Vulnerability exists in the function win32k!ReadLayoutFile(), that parses keyboard layout files data. Possible attack vector -- local privileges escalation. Similar vuln (CVE-2012-0183) was patched recently, but Microsoft missed to rewrite vulnerable code on Windows XP, and this PoC still able to crash fully-patched XP SP3. However, pool corruption is not fully-controllable, and reliable code execution exploit development is quite a difficult task.
This exploit is a command injection vulnerability in the HP Hydra client. It allows an attacker to inject arbitrary commands into the vulnerable system. The exploit is triggered by sending a specially crafted packet to the Hydra port (13838) of the vulnerable system. The packet contains a malicious payload which is then executed on the vulnerable system. The payload is a Perl script which opens a port (12345) on the vulnerable system and allows an attacker to connect to it and execute arbitrary commands.
SVG is a XML-based file format for static or animated images. Some SVG specifications (like SVG 1.1 and SVG Tiny 1.2) allow to trigger some Java code when the SVG file is opened. PoC codes are available online at http://www.agarri.fr/docs/batik-evil.svg and https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18890.svg
Artiphp is a content management system (CMS) open and free to create and manage your website. Artiphp stores database backups using backupDB() utility with a predictable file name inside the web root, which can be exploited to disclose sensitive information by downloading the file. The backup is located in '/artzone/artpublic/database/' directory as 'db_backup_[type].[yyyy-mm-dd].sql.gz' filename.
Cyrill Brunschwiler, Security Analyst at Compass Security Network Computing, Switzerland discovered a web application issue based OS command execution flaw in the OpenKM solution. OpenKM does allow administrative users (having the AdminRole) to run bean shell scripts. Due to the flaw, an attacker could lure an OpenKM administrator to a malicious web page that causes arbitrary OS commands being run in the administrators OpenKM session context. This is possible because OpenKM does not implement access control mechanisms to avoid so called Cross-site Request Forgery (a.k.a. CSRF, XSRF, session riding, forceful browsing). The commands are being executed silently. In the end, this allows an attacker to run OS commands with the privileges of the process owner of the application server (JBOSS).
Axous 1.1.1 (And below) suffers from multiple CSRF vulnerabilities which could allow an attacker to change any parameters when an authenticated user/admin browses a special crafted web page. In this Advisory I will only demonstrate how to add a new administrator but, with little modifications to my exploit, you can modify any parameter. Axous 1.1.1 (And below) also suffers from multiple persistent XSS vulnerabilities which could allow an attacker to inject malicious JavaScript code in the application.
The Serendipity backend is prone to a Cross-Site Scripting and SQL-Injection vulnerability. Cross Site-Scripting (CVE-2012-2331) can be exploited by sending a malicious URL to the target. SQL-Injection (CVE-2012-2332) can be exploited by sending a malicious URL to the target.
The remote attacker has the possibility to execute arbitrary SQL Code and bypass the user authentication. To exploit this vulnerability, the attacker needs to perform a login with the following data: Username: admin' OR '1='1 and Password: x
Due to insufficient permission checking in the updateOrganizations method of UserService any user can assign hem or her self to any organization by issueing a single http request. It is common to grant special privileges to members of an organization.
Galette is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Attackers can use a browser to exploit this issue.
Services By CQR