - 'products.php' SQL Injection
SoftBizScripts Dating Script 1.0 - 'index.php' SQL Injection
SoftBizScripts Dating Script 1.0 - 'news_desc.php' SQL Injection

Dating Script 3.25 - SQL Injection

Starting Page 1.3 - SQL Injection
Starting Page 1.3 - 'linkid' Parameter SQL Injection
Starting Page 1.3 - 'category' Parameter SQL Injection
My link trader 1.1 - 'id' Parameter SQL Injection
Blackboard LMS 9.1 SP14 - Cross-Site Scripting
Huawei Flybox B660 - Cross-Site Request Forgery
Travel Portal Script 9.33 - SQL Injection
Movie Portal Script 7.35 - SQL Injection
 2017-01-12 05:01:16 +00:00
Offensive Security
bac881f89a DB: 2017-01-03 
3 new exploits

QNAP NAS Devices - Heap Overflow

Castle Rock Computing SNMPc 7.0.19 - Community String Stack Based Buffer Overflow

Internet Download Accelerator 6.10.1.1527 - FTP Buffer Overflow (SEH)

PHPFanBase 2.x - (protection.php) Remote File Inclusion
PHPFanBase 2.x - 'protection.php' Remote File Inclusion

DigiAffiliate 1.4 - (visu_user.asp id) SQL Injection
DigiAffiliate 1.4 - 'id' Parameter SQL Injection

ExoPHPDesk 1.2.1 - (faq.php) SQL Injection
ExoPHPDesk 1.2.1 - 'faq.php' SQL Injection

MiniGal b13 - (image backdoor) Remote Code Execution
MiniGal b13 - Remote Code Execution
PHP Auto Listings - 'moreinfo.php pg' SQL Injection
Pre Simple CMS - SQL Injection (Authentication Bypass)
PHP Auto Listings - 'pg' Parameter SQL Injection
Pre Simple CMS - Authentication Bypass

Harlandscripts drinks - (recid) SQL Injection
Harlandscripts drinks - 'recid' Parameter SQL Injection

Mole Group Taxi Calc Dist Script - (Authentication Bypass) SQL Injection
Mole Group Taxi Calc Dist Script - Authentication Bypass

DevelopItEasy Membership System 1.3 - (Authentication Bypass) SQL Injection
DevelopItEasy Membership System 1.3 - Authentication Bypass

NICE FAQ Script - (Authentication Bypass) SQL Injection
NICE FAQ Script - Authentication Bypass

SoftComplex PHP Image Gallery 1.0 - (Authentication Bypass) SQL Injection
SoftComplex PHP Image Gallery 1.0 - Authentication Bypass
DELTAScripts PHP Classifieds 7.5 - (Authentication Bypass) SQL Injection
DELTAScripts PHP Links 1.3 - (Authentication Bypass) SQL Injection
DELTAScripts PHP Shop 1.0 - (Authentication Bypass) SQL Injection
SoftComplex PHP Image Gallery - (ctg) SQL Injection
DELTAScripts PHP Classifieds 7.5 - Authentication Bypass
DELTAScripts PHP Links 1.3 - Authentication Bypass
DELTAScripts PHP Shop 1.0 - Authentication Bypass
SoftComplex PHP Image Gallery - 'ctg' Parameter SQL Injection
TurnkeyForms Business Survey Pro 1.0 - 'id' SQL Injection
Mole Group Pizza - (manufacturers_id) Script SQL Injection
TurnkeyForms Business Survey Pro 1.0 - 'id' Parameter SQL Injection
Mole Group Pizza - 'manufacturers_id' Parameter SQL Injection
E-topbiz Online Store 1 - (Authentication Bypass) SQL Injection
PHP Auto Listings Script - (Authentication Bypass) SQL Injection
Mole Group Rental Script - (Authentication Bypass) SQL Injection
MyioSoft Ajax Portal 3.0 - (Authentication Bypass) SQL Injection
MyioSoft EasyBookMarker - (Authentication Bypass) SQL Injection
MyioSoft EasyCalendar - (Authentication Bypass) SQL Injection
E-topbiz Online Store 1 - Authentication Bypass
PHP Auto Listings Script - Authentication Bypass
Mole Group Rental Script - Authentication Bypass
MyioSoft Ajax Portal 3.0 - Authentication Bypass
MyioSoft EasyBookMarker 4.0 - Authentication Bypass
MyioSoft EasyCalendar - Authentication Bypass

E-topbiz Online Store 1 - 'cat_id' SQL Injection
E-topbiz Online Store 1 - 'cat_id' Parameter SQL Injection

Myiosoft EasyBookMarker 4 - (Parent) SQL Injection
Myiosoft EasyBookMarker 4 - 'Parent' Parameter SQL Injection
Enthusiast 3.1.4 - (show_joined.php path) Remote File Inclusion
V3 Chat Profiles/Dating Script 3.0.2 - (Authentication Bypass) SQL Injection
Enthusiast 3.1.4 - 'show_joined.php' Remote File Inclusion
V3 Chat Profiles/Dating Script 3.0.2 - Authentication Bypass
DigiAffiliate 1.4 - (Authentication Bypass) SQL Injection
Mole Group Airline Ticket Script - (Authentication Bypass) SQL Injection
DigiAffiliate 1.4 - Authentication Bypass
Mole Group Airline Ticket Script - Authentication Bypass
ExoPHPDesk 1.2 Final - (Authentication Bypass) SQL Injection
ZEEMATRI 3.0 - (bannerclick.php adid) SQL Injection
ExoPHPDesk 1.2 Final - Authentication Bypass
ZEEMATRI 3.0 - 'adid' Parameter SQL Injection

Joomla! Component com_books - (book_id) SQL Injection
Joomla! Component com_books - 'book_id' Parameter SQL Injection

Joomla! / Mambo Component 'com_catalogproduction' - 'id' SQL Injection
Joomla! / Mambo Component com_catalogproduction - 'id' Parameter SQL Injection

PozScripts Business Directory Script - 'cid' SQL Injection
PozScripts Business Directory Script - 'cid' Parameter SQL Injection
Alstrasoft Web Host Directory - (Authentication Bypass) SQL Injection
Quick Poll Script - 'code.php id' SQL Injection
Alstrasoft Web Host Directory - Authentication Bypass
Quick Poll Script - 'id' Parameter SQL Injection

Bankoi Webhost Panel 1.20 - (Authentication Bypass) SQL Injection
Bankoi Webhost Panel 1.20 - Authentication Bypass
Minigal b13 - 'index.php list' Remote File Disclosure
yahoo answers - 'id' SQL Injection
Minigal b13 - Remote File Disclosure
yahoo answers - 'id' Parameter SQL Injection

PHPstore Wholesale - 'track.php?id' SQL Injection
PHPstore Wholesale - 'id' Parameter SQL Injection

E-topbiz ADManager 4 - (group) Blind SQL Injection
E-topbiz ADManager 4 - 'group' Parameter Blind SQL Injection
PHPfan 3.3.4 - (init.php includepath) Remote File Inclusion
Jadu Galaxies - 'categoryId' Blind SQL Injection
PHPfan 3.3.4 - 'init.php' Remote File Inclusion
Jadu Galaxies - 'categoryId' Parameter Blind SQL Injection

MemHT Portal 4.0.1 - (avatar) Remote Code Execution
MemHT Portal 4.0.1 - Remote Code Execution

MemHT Portal 4.0.1 - (pvtmsg) Delete All Private Messages Exploit
MemHT Portal 4.0.1 - Delete All Private Messages Exploit

MyioSoft Ajax Portal 3.0 - (page) SQL Injection
MyioSoft Ajax Portal 3.0 - 'page' Parameter SQL Injection

X10media Mp3 Search Engine < 1.6.2 Admin Access
X10media Mp3 Search Engine < 1.6.2 - Admin Access

Arab Portal 2.2 - (Authentication Bypass) SQL Injection
Arab Portal 2.2 - Authentication Bypass

Arab Portal 2.x - (forum.php qc) SQL Injection
Arab Portal 2.x - 'forum.php' SQL Injection

Arab Portal 2.2 - (mod.php module) Local File Inclusion
Arab Portal 2.2 - 'mod.php' Local File Inclusion

Collabtive - SQL Injection
Collabtive 0.65 - SQL Injection
All Enthusiast ReviewPost PHP Pro 2.5 - showproduct.php SQL Injection
All Enthusiast ReviewPost PHP Pro 2.5 - showcat.php SQL Injection
All Enthusiast ReviewPost PHP Pro 2.5 - 'showproduct.php' SQL Injection
All Enthusiast ReviewPost PHP Pro 2.5 - 'showcat.php' SQL Injection

All Enthusiast PhotoPost PHP Pro 5.0 - adm-photo.php Arbitrary Image Manipulation
All Enthusiast PhotoPost PHP Pro 5.0 - 'adm-photo.php' Arbitrary Image Manipulation

Collabtive 1.0 - (manageuser.php task Parameter) SQL Injection
Collabtive 1.0 - 'manageuser.php' SQL Injection

Arab Portal 2.0 - Link.php SQL Injection
Arab Portal 2.0 - 'Link.php' SQL Injection
Arab Portal System 2.0 - online.php title Parameter Cross-Site Scripting
Arab Portal System 2.0 - download.php title Parameter Cross-Site Scripting
Arab Portal 2.0 - 'online.php' Cross-Site Scripting
Arab Portal 2.0 - 'download.php' Cross-Site Scripting

ExoPHPDesk 1.2 - Pipe.php Remote File Inclusion
ExoPHPDesk 1.2 - 'Pipe.php' Remote File Inclusion

Collabtive 1.1 - (managetimetracker.php id Parameter) SQL Injection
Collabtive 1.1 - 'managetimetracker.php' SQL Injection

Zeeways Shaadi Clone 2.0 - 'admin/home.php' Authentication Bypass
Zeeways Shaadi Clone 2.0 - Authentication Bypass

PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - (AIO) 'PwnScriptum' Remote Code Execution
 2017-01-03 05:01:17 +00:00
Offensive Security
560fb055c7 DB: 2016-12-25 2016-12-25 05:01:18 +00:00
Offensive Security
897e1fa191 DB: 2016-12-24 
3 new exploits

WinFTP Server 2.0.2 - (PASV) Remote Denial of Service
WinFTP Server 2.0.2 - 'PASV' Remote Denial of Service

WinFTP Server 2.3.0 - (NLST) Denial of Service
WinFTP Server 2.3.0 - 'NLST' Denial of Service

vxFtpSrv 2.0.3 - CWD command Remote Buffer Overflow (PoC)
vxFtpSrv 2.0.3 - 'CWD' Remote Buffer Overflow (PoC)

OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation

X7 Chat 2.0.5 - lib/message.php preg_replace() PHP Code Execution (Metasploit)
X7 Chat 2.0.5 - 'message.php' PHP Code Execution (Metasploit)

OpenSSH < 7.4 - agent Protocol Arbitrary Library Loading

X7 Chat 2.0 - (help_file) Remote Command Execution
X7 Chat 2.0 - 'help_file' Parameter Remote Command Execution
Ultimate WebBoard 3.00 - (Category) SQL Injection
PromoteWeb MySQL - 'go.php id' SQL Injection
212Cafe Board 0.07 - (view.php qID) SQL Injection
Ultimate WebBoard 3.00 - 'Category' Parameter SQL Injection
PromoteWeb MySQL - 'id' Parameter SQL Injection
212Cafe Board 0.07 - 'qID' Parameter SQL Injection
The Gemini Portal - 'lang' Remote File Inclusion
RPG.Board 0.0.8Beta2 - (showtopic) SQL Injection
ASPapp KnowledgeBase - 'catid' SQL Injection
The Gemini Portal 4.7 - 'lang' Parameter Remote File Inclusion
RPG.Board 0.0.8Beta2 - 'showtopic' Parameter SQL Injection
ASPapp KnowledgeBase - 'catid' Parameter SQL Injection

X7 Chat 2.0.1A1 - (mini.php help_file) Local File Inclusion
X7 Chat 2.0.1A1 - 'mini.php' Local File Inclusion
CoAST 0.95 - (sections_file) Remote File Inclusion
Real Estate Manager - 'cat_id' SQL Injection
LnBlog 0.9.0 - (plugin) Local File Inclusion
PlugSpace 0.1 - (index.php navi) Local File Inclusion
MyCard 1.0.2 - (gallery.php id) SQL Injection
PowerPortal 2.0.13 - 'path' Local Directory Traversal
PHP-Lance 1.52 - (show.php catid) SQL Injection
Yoxel 1.23beta - (itpm_estimate.php a) Remote Code Execution
CoAST 0.95 - 'sections_file' Parameter Remote File Inclusion
Real Estate Manager 1.01 - 'cat_id' Parameter SQL Injection
LnBlog 0.9.0 - 'plugin' Parameter Local File Inclusion
PlugSpace 0.1 - 'navi' Parameter Local File Inclusion
MyCard 1.0.2 - 'id' Parameter SQL Injection
PowerPortal 2.0.13 - 'path' Parameter Local Directory Traversal
PHP-Lance 1.52 - 'catid' Parameter SQL Injection
Yoxel 1.23beta - 'itpm_estimate.php' Remote Code Execution

ZEELYRICS 2.0 - (bannerclick.php adid) SQL Injection
ZEELYRICS 2.0 - 'bannerclick.php' SQL Injection
Pro Chat Rooms 3.0.3 - (guid) SQL Injection
Pilot Group eTraining - 'news_read.php id' SQL Injection
BbZL.php 0.92 - (lien_2) Local Directory Traversal
Pro Chat Rooms 3.0.3 - SQL Injection
Pilot Group eTraining - 'news_read.php' SQL Injection
BbZL.php 0.92 - 'lien_2' Parameter Local Directory Traversal

Arcadem Pro - 'articlecat' SQL Injection
Arcadem Pro - 'articlecat' Parameter SQL Injection
ArabCMS - 'rss.php rss' Local File Inclusion
FAQ Management Script - 'catid' SQL Injection
ArabCMS - 'rss.php' Local File Inclusion
FAQ Management Script - 'catid' Parameter SQL Injection

BookMarks Favourites Script - 'view_group.php id' SQL Injection
BookMarks Favourites Script - 'id' Parameter SQL Injection

BMForum 5.6 - (tagname) SQL Injection
BMForum 5.6 - 'tagname' Parameter SQL Injection
Crux Gallery 1.32 - (index.php theme) Local File Inclusion
phpScheduleIt 1.2.10 - (reserve.php) Remote Code Execution
RPortal 1.1 - (file_op) Remote File Inclusion
Crux Gallery 1.32 - 'theme' Parameter Local File Inclusion
phpScheduleIt 1.2.10 - 'reserve.php' Remote Code Execution
RPortal 1.1 - 'file_op' Parameter Remote File Inclusion

Link Trader - 'ratelink.php lnkid' SQL Injection
Link Trader - 'lnkid' Parameter SQL Injection
OLIB 7 WebView 2.5.1.1 - (infile) Local File Inclusion
OpenX 2.6 - (ac.php bannerid) Blind SQL Injection
OLIB 7 WebView 2.5.1.1 - 'infile' Parameter Local File Inclusion
OpenX 2.6 - 'bannerid' Parameter Blind SQL Injection

X7 Chat 2.0.5 - (Authentication Bypass) SQL Injection
X7 Chat 2.0.5 - Authentication Bypass

Arcadem Pro 2.8 - (article) Blind SQL Injection
Arcadem Pro 2.8 - 'article' Parameter Blind SQL Injection

Link Trader - (lnkid) SQL Injection

phpScheduleIt PHP - reserve.php start_date Parameter Arbitrary Code Injection (Metasploit)
phpScheduleIt 1.2.10 - 'reserve.php' Arbitrary Code Injection (Metasploit)

PowerPortal 1.1/1.3 - modules.php Traversal Arbitrary Directory Listing
PowerPortal 1.1/1.3 - 'modules.php' Traversal Arbitrary Directory Listing

Atomic Photo Album 0.x/1.0 - Apa_PHPInclude.INC.php Remote File Inclusion
Atomic Photo Album 0.x/1.0 - 'Apa_PHPInclude.INC.php' Remote File Inclusion
BMForum 3.0 - topic.php Multiple Parameter Cross-Site Scripting
BMForum 3.0 - forums.php Multiple Parameter Cross-Site Scripting
BMForum 3.0 - post.php forumid Parameter Cross-Site Scripting
BMForum 3.0 - announcesys.php forumid Parameter Cross-Site Scripting
BMForum 3.0 - 'topic.php' Cross-Site Scripting
BMForum 3.0 - 'forums.php' Cross-Site Scripting
BMForum 3.0 - 'post.php' Cross-Site Scripting
BMForum 3.0 - 'announcesys.php' Cross-Site Scripting
PowerPortal 1.1/1.3 - 'index.php' search Parameter Cross-Site Scripting
PowerPortal 1.1/1.3 - search.php search Parameter Cross-Site Scripting
PowerPortal 1.1/1.3 - 'index.php' Cross-Site Scripting
PowerPortal 1.1/1.3 - 'search.php' Cross-Site Scripting
X7 Chat 2.0.4 - sources/frame.php room Parameter Cross-Site Scripting
X7 Chat 2.0.4 - upgradev1.php INSTALL_X7CHATVERSION Parameter Cross-Site Scripting
X7 Chat 2.0.4 - 'frame.php' Cross-Site Scripting
X7 Chat 2.0.4 - 'upgradev1.php' Cross-Site Scripting
BMForum 5.6 - 'index.php' outpused Parameter Cross-Site Scripting
BMForum 5.6 - newtem/footer/bsd01footer.php Multiple Parameter Cross-Site Scripting
BMForum 5.6 - newtem/header/bsd01header.php Multiple Parameter Cross-Site Scripting
BMForum 5.6 - 'index.php' Cross-Site Scripting
BMForum 5.6 - 'bsd01footer.php' Cross-Site Scripting
BMForum 5.6 - 'bsd01header.php' Cross-Site Scripting
Pilot Group eTraining - courses_login.php cat_id Parameter Cross-Site Scripting
Pilot Group eTraining - news_read.php id Parameter Cross-Site Scripting
Pilot Group eTraining - lessons_login.php Multiple Parameter Cross-Site Scripting
Pilot Group eTraining - 'courses_login.php' Cross-Site Scripting
Pilot Group eTraining - 'news_read.php' Cross-Site Scripting
Pilot Group eTraining - 'lessons_login.php' Cross-Site Scripting

