Exploits

ACE Stream Media 2.1 – ‘acestream://’ Format String

ACE Stream Media 2.1 (acestream://) Format String Exploit PoC

Technicolor TC7200 – Multiple Cross-Site Request Forgery Vulnerabilities

# Exploit Title: Technicolor TC7200 - Multiple CSRF Vulnerabilities

Technicolor TC7200 – Multiple Cross-Site Scripting Vulnerabilities

# Exploit Title: Technicolor TC7200 - Multiple XSS Vulnerabilities

DirectControlTM 3.1.7.0 – Multiple Vulnerabilities

DirectControlTM Version 3.1.7.0 - Multiple Vulnerabilties

Apache Libcloud Digital Ocean API – Local Information Disclosure

source: https://www.securityfocus.com/bid/64617/info

CMS Afroditi – ‘id’ SQL Injection

source: https://www.securityfocus.com/bid/64572/info

WordPress Plugin Advanced Dewplayer – ‘download-file.php’ Script Directory Traversal

source: https://www.securityfocus.com/bid/64587/info

D-Link DSL-2750u ME_1.09 – Cross-Site Request Forgery

######################################################################

Ofilter Player 1.1 – ‘.wav’ Integer Division by Zero

JForum ‘adminUsers’ Module – Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/64540/info

AFCommerce – ‘adblock.php’ Remote File Inclusion

source: https://www.securityfocus.com/bid/64541/info

AFCommerce – ‘adminpassword.php’ Remote File Inclusion

source: https://www.securityfocus.com/bid/64541/info

AFCommerce – ‘controlheader.php’ Remote File Inclusion

source: https://www.securityfocus.com/bid/64541/info

RealNetworks RealPlayer 16.0.3.51/16.0.2.32 – ‘.rmp’ Version Attribute Buffer Overflow

#!/usr/bin/perl

RedHat CloudForms Management Engine 5.1 – agent/linuxpkgs Directory Traversal (Metasploit)

##

OpenSIS ‘modname’ – PHP Code Execution (Metasploit)

##

Synology DiskStation Manager – SLICEUPLOAD Remote Command Execution (Metasploit)

##

Zimbra Collaboration Server 7.2.2/8.0.2 – Local File Inclusion (Metasploit)

##

HP SiteScope issueSiebelCmd – Remote Code Execution (Metasploit)

##

Synology DSM 4.3-3810 – Directory Traversal

Title: Synology DSM multiple directory traversal

Song Exporter 2.1.1 RS iOS – Local File Inclusion

Document Title:

Huawei Technologies du Mobile Broadband 16.0 – Local Privilege Escalation

Huawei Technologies du Mobile Broadband 16.0 Local Privilege Escalation

PHP MBB CMS 004 – Multiple Vulnerabilities

# MBB CMS

xBoard 5.0/5.5/6.0 – ‘view.php’ Local File Inclusion

source: https://www.securityfocus.com/bid/64619/info

WordPress Theme Persuasion 2.x – Arbitrary File Download / File Deletion

Exploit Title: Persuasion Wordpress Theme - Arbitrary File Download and File Deletion Exploit

Easy Karaokay Player 3.3.31 – ‘.wav’ Integer Division by Zero

#!/usr/bin/python

Cisco EPC3925 – Persistent Cross-Site Scripting

#######################################################################

DenyHosts – ‘regex.py’ Remote Denial of Service

source: https://www.securityfocus.com/bid/64478/info

Hancom Office – ‘.hml’ File Processing Heap Buffer Overflow

source: https://www.securityfocus.com/bid/64499/info

Jenkins 1.523 – Persistent HTML Code

###################################################

SonarQube Jenkins Plugin – Plain Text Password

###################################################

Leed – ‘id’ SQL Injection

source: https://www.securityfocus.com/bid/64426/info

Ability Mail Server 2013 3.1.1 – Web UI Persistent Cross-Site Scripting

#!/usr/bin/env python

QuickHeal AntiVirus 7.0.0.1 – Local Stack Overflow

Document Title:

FileMaster SY-IT 3.1 iOS – Multiple Web Vulnerabilities

Document Title:

Microsoft Windows – ‘ndproxy.sys’ Local Privilege Escalation (Metasploit)

##

Nvidia (nvsvc) Display Driver Service – Local Privilege Escalation (Metasploit)

##

Adobe Reader ToolButton – Use-After-Free (Metasploit)

##

PHP – ‘openssl_x509_parse()’ Memory Corruption

SektionEins GmbH

Ditto Forensic FieldStation 2013Oct15a – Multiple Vulnerabilities

Title: Ditto Forensic FieldStation, multiple vulnerabilities

Microsoft Windows Kernel – ‘win32k.sys’ Integer Overflow (MS13-101)

Core Security - Corelabs Advisory

InstantCMS 1.10.3 – Blind SQL Injection

Advisory ID: HTB23185

Piwigo – ‘admin.php’ Cross-Site Request Forgery (User Creation)

source: https://www.securityfocus.com/bid/64357/info

WordPress Core 2.0.11 – ‘/wp-admin/options-discussion.php’ Script Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/64564/info

Gitlab 6.0 – Persistent Cross-Site Scripting

##Exploit-DB note: Tested commit 10b0b8f1797e6c09b4c063c04a4864ecd31d34f4

VUPlayer 2.49 – ‘.m3u’ File Universal Buffer Overflow (DEP Bypass) (2)

# VUPlayer 2.49 (.M3U) Exploit(Universal buffer overflow/DEP bypass)

Wallpaper Script 3.5.0082 – Persistent Cross-Site Scripting

[~] Exploit Title : Wallpaper Script Stored XSS Vulnerability

iScripts MultiCart 2.4 – Persistent Cross-Site Scripting / Cross-Site Request Forgery / Cross-Site Scripting / Cross-Site Request Forgery / Mass Accounts Takeover

# Exploit Title : iScripts MultiCart same product id for which you submited the review.

UPC Ireland Cisco EPC 2425 Router / Horizon Box – WPA-PSK Handshake Information

# Exploit Title: UPC Ireland Cisco EPC 2425 Router / Horizon Box

Beetel TC1-450 Airtel Wireless Router – Multiple Cross-Site Request Forgery Vulnerabilities

# Exploit Title: Beetel TC1-450 Airtel Wireless Router - Multiple CSRF Vulnerabilities