EMC CMCNE 11.2.1 – FileUploadController Remote Code Execution (Metasploit)
require 'msf/core'
java
java 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Automated Logic WebCTRL 6.5 – Unrestricted File Upload / Remote Code Execution
#!/usr/bin/env python
Automated Logic WebCTRL 6.1 – Path Traversal / Arbitrary File Write
Automated Logic WebCTRL 6.1 Path Traversal Arbitrary File Write
Jenkins < 1.650 - Java Deserialization
import random
ManageEngine Desktop Central 10 Build 100087 – Remote Code Execution (Metasploit)
# Exploit Title: ManageEngine Desktop Central 10 Build 100087 RCE
ManageEngine ServiceDesk Plus 9.0 – Authentication Bypass
Title: ManageEngine ServiceDesk Plus Application Compromise
Oracle PeopleSoft – Server-Side Request Forgery
Application: Oracle PeopleSoft
CloudBees Jenkins 2.32.1 – Java Deserialization
Source: https://blogs.securiteam.com/index.php/archives/3171
Serviio PRO 1.8 DLNA Media Streaming Server – REST API Arbitrary Password Change
#!/usr/bin/env python
Serviio PRO 1.8 DLNA Media Streaming Server – REST API Information Disclosure
#!/usr/bin/env python
Grails PDF Plugin 0.6 – XML External Entity Injection
# Exploit Title: Grails PDF Plugin 0.6 XXE
OpenText Documentum D2 – Remote Code Execution
CVE Identifier: CVE-2017-5586
Blackboard LMS 9.1 SP14 – Cross-Site Scripting
Document Title:
ManagEnegine ADManager Plus 6.5.40 – Multiple Vulnerabilities
1. ADVISORY INFORMATION
Java Debug Wire Protocol (JDWP) – Remote Code Execution
#!/usr/bin/python
Red Hat JBoss EAP – Deserialization of Untrusted Data
Security Advisory @ Mediaservice.net Srl
AppFusions Doxygen for Atlassian Confluence 1.3.2 – Cross-Site Scripting
[RCESEC-2016-009] AppFusions Doxygen for Atlassian Confluence v1.3.2 renderContent() Persistent Cross-Site Scripting
Atlassian Confluence AppFusions Doxygen 1.3.0 – Directory Traversal
RCE Security Advisory
ManageEngine ServiceDesk Plus 9.2 Build 9207 – Unauthorized Information Disclosure
Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets
Symantec Messaging Gateway 10.6.1 – Directory Traversal
# Title : Symantec Messaging Gateway
Sakai 10.7 – Multiple Vulnerabilities
Sakai 10.7 Multiple Vulnerabilities
ColoradoFTP 1.3 Prime Edition (Build 8) – Directory Traversal
###################################################
Micro Focus Filr 2 2.0.0.421/1.2 1.2.0.846 – Multiple Vulnerabilities
SEC Consult Vulnerability Lab Security Advisory < 20160725-0 >
SAP NetWeaver AS JAVA 7.1 < 7.5 - Directory Traversal
Application: SAP NetWeaver AS JAVA
SAP NetWeaver AS JAVA 7.1 < 7.5 - 'ctcprotocol Servlet' XML External Entity
Application: SAP NetWeaver AS JAVA
Apache Continuum 1.4.2 – Multiple Vulnerabilities
# Exploit Title: Unauthenticated command injection - Apache Continuum
PowerFolder Server 10.4.321 – Remote Code Execution
Mogwai Security Advisory MSA-2016-01
SAP xMII 15.0 – Directory Traversal
Application: SAP xMII
Symantec Brightmail 10.6.0-7 – LDAP Credentials Disclosure (Metasploit)
# Exploit Title: Symantec Brightmail ldap credential Grabber
Solr 3.5.0 – Arbitrary Data Deletion
# Exploit Title: All Solr Data Can Be Delete
Hippo CMS 10.1 – Multiple Vulnerabilities
Hippo CMS 10.1 XML External Entity Information Disclosure Vulnerability
GlassFish Server – Arbitrary File Read
# Title: glassfish Arbitrary file read vulnerability
OpenMRS Reporting Module 0.9.7 – Remote Code Execution
Title: Unauthenticated remote code execution in OpenMRS
FireEye – Wormable Remote Code Execution in MIP JAR Analysis
Source: https://code.google.com/p/google-security-research/issues/detail?id=666
Jenkins 1.633 – Credential Recovery
# Exploit Title: Jenkins Unauthenticated Credential Recovery
JIRA and HipChat for JIRA Plugin – Velocity Template Injection
############################################################################
Jenkins 1.626 – Cross-Site Request Forgery / Code Execution
# Title: Jenkins 1.626 - Cross Site Request Forgery / Code Execution
Apache JackRabbit – WebDAV XML External Entity
#!/usr/bin/env python
JBoss JMXInvokerServlet JMXInvoker 0.3 – Remote Command Execution
import java.io.BufferedReader;