OpenX - /www/admin/plugin-index.php parent Parameter Cross-Site Scripting
OpenX 2.8.10 - 'plugin-index.php' Cross-Site Scripting

Apache mod_session_crypto - Padding Oracle
 2016-12-24 05:01:17 +00:00
Offensive Security
26b1e8b6ad DB: 2016-12-23 
10 new exploits

Microsoft Internet Explorer 11 - MSHTML CPaste­Command::Convert­Bitmapto­Png Heap-Based Buffer Overflow (MS14-056)

Microsoft Internet Explorer 11 MSHTML - CSplice­Tree­Engine::Remove­Splice Use-After-Free (MS14-035)
Microsoft Internet Explorer 11 - MSHTML CSplice­Tree­Engine::Remove­Splice Use-After-Free (MS14-035)
macOS 10.12.1 Kernel - Writable Privileged IOKit Registry Properties Code Execution
macOS 10.12 - Double vm_deallocate in Userspace MIG Code Use-After-Free
macOS < 10.12.2 / iOS < 10.2 Kernel - ipc_port_t Reference Count Leak Due to Incorrect externalMethod Overrides Use-After-Free
macOS 10.12.1 / iOS < 10.2 - powerd Arbitrary Port Replacement
macOS 10.12.1 / iOS < 10.2 - syslogd Arbitrary Port Replacement
IBM AIX 6.1/7.1/7.2 - 'Bellmail' Privilege Escalation
Vesta Control Panel 0.9.8-16 - Local Privilege Escalation
macOS < 10.12.2 / iOS < 10.2 Kernel - _kernelrpc_mach_port_insert_right_trap Reference Count Leak / Use-After-Free
macOS < 10.12.2 / iOS < 10.2 - Broken Kernel Mach Port Name uref Handling Privileged Port Name Replacement Privilege Escalation

PHP iCalendar 2.21 - (publish.ical.php) Remote Code Execution
PHP iCalendar 2.21 - 'publish.ical.php' Remote Code Execution

CzarNews 1.14 - (tpath) Remote File Inclusion
CzarNews 1.14 - 'tpath' Parameter Remote File Inclusion

N/X WCMS 4.1 - (nxheader.inc.php) Remote File Inclusion
N/X WCMS 4.1 - 'nxheader.inc.php' Remote File Inclusion

Powies pForum 1.29a - (editpoll.php) SQL Injection
Powies pForum 1.29a - 'editpoll.php' SQL Injection

AssetMan 2.4a - (download_pdf.php) Remote File Disclosure
AssetMan 2.4a - 'download_pdf.php' Remote File Disclosure

Orion-Blog 2.0 - (AdminBlogNewsEdit.asp) Remote Authentication Bypass
Orion-Blog 2.0 - Remote Authentication Bypass

Ol BookMarks Manager 0.7.4 - (root) Remote File Inclusion
Ol BookMarks Manager 0.7.4 - 'root' Parameter Remote File Inclusion

AdminBot 9.0.5 - (live_status.lib.php ROOT) Remote File Inclusion
AdminBot 9.0.5 - 'live_status.lib.php' Remote File Inclusion

WSN Links Basic Edition - (displaycat catid) SQL Injection
WSN Links Basic Edition - 'catid' Parameter SQL Injection

phpRealty 0.02 - (MGR) Multiple Remote File Inclusion
phpRealty 0.02 - 'MGR' Parameter Multiple Remote File Inclusion
jPORTAL 2 - mailer.php SQL Injection
jPORTAL 2.3.1 - articles.php SQL Injection
jPORTAL 2 - 'mailer.php' SQL Injection
jPORTAL 2.3.1 - 'articles.php' SQL Injection

AvailScript Jobs Portal Script - Authenticated (jid) SQL Injection
AvailScript Jobs Portal Script - 'jid' Parameter SQL Injection

PhpWebGallery 1.3.4 - Cross-Site Scripting / Local File Inclusion
PHPWebGallery 1.3.4 - Cross-Site Scripting / Local File Inclusion

D-iscussion Board 3.01 - (topic) Local File Inclusion
D-iscussion Board 3.01 - 'topic' Parameter Local File Inclusion

PhpWebGallery 1.3.4 - Blind SQL Injection
PHPWebGallery 1.3.4 - Blind SQL Injection
PhpWebGallery 1.3.4 - Blind SQL Injection
pForum 1.30 - (showprofil.php id) SQL Injection
WebPortal CMS 0.7.4 - (download.php aid) SQL Injection
iBoutique 4.0 - (cat) SQL Injection
SkaLinks 1.5 - (register.php) Arbitrary Add Editor
vbLOGIX Tutorial Script 1.0 - 'cat_id' SQL Injection
PHPWebGallery 1.3.4 - Blind SQL Injection
pForum 1.30 - 'showprofil.php' SQL Injection
WebPortal CMS 0.7.4 - 'download.php' SQL Injection
iBoutique 4.0 - 'cat' Parameter SQL Injection
SkaLinks 1.5 - 'register.php' Arbitrary Add Editor
vbLOGIX Tutorial Script 1.0 - 'cat_id' Parameter SQL Injection

pLink 2.07 - (linkto.php id) Blind SQL Injection
pLink 2.07 - 'linkto.php' Blind SQL Injection

FoT Video scripti 1.1b - (oyun) SQL Injection
FoT Video scripti 1.1b - 'oyun' Parameter SQL Injection

Pre Real Estate Listings - 'search.php c' SQL Injection
Pre Real Estate Listings - 'search.php' SQL Injection

iScripts EasyIndex - (produid) SQL Injection
iScripts EasyIndex - 'produid' Parameter SQL Injection
Hotel Reservation System - 'city.asp city' Blind SQL Injection
phpRealty 0.3 - (INC) Remote File Inclusion
PHP Crawler 0.8 - (footer) Remote File Inclusion
Technote 7 - (shop_this_skin_path) Remote File Inclusion
Hotel Reservation System - 'city.asp' Blind SQL Injection
phpRealty 0.3 - 'INC' Parameter Remote File Inclusion
PHP Crawler 0.8 - Remote File Inclusion
Technote 7 - 'shop_this_skin_path' Parameter Remote File Inclusion
E-PHP CMS - 'article.php es_id' SQL Injection
addalink 4 - 'category_id' SQL Injection
ProArcadeScript 1.3 - (random) SQL Injection
CYASK 3.x - (collect.php neturl) Local File Disclosure
Diesel Joke Site - 'picture_category.php id' SQL Injection
ProActive CMS - 'template' Local File Inclusion
E-PHP CMS - 'article.php' SQL Injection
addalink 4 - 'category_id' Parameter SQL Injection
ProArcadeScript 1.3 - 'random' Parameter SQL Injection
CYASK 3.x - 'neturl' Parameter Local File Disclosure
Diesel Joke Site - 'picture_category.php' SQL Injection
ProActive CMS - 'template' Parameter Local File Inclusion
Diesel Pay Script - (area) SQL Injection
Plaincart 1.1.2 - (p) SQL Injection
Oceandir 2.9 - (show_vote.php id) SQL Injection
jPORTAL 2 - 'humor.php id' SQL Injection
Diesel Pay Script - 'area' Parameter SQL Injection
Plaincart 1.1.2 - 'p' Parameter SQL Injection
Oceandir 2.9 - 'show_vote.php' SQL Injection
jPORTAL 2 - 'humor.php' SQL Injection

Diesel Job Site - (job_id) Blind SQL Injection
Diesel Job Site - 'job_id' Parameter Blind SQL Injection

e107 Plugin Image Gallery 0.9.6.2 - (image) SQL Injection
e107 Plugin Image Gallery 0.9.6.2 - SQL Injection

WSN Links 2.22/2.23 - (vote.php) SQL Injection
WSN Links 2.22/2.23 - 'vote.php' SQL Injection
BuzzyWall 1.3.1 - (search.php search) SQL Injection
WCMS 1.0b - (news_detail.asp id) SQL Injection
BuzzyWall 1.3.1 - 'search' Parameter SQL Injection
WCMS 1.0b - 'news_detail.asp' SQL Injection

OpenElec 3.01 - (form.php obj) Local File Inclusion
OpenElec 3.01 - 'obj' Parameter Local File Inclusion
basebuilder 2.0.1 - (main.inc.php) Remote File Inclusion
Fez 1.3/2.0 RC1 - (list.php) SQL Injection
basebuilder 2.0.1 - 'main.inc.php' Remote File Inclusion
Fez 1.3/2.0 RC1 - 'list.php' SQL Injection
OpenRat 0.8-beta4 - (tpl_dir) Remote File Inclusion
Sofi WebGui 0.6.3 PRE - (mod_dir) Remote File Inclusion
OpenRat 0.8-beta4 - 'tpl_dir' Parameter Remote File Inclusion
Sofi WebGui 0.6.3 PRE - 'mod_dir' Parameter Remote File Inclusion

JETIK-WEB Software - 'sayfa.php kat' SQL Injection
JETIK-WEB Software - 'kat' Parameter SQL Injection
WebPortal CMS 0.7.4 - (code) Remote Code Execution
HotScripts Clone - 'cid' SQL Injection
WebPortal CMS 0.7.4 - 'code' Parameter Remote Code Execution
HotScripts Clone - 'cid' Parameter SQL Injection
emergecolab 1.0 - (sitecode) Local File Inclusion
mailwatch 1.0.4 - (docs.php doc) Local File Inclusion
PHPcounter 1.3.2 - (defs.php l) Local File Inclusion
emergecolab 1.0 - 'sitecode' Parameter Local File Inclusion
mailwatch 1.0.4 - 'doc' Parameter Local File Inclusion
PHPcounter 1.3.2 - 'defs.php' Local File Inclusion

webcp 0.5.7 - (filelocation) Remote File Disclosure
webcp 0.5.7 - 'filelocation' Parameter Remote File Disclosure
LanSuite 3.3.2 - (design) Local File Inclusion
PHPOCS 0.1-beta3 - (index.php act) Local File Inclusion
Vikingboard 0.2 Beta - (task) Local File Inclusion
LanSuite 3.3.2 - 'design' Parameter Local File Inclusion
PHPOCS 0.1-beta3 - 'act' Parameter Local File Inclusion
Vikingboard 0.2 Beta - 'task' Parameter Local File Inclusion

barcodegen 2.0.0 - (class_dir) Remote File Inclusion
barcodegen 2.0.0 - 'class_dir' Parameter Remote File Inclusion

PHPcounter 1.3.2 - (index.php name) SQL Injection
PHPcounter 1.3.2 - 'index.php' SQL Injection

PhpWebGallery 1.7.2 - Session Hijacking / Code Execution
PHPWebGallery 1.7.2 - Session Hijacking / Code Execution

BuzzyWall 1.3.1 - (download id) Remote File Disclosure
BuzzyWall 1.3.1 - 'id' Parameter Remote File Disclosure

Pre Real Estate Listings - (Authentication Bypass) SQL Injection
Pre Real Estate Listings - Authentication Bypass

Netartmedia Real Estate Portal 1.2 - (ad_id) SQL Injection
Netartmedia Real Estate Portal 1.2 - 'ad_id' Parameter SQL Injection

SkaLinks 1.5 - (Authentication Bypass) SQL Injection
SkaLinks 1.5 - Authentication Bypass

diesel job site 1.4 - Multiple Vulnerabilities
Diesel Job Site 1.4 - Multiple Vulnerabilities

ProArcadeScript to Game - (game) SQL Injection
ProArcadeScript to Game - SQL Injection

Link Bid Script - 'links.php id' SQL Injection
Link Bid Script - 'links.php' SQL Injection

NetArt Media iBoutique 4.0 - (index.php key Parameter) SQL Injection
iBoutique 4.0 - 'key' Parameter SQL Injection

PHPForum 2.0 RC1 - Mainfile.php Remote File Inclusion
PHPForum 2.0 RC1 - 'Mainfile.php' Remote File Inclusion

JPortal 2.2.1 - print.php SQL Injection
jPORTAL 2.2.1 - 'print.php' SQL Injection

CzarNews 1.13/1.14 - headlines.php Remote File Inclusion
CzarNews 1.13/1.14 - 'headlines.php' Remote File Inclusion

JPortal 2.3.1 - Banner.php SQL Injection
jPORTAL 2.3.1 - 'Banner.php' SQL Injection

CJ Ultra Plus 1.0.3/1.0.4 - OUT.php SQL Injection
CJ Ultra Plus 1.0.3/1.0.4 - 'OUT.php' SQL Injection

JPortal 2.2.1/2.3.1 - download.php SQL Injection
jPORTAL 2.2.1/2.3.1 - 'download.php' SQL Injection
JPortal Web Portal 2.2.1/2.3.1 - comment.php id Parameter SQL Injection
JPortal Web Portal 2.2.1/2.3.1 - news.php id Parameter SQL Injection
JPortal Web Portal 2.2.1/2.3.1 - 'comment.php' SQL Injection
JPortal Web Portal 2.2.1/2.3.1 - 'news.php' SQL Injection

PHPWCMS 1.2.5 -DEV - random_image.php imgdir Parameter Traversal Arbitrary File Access
PHPWCMS 1.2.5 -DEV - 'imgdir' Parameter Traversal Arbitrary File Access

JPortal 2.2.1/2.3 Forum - forum.php SQL Injection
jPORTAL 2.2.1/2.3 Forum - 'forum.php' SQL Injection

Diesel Joke Site - Category.php SQL Injection
Diesel Joke Site - 'Category.php' SQL Injection
TinyPHPForum 3.6 - error.php Information Disclosure
TinyPHPForum 3.6 - UpdatePF.php Authentication Bypass
TinyPHPForum 3.6 - 'error.php' Information Disclosure
TinyPHPForum 3.6 - 'UpdatePF.php' Authentication Bypass
Vikingboard Viking board 0.1b - help.php act Parameter Cross-Site Scripting
Vikingboard Viking board 0.1b - report.php p Parameter Cross-Site Scripting
Vikingboard 0.1 - topic.php SQL Injection
Vikingboard 0.1b - 'help.php' Cross-Site Scripting
Vikingboard 0.1b - 'report.php' Cross-Site Scripting
Vikingboard 0.1 - 'topic.php' SQL Injection
PHP iCalendar 1.1/2.x - day.php Multiple Parameter Cross-Site Scripting
PHP iCalendar 1.1/2.x - month.php Multiple Parameter Cross-Site Scripting
PHP iCalendar 1.1/2.x - year.php Multiple Parameter Cross-Site Scripting
PHP iCalendar 1.1/2.x - week.php Multiple Parameter Cross-Site Scripting
PHP iCalendar 1.1/2.x - search.php Multiple Parameter Cross-Site Scripting
PHP iCalendar 1.1/2.x - rss/index.php getdate Parameter Cross-Site Scripting
PHP iCalendar 1.1/2.x - print.php getdate Parameter Cross-Site Scripting
PHP iCalendar 1.1/2.x - preferences.php Multiple Parameter Cross-Site Scripting
PHP iCalendar 1.1/2.x - 'day.php' Cross-Site Scripting
PHP iCalendar 1.1/2.x - 'month.php' Cross-Site Scripting
PHP iCalendar 1.1/2.x - 'year.php' Cross-Site Scripting
PHP iCalendar 1.1/2.x - 'week.php' Cross-Site Scripting
PHP iCalendar 1.1/2.x - 'search.php' Cross-Site Scripting
PHP iCalendar 1.1/2.x - 'getdate' Parameter Cross-Site Scripting
PHP iCalendar 1.1/2.x - 'print.php' Cross-Site Scripting
PHP iCalendar 1.1/2.x - 'preferences.php' Cross-Site Scripting
Vikingboard Viking board 0.1.2 - cp.php Multiple Parameter Cross-Site Scripting
Vikingboard Viking board 0.1.2 - user.php u Parameter Cross-Site Scripting
Vikingboard Viking board 0.1.2 - post.php Multiple Parameter Cross-Site Scripting
Vikingboard Viking board 0.1.2 - topic.php s Parameter Cross-Site Scripting
Vikingboard Viking board 0.1.2 - forum.php debug Variable Information Disclosure
Vikingboard Viking board 0.1.2 - cp.php debug Variable Information Disclosure
Vikingboard 0.1.2 - 'cp.php' Cross-Site Scripting
Vikingboard 0.1.2 - 'user.php' Cross-Site Scripting
Vikingboard 0.1.2 - 'post.php' Cross-Site Scripting
Vikingboard 0.1.2 - 'topic.php' Cross-Site Scripting
Vikingboard 0.1.2 - 'forum.php' Information Disclosure
Vikingboard 0.1.2 - 'cp.php' Information Disclosure
PaysiteReviewCMS 1.1 - search.php q Parameter Cross-Site Scripting
PaysiteReviewCMS - image.php image Parameter Cross-Site Scripting
PaysiteReviewCMS 1.1 - 'search.php' Cross-Site Scripting
PaysiteReviewCMS - 'image.php' Cross-Site Scripting

BuzzScripts BuzzyWall 1.3.2 - 'resolute.php' Information Disclosure
BuzzyWall 1.3.2 - 'resolute.php' Information Disclosure
 2016-12-23 05:01:18 +00:00
Offensive Security
62dddb2f49 DB: 2016-12-20 
9 new exploits

Apache 2.2 - (Windows) Local Denial of Service
Apache 2.2 (Windows) - Local Denial of Service

Apache 1.3.x + Tomcat 4.0.x/4.1.x Mod_JK - Chunked Encoding Denial of Service
Apache 1.3.x + Tomcat 4.0.x/4.1.x (Mod_JK) - Chunked Encoding Denial of Service

Apache 2.4.7 mod_status - Scoreboard Handling Race Condition
Apache 2.4.7 (mod_status) - Scoreboard Handling Race Condition

