Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.
A path traversal vulnerability that can be exploited to read files outside of the web root using encoded dot and slash characters.
A heap-based buffer overflow vulnerability was discovered in the read_1_byte function of Dwarf2.c in binutils. The vulnerability occurs when a specially crafted ELF file is processed by the nm utility. The read_1_byte function reads a single byte from a buffer, but does not check if the requested byte is within the bounds of the buffer. This can lead to a heap-based buffer overflow, which can be exploited to execute arbitrary code.
This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes. If successful, it could cause the Notes client to hang and have to be restarted.
The functions.php file line 88 has hardcoded admin credentials. Using the hardcoded admin credentials we then have access to the view.php file that is vulnerable to Blind SQL injection.
ClipShare is the first and most popular PHP video script for building highly-profitable video sharing websites. SQL injection on [category] URI parameter. Proof of Concept (PoC): SQLi: https://localhost/[path]/videos/[category]' AND 5593=5593 AND 'LJPS'='LJPS Parameter: #1* (URI) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: https://localhost/[path]/videos/[category]' AND 5593=5593 AND 'LJPS'='LJPS Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: https://localhost/[path]/videos/[category]' AND SLEEP(5) AND 'xNCN'='xNCN
This exploit is a JSP Remote Code Execution vulnerability which allows an attacker to execute arbitrary code on the vulnerable server. The vulnerability is caused by the lack of input validation and the use of user-supplied data in the JSP code. The attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious code to the vulnerable server. The malicious code will then be executed on the server, allowing the attacker to gain access to the server and execute arbitrary code.
This module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands. All versions from 2.2.2 up to 2.2.22 should be vulnerable.
Utilizing Rancher Server, an attacker can create a docker container with the '/' path mounted with read/write permissions on the host server that is running the docker container. As the docker container executes command as uid 0 it is honored by the host operating system allowing the attacker to edit/create files owed by root. This exploit abuses this to creates a cron job in the '/etc/cron.d/' path of the host server. The Docker image should exist on the target system or be a valid image from hub.docker.com. Use `check` with verbose mode to get a list of exploitable Rancher Hosts managed by the target system.
PyroBatchFTP is vulnerable to a buffer overflow vulnerability when a long string is sent to the FTP server. This can be exploited to execute arbitrary code by overwriting the SEH handler. The vulnerability exists due to a lack of proper bounds checking of user-supplied data before copying it into a fixed-length buffer.
Services By CQR