JBoss AS 3/4/5/6 – Remote Command Execution
# coding: utf-8
multiple
multiple 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Metasploit Project < 4.11.1 - Initial User Creation Cross-Site Request Forgery (Metasploit)
# Exploit Title: Metasploit Project initial User Creation CSRF
CrushFTP 7.2.0 – Multiple Vulnerabilities
========================================================
ManageEngine OpManager / Applications Manager / IT360 – ‘FailOverServlet’ Multiple Vulnerabilities
>> Multiple vulnerabilities in FailOverServlet in ManageEngine OpManager, Applications Manager and IT360
Symantec Data Center Security – Multiple Vulnerabilities
SEC Consult Vulnerability Lab Security Advisory < 20150122-0 >
jclassifiedsmanager – Multiple Vulnerabilities
# Exploit Title: jclassifiedsmanager Multiple Vulnerabilities
SWFupload 2.5.0 – Cross Frame Scripting (XFS)
# Exploit Title: SWFupload All Version XSF Vulnerability
ManageEngine Desktop Central – Create Administrator
>> Administrator account creation in ManageEngine Desktop Central / Desktop Central MSP
Ansible Tower 2.0.2 – Multiple Vulnerabilities
SEC Consult Vulnerability Lab Security Advisory < 20150113-1 >
Ntpdc 4.2.6p3 – Local Buffer Overflow
# Source: https://hatriot.github.io/blog/2015/01/06/ntpdc-exploit/
Pimcore CMS 2.3.0/3.0 – SQL Injection
Document Title:
ManageEngine Netflow Analyzer / IT360 – Arbitrary File Download
>> Arbitrary file download in ManageEngine Netflow Analyzer and IT360
tcpdump 4.6.2 – Geonet Decoder Denial of Service
CVE-2014-8768 tcpdump denial of service in verbose mode using malformed
JourneyMap 5.0.0RC2 Ultimate Edition – Resource Consumption (Denial of Service)
# Exploit Title: JourneyMap Disk-space consumption exploit
FluxBB < 1.5.6 - SQL Injection
#!/usr/bin/env python
clientResponse Client Management 4.1 – Cross-Site Scripting
# Exploit Title: clientResponse Client Management XSS Vulnerability
Gogs – ‘users’/’repos’ ‘?q’ SQL Injection
Unauthenticated SQL Injection in Gogs repository search
Gogs – ‘label’ SQL Injection
Blind SQL Injection in Gogs label search
Joomla! Component com_hdflvplayer < 2.1.0.1 - SQL Injection
#!/usr/bin/python
Proticaret E-Commerce Script 3.0 – SQL Injection (1)
Document Title:
Subex Fms 7.4 – SQL Injection
=======================================================================================
Password Manager Pro / Pro MSP – Blind SQL Injection
>> Authenticated blind SQL injection in Password Manager Pro / Pro MSP
ManageEngine OpManager / Social IT Plus / IT360 – Multiple Vulnerabilities
>> Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360
ManageEngine EventLog Analyzer – Multiple Vulnerabilities (2)
>> Multiple vulnerabilities in ManageEngine EventLog Analyzer
HP Operations Agent – Cross-Site Scripting iFrame Injection
#!/usr/bin/python
Nessus Web UI 2.3.3 – Persistent Cross-Site Scripting
Nessus Web UI 2.3.3: Stored XSS
Moab < 7.2.9 - Authentication Bypass
##[Moab Authentication Bypass : CVE-2014-5300]##
Laravel – ‘Hash::make()’ Password Truncation Security
source: https://www.securityfocus.com/bid/69849/info
Jenkins 1.578 – Multiple Vulnerabilities
#Affected Vendor: http://jenkins-ci.org/
Mozilla Firefox 9.0.1 / Thunderbird 3.1.20 – Information Disclosure
source: https://www.securityfocus.com/bid/69525/info
Syslog LogAnalyzer 3.6.5 – Persistent Cross-Site Scripting
Vulnerability title: Syslog LogAnalyzer 3.6.5 Stored XSS
Arachni Web Application Scanner Web UI – Persistent Cross-Site Scripting
Title: Arachni Web Application Scanner Web UI Stored XSS Vulnerability
NRPE 2.15 – Remote Code Execution
#!/usr/bin/python
ManageEngine DeviceExpert 5.9 – User Credential Disclosure
>> User credential disclosure in ManageEngine DeviceExpert 5.9
Granding MA300 – Weak Pin Encryption Brute Force
source: https://www.securityfocus.com/bid/69390/info
Granding MA300 – Traffic Sniffing Man In The Middle Fingerprint PIN Disclosure
source: https://www.securityfocus.com/bid/69390/info
ntopng 1.2.0 – Cross-Site Scripting Injection
ntopng 1.2.0 XSS injection using monitored network traffic