Google Chrome < 31.0.1650.48 - HTTP 1xx base::String­Tokenizer­T<...>::Quick­Get­Next Out-of-Bounds Read

Apache 1.3.31 mod_include - Local Buffer Overflow
Apache 1.3.31 (mod_include) - Local Buffer Overflow

Gopher 3.0.9 - (+VIEWS) Remote Client Side Buffer Overflow
Gopher 3.0.9 - (+VIEWS) Remote Client-Side Buffer Overflow

Apache 'Mod_Auth_OpenID' - Session Stealing
Apache (Mod_Auth_OpenID) - Session Stealing
Apache 2.0.4x mod_php Module - File Descriptor Leakage (1)
Apache 2.0.4x mod_php Module - File Descriptor Leakage (2)
Apache 2.0.4x (mod_php) - File Descriptor Leakage (1)
Apache 2.0.4x (mod_php) - File Descriptor Leakage (2)

Apache 2.0.4x mod_perl Module - File Descriptor Leakage (3)
Apache 2.0.4x (mod_perl) - File Descriptor Leakage (3)

Apache 1.3.x mod_include - Local Buffer Overflow
Apache 1.3.x (mod_include) - Local Buffer Overflow

Naenara Browser 3.5 (RedStar 3.0 Desktop) - 'JACKRABBIT' Client-Side Command Execution
Apport 2.x (Ubuntu Desktop 12.10 < 16.04) - Local Code Execution
RedStar 3.0 Server - 'BEAM & RSSMON' Command Execution (Shellshock)
Google Chrome + Fedora 25 / Ubuntu 16.04 - 'tracker-extract' / 'gnome-video-thumbnailer' + 'totem' Drive-By Download

Apache 1.3.x mod_mylo - Remote Code Execution
Apache 1.3.x (mod_mylo) - Remote Code Execution

Apache 1.3.x < 2.0.48 - mod_userdir Remote Users Disclosure
Apache 1.3.x < 2.0.48 (mod_userdir) - Remote Users Disclosure

Apache mod_ssl (< 2.8.7) OpenSSL - 'OpenFuckV2.c' Remote Exploit (2)
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Exploit (2)

Mozilla Firefox 3.5 - (Font tags) Remote Heap Spray Exploit (2)
Mozilla Firefox 3.5 - (Font tags) Remote Heap Spray

Apache mod_perl 'Apache::Status' and 'Apache2::Status' - Cross-Site Scripting
Apache (mod_perl) - 'Apache::Status' / 'Apache2::Status' Cross-Site Scripting

Apache 2.2.14 mod_isapi - Dangling Pointer Remote SYSTEM Exploit
Apache 2.2.14 (mod_isapi) - Dangling Pointer Remote SYSTEM Exploit

Apache (Windows x86) - (Windows x86) Chunked Encoding (Metasploit)
Apache (Windows x86) - Chunked Encoding (Metasploit)

Apache mod_proxy - Reverse Proxy Exposure (PoC)
Apache (mod_proxy) - Reverse Proxy Exposure (PoC)

Apache 1.3.20 - Win32 PHP.exe Remote File Disclosure
Apache 1.3.20 (Win32) - 'PHP.exe' Remote File Disclosure

Apache mod_ssl (< 2.8.7) OpenSSL - 'OpenFuck.c' Remote Exploit (1)
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Exploit (1)

Joomla! Component 'com_media' - Arbitrary File Upload (Metasploit)
Joomla! Component Media Manager - Arbitrary File Upload (Metasploit)

Apache 2.2.6 - 'mod_negotiation' HTML Injection and HTTP Response Splitting
Apache 2.2.6 (mod_negotiation) - HTML Injection and HTTP Response Splitting

Apache 7.0.x 'mod_proxy'- Reverse Proxy Security Bypass
Apache 7.0.x (mod_proxy) - Reverse Proxy Security Bypass

Apache 2.2.15 - 'mod_proxy' Reverse Proxy Security Bypass
Apache 2.2.15 (mod_proxy) - Reverse Proxy Security Bypass

Apache 'mod_wsgi' Module - Information Disclosure
Apache (mod_wsgi) - Information Disclosure

Joomla! Component 'com_jp_jobs' 1.4.1 - SQL Injection
Joomla! Component JP Jobs 1.4.1 - SQL Injection

Joomla! Component 'com_joomlapicasa' 2.0 - Local File Inclusion
Joomla! Component Picasa 2.0 - Local File Inclusion

Joomla! Component 'com_jinventory' - Local File Inclusion
Joomla! Component JInventory 1.23.02 - Local File Inclusion

Joomla! Component 'com_loginbox' - Local File Inclusion
Joomla! Component LoginBox - Local File Inclusion

Joomla! Component 'com_Joomlaupdater' - Local File Inclusion
Joomla! Component Magic Updater - Local File Inclusion
Joomla! Component 'com_news_portal' 1.5.x - Local File Inclusion
Joomla! Component 'com_fss' 1.3 - 'faqid' Parameter SQL Injection
Joomla! Component News Portal 1.5.x - Local File Inclusion
Joomla! Component Freestyle FAQ Lite 1.3 - 'faqid' Parameter SQL Injection
Joomla! Component 'com_jwhmcs' 1.5.0 - Local File Inclusion
Joomla! Component 'com_jukebox' 1.7 - Local File Inclusion
Joomla! Component 'com_Joomlaflickr' 1.0 - Local File Inclusion
Joomla! Component 'com_hsconfig' 1.5 - Local File Inclusion
Joomla! Component 'com_fabrik' 2.0 - Local File Inclusion
Joomla! Component 'com_datafeeds' 880 - Local File Inclusion
Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion
Joomla! Component Juke Box 1.7 - Local File Inclusion
Joomla! Component Joomla Flickr 1.0 - Local File Inclusion
Joomla! Component Highslide 1.5 - Local File Inclusion
Joomla! Component Fabrik 2.0 - Local File Inclusion
Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion
Joomla! Component 'com_foobla_suggestions' 1.5.1.2 - Local File Inclusion
Joomla! Component 'com_javoice' - Local File Inclusion
Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion
Joomla! Component JA Voice 2.0 - Local File Inclusion
Joomla! Component 'com_jfeedback' - Local File Inclusion
Joomla! Component 'com_jprojectmanager' - Local File Inclusion
Joomla! Component Jfeedback 1.2 - Local File Inclusion
Joomla! Component JProject Manager 1.0 - Local File Inclusion

Joomla! Component 'com_mv_restaurantmenumanager' 1.5.2 - SQL Injection
Joomla! Component Multi-Venue Restaurant Menu Manager 1.5.2 - SQL Injection

Joomla! Component 'com_horoscope' - Local File Inclusion
Joomla! Component Horoscope 1.5.0 - Local File Inclusion

Joomla! Component 'com_market' - Local File Inclusion
Joomla! Component Online Market 2.x - Local File Inclusion
Joomla! Component 'com_jvehicles' - 'aid' Parameter SQL Injection
Joomla! Component 'com_jp_jobs' 1.2.0 - 'id' Parameter SQL Injection
Joomla! Component Jvehicles 1.0/2.0 - 'aid' Parameter SQL Injection
Joomla! Component JP Jobs 1.2.0 - 'id' Parameter SQL Injection
Joomla! Component 'com_mtfireeagle' - Local File Inclusion
Joomla! Component 'com_mediamall' - Blind SQL Injection
Joomla! Component 'com_lovefactory' - Local File Inclusion
Joomla! Component 'com_jacomment' - Local File Inclusion
Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion
Joomla! Component Media Mall Factory 1.0.4 - Blind SQL Injection
Joomla! Component Love Factory 1.3.4 - Local File Inclusion
Joomla! Component JA Comment - Local File Inclusion

Joomla! Component 'com_iproperty' 1.5.3 - 'id' Parameter SQL Injection
Joomla! Component Intellectual Property 1.5.3 - 'id' Parameter SQL Injection

Joomla! Component 'com_joltcard' - SQL Injection
Joomla! Component JoltCard 1.2.1 - SQL Injection
Joomla! Component 'com_gadgetfactory' - Local File Inclusion
Joomla! Component 'com_matamko' - Local File Inclusion
Joomla! Component 'com_multiroot' - Local File Inclusion
Joomla! Component 'com_multimap' - Local File Inclusion
Joomla! Component 'com_drawroot' - Local File Inclusion
Joomla! Component Gadget Factory 1.0.0 - Local File Inclusion
Joomla! Component Matamko 1.01 - Local File Inclusion
Joomla! Component iNetLanka Multiple root 1.0 - Local File Inclusion
Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusion
Joomla! Component iNetLanka Contact Us Draw Root Map 1.1 - Local File Inclusion

Joomla! Component 'com_if_surfalert' - Local File Inclusion
Joomla! Component iF surfALERT 1.2 - Local File Inclusion

Joomla! Component 'com_gbufacebook' 1.0.5 - SQL Injection
Joomla! Component GBU Facebook 1.0.5 - SQL Injection
Joomla! Component 'com_jnewspaper' - 'cid' Parameter SQL Injection
Joomla! Component 'com_jtm' 1.9 Beta - SQL Injection
Joomla! Component Online News Paper Manager 1.0 - 'cid' Parameter SQL Injection
Joomla! Component JTM Reseller 1.9 Beta - SQL Injection

Joomla! Component 'com_mmsblog' - Local File Inclusion
Joomla! Component MMS Blog 2.3.0 - Local File Inclusion

Joomla! Component 'com_noticeboard' - Local File Inclusion
Joomla! Component NoticeBoard 1.3 - Local File Inclusion

Joomla! Component 'com_graphics' 1.0.6 - Local File Inclusion
Joomla! Component Graphics 1.0.6 - Local File Inclusion

Joomla! Component 'com_newsfeeds' - SQL Injection
Joomla! Component Newsfeeds - SQL Injection

Joomla! Component 'com_konsultasi' - 'sid' Parameter SQL Injection
Joomla! Component Komento 1.0.0 - 'sid' Parameter SQL Injection

Joomla! Component 'com_dioneformwizard' - Local File Inclusion
Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion

Joomla! Component 'com_jejob' 1.0 - Local File Inclusion
Joomla! Component JE Job 1.0 - Local File Inclusion

Joomla! Component 'com_jequoteform' - Local File Inclusion
Joomla! Component JE Quotation Form 1.0b1 - Local File Inclusion

Joomla! Component 'com_mscomment' 0.8.0b - Local File Inclusion
Joomla! Component MS Comment 0.8.0b - Local File Inclusion

Apache Axis2 Administration console - Authenticated Cross-Site Scripting
Apache Axis2 Administration Console - Authenticated Cross-Site Scripting

Joomla! Component 'com_mycar' - Multiple Vulnerabilities
Joomla! Component My Car 1.0 - Multiple Vulnerabilities

Joomla! Component 'com_jejob' 1.0 - 'catid' Parameter SQL Injection
Joomla! Component JE Job 1.0 - 'catid' Parameter SQL Injection

Joomla! Component 'com_jsjobs' - SQL Injection
Joomla! Component JS Jobs 1.0.5.8 - SQL Injection

Joomla! Component 'com_djartgallery' - Multiple Vulnerabilities
Joomla! Component DJ-ArtGallery 0.9.1 - Multiple Vulnerabilities

Joomla! Component 'com_gamesbox' 1.0.2 - 'id' SQL Injection
Joomla! Component Gamesbox 1.0.2 - 'id' Parameter SQL Injection

Joomla! Component 'com_eventcal' 1.6.4 - Blind SQL Injection
Joomla! Component eventCal 1.6.4 - Blind SQL Injection

Joomla! Component 'com_ninjamonials' - Blind SQL Injection
Joomla! Component NinjaMonials - Blind SQL Injection

Joomla! Component 'com_neorecruit' - 'Itemid' Parameter Blind SQL Injection
Joomla! Component NeoRecruit 1.6.4 - 'Itemid' Parameter Blind SQL Injection
Joomla! Component 'com_golfcourseguide' 0.9.6.0 - SQL Injection
Joomla! Component 'com_huruhelpdesk' - SQL Injection
Joomla! Component Golf Course Guide 0.9.6.0 - SQL Injection
Joomla! Component Huru Helpdesk - SQL Injection

Joomla! Component 'com_joomdle' 0.24 - SQL Injection
Joomla! Component Joomdle 0.24 - SQL Injection

Joomla! Component 'com_Joomla-visites' - Remote File Inclusion
Joomla! Component Visites 1.1 RC2 - Remote File Inclusion

Joomla! Component 'com_jefaqpro' - Multiple Blind SQL Injection
Joomla! Component JE FAQ Pro 1.5.0 - Multiple Blind SQL Injection

Joomla! Component 'com_magazine' 3.0.1 - Remote File Inclusion
Joomla! Component iJoomla Magazine 3.0.1 - Remote File Inclusion

Joomla! Component 'com_gantry' 3.0.10 - Blind SQL Injection
Joomla! Component Gantry 3.0.10 - Blind SQL Injection

Joomla! Component 'com_jphone' - Local File Inclusion
Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion

Joomla! Component 'com_jgen' - SQL Injection
Joomla! Component JGen 0.9.33 - SQL Injection

Joomla! Component 'com_ezautos' - SQL Injection
Joomla! Component Joostina - SQL Injection

Joomla! Component 'com_jeguestbook' 1.0 - Multiple Vulnerabilities
Joomla! Component JE Guestbook 1.0 - Multiple Vulnerabilities

Joomla! Component 'com_jedirectory' - SQL Injection
Joomla! Component JE Directory 1.0 - SQL Injection

Joomla! Component 'com_jscalendar' 1.5.1 - Multiple Vulnerabilities
Joomla! Component JS Calendar 1.5.1 - Multiple Vulnerabilities

Joomla! Component 'com_jeajaxeventcalendar' - SQL Injection
Joomla! Component JE Ajax Event Calendar - SQL Injection

Joomla! Component 'com_flipwall' - SQL Injection
Joomla! Component Pulse Infotech Flip Wall - SQL Injection

Joomla! Component 'com_jquarks4s' 1.0.0 - Blind SQL Injection
Joomla! Component JQuarks4s 1.0.0 - Blind SQL Injection
Joomla! Component 'com_jsupport' - Cross-Site Scripting
Joomla! Component 'com_jsupport' - SQL Injection
Joomla! Component JSupport 1.5.6 - Cross-Site Scripting
Joomla! Component JSupport 1.5.6 - SQL Injection

Joomla! Component 'com_jimtawl' - Local File Inclusion
Joomla! Component Jimtawl 1.0.2 - Local File Inclusion

phpMyAdmin - Client Side Code Injection / Redirect Link Falsification
phpMyAdmin - Client-Side Code Injection / Redirect Link Falsification

Joomla! Component 'com_jeauto' 1.0 - SQL Injection
Joomla! Component JE Auto 1.0 - SQL Injection

Joomla! Component 'com_jradio' - Local File Inclusion
Joomla! Component JRadio - Local File Inclusion

Joomla! Component 'com_jotloader' 2.2.1 - Local File Inclusion
Joomla! Component JotLoader 2.2.1 - Local File Inclusion

Joomla! Component 'com_hmcommunity' - Multiple Vulnerabilities
Joomla! Component HM Community - Multiple Vulnerabilities

Joomla! Component 'com_estateagent' - SQL Injection
Joomla! Component Estate Agent - SQL Injection

EPortfolio 1.0 - Client Side Input Validation
EPortfolio 1.0 - Client-Side Input Validation

ActiveWeb Contentserver 5.6.2929 CMS - Client Side Filtering Bypass
ActiveWeb Contentserver 5.6.2929 CMS - Client-Side Filtering Bypass
Joomla! Component 'com_komento' 1.7.2 - Persistent Cross-Site Scripting
Joomla! Component 'com_jvcomment' 3.0.2 - 'id' Parameter SQL Injection
Joomla! Component Komento 1.7.2 - Persistent Cross-Site Scripting
Joomla! Component JV Comment 3.0.2 - 'id' Parameter SQL Injection

Joomla! Component 'com_jcomments' 2.1 - 'ComntrNam' Parameter Cross-Site Scripting
Joomla! Component JComments 2.1 - 'ComntrNam' Parameter Cross-Site Scripting

Joomla! Component 'com_clubmanager' - 'cm_id' Parameter SQL Injection
Joomla! Component Club Manager - 'cm_id' Parameter SQL Injection

Joomla! Component 'com_jstore' - 'Controller' Parameter Local File Inclusion
Joomla! Component Jstore - 'Controller' Parameter Local File Inclusion

Joomla! Component 'com_ecommercewd' 1.2.5 - SQL Injection
Joomla! Component ECommerce-WD 1.2.5 - SQL Injection

Joomla! Component 'com_contactformmaker' 1.0.1 - SQL Injection
Joomla! Component Contact Form Maker 1.0.1 - SQL Injection

Joomla! Component 'com_kp' - 'Controller' Parameter Local File Inclusion
Joomla! Component com_kp - 'Controller' Parameter Local File Inclusion

Joomla! Component 'com_helpdeskpro' < 1.4.0 - Multiple Vulnerabilities
Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities
Wordpress Plugin WP Support Plus Responsive Ticket System 7.1.3 - SQL Injection
Wordpress Plugin WP Private Messages 1.0.1 - SQL Injection
WordPress Plugin 404 Redirection Manager 1.0 - SQL Injection
ntop-ng 2.5.160805 - Username  Enumeration
 2016-12-20 05:01:16 +00:00
Offensive Security
18d8085c6d DB: 2016-12-18 
13 new exploits

Microsoft Internet Explorer 9 MSHTML - CMarkup::Reload­In­Compat­View Use-After-Free
Microsoft Internet Explorer 9 IEFRAME - CMarkup::Remove­Pointer­Pos Use-After-Free (MS13-055)
Orthanc DICOM Server 1.1.0 - Memory Corruption
Microsoft Internet Explorer 9 - MSHTML CMarkup::Reload­In­Compat­View Use-After-Free
Microsoft Internet Explorer 9 - IEFRAME CMarkup::Remove­Pointer­Pos Use-After-Free (MS13-055)
OsiriX DICOM Viewer 8.0.1 - Memory Corruption
ConQuest DICOM Server 1.4.17d - Stack Buffer Overflow
DCMTK 3.6.0 storescp - Stack Buffer Overflow
Horos 2.1.0 DICOM Medical Image Viewer - Denial of Service
Microsoft Internet Explorer 9 IEFRAME - CMarkup­Pointer::Move­To­Gap Use-After-Free
Microsoft Internet Explorer 9 IEFRAME - CView::Ensure­Size Use-After-Free (MS13-021)

Nagios < 4.2.4 - Privilege Escalation
iOS 10.1.1 / macOS 10.12 16A323 XNU Kernel - set_dp_control_port Lack of Locking Use-After-Free

Alienvault OSSIM - SQL Injection / Remote Code Execution (Metasploit)
Alienvault Open Source SIEM (OSSIM) - SQL Injection / Remote Code Execution (Metasploit)

Alienvault OSSIM < 4.7.0 - av-centerd 'get_log_line()' Remote Code Execution
Alienvault Open Source SIEM (OSSIM) < 4.7.0 - av-centerd 'get_log_line()' Remote Code Execution

Alienvault OSSIM - av-centerd Command Injection (Metasploit)
Alienvault Open Source SIEM (OSSIM) - av-centerd Command Injection (Metasploit)

Horos 2.1.0 Web Portal - Directory Traversal

Linux/x86 - /bin/bash -c Arbitrary Command Execution Shellcode (72 bytes)

Alienvault OSSIM Open Source SIEM 3.1 - Multiple Security Vulnerabilities
Alienvault Open Source SIEM (OSSIM) 3.1 - Multiple Security Vulnerabilities

Alienvault OSSIM Open Source SIEM 3.1 - Reflected Cross-Site Scripting / Blind SQL Injection
Alienvault Open Source SIEM (OSSIM) 3.1 - Reflected Cross-Site Scripting / Blind SQL Injection

Alienvault OSSIM 4.1.2 - Multiple SQL Injections
Alienvault Open Source SIEM (OSSIM) 4.1.2 - Multiple SQL Injections

Alienvault OSSIM Open Source SIEM 4.1 - Multiple SQL Vulnerabilities
Alienvault Open Source SIEM (OSSIM) 4.1 - Multiple SQL Vulnerabilities

Alienvault 4.3.1 - Unauthenticated SQL Injection
Alienvault 4.3.1 - Unauthenticated SQL Injection / Cross-Site Scripting

Alienvault OSSIM 4.6.1 - Authenticated SQL Injection (Metasploit)
Alienvault Open Source SIEM (OSSIM) 4.6.1 - Authenticated SQL Injection (Metasploit)

Alienvault OSSIM 4.3 - Cross-Site Request Forgery
Alienvault Open Source SIEM (OSSIM) 4.3 - Cross-Site Request Forgery
WHMCS Addon VMPanel 2.7.4 - SQL Injection
WordPress Plugin Quiz And Survey Master 4.5.4 / 4.7.8 - Cross-Site Request Forgery
 2016-12-18 05:01:16 +00:00
Offensive Security
24bf161ca6 DB: 2016-12-16 
5 new exploits

HydraIrc 0.3.164 - (last) Remote Denial of Service
Download Accelerator Plus - DAP 8.6 (AniGIF.ocx) Buffer Overflow (PoC)
HydraIrc 0.3.164 - Remote Denial of Service
Download Accelerator Plus DAP 8.6 - 'AniGIF.ocx' Buffer Overflow (PoC)
Microsoft Internet Explorer 9 MSHTML - CMarkup::Reload­In­Compat­View Use-After-Free
Microsoft Internet Explorer 9 IEFRAME - CMarkup::Remove­Pointer­Pos Use-After-Free (MS13-055)

Nidesoft MP3 Converter 2.6.18 - SEH Local Buffer Overflow

Nagios Core < 4.2.4 - Privilege Escalation

Nagios Core < 4.2.2 - Curl Command Injection / Remote Code Execution

Quicksilver Forums 1.2.1 - (set) Remote File Inclusion
Quicksilver Forums 1.2.1 - Remote File Inclusion

e-Vision CMS 2.0 - (all_users.php) SQL Injection
e-Vision CMS 2.0 - 'all_users.php' SQL Injection

LetterIt 2.0 - (inc/session.php) Remote File Inclusion
LetterIt 2.0 - 'session.php' Remote File Inclusion

e107 0.7.8 - (mailout.php) Access Escalation Exploit (Admin needed)
e107 0.7.8 - 'mailout.php' Access Escalation Exploit (Admin needed)

PHPMyRealty 1.0.x - (search.php type) SQL Injection
PHPMyRealty 1.0.x - 'search.php' SQL Injection

pligg 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection
Pligg 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection
LetterIt 2 - 'Language' Local File Inclusion
phpMyRealty - (location) SQL Injection
LetterIt 2 - 'Language' Parameter Local File Inclusion
phpMyRealty 2.0.0 - 'location' Parameter SQL Injection
ABG Blocking Script 1.0a - 'abg_path' Remote File Inclusion
E-topbiz Dating 3 PHP Script - (mail_id) SQL Injection
Scripts24 iTGP 1.0.4 - 'id' SQL Injection
Scripts24 iPost 1.0.1 - 'id' SQL Injection
eStoreAff 0.1 - 'cid' SQL Injection
GreenCart PHP Shopping Cart - 'id' SQL Injection
ABG Blocking Script 1.0a - 'abg_path' Parameter Remote File Inclusion
E-topbiz Dating 3 PHP Script - 'mail_id' Parameter SQL Injection
Scripts24 iTGP 1.0.4 - 'id' Parameter SQL Injection
Scripts24 iPost 1.0.1 - 'id' Parameter SQL Injection
eStoreAff 0.1 - 'cid' Parameter SQL Injection
GreenCart PHP Shopping Cart - 'id' Parameter SQL Injection

e-vision CMS 2.02 - (SQL Injection / Arbitrary File Upload / Information Gathering) Multiple Vulnerabilities
e-vision CMS 2.02 - SQL Injection / Arbitrary File Upload / Information Gathering

E-Store Kit-1 <= 2 PayPal Edition - 'pid' SQL Injection
E-Store Kit-1 <= 2 PayPal Edition - 'pid' Parameter SQL Injection

iges CMS 2.0 - (Cross-Site Scripting / SQL Injection) Multiple Vulnerabilities
iges CMS 2.0 - Cross-Site Scripting / SQL Injection

Multiple Wsn Products - (Local File Inclusion) Code Execution
Multiple Wsn Products - Local File Inclusion / Code Execution
Discuz! 6.0.1 - (searchid) SQL Injection
pPIM 1.0 - (Arbitrary File Delete / Cross-Site Scripting) Multiple Vulnerabilities
Discuz! 6.0.1 - 'searchid' Parameter SQL Injection
pPIM 1.0 - Arbitrary File Delete / Cross-Site Scripting
Vacation Rental Script 3.0 - 'id' SQL Injection
Quicksilver Forums 1.4.1 - forums[] SQL Injection
txtSQL 2.2 Final - (startup.php) Remote File Inclusion
Vacation Rental Script 3.0 - 'id' Parameter SQL Injection
Quicksilver Forums 1.4.1 - SQL Injection
txtSQL 2.2 Final - 'startup.php' Remote File Inclusion
OpenImpro 1.1 - (image.php id) SQL Injection
ZeeBuddy 2.1 - (bannerclick.php adid) SQL Injection
pPIM 1.0 - (upload/change Password) Multiple Vulnerabilities
Ovidentia 6.6.5 - (item) SQL Injection
BBlog 0.7.6 - (mod) SQL Injection
OpenImpro 1.1 - 'image.php' SQL Injection
ZeeBuddy 2.1 - 'adid' Parameter SQL Injection
pPIM 1.0 - upload/change Password
Ovidentia 6.6.5 - 'item' Parameter SQL Injection
BBlog 0.7.6 - 'mod' Parameter SQL Injection

pPIM 1.01 - (notes.php id) Local File Inclusion
pPIM 1.01 - 'notes.php' Local File Inclusion

e107 plugin fm pro 1 - (File Disclosure / Arbitrary File Upload / Directory Traversal) Multiple Vulnerabilities
e107 plugin fm pro 1 - File Disclosure / Arbitrary File Upload / Directory Traversal

Coppermine Photo Gallery 1.4.19 - Remote Arbitrary .PHP File Upload
Coppermine Photo Gallery 1.4.19 - Remote File Upload

pPIM 1.01 - (notes.php id) Remote Command Execution
pPIM 1.01 - 'notes.php' Remote Command Execution

moziloCMS 1.11 - (Local File Inclusion / Full Path Disclosure / Cross-Site Scripting) Multiple Vulnerabilities
moziloCMS 1.11 - Local File Inclusion / Full Path Disclosure / Cross-Site Scripting

Joomla! Component 'com_agenda' 1.0.1 - 'id' Parameter SQL Injection
Joomla! Component Agenda Address Book 1.0.1 - 'id' Parameter SQL Injection

Joomla! Component 'com_alphauserpoints' 1.5.5 - Local File Inclusion
Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion

Joomla! Component 'com_arcadegames' - Local File Inclusion
Joomla! Component Arcade Games 1.0 - Local File Inclusion
Joomla! Component 'com_AddressBook' - Local File Inclusion
Joomla! Component 'com_advertising' - Local File Inclusion
Joomla! Component Address Book 1.5.0 - Local File Inclusion
Joomla! Component Advertising 0.25 - Local File Inclusion
Joomla! Component 'com_blogfactory' - Local File Inclusion
Joomla! Component 'com_beeheard' - Local File Inclusion
Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusion
Joomla! Component BeeHeard 1.0 - Local File Inclusion

Joomla! Component 'com_archeryscores' 1.0.6 - Local File Inclusion
Joomla! Component Archery Scores 1.0.6 - Local File Inclusion

Joomla! Component 'com_abc' - SQL Injection
Joomla! Component ABC 1.1.7 - SQL Injection

Joomla! Component 'com_bfquiztrial' - SQL Injection (1)
Joomla! Component BF Quiz 1.3.0 - SQL Injection (1)

Joomla! Component 'com_bfquiztrial' - SQL Injection (2)
Joomla! Component BF Quiz 1.0 - SQL Injection (2)

e107 0.7.21 full - (Remote File Inclusion / Cross-Site Scripting) Multiple Vulnerabilities
e107 0.7.21 full - Remote File Inclusion / Cross-Site Scripting

Joomla! Component 'com_awd_song' - Persistent Cross-Site Scripting
Joomla! Component JE Awd Song - Persistent Cross-Site Scripting

Joomla! Component 'com_addressbook' - Blind SQL Injection
Joomla! Component Address Book - Blind SQL Injection

Joomla! Component 'com_autartimonial' - SQL Injection
Joomla! Component AutarTimonial 1.0.8 - SQL Injection

Joomla! Component 'com_artforms' 2.1b7.2 rc2 - Multiple Vulnerabilities
Joomla! Component ArtForms 2.1b7.2 rc2 - Multiple Vulnerabilities

Joomla! Component 'com_camelcitydb2' 2.2 - SQL Injection
Joomla! Component CamelcityDB 2.2 - SQL Injection

Joomla! Component 'com_amblog' 1.0 - Multiple SQL Injections
Joomla! Component Amblog 1.0 - Multiple SQL Injections

Joomla! Component 'com_aardvertiser' 2.1 - Blind SQL Injection
Joomla! Component Aardvertiser 2.1 - Blind SQL Injection

Joomla! Component 'com_cbe' - Local File Inclusion / Remote Code Execution
Joomla! Component Community Builder Enhanced (CBE) 1.4.8/1.4.9/1.4.10 - Local File Inclusion / Remote Code Execution

Joomla! Component 'com_allcinevid' 1.0.0 - Blind SQL Injection
Joomla! Component allCineVid 1.0.0 - Blind SQL Injection

Joomla! Component 'com_alameda' 1.0 - SQL Injection
Joomla! Component Alameda 1.0 - SQL Injection

Free Hosting Manager 2.0 - (packages.php id Parameter) SQL Injection
Free Hosting Manager 2.0 - 'id' Parameter SQL Injection
Coppermine Photo Gallery 1.x - menu.inc.php CPG_URL Parameter Cross-Site Scripting
Coppermine Photo Gallery 1.x - modules.php startdir Parameter Traversal Arbitrary File Access
Coppermine Photo Gallery 1.x - init.inc.php Remote File Inclusion
Coppermine Photo Gallery 1.x - theme.php Multiple Parameter Remote File Inclusion
Coppermine Photo Gallery 1.2.2b - 'menu.inc.php' Cross-Site Scripting
Coppermine Photo Gallery 1.2.0 RC4 - 'startdir' Parameter Traversal Arbitrary File Access
Coppermine Photo Gallery 1.2.0 RC4 - 'init.inc.php' Remote File Inclusion
Coppermine Photo Gallery 1.2.2b - 'theme.php' Remote File Inclusion

BBlog 0.7.4 - PostID Parameter SQL Injection
BBlog 0.7.4 - 'PostID' Parameter SQL Injection

Coppermine Photo Gallery 1.x - Albmgr.php SQL Injection
Coppermine Photo Gallery 1.4.11 - SQL Injection
LoveCMS 1.4 - install/index.php step Parameter Remote File Inclusion
LoveCMS 1.4 - install/index.php step Parameter Traversal Arbitrary File Access
LoveCMS 1.4 - 'index.php' load Parameter Traversal Arbitrary File Access
LoveCMS 1.4 - 'index.php' id Parameter Cross-Site Scripting
LoveCMS 1.4 - 'step' Parameter Remote File Inclusion
LoveCMS 1.4 - 'step' Parameter Traversal Arbitrary File Access
LoveCMS 1.4 - 'load' Parameter Traversal Arbitrary File Access
LoveCMS 1.4 - 'id' Parameter Cross-Site Scripting
Coppermine Photo Gallery 1.4.x - mode.php referer Parameter Cross-Site Scripting
Coppermine Photo Gallery 1.4.x - viewlog.php log Parameter Local File Inclusion
Coppermine Photo Gallery 1.4.12 - 'referer' Parameter Cross-Site Scripting
Coppermine Photo Gallery 1.4.12 - 'log' Parameter Local File Inclusion

Joomla! / Mambo Component 'com_detail' - 'id' Parameter SQL Injection
Joomla! / Mambo Component com_detail - 'id' Parameter SQL Injection

Joomla! / Mambo Component 'com_lms' - 'cat' Parameter SQL Injection
Joomla! / Mambo Component Showroom Joomlearn LMS - 'cat' Parameter SQL Injection
Blog Manager - inc_webblogmanager.asp ItemID Parameter SQL Injection
Blog Manager - inc_webblogmanager.asp categoryId Parameter Cross-Site Scripting
Blog Manager - 'ItemID' Parameter SQL Injection
Blog Manager - 'categoryId' Parameter Cross-Site Scripting

e107 0.7.x - (CAPTCHA Security Bypass / Cross-Site Scripting) Multiple Vulnerabilities
e107 0.7.x - CAPTCHA Security Bypass / Cross-Site Scripting

Joomla! Component 'com_canteen' 1.0 - Local File Inclusion
Joomla! Component Canteen 1.0 - Local File Inclusion
Coppermine Photo Gallery 1.5.10 - help.php Multiple Parameter Cross-Site Scripting
Coppermine Photo Gallery 1.5.10 - searchnew.php picfile_* Parameter Cross-Site Scripting
Coppermine Photo Gallery 1.5.10 - 'help.php' Cross-Site Scripting
Coppermine Photo Gallery 1.5.10 - 'searchnew.php' Cross-Site Scripting
 2016-12-16 05:01:19 +00:00
Offensive Security
32e86030d5 DB: 2016-12-15 
3 new exploits

minix 3.1.2a - tty panic Local Denial of Service
minix 3.1.2a - tty panic Remote Denial of Service
Minix 3.1.2a - tty panic Local Denial of Service
Minix 3.1.2a - tty panic Remote Denial of Service

Microsoft IIS 5.0 - WebDav Lock Method Memory Leak Denial of Service
Microsoft IIS 5.0 - WebDAV Lock Method Memory Leak Denial of Service

MINIX 3.3.0 - Local Denial of Service (PoC)
Minix 3.3.0 - Local Denial of Service (PoC)

MINIX 3.3.0 - Remote TCP/IP Stack Denial of Service
Minix 3.3.0 - Remote TCP/IP Stack Denial of Service

Apache 2.4.23 (mod_http2) - Denial of Service

Adobe Animate 15.2.1.95 - Memory Corruption

CoolPlayer - m3u File Local Buffer Overflow
CoolPlayer 2.18 - '.m3u' File Local Buffer Overflow

Microsoft Windows 7 SP1 - 'mrxdav.sys' WebDav Privilege Escalation (MS16-016) (Metasploit)
Microsoft Windows 7 SP1 - 'mrxdav.sys' WebDAV Privilege Escalation (MS16-016) (Metasploit)

Apache Tomcat (WebDAV) - Remote File Disclosure
Apache Tomcat - (WebDAV) Remote File Disclosure

Apache Tomcat (WebDAV) - Remote File Disclosure (SSL)
Apache Tomcat - (WebDAV) Remote File Disclosure (SSL)

APT - Repository Signing Bypass via Memory Allocation Failure

PHPFootball 1.6 - (show.php) Remote Database Disclosure
PHPFootball 1.6 - Remote Database Disclosure

Aprox CMS Engine 5 (1.0.4) - Local File Inclusion
Aprox CMS Engine 5.1.0.4 - Local File Inclusion

PHP Help Agent 1.1 - (content) Local File Inclusion
PHP Help Agent 1.1 - 'content' Parameter Local File Inclusion

