Exploits

A10 Networks ACOS 2.7.0-P2 (Build 53) – Buffer Overflow (PoC)

-----BEGIN PGP SIGNED MESSAGE-----

CMS Made Simple 1.11.10 – Multiple Cross-Site Scripting Vulnerabilities

Exploit Title : CMS Made Simple 1.11.10 Multiple XSS Vulnerability

Oracle Identity Manager 11g R2 SP1 (11.1.2.1.0) – Unvalidated Redirects

Unvalidated Redirects on Oracle Identity Manager

CIS Manager CMS – SQL Injection

[+] Sql Injection on CIS Manager CMS

iShare Your Moving Library 1.0 iOS – Multiple Vulnerabilities

Document Title:

Kloxo 6.1.18 Stable – Cross-Site Request Forgery

# Exploit Title :Kloxo 6.1.18 Stable CSRF Vulnerability

Kloxo-MR 6.5.0 – Cross-Site Request Forgery

# Exploit Title :Kloxo-MR 6.5.0 CSRF Vulnerability

ZamFoo – Multiple Remote Command Execution Vulnerabilities

source: https://www.securityfocus.com/bid/67215/info

Horde Webmail 5.1 – Open Redirect

[+] Horde webmail - Open Redirect Vulnerability

PhonerLite 2.14 SIP Soft Phone – SIP Digest Disclosure

-----BEGIN PGP SIGNED MESSAGE-----

Alienvault 4.5.0 – (Authenticated) SQL Injection (Metasploit)

The following request is vulnerable to a SQL injection attack from authenticated users.

plexusCMS 0.5 – Cross-Site Scripting / Remote Shell / Credentials Leak

# Exploit Title: plexusCMS 0.5 XSS Remote Shell Exploit

PhotoWIFI Lite 1.0 iOS – Multiple Vulnerabilities

Document Title:

Vanctech File Commander 1.1 iOS – Multiple Vulnerabilities

Document Title:

SePortal 2.5 – SQL Injection / Remote Code Execution (Metasploit)

##

WordPress Plugin Ajax Pagination 1.1 – Local File Inclusion

Details

EMC Cloud Tiering Appliance 10.0 – XML External Entity Arbitrary File Read (Metasploit)

EMC Cloud Tiering Appliance v10.0 Unauthed XXE

Primo Interactive CMS – ‘pcm.cgi’ Remote Command Execution

source: https://www.securityfocus.com/bid/66549/info

AudioCoder 0.8.29 – Memory Corruption (SEH)

###########################################################

ASP-Nuke 2.0.7 – ‘gotourl.asp’ Open Redirect

[+] ASP-Nuke 2.0.7 - Open Redirect Vulnerability in gotourl

Fitnesse Wiki – Remote Command Execution (Metasploit)

##

iStArtApp FileXChange 6.2 iOS – Multiple Vulnerabilities

Document Title:

Dell SonicWALL EMail Security Appliance Application 7.4.5 – Multiple Vulnerabilities

Document Title:

FTP Drive + HTTP 1.0.4 iOS – Code Execution

Document Title:

Lazybone Studios WiFi Music 1.0 iOS – Multiple Vulnerabilities

Document Title:

Easy FileManager 1.1 iOS – Multiple Vulnerabilities

Document Title:

ePhone Disk 1.0.2 iOS – Multiple Vulnerabilities

Document Title:

LinEx – Password Reset

# Exploit Title: LinEx All Versions Password Reset Vulnerability

Joomla! Component Kunena 3.0.4 – Persistent Cross-Site Scripting

Persistent XSS in Joomla::Kunena 3.0.4

Katello (RedHat Satellite) – users/update_roles Missing Authorisation (Metasploit)

##

InterWorx Control Panel 5.0.13 build 574 – ‘xhr.php?i’ SQL Injection

=================================================

Apache CouchDB 1.5.0 – ‘uuids’ Denial of Service

# Exploit Title: Couchdb uuids DOS exploit

OpenCart 1.5.6.1 – ‘openbay’ Multiple SQL Injections

# Exploit Title : OpenCart log('getEbayItemId() - Product ID: '.$product_id);

VirusChaser 8.0 – Stack Buffer Overflow

# Exploit Title: VirusChaser 8.0 - Stack Buffer Overflow

Allied Telesis AT-RG634A ADSL Broadband Router – Web Shell

Allied Telesis AT-RG634A ADSL Broadband router hidden administrative

IBM Tealeaf CX 8.8 – Remote OS Command Injection

# IBM Tealeaf CX (v8 release 8) Remote OS Command Injection

DotItYourself – ‘dot-it-yourself.cgi’ Remote Command Execution

source: https://www.securityfocus.com/bid/66487/info

Beheer Systeem – ‘pbs.cgi’ Remote Command Execution

source: https://www.securityfocus.com/bid/66489/info

Getsimple CMS 3.3.1 – Persistent Cross-Site Scripting

# Exploit Title: etSimple CMS v3.3.1 Persistent Cross Site Scripting

Cart Engine 3.0.0 – Remote Code Execution

Cart Engine 3.0.0 Remote Code Execution

Cart Engine 3.0.0 – ‘task.php’ Local File Inclusion

Cart Engine 3.0.0 (task.php) Local File Inclusion Vulnerability

Cart Engine 3.0.0 – Database Backup Disclosure

Kemana Directory 1.5.6 – kemana_admin_passwd Cookie User Password Hash Disclosure

Kemana Directory 1.5.6 kemana_admin_passwd Cookie User Password Hash Disclosure

Kemana Directory 1.5.6 – Remote Code Execution

Kemana Directory 1.5.6 Remote Code Execution

Kemana Directory 1.5.6 – ‘task.php’ Local File Inclusion

Kemana Directory 1.5.6 (run param) Local File Inclusion Vulnerability

Kemana Directory 1.5.6 – Database Backup Disclosure

Kemana Directory 1.5.6 – ‘qvc_init()’ Cookie Poisoning CAPTCHA Bypass

#!C:\Perl64\bin\perl.exe

qEngine CMS 6.0.0 – Multiple Vulnerabilities

FreePBX – ‘config.php’ Remote Code Execution (Metasploit)

##

Haihaisoft HUPlayer 1.0.4.8 – ‘.m3u’ / ‘.pls’ / ‘.asx’ Buffer Overflow (SEH)

#-----------------------------------------------------------------------------#