The Telnet server of Schenider Electric ETY Series Controllers have a security vulnerability which allows an attacker to remotely execute code on the device. The vulnerability is triggered by sending a specially crafted packet containing the telnet instance name tTelnetd. This can cause the device to crash and lead to remote code execution.
This module abuses an Invalid Array Indexing Vulnerability on the static function storeImageArray() function in order to produce a memory corruption and finally escape the Java Sandbox. The vulnerability affects Java version 7u21 and earlier.
VLC Player is prone to a remote denial-of-service vulnerability. Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed exploit attempts may result in a denial-of-service condition. VLC Player 2.0.8 is vulnerable; other versions may also be affected.
The Vulnerability Laboratory Research Team discovered a persistent vulnerability in the Photo Transfer Upload v1.0 application (Apple iOS - iPad & iPhone). The file include vulnerability allows remote attackers to include (upload) local file or path requests to compromise the application or service. The vulnerability is located in the upload module when processing to upload files with manipulated filename values in the POST method request.
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the Copy to WebDAV v1.1 application (Apple iOS - iPad & iPhone). The file include vulnerability allows remote attackers to include (upload) local file or path requests to compromise the application or service. The vulnerability is located in the upload module when processing to upload files with manipulated filename value in the POST method request. The attacker can inject local files or path to request own context and compromise the mobile device.
Quack Chat 1.0 is vulnerable to XSS, SQL Injection and Path Diclosure. XSS can be exploited by injecting malicious code into the 'name' parameter of the qchat.php file. SQL Injection can be exploited by injecting malicious code into the 'id' and 'page' parameters of the qc_admin/index.php?p=history file. Path Diclosure can be exploited by injecting malicious code into the 'id' parameter of the qc_admin/index.php?p=history file.
This module exploits a vulnerability found in Joomla 2.5.x up to 2.5.13, as well as 3.x up to 3.1.4 versions. The vulnerability exists in the Media Manager component, which comes by default in Joomla, allowing arbitrary file uploads, and results in arbitrary code execution. The module has been tested successfully on Joomla 2.5.13 and 3.1.4 on Ubuntu 10.04. Note: If public access isn't allowed to the Media Manager, you will need to supply a valid username and password (Editor role or higher) in order to work properly.
This module exploits a stack based buffer overflow in Ultra Mini HTTPD 1.21 allowing remote attackers to execute arbitrary code via a long resource name in an HTTP request.
This module exploits a boundary condition error in Intrasrv Simple Web Server 1.0. The web interface does not validate the boundaries of an HTTP request string prior to copying the data to an insufficiently large buffer. Successful exploitation leads to arbitrary remote code execution in the context of the application.
A SQL injection vulnerability exists in Alibaba Clone Tritanium Version, which allows an attacker to execute arbitrary SQL commands via the 'id' parameter in the 'news_desc.html' script. An attacker can exploit this vulnerability to gain access to sensitive information in the back-end database.
Services By CQR