Alstrasoft Affiliate Network Pro - (pgm) SQL Injection
Alstrasoft Affiliate Network Pro - 'pgm' Parameter SQL Injection
PHPHoo3 <= 5.2.6 - (PHPHoo3.php viewCat) SQL Injection
Alstrasoft Video Share Enterprise 4.5.1 - (UID) SQL Injection
PHPHoo3 <= 5.2.6 - 'viewCat' Parameter SQL Injection
Alstrasoft Video Share Enterprise 4.5.1 - 'UID' Parameter SQL Injection
Arctic Issue Tracker 2.0.0 - (index.php filter) SQL Injection
Aprox CMS Engine 5.(1.0.4) - 'index.php' SQL Injection
Siteframe - 'folder.php id' SQL Injection
PHPFootball 1.6 - (show.php) SQL Injection
DigiLeave 1.2 - (info_book.asp book_id) Blind SQL Injection
HRS Multi - 'picture_pic_bv.asp key' Blind SQL Injection
Arctic Issue Tracker 2.0.0 - 'filter' Parameter SQL Injection
Aprox CMS Engine 5.1.0.4 - 'index.php' SQL Injection
Siteframe CMS 3.2.3 - 'folder.php' SQL Injection
PHPFootball 1.6 - SQL Injection
DigiLeave 1.2 - 'book_id' Parameter Blind SQL Injection
HRS Multi - 'key' Parameter Blind SQL Injection
MojoPersonals - 'mojoClassified.cgi mojo' Blind SQL Injection
MojoJobs - 'mojoJobs.cgi mojo' Blind SQL Injection
MojoAuto - 'mojoAuto.cgi mojo' Blind SQL Injection
EZWebAlbum (dlfilename) - Remote File Disclosure
Arctic Issue Tracker 2.0.0 - (index.php filter) SQL Injection
ShopCartDx 4.30 - 'pid' SQL Injection
MojoPersonals - Blind SQL Injection
MojoJobs - Blind SQL Injection
MojoAuto - Blind SQL Injection
EZWebAlbum - Remote File Disclosure
Arctic Issue Tracker 2.0.0 - 'filter' Parameter SQL Injection
ShopCartDx 4.30 - 'pid' Parameter SQL Injection
YouTube blog 0.1 - (Remote File Inclusion / SQL Injection / Cross-Site Scripting) Multiple Vulnerabilities
Pre Survey Poll - 'default.asp catid' SQL Injection
Atom Photoblog 1.1.5b1 - (photoId) SQL Injection
ibase 2.03 - 'download.php' Remote File Disclosure
YouTube blog 0.1 - Remote File Inclusion / SQL Injection / Cross-Site Scripting
Pre Survey Poll - 'catid' Parameter SQL Injection
Atom Photoblog 1.1.5b1 - 'photoId' Parameter SQL Injection
ibase 2.03 - Remote File Disclosure
Live Music Plus 1.1.0 - 'id' SQL Injection
xrms 1.99.2 - (Remote File Inclusion / Cross-Site Scripting / Information Gathering) Multiple Vulnerabilities
Live Music Plus 1.1.0 - 'id' Parameter SQL Injection
XRms 1.99.2 - Remote File Inclusion / Cross-Site Scripting / Information Gathering
FizzMedia 1.51.2 - (comment.php mid) SQL Injection
PHPTest 0.6.3 - (picture.php image_id) SQL Injection
FizzMedia 1.51.2 - SQL Injection
PHPTest 0.6.3 - SQL Injection
Mobius 1.4.4.1 - (browse.php id) SQL Injection
EPShop < 3.0 - 'pid' SQL Injection
Mobius 1.4.4.1 - SQL Injection
EPShop < 3.0 - 'pid' Parameter SQL Injection
TriO 2.1 - (browse.php id) SQL Injection
CMScout 2.05 - (common.php bit) Local File Inclusion
Getacoder clone - (sb_protype) SQL Injection
GC Auction Platinum - (cate_id) SQL Injection
SiteAdmin CMS - (art) SQL Injection
TriO 2.1 - 'browse.php' SQL Injection
CMScout 2.05 - 'bit' Parameter Local File Inclusion
Getacoder clone - 'sb_protype' Parameter SQL Injection
GC Auction Platinum - 'cate_id' Parameter SQL Injection
SiteAdmin CMS - 'art' Parameter SQL Injection

Youtuber Clone - 'ugroups.php UID' SQL Injection
Youtuber Clone - SQL Injection

PixelPost 1.7.1 - (language_full) Local File Inclusion
PixelPost 1.7.1 - 'language_full' Parameter Local File Inclusion
ViArt Shop 3.5 - (category_id) SQL Injection
Minishowcase 09b136 - 'lang' Local File Inclusion
ViArt Shop 3.5 - 'category_id' Parameter SQL Injection
Minishowcase 09b136 - 'lang' Parameter Local File Inclusion
Gregarius 0.5.4 - rsargs[] SQL Injection
PHP Hosting Directory 2.0 - (admin.php rd) Remote File Inclusion
HIOX Random Ad 1.3 - (hioxRandomAd.php hm) Remote File Inclusion
hiox browser Statistics 2.0 - Remote File Inclusion
Gregarius 0.5.4 - SQL Injection
PHP Hosting Directory 2.0 - Remote File Inclusion
HIOX Random Ad 1.3 - Remote File Inclusion
HIOX Browser Statistics 2.0 - Remote File Inclusion
nzFotolog 0.4.1 - (action_file) Local File Inclusion
ZeeReviews - 'comments.php ItemID' SQL Injection
nzFotolog 0.4.1 - 'action_file' Parameter Local File Inclusion
ZeeReviews - SQL Injection

Article Friendly Pro/Standard - (Cat) SQL Injection
Article Friendly Pro/Standard - SQL Injection
PozScripts Classified Ads Script - 'cid' SQL Injection
TubeGuru Video Sharing Script - (UID) SQL Injection
PozScripts Classified Ads Script - 'cid' Parameter SQL Injection
TubeGuru Video Sharing Script - 'UID' Parameter SQL Injection

pligg 9.9.0 - (Cross-Site Scripting / Local File Inclusion / SQL Injection) Multiple Vulnerabilities
pligg 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection

camera life 2.6.2b4 - (SQL Injection / Cross-Site Scripting) Multiple Vulnerabilities
camera Life 2.6.2b4 - SQL Injection / Cross-Site Scripting

Alstrasoft Article Manager Pro - (Authentication Bypass) SQL Injection
Alstrasoft Article Manager Pro 1.6 - Authentication Bypass

viart shopping cart 3.5 - Multiple Vulnerabilities
Viart shopping cart 3.5 - Multiple Vulnerabilities

PHPFootball 1.6 - (filter.php) Remote Hash Disclosure
PHPFootball 1.6 - Remote Hash Disclosure
talkback 2.3.14 - Multiple Vulnerabilities
Siteframe CMS 3.2.x - (SQL Injection / phpinfo()) Multiple Vulnerabilities
TalkBack 2.3.14 - Multiple Vulnerabilities
Siteframe CMS 3.2.x - SQL Injection / phpinfo()

CMScout - (Cross-Site Scripting / HTML Injection) Multiple Vulnerabilities
CMScout - Cross-Site Scripting / HTML Injection

ShopCartDx 4.30 - (products.php) Blind SQL Injection
ShopCartDx 4.30 - 'products.php' Blind SQL Injection

viart shop 4.0.5 - Multiple Vulnerabilities
ViArt Shop 4.0.5 - Multiple Vulnerabilities

Siteframe 3.2.3 - (user.php) SQL Injection
Siteframe CMS 3.2.3 - 'user.php' SQL Injection

viart shop 4.0.5 - Cross-Site Request Forgery
ViArt Shop 4.0.5 - Cross-Site Request Forgery

Siteframe 2.2.4 - search.php Cross-Site Scripting

Siteframe 2.2.4 - download.php Information Disclosure
Siteframe CMS 2.2.4 - 'download.php' Information Disclosure

phpx 3.2.3 - Multiple Vulnerabilities
PHPX 3.2.3 - Multiple Vulnerabilities
PHPX 3.x - admin/page.php Cross-Site Request Forgery / Arbitrary Command Execution
PHPX 3.x - admin/news.php Cross-Site Request Forgery / Arbitrary Command Execution
PHPX 3.x - admin/user.php Cross-Site Request Forgery / Arbitrary Command Execution
PHPX 3.x - admin/images.php Cross-Site Request Forgery / Arbitrary Command Execution
PHPX 3.x - admin/forums.php Cross-Site Request Forgery / Arbitrary Command Execution
PHPX 3.x - 'page.php' Cross-Site Request Forgery / Arbitrary Command Execution
PHPX 3.x - 'news.php' Cross-Site Request Forgery / Arbitrary Command Execution
PHPX 3.x - 'user.php' Cross-Site Request Forgery / Arbitrary Command Execution
PHPX 3.x - 'images.php' Cross-Site Request Forgery / Arbitrary Command Execution
PHPX 3.x - 'forums.php' Cross-Site Request Forgery / Arbitrary Command Execution

Alstrasoft Video Share Enterprise 4.x - MyajaxPHP.php Remote File Inclusion
Alstrasoft Video Share Enterprise 4.x - 'MyajaxPHP.php' Remote File Inclusion
Alstrasoft Affiliate Network Pro 8.0 - merchants/index.php Multiple Parameter Cross-Site Scripting
Alstrasoft Affiliate Network Pro 8.0 - merchants/temp.php rowid Parameter Cross-Site Scripting
Alstrasoft Affiliate Network Pro 8.0 - merchants/index.php uploadProducts Action pgmid Parameter SQL Injection
Alstrasoft Affiliate Network Pro 8.0 - 'index.php' Cross-Site Scripting
Alstrasoft Affiliate Network Pro 8.0 - 'temp.php' Cross-Site Scripting
Alstrasoft Affiliate Network Pro 8.0 - 'pgmid' Parameter SQL Injection
PHPX 3.5.15/3.5.16 - print.php news_id Parameter SQL Injection
PHPX 3.5.15/3.5.16 - forums.php Multiple Parameter SQL Injection
PHPX 3.5.15/3.5.16 - users.php user_id Parameter SQL Injection
PHPX 3.5.15/3.5.16 - news.php Multiple Parameter SQL Injection
PHPX 3.5.15/3.5.16 - gallery.php Multiple Parameter SQL Injection
PHPX 3.5.15/3.5.16 - 'print.php' SQL Injection
PHPX 3.5.15/3.5.16 - 'forums.php' SQL Injection
PHPX 3.5.15/3.5.16 - 'users.php' SQL Injection
PHPX 3.5.15/3.5.16 - 'news.php' SQL Injection
PHPX 3.5.15/3.5.16 - 'gallery.php' SQL Injection
XRms 1.99.2 - activities/some.php title Parameter Cross-Site Scripting
XRms 1.99.2 - companies/some.php company_name Parameter Cross-Site Scripting
XRms 1.99.2 - contacts/some.php last_name Parameter Cross-Site Scripting
XRms 1.99.2 - campaigns/some.php campaign_title Parameter Cross-Site Scripting
XRms 1.99.2 - opportunities/some.php opportunity_title Parameter Cross-Site Scripting
XRms 1.99.2 - cases/some.php case_title Parameter Cross-Site Scripting
XRms 1.99.2 - files/some.php file_id Parameter Cross-Site Scripting
XRms 1.99.2 - reports/custom/mileage.php starting Parameter Cross-Site Scripting
XRms 1.99.2 - 'title' Parameter Cross-Site Scripting
XRms 1.99.2 - 'company_name' Parameter Cross-Site Scripting
XRms 1.99.2 - 'last_name' Parameter Cross-Site Scripting
XRms 1.99.2 - 'campaign_title' Parameter Cross-Site Scripting
XRms 1.99.2 - 'opportunity_title' Parameter Cross-Site Scripting
XRms 1.99.2 - 'case_title' Parameter Cross-Site Scripting
XRms 1.99.2 - 'file_id' Parameter Cross-Site Scripting
XRms 1.99.2 - 'starting' Parameter Cross-Site Scripting

Pligg 1.0.4 - 'install1.php' Cross-Site Scripting

Joomla! Component DT Register - 'cat' SQL Injection
Joomla! Component DT Register - 'cat' Parameter SQL Injection
 2016-12-15 13:07:17 +00:00
Offensive Security
eddddf7aa8 DB: 2016-12-15 
5 new exploits

Microsoft Internet Explorer 9 IEFRAME - CSelection­Interact­Button­Behavior::_Update­Button­Location Use-After-Free (MS13-047)
Microsoft Internet Explorer 9 - IEFRAME CSelection­Interact­Button­Behavior::_Update­Button­Location Use-After-Free (MS13-047)

Poppler 0.10.3 - Multiple Denial of Service Vulnerabilities
Poppler 0.10.3 - Denial of Service

Samsung Devices KNOX Extensions - OTP Service Heap Overflow

Serva 3.0.0 HTTP Server - Denial of Service
Serva 3.0.0 - HTTP Server Denial of Service
TP-LINK TD-W8151N - Denial of Service
Samsung Devices KNOX Extensions - OTP TrustZone Trustlet Stack Buffer Overflow

CMailServer 5.4.6 - 'CMailCOM.dll' Remote Overwrite (SEH)
Youngzsoft CMailServer 5.4.6 - 'CMailCOM.dll' Remote Overwrite (SEH)
Trixbox - (langChoice) Local File Inclusion (connect-back) (2)
Trixbox 2.6.1 - (langChoice) Remote Code Execution (Python)
Fonality trixbox - 'langChoice' Parameter Local File Inclusion (connect-back) (2)
Fonality trixbox 2.6.1 - 'langChoice' Parameter Remote Code Execution (Python)
Youngzsoft 3.30/4.0 CMailServer - Buffer Overflow (1)
Youngzsoft 3.30/4.0 CMailServer - Buffer Overflow (2)
Youngzsoft CMailServer 3.30/4.0 - Buffer Overflow (1)
Youngzsoft CMailServer 3.30/4.0 - Buffer Overflow (2)

Joomla! Component 'com_contenthistory' - SQL Injection / Remote Code Execution (Metasploit)
Joomla! 3.4.4 Component Content History - SQL Injection / Remote Code Execution (Metasploit)

McAfee Virus Scan Enterprise for Linux - Remote Code Execution

BrewBlogger 1.3.1 - (printLog.php) SQL Injection
BrewBlogger 1.3.1 - 'printLog.php' SQL Injection

ContentNow 1.30 - (Local File Inclusion / Arbitrary File Upload / Delete) Multiple Vulnerabilities
ContentNow 1.30 - Local File Inclusion / Arbitrary File Upload/Delete

ContentNow 1.30 - (Arbitrary File Upload / Cross-Site Scripting) Multiple Vulnerabilities
ContentNow 1.30 - Arbitrary File Upload / Cross-Site Scripting

ContentNow 1.39 - (pageid) SQL Injection
ContentNow 1.39 - 'pageid' Parameter SQL Injection

Maian Recipe 1.0 - (path_to_folder) Remote File Inclusion
Maian Recipe 1.0 - 'path_to_folder' Parameter Remote File Inclusion

Sisplet CMS 05.10 - (site_path) Remote File Inclusion
Sisplet CMS 05.10 - 'site_path' Parameter Remote File Inclusion
Sisplet CMS - 'index.php id' 2008-01-24 SQL Injection
VanGogh Web CMS 0.9 - (article_ID) SQL Injection
Sisplet CMS 2008-01-24 - 'id' Parameter SQL Injection
VanGogh Web CMS 0.9 - 'article_ID' Parameter SQL Injection
Efestech Shop 2.0 - 'cat_id' SQL Injection
plx Ad Trader 3.2 - (adid) SQL Injection
Joomla! Component versioning 1.0.2 - 'id' SQL Injection
Joomla! Component mygallery - 'cid' SQL Injection
XchangeBoard 1.70 - (boardID) SQL Injection
CMS little 0.0.1 - (index.php template) Local File Inclusion
Joomla! Component com_brightweblinks - 'catid' SQL Injection
Efestech Shop 2.0 - 'cat_id' Parameter SQL Injection
plx Ad Trader 3.2 - 'adid' Parameter SQL Injection
Joomla! Component versioning 1.0.2 - 'id' Parameter SQL Injection
Joomla! Component mygallery - 'cid' Parameter SQL Injection
XchangeBoard 1.70 - 'boardID' Parameter SQL Injection
CMS little 0.0.1 - 'template' Parameter Local File Inclusion
Joomla! Component Brightcode Weblinks - 'catid' Parameter SQL Injection

phPortal 1.2 - Multiple Remote File Inclusions
PHPortal 1.2 - Multiple Remote File Inclusions
phpWebNews 0.2 MySQL Edition - (id_kat) SQL Injection
phpWebNews 0.2 MySQL Edition - (det) SQL Injection
pHNews CMS - Multiple Local File Inclusion
PHPwebnews 0.2 MySQL Edition - 'id_kat' Parameter SQL Injection
PHPwebnews 0.2 MySQL Edition - 'det' Parameter SQL Injection
pHNews CMS Alpha 1 - Local File Inclusion

Kasseler CMS 1.3.0 - (Local File Inclusion / Cross-Site Scripting) Multiple Vulnerabilities
Kasseler CMS 1.3.0 - Local File Inclusion / Cross-Site Scripting
XPOZE Pro 3.06 - 'uid' SQL Injection
ContentNow 1.4.1 - (Arbitrary File Upload / Cross-Site Scripting) Multiple Vulnerabilities
SmartPPC Pay Per Click Script - '&idDirectory=' Blind SQL Injection (1)
XPOZE Pro 3.06 - 'uid' Parameter SQL Injection
ContentNow 1.4.1 - Arbitrary File Upload / Cross-Site Scripting
SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (1)
Fuzzylime CMS 3.01a - (file) Local File Inclusion
Triton CMS Pro - (x-forwarded-for) Blind SQL Injection
Neutrino 0.8.4 Atomic Edition - Remote Code Execution
SmartPPC Pay Per Click Script - '&idDirectory=' Blind SQL Injection (2)
Fuzzylime CMS 3.01a - 'file' Parameter Local File Inclusion
Triton CMS Pro 1.06 - 'x-forwarded-for' Blind SQL Injection
QNX Neutrino 0.8.4 Atomic Edition - Remote Code Execution
SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (2)

Joomla! Component com_content 1.0.0 - 'itemID' SQL Injection
Joomla! Component Content 1.0.0 - 'itemID' Parameter SQL Injection

