Exploits

Geovision Inc. IP Camera & Video – Remote Command Execution

#!/usr/bin/env python2.7

HPE iMC 7.3 – RMI Java Deserialization

# Exploit Title: HPE iMC 7.3 Java RMI Registry Deserialization RCE Vulnerability

Advantech WebAccess < 8.3 - SQL Injection

#!/usr/bin/python2.7

System Shield 5.0.0.136 – Privilege Escalation

Exploit Title - System Shield AntiVirus & AntiSpyware Arbitrary Write Privilege Escalation

LabF nfsAxe 3.7 TFTP Client – Local Buffer Overflow

#!/usr/bin/python

Joomla! Component Picture Calendar for Joomla! 3.1.4 – Directory Traversal

# # # # #

Joomla! Component CP Event Calendar 3.0.1 – ‘id’ SQL Injection

# # # # #

Joomla! Component Visual Calendar 3.1.3 – ‘id’ SQL Injection

# # # # #

BMC BladeLogic RSCD Agent 8.3.00.64 – Windows Users Disclosure

# Exploit Title: BMC BladeLogic RSCD agent get Windows users

Hotspot Shield – Information Disclosure

## Vulnerability Summary

macOS – ‘sysctl_vfs_generic_conf’ Stack Leak Through Struct Padding

The sysctls vfs.generic.conf.* are handled by sysctl_vfs_generic_conf(), which is implemented as follows:

Oracle WebLogic – wls-wsat Component Deserialization Remote Code Execution (Metasploit)

##

Arq 5.10 – Local Privilege Escalation (1)

#!/usr/bin/env ruby

Arq 5.10 – Local Privilege Escalation (2)

#!/bin/bash

systemd (systemd-tmpfiles) < 236 - 'fs.protected_hardlinks=0' Local Privilege Escalation

Product: systemd (systemd-tmpfiles)

iBall WRA150N – Multiple Vulnerabilities

## Vulnerabilities summary

Artifex MuJS 1.0.2 – Denial of Service

Hello,

Artifex MuJS 1.0.2 – Integer Overflow

# Exploit Title: DoS caused by the interactive call between two functions

Werkzeug – ‘Debug Shell’ Command Execution

#!/usr/bin/env python

PACSOne Server 6.6.2 DICOM Web Viewer – Directory Trasversal

# Exploit Title: PACSOne Server 6.6.2 DICOM Web Viewer Directory Trasversal / Local File Inclusion

PACSOne Server 6.6.2 DICOM Web Viewer – SQL Injection

# Exploit Title: PACSOne Server 6.6.2 DICOM Web Viewer SQL Injection

Gnew 2018.1 – Cross-Site Request Forgery

# Exploit Title: Gnew 2018.1 - Cross-Site Request Forgery

Nexpose < 6.4.66 - Cross-Site Request Forgery

# Exploit Title: [Cross Site Request Forgery at Nexpose Automated Actions]

Joomla! Component JS Support Ticket 1.1.0 – Cross-Site Request Forgery

[CODE]

Joomla! Component Jtag Members Directory 5.3.7 – Arbitrary File Download

# # # # #

Task Rabbit Clone 1.0 – ‘id’ SQL Injection

# # # # #

TSiteBuilder 1.0 – SQL Injection

# # # # #

Hot Scripts Clone – ‘subctid’ SQL Injection

# # # # #

Multilanguage Real Estate MLM Script 3.0 – ‘srch’ SQL Injection

# # # # #

Buddy Zone 2.9.9 – SQL Injection

# # # # #

Netis WF2419 Router – Cross-Site Request Forgery

# Exploit Title: Netis-WF2419 Router Cross-Site Request Forgery (CSRF)

Trend Micro Threat Discovery Appliance 2.6.1062r1 – ‘dlp_policy_upload.cgi’ Remote Code Execution

#!/usr/local/bin/python

KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery

# Exploit Title: Application wide CSRF Bypass

Sony Playstation 3 (PS3) 4.82 – ‘Jailbreak’ (ROP)

EDB Note ~ http://ps3xploit.com/help/dumper.html

Dodocool DC38 N300 – Cross-site Request Forgery

# Exploit Title: DODOCOOL DC38 N300 Cross-site Request Forgery

WordPress Plugin Learning Management System – ‘course_id’ SQL Injection

# Exploit Title: Good LMS - Learning Management System WP Plugin SQL

BMC BladeLogic 8.3.00.64 – Remote Command Execution

# Exploit Title: BMC BladeLogic RSCD agent remote exec - XMLRPC version

Exodus Wallet (ElectronJS Framework) – Remote Code Execution

ASUS DSL-N14U B1 Router 1.1.2.3_345 – Change Administrator Password

import requests

Professional Local Directory Script 1.0 – SQL Injection

# # # # #

RAVPower 2.000.056 – Root Remote Code Execution

"""

WordPress Plugin Email Subscribers & Newsletters 3.4.7 – Information Disclosure

# Exploit Title: WordPress Plugin Email Subscribers & Newsletters 3.4.7 - Information Disclosure

Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Encryption Keys Disclosure

# Exploit Title: Telerik UI for ASP.NET AJAX DialogHandler Dialog cracker

Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Arbitrary File Upload

# Exploit Title: Telerik UI for ASP.NET AJAX RadAsyncUpload uploader

Sync Breeze Enterprise 9.5.16 – ‘Import Command’ Buffer Overflow (Metasploit)

##

Kaltura – Remote PHP Code Execution over Cookie (Metasploit)

##

GoAhead Web Server 2.5 < 3.6.5 - HTTPd 'LD_PRELOAD' Arbitrary Module Load (Metasploit)

##

Oracle VirtualBox < 5.1.30 / < 5.2-rc1 - Guest to Host Escape

# SSD Advisory – Oracle VirtualBox Multiple Guest to Host Escape Vulnerabilities

MixPad 5.00 – Buffer Overflow

#!/usr/bin/python

CentOS Web Panel 0.9.8.12 – ‘row_id’ / ‘domain’ SQL Injection

Document Title: