PCMAN FTP 2.07 is vulnerable to Directory Traversal (quick and dirty code just for PoC) which allows an attacker to access files outside of the web root directory.
The POST parameter 'persistant' which serves for making a new service run in the background is not properly sanitised before being used to execute commands. This can be exploited to inject and execute arbitrary shell commands as well as using cross-site request forgery attacks.
Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Mango suffers from an authenticated arbitrary JSP code execution. The vulnerability is caused due to the improper verification of uploaded image files in 'graphicalViewsBackgroundUpload' script via the 'backgroundImage' POST parameter which allows of arbitrary files being uploaded in '/modules/graphicalViews/web/graphicalViewUploads/'. This can be exploited to execute arbitrary JSP code by uploading a malicious JSP script file that will be stored as a sequence number depending on how many files were uploaded (1.jsp or 2.jsp or 3.jsp .. n.jsp).
A denial of service vulnerability exists in Telegram 3.2 on IOS 9.0.1 when a user pastes 5000 X “A” in their contact name. This causes the application to crash.
Git Windows SVN ssh-agent.exe is vulnerable to buffer overflow. Under cmd dir in Git there is start-ssh-agent.cmd file used to invoke ssh-agent.exe. This is local attack vector in which if the "start-ssh-agent.cmd" file is replaced with specially crafted malicious '.cmd' file we cause buffer overflow, code execution may become possible.
Cross-site Request Forgery exploits the way in which HTTP and web browsers work. Due to the fact that HTTP is a stateless protocol, and that web browsers will include all relevant cookies for the domain that a request is for, if an administrator user was logged into the application and the attacker sent a link that the administrator duly followed (or the attacker tricked them into following a link on a page), the administrator’s browser would include all cookies (including the session cookies) in the request. The attacker’s link would then be executed with administrator privileges. This attack is not limited to sending malicious URLs to users; multiple different attack vectors exist to perform this attack in a more covert manner, such as embedding the attack within an invisible iFrame on a different page. Using the iFrame method it is also possible to submit both GET and POST requests.
FreshFTP suffers a DOS condition due to unexpected format of the QFL file. This DOS condition leads to very high CPU Usage as well as RAM usage which can harm the system.
The Graphical User Interface (GUI) of FortiManager v5.2.2 is vulnerable to two reflected Cross-Site Scripting (XSS) vulnerabilities. 2 potential XSS vectors were identified: XSS vulnerability in SOMVpnSSLPortalDialog and XSS vulnerability in FGDMngUpdHistory. The Graphical User Interface (GUI) of FortiManager v5.2.3 is vulnerable to one reflected XSS vulnerability and one stored XSS vulnerability. 2 potential XSS vectors were identified: XSS vulnerability in sharedjobmanager and XSS vulnerability in SOMServiceObjDialog.
The attached PoC triggers a buffer overflow in the NtGdiBitBlt system call. It reproduces reliably on Win 7 32-bit with Special Pool enabled on win32k.sys.
This exploit allows an attacker to exfiltrate memory from a vulnerable SMF (Simple Machine Forum) installation. The exploit works by sending a specially crafted XML payload to the target server, which then triggers an Object Injection vulnerability. The payload contains an XXE (XML External Entity) element, which is used to send requests to a local server running on the attacker's machine. The local server then responds with the contents of the memory address specified in the payload. The attacker can then use this technique to dump the contents of the target server's memory.
Services By CQR