BoonEx Ray 3.5 - (sIncPath) Remote File Inclusion
BoonEx Ray 3.5 - 'sIncPath' Parameter Remote File Inclusion
DreamPics Builder - (page) SQL Injection
DreamNews Manager - 'id' SQL Injection
gapicms 9.0.2 - (dirDepth) Remote File Inclusion
phpDatingClub - 'website.php' Local File Inclusion
DreamPics Builder - 'page' Parameter SQL Injection
DreamNews Manager - 'id' Parameter SQL Injection
gapicms 9.0.2 - 'dirDepth' Parameter Remote File Inclusion
phpDatingClub 3.7 - 'website.php' Local File Inclusion

Million Pixels 3 - (id_cat) SQL Injection
Million Pixels 3 - 'id_cat' Parameter SQL Injection
Fuzzylime CMS 3.01 - (polladd.php poll) Remote Code Execution (PHP)
Fuzzylime CMS 3.01 - (polladd.php poll) Remote Code Execution (Perl)
Fuzzylime CMS 3.01 - 'poll' Parameter Remote Code Execution (PHP)
Fuzzylime CMS 3.01 - 'poll' Parameter Remote Code Execution (Perl)
WebCMS Portal Edition - 'id' SQL Injection
jsite 1.0 oe - (SQL Injection / Local File Inclusion) Multiple Vulnerabilities
Avlc Forum - 'vlc_forum.php id' SQL Injection
Fuzzylime CMS 3.01 - (commrss.php) Remote Code Execution
WebCMS Portal Edition - 'id' Parameter SQL Injection
jsite 1.0 oe - SQL Injection / Local File Inclusion
Avlc Forum - 'vlc_forum.php' SQL Injection
Fuzzylime CMS 3.01 - 'commrss.php' Remote Code Execution

Ultrastats 0.2.142 - (players-detail.php) Blind SQL Injection
Ultrastats 0.2.142 - 'players-detail.php' Blind SQL Injection

CodeDB - 'list.php lang' Local File Inclusion
CodeDB 1.1.1 - 'list.php' Local File Inclusion

Pluck 4.5.1 - (blogpost) Local File Inclusion (win only)
Pluck CMS 4.5.1 - 'blogpost' Parameter Local File Inclusion (win only)
Pragyan CMS 2.6.2 - (sourceFolder) Remote File Inclusion
Comdev Web Blogger 4.1.3 - (arcmonth) SQL Injection
Pragyan CMS 2.6.2 - 'sourceFolder' Parameter Remote File Inclusion
Comdev Web Blogger 4.1.3 - 'arcmonth' Parameter SQL Injection

phpWebNews 0.2 MySQL Edition - (SQL) Insecure Cookie Handling
PHPwebnews 0.2 MySQL Edition - (SQL) Insecure Cookie Handling

WebCMS Portal Edition - 'index.php id' Blind SQL Injection
WebCMS Portal Edition - 'id' Parameter Blind SQL Injection

Pluck 4.5.3 - (update.php) Remote File Corruption Exploit
Pluck CMS 4.5.3 - 'update.php' Remote File Corruption Exploit

Ultrastats 0.2.144/0.3.11 - (index.php serverid) SQL Injection
Ultrastats 0.2.144/0.3.11 - 'serverid' Parameter SQL Injection

Pluck CMS 4.5.3 - (g_pcltar_lib_dir) Local File Inclusion
Pluck CMS 4.5.3 - 'g_pcltar_lib_dir' Parameter Local File Inclusion

Fuzzylime CMS 3.03 - (track.php p) Local File Inclusion
Fuzzylime CMS 3.03 - 'track.php' Local File Inclusion

CMS little 0.0.1 - (index.php term) SQL Injection
CMS little 0.0.1 - 'term' Parameter SQL Injection

SHOP-INET 4 - 'show_cat2.php grid' SQL Injection
SHOP-INET 4 - 'grid' Parameter SQL Injection

Pluck CMS 4.6.1 - (module_pages_site.php post) Local File Inclusion
Pluck CMS 4.6.1 - 'module_pages_site.php' Local File Inclusion

Joomla! Component Maian Music 1.2.1 - (category) SQL Injection
Joomla! Component Maian Music 1.2.1 - 'category' Parameter SQL Injection

Pluck 4.6.2 - (langpref) Local File Inclusion
Pluck CMS 4.6.2 - 'langpref' Parameter Local File Inclusion

phportal 1.0 - Insecure Cookie Handling
PHPortal 1.0 - Insecure Cookie Handling

Kasseler CMS - (File Disclosure / Cross-Site Scripting) Multiple Vulnerabilities
Kasseler CMS - File Disclosure / Cross-Site Scripting

DreamPics Builder - (exhibition_id) SQL Injection
DreamPics Builder - 'exhibition_id' Parameter SQL Injection

Trixbox 2.2.4 - PhonecDirectory.php SQL Injection
Fonality trixbox 2.2.4 - 'PhonecDirectory.php' SQL Injection

Kasseler CMS 1.4.x lite - (Module Jokes) SQL Injection
Kasseler CMS 1.4.x lite Module Jokes - SQL Injection

PHPortal_1.2 - (gunaysoft.php) Remote File Inclusion
PHPortal 1.2 - 'gunaysoft.php' Remote File Inclusion

Trixbox CE 2.6.1 - langChoice PHP Local File Inclusion (Metasploit)
Fonality trixbox CE 2.6.1 - 'langChoice' Parameter Local File Inclusion (Metasploit)

maian weblog 4.0 - Blind SQL Injection
Maian Weblog 4.0 - Blind SQL Injection

brewblogger 2.3.2 - Multiple Vulnerabilities
BrewBlogger 2.3.2 - Multiple Vulnerabilities
Maian Weblog 2.0 - print.php Multiple Parameter SQL Injection
Maian Weblog 2.0 - mail.php Multiple Parameter SQL Injection
Maian Weblog 2.0 - 'print.php' SQL Injection
Maian Weblog 2.0 - 'mail.php' SQL Injection
PHPwebnews 0.1 - iklan.php m_txt Parameter Cross-Site Scripting
PHPwebnews 0.1 - 'index.php' m_txt Parameter Cross-Site Scripting
PHPwebnews 0.1 - bukutamu.php m_txt Parameter Cross-Site Scripting
PHPwebnews 0.1 - 'iklan.php' Cross-Site Scripting
PHPwebnews 0.1 - 'index.php' Cross-Site Scripting
PHPwebnews 0.1 - 'bukutamu.php' Cross-Site Scripting

Joomla! Component com_content 1.5 RC3 - 'index.php' view Parameter SQL Injection
Joomla! Component Content 1.5 RC3 - 'view' Parameter SQL Injection
Trixbox 2.4.2 - user/index.php Query String Cross-Site Scripting
Trixbox 2.4.2 - maint/index.php Query String Cross-Site Scripting
Fonality trixbox 2.4.2 - Cross-Site Scripting

Pluck 4.5.2 - Multiple Cross-Site Scripting Vulnerabilities
Pluck CMS 4.5.2 - Multiple Cross-Site Scripting Vulnerabilities

Trixbox - SQL Injection
Fonality trixbox - SQL Injection

Trixbox - 'endpoint_aastra.php mac Parameter' Remote Code Injection
Fonality trixbox - 'mac' Parameter Remote Code Injection

THELIA 1.4.2.1 - Multiple Cross-Site Scripting Vulnerabilities

Pluck 4.6.3 - 'cont1' Parameter HTML Injection
Pluck CMS 4.6.3 - 'cont1' Parameter HTML Injection

Pluck 4.7 - Multiple Local File Inclusion / File Disclosure Vulnerabilities
Pluck CMS 4.7 - Multiple Local File Inclusion / File Disclosure Vulnerabilities

Boonex Dolphin 6.1 - 'xml/get_list.php' SQL Injection
Boonex Dolphin 6.1 - 'get_list.php' SQL Injection

Joomla! Component 'com_content' - 'year' Parameter SQL Injection
Joomla! Component Content - 'year' Parameter SQL Injection

Pluck 4.7 - Directory Traversal
Pluck CMS 4.7 - Directory Traversal

SenseSites CommonSense CMS - cat2.php id Parameter SQL Injection
SenseSites CommonSense CMS - 'id' Parameter SQL Injection
Fonality trixbox - /maint/modules/endpointcfg/endpoint_generic.php mac Parameter SQL Injection
Fonality trixbox - /maint/modules/home/index.php lang Parameter Directory Traversal
Fonality trixbox - '/maint/modules/asterisk_info/asterisk_info.php' lang Parameter Directory Traversal
Fonality trixbox - /maint/modules/repo/repo.php lang Parameter Directory Traversal
Fonality trixbox - '/maint/modules/endpointcfg/endpointcfg.php' lang Directory Traversal
Fonality trixbox - /var/www/html/maint/modules/home/index.php lang Parameter Remote Code Execution
Fonality trixbox - 'endpoint_generic.php' SQL Injection
Fonality trixbox - 'index.php' Directory Traversal
Fonality trixbox - 'asterisk_info.php' Directory Traversal
Fonality trixbox - 'repo.php' Directory Traversal
Fonality trixbox - 'endpointcfg.php' Directory Traversal
Fonality trixbox - 'index.php' Remote Code Execution

Joomla! Component DT Register - 'cat' SQL Injection
 2016-12-15 05:01:19 +00:00
Offensive Security
b080c70f8b DB: 2016-12-14 
7 new exploits

Microsoft Internet Explorer 9 IEFRAME - CSelection­Interact­Button­Behavior::_Update­Button­Location Use-After-Free (MS13-047)

Xitami Web Server 5.0a0 - Denial of Service
OpenSSL 1.1.0a/1.1.0b - Denial of Service
Serva 3.0.0 HTTP Server - Denial of Service
iOS 10.1.x - Certificate File Memory Corruption

OpenBSD 4.0 - (vga) Privilege Escalation
OpenBSD 4.0 - 'vga' Privilege Escalation

10-Strike Network File Search Pro 2.3 - SEH Local Buffer Overflow

MyBloggie 2.1.4 - (trackback.php) Multiple SQL Injections
MyBloggie 2.1.4 - 'trackback.php' Multiple SQL Injections

AShop Deluxe 4.x - (catalogue.php cat) SQL Injection
AShop Deluxe 4.x - 'catalogue.php' SQL Injection

HIOX Banner Rotator 1.3 - (hm) Remote File Inclusion
HIOX Banner Rotator 1.3 - 'hm' Parameter Remote File Inclusion

CAT2 - (spaw_root) Local File Inclusion
CAT2 - 'spaw_root' Parameter Local File Inclusion

MyBloggie 2.1.3 - search.php SQL Injection
MyBloggie 2.1.2/2.1.3 - upload.php Multiple Parameter Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - delcomment.php Multiple Parameter Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - deluser.php 'id' Parameter Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - addcat.php errormsg Parameter Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - edituser.php errormsg Parameter Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - adduser.php errormsg Parameter Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - editcat.php errormsg Parameter Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - add.php trackback_url Parameter Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - delcat.php cat_id Parameter Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - del.php post_id Parameter Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - 'upload.php' Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - 'delcomment.php' Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - 'deluser.php' Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - 'addcat.php' Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - 'edituser.php' Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - 'adduser.php' Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - 'editcat.php' Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - 'trackback_url' Parameter Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - 'delcat.php' Cross-Site Scripting
MyBloggie 2.1.2/2.1.3 - 'del.php' Cross-Site Scripting

MyBloggie 2.1.x - Multiple Remote File Inclusion

MyBloggie 2.1.x - MyBloggie_Root_Path Parameter Multiple Remote File Inclusion
MyBloggie 2.1.x - 'MyBloggie_Root_Path' Parameter Remote File Inclusion
AShop Deluxe 4.5 - ashop/catalogue.php Multiple Parameter Cross-Site Scripting
AShop Deluxe 4.5 - ashop/basket.php cat Parameter Cross-Site Scripting
AShop Deluxe 4.5 - ashop/search.php SearchString Parameter Cross-Site Scripting
AShop Deluxe 4.5 - shipping.php Multiple Parameter Cross-Site Scripting
AShop Deluxe 4.5 - admin/editcatalogue.php cat Parameter Cross-Site Scripting
AShop Deluxe 4.5 - admin/salesadmin.php resultpage Parameter Cross-Site Scripting
AShop Deluxe 4.5 - 'catalogue.php' Cross-Site Scripting
AShop Deluxe 4.5 - 'basket.php' Cross-Site Scripting
AShop Deluxe 4.5 - 'search.php' Cross-Site Scripting
AShop Deluxe 4.5 - 'shipping.php' Cross-Site Scripting
AShop Deluxe 4.5 - 'editcatalogue.php' Cross-Site Scripting
AShop Deluxe 4.5 - 'salesadmin.php' Cross-Site Scripting

MyBloggie 2.1.5 - 'index.php' PATH_INFO Parameter Cross-Site Scripting
MyBloggie 2.1.5 - 'index.php' Cross-Site Scripting

MyBloggie 2.1.5 - 'login.php' PATH_INFO Parameter Cross-Site Scripting
MyBloggie 2.1.5 - 'login.php' Cross-Site Scripting
Smart Guard Network Manager 6.3.2 - SQL Injection
WordPress Plugin Multisite Post Duplicator 0.9.5.1 - Cross-Site Request Forgery
 2016-12-14 05:01:23 +00:00
Offensive Security
0231ae9ba7 DB: 2016-12-09 
5 new exploits

Dual DHCP DNS Server 7.29 - Denial of Service
TP-LINK TD-W8951ND - Denial of Service
OpenSSH 7.2 - Denial of Service

Linux Kernel 4.4.0 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation

Advanced Webhost Billing System (AWBS) - cart2.php Remote File Inclusion
Advanced Webhost Billing System (AWBS) 2.4.0 - 'cart2.php' Remote File Inclusion
AWBS 2.7.1 - (news.php viewnews) SQL Injection
Anata CMS 1.0b5 - (change.php) Arbitrary Add Admin
Advanced Webhost Billing System (AWBS) 2.7.1 - 'news.php' SQL Injection
Anata CMS 1.0b5 - 'change.php' Arbitrary Add Admin

Simple Machines Forum 1.0.13 / 1.1.5 - 'Destroyer 0.1' Password Reset Security Bypass
Simple Machines Forum (SMF) 1.0.13 / 1.1.5 - 'Destroyer 0.1' Password Reset Security Bypass

Simple Machines Forum (SMF) - Multiple Security Vulnerabilities
Simple Machines Forum (SMF) 1.1.10/2.0 RC2 - Multiple Security Vulnerabilities

Advanced Webhost Billing System 2.2.2 - contact.php Multiple Cross-Site Scripting Vulnerabilities

Advanced Webhost Billing System 2.9.2 - 'oid' Parameter SQL Injection
Advanced Webhost Billing System (AWBS) 2.9.2 - 'oid' Parameter SQL Injection

Simple Machines Forum (SMF) 2.0.2 - 'index.php' scheduled Parameter Cross-Site Scripting
Simple Machines Forum (SMF) 2.0.2 - 'scheduled' Parameter Cross-Site Scripting

Cisco Unified Communications Manager 7/8/9 - Directory Traversal
 2016-12-09 05:01:19 +00:00
Offensive Security
fb1dd3709f DB: 2016-12-08 
12 new exploits

vsftpd 2.0.5 - (CWD) Authenticated Remote Memory Consumption Exploit
vsftpd 2.0.5 - 'CWD' Authenticated Remote Memory Consumption

XChat - Heap Overflow Denial of Service
XChat 2.8.9 - Heap Overflow Denial of Service

Adobe Photoshop CC & Bridge CC - '.png' File Parsing Memory Corruption (1)
Adobe Photoshop CC / Bridge CC - '.png' File Parsing Memory Corruption (1)

glibc - getaddrinfo Stack Based Buffer Overflow (1)
glibc - 'getaddrinfo' Stack Based Buffer Overflow (PoC)
Microsoft Edge - JSON.parse Info Leak
Android - IOMXNodeInstance::enableNativeBuffers Unchecked Index
Microsoft Edge - CMarkup::Ensure­Delete­CFState Use-After-Free (MS15-125)
Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free (MS13-009)
Microsoft Edge - CBase­Scriptable::Private­Query­Interface Memory Corruption (MS16-068)
Windows 10 x86/x64 WLAN AutoConfig - Denial of Service (POC)

Linux Kernel 2.6.37 (RedHat / Ubuntu 10.04) - 'Full-Nelson.c' Privilege Escalation (1)
Linux Kernel 2.6.37 (RedHat / Ubuntu 10.04) - 'Full-Nelson.c' Privilege Escalation

Linux Kernel < 2.6.36.2 (Ubuntu 10.04) - 'Half-Nelson.c' Econet Privilege Escalation (2)
Linux Kernel < 2.6.36.2 (Ubuntu 10.04) - 'Half-Nelson.c' Econet Privilege Escalation

Microsoft PowerShell - XML External Entity Injection

XChat 2.8.7b - (URI Handler) Remote Code Execution (Internet Explorer 6/7'
XChat 2.8.7b - 'URI Handler' Remote Code Execution (Internet Explorer 6/7)

Android - Inter-Process munmap with User-Controlled Size in android.graphics.Bitmap

glibc - getaddrinfo Stack Based Buffer Overflow (2)
glibc - 'getaddrinfo' Stack Based Buffer Overflow

Microsoft Internet Explorer jscript9 - Java­Script­Stack­Walker Memory Corruption (MS15-056)

Linux/x86 - Netcat (-e option disabled) Reverse Shell Shellcode (180 bytes)

Gravity Board X 1.1 - (csscontent) Remote Code Execution
Gravity Board X 1.1 - 'csscontent' Parameter Remote Code Execution

Mambo Component 'com_extcalendar' 2.0 - Remote File Inclusion
Mambo Component ExtCalendar 2.0 - Remote File Inclusion

Mambo Component com_babackup 1.1 - File Inclusion
Mambo Component bigAPE-Backup 1.1 - File Inclusion

E-Smart Cart 1.0 - 'Product_ID' SQL Injection
E-Smart Cart 1.0 - 'Product_ID' Parameter SQL Injection

Joomla! / Mambo Component 'com_swmenupro' 4.0 - Remote File Inclusion
Joomla! / Mambo Component SWmenu 4.0 - Remote File Inclusion

Joomla! / Mambo Component 'com_thopper' 1.1 - Remote File Inclusion
Joomla! / Mambo Component Taskhopper 1.1 - Remote File Inclusion

Joomla! / Mambo Component 'com_articles' 1.1 - Remote File Inclusion
Joomla! / Mambo Component New Article 1.1 - Remote File Inclusion

Cartweaver - 'Details.cfm ProdID' SQL Injection
Cartweaver 2.16.11 - 'ProdID' Parameter SQL Injection

Joomla! / Mambo Component 'com_rsgallery' 2.0b5 - 'catid' SQL Injection
Joomla! / Mambo Component rsgallery 2.0b5 - 'catid' Parameter SQL Injection

xeCMS 1.x - (view.php list) Remote File Disclosure
xeCMS 1.x - 'view.php' Remote File Disclosure

Mambo Component 'com_portfolio' 1.0 - 'categoryId' SQL Injection
Mambo Component Portfolio Manager 1.0 - 'categoryId' Parameter SQL Injection

Easy-Clanpage 2.2 - 'id' SQL Injection
Easy-Clanpage 2.2 - 'id' Parameter SQL Injection
JAMM CMS - 'id' Blind SQL Injection
Gravity Board X 2.0 Beta - (SQL Injection / Cross-Site Scripting) Multiple Vulnerabilities
JAMM CMS - 'id' Parameter Blind SQL Injection
Gravity Board X 2.0 Beta - SQL Injection / Cross-Site Scripting
GLLCTS2 <= 4.2.4 - (login.php detail) SQL Injection
Butterfly ORGanizer 2.0.0 - (SQL Injection / Cross-Site Scripting) Multiple Vulnerabilities
GLLCTS2 <= 4.2.4 - 'detail' Parameter SQL Injection
Butterfly ORGanizer 2.0.0 - SQL Injection / Cross-Site Scripting

Mambo Component 'com_galleries' 1.0 - 'aid' Parameter SQL Injection
Mambo Component Galleries 1.0 - 'aid' Parameter SQL Injection
Easy-Clanpage 3.0b1 - (section) Local File Inclusion
WebChamado 1.1 - (tsk_id) SQL Injection
Pre News Manager 1.0 - (index.php id) SQL Injection
Pre Ads Portal 2.0 - SQL Injection
Easy-Clanpage 3.0b1 - 'section' Parameter Local File Inclusion
WebChamado 1.1 - 'tsk_id' Parameter SQL Injection
Pre News Manager 1.0 - 'id' Parameter SQL Injection
Pre ADS Portal 2.0 - SQL Injection

GLLCTS2 - 'listing.php sort' Blind SQL Injection
GLLCTS2 - 'sort' Parameter Blind SQL Injection

Contenido 4.8.4 - (Remote File Inclusion / Cross-Site Scripting) Multiple Vulnerabilities
Contenido 4.8.4 - Remote File Inclusion / Cross-Site Scripting
PHPMyCart - 'shop.php cat' SQL Injection
SHOUTcast Admin Panel 2.0 - (page) Local File Inclusion
Cartweaver 3 - (prodId) Blind SQL Injection
DIY - (index_topic did) Blind SQL Injection
PHPMyCart 1.3 - 'cat' Parameter SQL Injection
SHOUTcast Admin Panel 2.0 - 'page' Parameter Local File Inclusion
Cartweaver 3 - 'prodId' Parameter Blind SQL Injection
DIY - 'did' Parameter Blind SQL Injection
ezcms 1.2 - (Blind SQL Injection / Authentication Bypass) Multiple Vulnerabilities
PHPEasyNews 1.13 RC2 - (POST) SQL Injection
ezcms 1.2 - Blind SQL Injection / Authentication Bypass
PHPEasyNews 1.13 RC2 - 'POST' Parameter SQL Injection

Devalcms 1.4a - (currentfile) Local File Inclusion
Devalcms 1.4a - 'currentfile' Parameter Local File Inclusion

IPTBB 0.5.6 - (index.php act) Local File Inclusion
IPTBB 0.5.6 - 'act' Parameter Local File Inclusion

Mambo Component 'articles' - 'artid' Parameter Blind SQL Injection
Mambo Component Articles - 'artid' Parameter Blind SQL Injection

Mambo Component 'com_n-gallery' - Multiple SQL Injections
Mambo Component N-Gallery - Multiple SQL Injections

devalcms 1.4a - Cross-Site Scripting / Remote Code Execution
Devalcms 1.4a - Cross-Site Scripting / Remote Code Execution

PHP JOBWEBSITE PRO - (Authentication Bypass) SQL Injection
PHP JOBWEBSITE PRO - Authentication Bypass

Pre ADS Portal 2.0 - (Authentication Bypass / Cross-Site Scripting) Multiple Vulnerabilities
Pre ADS Portal 2.0 - Authentication Bypass / Cross-Site Scripting

Mambo Component 'com_n-forms' - 'form_id' Parameter Blind SQL Injection
Mambo Component n-form - 'form_id' Parameter Blind SQL Injection

Pre Job Board - (Authentication Bypass) SQL Injection
Pre Job Board - Authentication Bypass

Butterfly ORGanizer 2.0.1 - (view.php id) SQL Injection
Butterfly ORGanizer 2.0.1 - 'id' Parameter SQL Injection

facil-cms 0.1rc2 - Multiple Vulnerabilities
Facil-CMS 0.1RC2 - Multiple Vulnerabilities

Family Connections CMS 1.9 - (member) SQL Injection
Family Connections CMS 1.9 - SQL Injection

Mambo Component 'com_hestar' - SQL Injection
Mambo Component Hestar - SQL Injection

Joomla! / Mambo Component 'com_tupinambis' - SQL Injection
Joomla! / Mambo Component Tupinambis - SQL Injection

Joomla! / Mambo Component 'com_ezine' 2.1 - Remote File Inclusion
Joomla! / Mambo Component D4J eZine 2.1 - Remote File Inclusion

Mambo Component 'com_materialsuche' 1.0 - SQL Injection
Mambo Component Material Suche 1.0 - SQL Injection

Pre ADS Portal - 'cid' SQL Injection
Pre ADS Portal - 'cid' Parameter SQL Injection

Pre News Manager - (nid) SQL Injection
Pre News Manager - 'nid' Parameter SQL Injection

Mambo Component 'com_akogallery' - SQL Injection
Mambo Component AkoGallery - SQL Injection

Mambo Component 'com_mambads' - SQL Injection
Mambo Component MambAds - SQL Injection

Facil-CMS - (Local File Inclusion / Remote File Inclusion)
Facil-CMS 0.1RC2 - Local / Remote File Inclusion

AskMe Pro 2.1 - (que_id) SQL Injection
Alstrasoft AskMe Pro 2.1 - 'que_id' Parameter SQL Injection

Pre Job Board Pro - SQL Injection Authentication Bypass
Pre Job Board Pro - Authentication Bypass

DiY-CMS 1.0 - Multiple Remote File Inclusion
DIY-CMS 1.0 - Multiple Remote File Inclusion

Alstrasoft AskMe Pro 2.1 - (forum_answer.php?que_id) SQL Injection

Alstrasoft AskMe Pro 2.1 - (profile.php?id) SQL Injection
Alstrasoft AskMe Pro 2.1 - 'profile.php' SQL Injection

Pre Ads Portal - SQL Bypass
Pre ADS Portal - Authentication Bypass

Family Connections CMS 2.3.2 - (POST) Persistent Cross-Site Scripting / XML Injection
Family Connections CMS 2.3.2 - Persistent Cross-Site Scripting / XML Injection

Family Connections CMS 2.5.0 / 2.7.1 - (less.php) Remote Command Execution
Family Connections CMS 2.5.0 / 2.7.1 - 'less.php' Remote Command Execution

Family Connections CMS - 'less.php' Remote Command Execution (Metasploit)
Family Connections CMS 2.7.1 - 'less.php' Remote Command Execution (Metasploit)

Gravity Board X 1.1 - DeleteThread.php Cross-Site Scripting

Clever Copy 3.0 - Connect.INC Information Disclosure
Clever Copy 3.0 - 'Connect.INC' Information Disclosure

Cartweaver 2.16.11 - Results.cfm category Parameter SQL Injection
Cartweaver 2.16.11 - Details.cfm ProdID Parameter SQL Injection
Cartweaver 2.16.11 - 'Results.cfm' SQL Injection
Mambo Component 'lmtg_myhomepage' 1.2 - Multiple Remote File Inclusion
Mambo Component 'com_rssxt' 1.0 - 'MosConfig_absolute_path' Parameter Multiple Remote File Inclusion
Mambo Component LMTG Myhomepage 1.2 - Multiple Remote File Inclusion
Mambo Component Rssxt 1.0 - 'MosConfig_absolute_path' Parameter Multiple Remote File Inclusion

Mambo Component 'com_admin-copy_module' - 'MosConfig_absolute_path' Parameter Remote File Inclusion
Mambo Component Display MOSBot Manager - 'MosConfig_absolute_path' Parameter Remote File Inclusion

Joomla! / Mambo Component 'com_comprofiler' 1.0 - 'class.php' Remote File Inclusion
Joomla! / Mambo Component Comprofiler 1.0 - 'class.php' Remote File Inclusion

Joomla! / Mambo Component 'com_sg' - 'pid' Parameter SQL Injection
Joomla! / Mambo Component com_sg - 'pid' Parameter SQL Injection

Joomla! / Mambo Component 'com_salesrep' - 'rid' Parameter SQL Injection
Joomla! / Mambo Component com_salesrep - 'rid' Parameter SQL Injection
Joomla! / Mambo Component 'com_filebase' - 'filecatid' Parameter SQL Injection
Joomla! / Mambo Component 'com_scheduling' - 'id' Parameter SQL Injection
Joomla! / Mambo Component Filebase - 'filecatid' Parameter SQL Injection
Joomla! / Mambo Component com_scheduling - 'id' Parameter SQL Injection

Joomla! / Mambo Component 'com_profile' - 'oid' Parameter SQL Injection
Joomla! / Mambo Component com_profile - 'oid' Parameter SQL Injection

Joomla! / Mambo Component 'com_datsogallery' 1.3.1 - 'id' Parameter SQL Injection
Joomla! / Mambo Component Datsogallery 1.3.1 - 'id' Parameter SQL Injection
PHP JOBWEBSITE PRO - siteadmin/forgot.php adname Parameter SQL Injection
PHP JOBWEBSITE PRO - siteadmin/forgot.php Multiple Parameter Cross-Site Scripting
PHP JOBWEBSITE PRO - 'adname' Parameter SQL Injection
PHP JOBWEBSITE PRO - 'forgot.php' Cross-Site Scripting

Joomla! / Mambo Component 'com_gigcal' 1.0 - 'banddetails.php' SQL Injection
Joomla! / Mambo Component gigCalendar 1.0 - 'banddetails.php' SQL Injection

Conkurent PHPMyCart 1.3 - Cross-Site Scripting / Authentication Bypass
PHPMyCart 1.3 - Cross-Site Scripting / Authentication Bypass

Mambo Component 'com_docman' 1.3.0 - Multiple SQL Injection
Mambo Component Docman 1.3.0 - Multiple SQL Injection

Mambo Component 'com_n-skyrslur' - Cross-Site Scripting
Mambo Component N-Skyrslur - Cross-Site Scripting

Mambo Component 'com_n-gallery' - SQL Injection
Mambo Component N-Gallery - SQL Injection

Mambo Component 'com_n-press' - SQL Injection
Mambo Component N-Press - SQL Injection
Mambo Component 'com_n-frettir' - SQL Injection
Mambo Component 'com_n-myndir' - SQL Injection
Mambo Component N-Frettir - SQL Injection
Mambo Component N-Myndir - SQL Injection

AbanteCart - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Edge SkateShop - Authentication bypass

AbanteCart 1.2.7 - Cross-Site Scripting
 2016-12-08 05:01:21 +00:00
Offensive Security
855e59f932 DB: 2016-12-07 
9 new exploits

MDaemon 9.6.5 - Multiple Remote Buffer Overflow (PoC)
Asterisk - (SIP channel driver / in pedantic mode) Remote Crash
Alt-N MDaemon 9.6.5 - Multiple Remote Buffer Overflow (PoC)
Asterisk 1.2.x - (SIP channel driver / in pedantic mode) Remote Crash

F5 BIG-IP - Remote Root Authentication Bypass (1)
F5 BIG-IP - Authentication Bypass (1)

Ntpd ntp-4.2.6p5 - ctl_putdata() Buffer Overflow
NTPd ntp-4.2.6p5 - ctl_putdata() Buffer Overflow

NetCat 0.7.1 - Denial of Service
Microsoft Event Viewer 1.0 - XML External Entity Injection
Microsoft MSINFO32.EXE 6.1.7601 - '.NFO' XML External Entity Injection
Apache CouchDB 2.0.0 - Local Privilege Escalation

Samba 2.2.8 - Remote Root Exploit
Samba 2.2.8 - Remote Code Execution

Microsoft Windows - WebDAV Remote Root Exploit (2)
Microsoft Windows - WebDAV Remote Code Execution (2)

Microsoft IIS 5.0 - WebDAV Remote Root Exploit (3) (xwdav)
Microsoft IIS 5.0 - WebDAV Remote Code Execution (3) (xwdav)

miniSQL (mSQL) 1.3 - Remote GID Root Exploit
miniSQL (mSQL) 1.3 - GID Remote Code Execution
Real Server 7/8/9 (Windows / Linux) - Remote Root Exploit
GtkFtpd 1.0.4 - Remote Root Buffer Overflow
Real Server 7/8/9 (Windows / Linux) - Remote Code Execution
GtkFtpd 1.0.4 - Buffer Overflow
Solaris Sadmind - Default Configuration Remote Root Exploit
Knox Arkeia Pro 5.1.12 - Backup Remote Root Exploit
Solaris Sadmind - Default Configuration Remote Code Execution
Knox Arkeia Pro 5.1.12 - Backup Remote Code Execution

ProFTPd 1.2.9rc2 - ASCII File Remote Root Exploit
ProFTPd 1.2.9rc2 - ASCII File Remote Code Execution

ProFTPd 1.2.7 < 1.2.9rc2 - Remote Root / Brute Force Exploit
ProFTPd 1.2.7 < 1.2.9rc2 - Remote Code Execution / Brute Force

Cyrus IMSPD 1.7 - abook_dbname Remote Root Exploit
Cyrus IMSPD 1.7 - 'abook_dbname' Remote Code Execution

Ethereal 0.10.0 < 0.10.2 - IGAP Overflow Remote Root Exploit
Ethereal 0.10.0 < 0.10.2 - IGAP Overflow
Monit 4.1 - Remote Root Buffer Overflow
Monit 4.2 - Remote Root Buffer Overflow
Monit 4.1 - Buffer Overflow
Monit 4.2 - Buffer Overflow

INND/NNRP < 1.6.x - Remote Root Overflow
INND/NNRP < 1.6.x - Overflow Exploit

LPRng (RedHat 7.0) - lpd Remote Root Format String
LPRng (RedHat 7.0) - 'lpd' Format String

BeroFTPD 1.3.4(1) (Linux/x86) - Remote Root Exploit
BeroFTPD 1.3.4(1) (Linux/x86) - Remote Code Execution
BIND 8.2.x - (TSIG) Remote Root Stack Overflow (1)
BIND 8.2.x - (TSIG) Remote Root Stack Overflow (2)
BIND 8.2.x - (TSIG) Remote Root Stack Overflow (3)
BIND 8.2.x - (TSIG) Remote Root Stack Overflow (4)
BIND 8.2.x - (TSIG) Stack Overflow (1)
BIND 8.2.x - (TSIG) Stack Overflow (2)
BIND 8.2.x - (TSIG) Stack Overflow (3)
BIND 8.2.x - (TSIG) Stack Overflow (4)

HP Web JetAdmin 6.5 - (connectedNodes.ovpl) Remote Root Exploit
HP Web JetAdmin 6.5 - 'connectedNodes.ovpl' Remote Code Execution

CVS (Linux/FreeBSD) - Remote Entry Line Heap Overflow Root Exploit
CVS (Linux/FreeBSD) - Remote Entry Line Heap Overflow

Solaris /bin/login (SPARC/x86) - Remote Root Exploit
Solaris /bin/login (SPARC/x86) - Remote Code Execution

Drcat 0.5.0-beta - (drcatd) Remote Root Exploit
Drcat 0.5.0-beta - 'drcatd' Remote Code Execution

Dropbear SSH 0.34 - Remote Root Exploit
Dropbear SSH 0.34 - Remote Code Execution

Apple Mac OSX 10.3.3 - AppleFileServer Remote Root Overflow
Apple Mac OSX 10.3.3 - AppleFileServer Overflow Remote Code Execution

Monit 4.2 - Basic Authentication Remote Root Exploit
Monit 4.2 - Basic Authentication Remote Code Execution

WvTFTPd 0.9 - Remote Root Heap Overflow
WvTFTPd 0.9 - Heap Overflow

Qwik SMTP 0.3 - Remote Root Format String
Qwik SMTP 0.3 - Format String

Citadel/UX 6.27 - Remote Root Format String
Citadel/UX 6.27 - Format String

Knox Arkeia Server Backup 5.3.x - Remote Root Exploit
Knox Arkeia Server Backup 5.3.x - Remote Code Execution
Smail 3.2.0.120 - Remote Root Heap Overflow
mtftpd 0.0.3 - Remote Root Exploit
Smail 3.2.0.120 -  Heap Overflow
mtftpd 0.0.3 - Remote Code Execution

dSMTP Mail Server 3.1b - Linux Remote Root Format String
dSMTP Mail Server 3.1b (Linux) - Format String Exploit

IPSwitch IMail Server 8.15 - IMAPD Remote Root Exploit
IPSwitch IMail Server 8.15 - IMAPD Remote Code Execution

linux-ftpd-ssl 0.17 - (MKD/CWD) Remote Root Exploit
linux-ftpd-ssl 0.17 - 'MKD'/'CWD' Remote Code Execution

MDaemon POP3 Server < 9.06 - (USER) Remote Heap Overflow
Alt-N MDaemon POP3 Server < 9.06 - (USER) Remote Heap Overflow

GNU InetUtils ftpd 1.4.2 - (ld.so.preload) Remote Root Exploit
GNU InetUtils ftpd 1.4.2 - 'ld.so.preload' Remote Code Execution

ProFTPd 1.2.9 rc2 - (ASCII File) Remote Root Exploit
ProFTPd 1.2.9 rc2 - ASCII File Remote Code Execution

dproxy-nexgen (Linux/x86) - Remote Root Buffer Overflow
dproxy-nexgen (Linux/x86) - Buffer Overflow

Kerberos 1.5.1 - Kadmind Remote Root Buffer Overflow
Kerberos 1.5.1 - Kadmind Buffer Overflow

webdesproxy 0.0.1 - GET Request Remote Root Exploit (exec-shield)
webdesproxy 0.0.1 - (exec-shield) GET Request Remote Code Execution

VHCS 2.4.7.1 - 'vhcs2_daemon' Remote Root Exploit
VHCS 2.4.7.1 - 'vhcs2_daemon' Remote Code Execution

MDaemon IMAP server 9.6.4 - 'FETCH' Remote Buffer Overflow
Alt-N MDaemon IMAP server 9.6.4 - 'FETCH' Remote Buffer Overflow

Sun Solaris 10 - rpc.ypupdated Remote Root Exploit
Sun Solaris 10 - 'rpc.ypupdated' Remote Code Execution

ZYXEL ZyWALL Quagga/Zebra - 'Default Password' Remote Root Exploit
ZYXEL ZyWALL Quagga/Zebra - 'Default Password' Remote Code Execution

Sun Solaris 10 - rpc.ypupdated Remote Root Exploit (Metasploit)
Sun Solaris 10 - rpc.ypupdated Remote Code Execution (Metasploit)

Trixbox 2.6.1 - (langChoice) Remote Root Exploit (Python)
Trixbox 2.6.1 - (langChoice) Remote Code Execution (Python)

Solaris 9 (UltraSPARC) - sadmind Remote Root Exploit
Solaris 9 (UltraSPARC) - sadmind Remote Code Execution

Apache SpamAssassin Milter Plugin 0.3.1 - Remote Root Command Execution
Apache SpamAssassin Milter Plugin 0.3.1 - Remote Command Execution

Microworld eScan AntiVirus < 3.x - Remote Root Command Execution
Microworld eScan AntiVirus < 3.x - Remote Code Execution

AIX5l with FTP-Server - Remote Root Hash Disclosure
AIX5l with FTP-Server - Hash Disclosure

McAfee LinuxShield 1.5.1 - Local/Remote File Inclusion (Root Remote Code Execution)
McAfee LinuxShield 1.5.1 - Local/Remote File Inclusion (Remote Code Execution)

ProFTPd 1.3.3c - Compromised Source Remote Root Trojan
ProFTPd 1.3.3c - Compromised Source (Trojan) Remote Code Execution

Comtrend ADSL Router CT-5367 C01_R12 - Remote Root Exploit
Comtrend ADSL Router CT-5367 C01_R12 - Remote Code Execution

MDaemon 9.6.4 - IMAPD FETCH Buffer Overflow (Metasploit)
Alt-N MDaemon 9.6.4 - IMAPD FETCH Buffer Overflow (Metasploit)

ACTi ASOC 2200 Web Configurator 2.6 - Remote Root Command Execution
ACTi ASOC 2200 Web Configurator 2.6 - Remote Command Execution

DreamBox DM800 1.5rc1 - Remote Root File Disclosure
DreamBox DM800 1.5rc1 - File Disclosure

TelnetD encrypt_keyid - Remote Root Function Pointer Overwrite
TelnetD encrypt_keyid - Function Pointer Overwrite
F5 BIG-IP - Remote Root Authentication Bypass (2)
MySQL - Remote Root Authentication Bypass
F5 BIG-IP - Authentication Bypass (2)
MySQL - Authentication Bypass

ManageEngine Security Manager Plus 5.5 build 5505 - Remote SYSTEM/Root SQL Injection
ManageEngine Security Manager Plus 5.5 build 5505 - Remote Root/SYSTEM SQL Injection

WIDZ 1.0/1.5 - Remote Root Compromise
WIDZ 1.0/1.5 - Remote Code Execution
Shuttle Tech ADSL Wireless 920 WM - Multiple Vulnerabilities
Dup Scout Enterprise 9.1.14 - Buffer Overflow (SEH)
DiskBoss Enterprise 7.4.28 - 'GET' Buffer Overflow

proManager 0.73 - (note.php) SQL Injection
ProManager 0.73 - 'note.php' SQL Injection

pNews 1.1.0 - (nbs) Remote File Inclusion
pNews 1.1.0 - 'nbs' Parameter Remote File Inclusion

Power Phlogger 2.0.9 - (config.inc.php3) File Inclusion
Power Phlogger 2.0.9 - 'config.inc.php3' File Inclusion

eFiction 3.1.1 - (path_to_smf) Remote File Inclusion
eFiction 3.1.1 - 'path_to_smf' Remote File Inclusion

FlexPHPNews 0.0.5 - (news.php newsid) SQL Injection
FlexPHPNews 0.0.5 - 'newsid' Parameter SQL Injection

Achievo 1.1.0 - (atk.inc config_atkroot) Remote File Inclusion
Achievo 1.1.0 - 'config_atkroot' Parameter Remote File Inclusion

SimpNews 2.40.01 - (print.php newnr) SQL Injection
SimpNews 2.40.01 - 'newnr' Parameter SQL Injection

PHPNews 0.93 - (format_menue) Remote File Inclusion
PHPNews 0.93 - 'format_menue' Parameter Remote File Inclusion

meBiblio 0.4.5 - (index.php action) Remote File Inclusion
meBiblio 0.4.5 - 'action' Parameter Remote File Inclusion

Joomla! Component rapidrecipe 1.6.5 - SQL Injection
Joomla! Component Rapid Recipe 1.6.5 - SQL Injection

mebiblio 0.4.7 - (SQL Injection / Arbitrary File Upload / Cross-Site Scripting) Multiple Vulnerabilities
mebiblio 0.4.7 - SQL Injection / Arbitrary File Upload / Cross-Site Scripting
pLog - 'albumID' SQL Injection
smeweb 1.4b - (SQL Injection / Cross-Site Scripting) Multiple Vulnerabilities
PLog 1.0.6 - 'albumID' Parameter SQL Injection
smeweb 1.4b - SQL Injection / Cross-Site Scripting

Joomla! Component joomradio 1.0 - 'id' SQL Injection
Joomla! Component JoomRadio 1.0 - 'id' Parameter SQL Injection

Battle Blog 1.25 - (comment.asp) SQL Injection
Battle Blog 1.25 - 'comment.asp' SQL Injection

1Book Guestbook Script - Code Execution
1Book Guestbook Script 1.0.1 - Code Execution
PHP-Address Book 3.1.5 - (SQL Injection / Cross-Site Scripting) Multiple Vulnerabilities
Joomla! Component EasyBook 1.1 - (gbid) SQL Injection
427bb 2.3.1 - (SQL Injection / Cross-Site Scripting) Multiple Vulnerabilities
PHP-Address Book 3.1.5 - SQL Injection / Cross-Site Scripting
Joomla! Component EasyBook 1.1 - 'gbid' Parameter SQL Injection
427bb 2.3.1 - SQL Injection / Cross-Site Scripting
Power Phlogger 2.2.5 - (css_str) SQL Injection
pSys 0.7.0.a - (shownews) SQL Injection
Joomla! Component JoomlaDate - (user) SQL Injection
Power Phlogger 2.2.5 - 'css_str' Parameter SQL Injection
pSys 0.7.0.a - 'shownews' Parameter SQL Injection
Joomla! Component JoomlaDate 1.2 - 'user' Parameter SQL Injection
JiRo?s FAQ Manager (read.asp fID) 1.0 - SQL Injection
phpinv 0.8.0 - (Local File Inclusion / Cross-Site Scripting) Multiple Vulnerabilities
Joomla! Component yvcomment 1.16 - Blind SQL Injection
JiRo's FAQ Manager eXperience 1.0 - 'fID' Parameter SQL Injection
phpinv 0.8.0 - Local File Inclusion / Cross-Site Scripting
Joomla! Component yvComment 1.16 - Blind SQL Injection

BrowserCRM 5.002.00 - (clients.php) Remote File Inclusion
BrowserCRM 5.002.00 - 'clients.php' Remote File Inclusion

Joomla! Component rapidrecipe - SQL Injection
Joomla! Component Rapid Recipe 1.6.6/1.6.7 - SQL Injection

Joomla! Component iJoomla! News Portal - 'itemID' SQL Injection
Joomla! Component iJoomla News Portal 1.0 - 'itemID' Parameter SQL Injection
real estate Web site 1.0 - (SQL Injection / Cross-Site Scripting) Multiple Vulnerabilities
telephone directory 2008 - (SQL Injection / Cross-Site Scripting) Multiple Vulnerabilities
ASPilot Pilot Cart 7.3 - (article) SQL Injection
real estate Web site 1.0 - SQL Injection / Cross-Site Scripting
Telephone Directory 2008 - SQL Injection / Cross-Site Scripting
ASPilot Pilot Cart 7.3 - 'article' Parameter SQL Injection
Flux CMS 1.5.0 - (loadsave.php) Arbitrary File Overwrite
pNews 2.08 - (shownews) SQL Injection
Flux CMS 1.5.0 - 'loadsave.php' Arbitrary File Overwrite
pNews 2.08 - 'shownews' Parameter SQL Injection
ErfurtWiki R1.02b - (css) Local File Inclusion
DCFM Blog 0.9.4 - (comments) SQL Injection
yblog 0.2.2.2 - (Cross-Site Scripting / SQL Injection) Multiple Vulnerabilities
Insanely Simple Blog 0.5 - (index) SQL Injection
ASPPortal Free Version - 'Topic_Id' SQL Injection
Experts 1.0.0 - (answer.php) SQL Injection
SyndeoCMS 2.6.0 - (Local File Inclusion / Cross-Site Scripting) Multiple Vulnerabilities
ErfurtWiki R1.02b - Local File Inclusion
DCFM Blog 0.9.4 - SQL Injection
Yblog 0.2.2.2 - Cross-Site Scripting / SQL Injection
Insanely Simple Blog 0.5 - SQL Injection
ASPPortal Free Version - 'Topic_Id' Parameter SQL Injection
Experts 1.0.0 - 'answer.php' SQL Injection
SyndeoCMS 2.6.0 - Local File Inclusion / Cross-Site Scripting

Yuhhu 2008 SuperStar - 'board' SQL Injection
Yuhhu 2008 SuperStar - 'board' Parameter SQL Injection

eFiction 3.0 - (toplists.php list) SQL Injection
eFiction 3.0 - 'toplists.php' SQL Injection

pSys 0.7.0 Alpha - (chatbox.php) SQL Injection
pSys 0.7.0 Alpha - 'chatbox.php' SQL Injection

pNews 2.03 - (newsid) SQL Injection
pNews 2.03 - 'newsid' Parameter SQL Injection

Joomla! Component JooBlog 0.1.1 - (PostID) SQL Injection
Joomla! Component JooBlog 0.1.1 - 'PostID' Parameter SQL Injection

FlexPHPNews 0.0.6 & PRO - (Authentication Bypass) SQL Injection
FlexPHPNews 0.0.6 & PRO - Authentication Bypass

E-ShopSystem - (Authentication Bypass / SQL Injection) Multiple Vulnerabilities
E-ShopSystem - Authentication Bypass / SQL Injection

Battle Blog 1.25 - (uploadform.asp) Arbitrary File Upload
Battle Blog 1.25 - 'uploadform.asp' Arbitrary File Upload

427BB Fourtwosevenbb 2.3.2 - SQL Injection
427BB 2.3.2 - SQL Injection

Joomla! Component 'com_joomradio' - SQL Injection
Joomla! Component JoomRadio 1.0 - SQL Injection

Joomla! Component 'com_elite_experts' - SQL Injection
Joomla! Component Elite Experts - SQL Injection

ASPilot Pilot Cart 7.3 - newsroom.asp SQL Injection
ASPilot Pilot Cart 7.3 - 'newsroom.asp' SQL Injection

Contrexx ShopSystem 2.2 SP3 (catId) - Blind SQL Injection
Contrexx ShopSystem 2.2 SP3 - 'catId' Parameter Blind SQL Injection

Comtrend Router CT-5624 - Remote Root/Support Password Disclosure/Change Exploit
Comtrend Router CT-5624 - Root/Support Password Disclosure/Change Exploit

alt-n mdaemon free 12.5.4 - Persistent Cross-Site Scripting
Alt-N MDaemon free 12.5.4 - Persistent Cross-Site Scripting

SimpNews 2.0.1/2.13 - PATH_SIMPNEWS Remote File Inclusion
SimpNews 2.0.1/2.13 - 'path_simpnews' Parameter Remote File Inclusion

PHPNews 1.2.3/1.2.4 - auth.php Remote File Inclusion
PHPNews 1.2.3/1.2.4 - 'auth.php' Remote File Inclusion
PHPSysInfo 2.0/2.3 - 'index.php' sensor_program Parameter Cross-Site Scripting
PHPSysInfo 2.0/2.3 - system_footer.php Multiple Parameter Cross-Site Scripting
PHPSysInfo 2.0/2.3 - 'sensor_program' Parameter Cross-Site Scripting
PHPSysInfo 2.0/2.3 - 'system_footer.php' Cross-Site Scripting

Seowonintech Routers fw: 2.3.9 - Remote Root File Disclosure
Seowonintech Routers fw: 2.3.9 - File Disclosure

PHPNews 1.2.x - auth.php SQL Injection
PHPNews 1.2.x - 'auth.php' SQL Injection
efiction 1.0/1.1/2.0 - titles.php let Parameter Cross-Site Scripting
efiction 1.0/1.1/2.0 - titles.php let Parameter SQL Injection
efiction 1.0/1.1/2.0 - viewstory.php sid Parameter SQL Injection
efiction 1.0/1.1/2.0 - viewuser.php uid Parameter SQL Injection
efiction 1.0/1.1/2.0 - 'titles.php' Cross-Site Scripting
efiction 1.0/1.1/2.0 - 'titles.php' SQL Injection
efiction 1.0/1.1/2.0 - 'sid' Parameter SQL Injection
efiction 1.0/1.1/2.0 - 'uid' Parameter SQL Injection

427BB 2.2 - showthread.php SQL Injection
427BB 2.2 - 'showthread.php' SQL Injection

BrowserCRM - results.php Cross-Site Scripting

Simpnews 2.x - Wap_short_news.php Remote File Inclusion
Simpnews 2.x - 'Wap_short_news.php' Remote File Inclusion

ZYXEL Prestige 660H-61 ADSL Router - RPSysAdmin.HTML Cross-Site Scripting
ZYXEL Prestige 660H-61 ADSL Router - Cross-Site Scripting
Yblog - funk.php id Parameter Cross-Site Scripting
Yblog - tem.php action Parameter Cross-Site Scripting
Yblog - uss.php action Parameter Cross-Site Scripting
Yblog - 'funk.php' Cross-Site Scripting
Yblog - 'tem.php' Cross-Site Scripting
Yblog - 'uss.php' Cross-Site Scripting
Simpnews 2.x - admin/index.php Unspecified Cross-Site Scripting
Simpnews 2.x - admin/pwlost.php Unspecified Cross-Site Scripting
Simpnews 2.x - 'index.php' Cross-Site Scripting
Simpnews 2.x - 'pwlost.php' Cross-Site Scripting

PHPNews 1.3 - Link_Temp.php Multiple Cross-Site Scripting Vulnerabilities
PHPNews 1.3 - 'Link_Temp.php' Cross-Site Scripting
Insanely Simple Blog 0.4/0.5 - 'index.php' current_subsection Parameter SQL Injection
Insanely Simple Blog 0.4/0.5 - Blog Anonymous Blog Entry Cross-Site Scripting
Insanely Simple Blog 0.4/0.5 - 'index.php' SQL Injection
Insanely Simple Blog 0.4/0.5 - Cross-Site Scripting
SimpNews 2.41.3 - admin/layout2b.php l_username Parameter Cross-Site Scripting
SimpNews 2.41.3 - comment.php backurl Parameter Cross-Site Scripting
SimpNews 2.41.3 - 'l_username' Parameter Cross-Site Scripting
SimpNews 2.41.3 - 'backurl' Parameter Cross-Site Scripting
BrowserCRM 5.100.1 - modules/Documents/version_list.php parent_id Parameter SQL Injection
BrowserCRM 5.100.1 - modules/Documents/index.php contact_id Parameter SQL Injection
BrowserCRM 5.100.1 - Multiple Script URI Cross-Site Scripting
BrowserCRM 5.100.1 - license/index.php framed Parameter Cross-Site Scripting
BrowserCRM 5.100.1 - licence/view.php framed Parameter Cross-Site Scripting
BrowserCRM 5.100.1 - pub/clients.php login[] Parameter Cross-Site Scripting
BrowserCRM 5.100.1 - 'index.php' login[] Parameter Cross-Site Scripting
BrowserCRM 5.100.1 - 'parent_id' Parameter SQL Injection
BrowserCRM 5.100.1 - 'contact_id' Parameter SQL Injection
BrowserCRM 5.100.1 - URI Cross-Site Scripting
BrowserCRM 5.100.1 - 'framed' Parameter Cross-Site Scripting
Wordpress Plugin Single Personal Message 1.0.3 - SQL Injection
BrowserCRM 5.100.1 - 'clients.php' Cross-Site Scripting
BrowserCRM 5.100.1 - 'login[]' Cross-Site Scripting
 2016-12-07 05:01:17 +00:00
Offensive Security
aa4fced35c DB: 2016-12-05 2016-12-05 05:01:20 +00:00