Bosch Security Systems DVR 630/650/670 series systems suffer from remote command execution as root and administrative password disclosure vulnerabilities.
719dd71f72a8aca1337281c76c2924d8Allied Telesis AT-MCF2000M version 3.0.2 suffers from a local root-level privilege escalation vulnerability.
4c2584b5e94ec7f5f55d14a740bab7e3This Metasploit module exploits a vulnerability found in Narcissus image configuration function. This is due to the backend.php file not handling the $release parameter properly, and then passes it on to the configure_image() function. In this function, the $release parameter can be used to inject system commands for passthru (a PHP function that's meant to be used to run a bash script by the vulnerable application), which allows remote code execution under the context of the web server.
7e5ccde71d249ff814c86c697a3cde11Narcissus online image builder suffers from a remote command execution vulnerability.
22a534aae90a11b4f47267228486925bdotProject versions 2.1.6 and below suffer from a remote file inclusion vulnerability.
685aa21c038e71ef7a0f03b8c14b5724netOffice Dwins versions 1.4p3 and below suffer from a remote SQL injection vulnerability.
5aeeed58f4247c77cb22adf0adc12ea2This Metasploit module exploits multiple design flaws in Sflog 1.0. By default, the CMS has a default admin credential of "admin:secret", which can be abused to access administrative features such as blogs management. Through the management interface, we can upload a backdoor that's accessible by any remote user, and then gain arbitrary code execution.
12ae94a4a6178fe449f24fdbf74b4c20WebPA versions 1.1.0.1 and below suffers from add administrator and arbitrary file upload vulnerabilities.
3c213bf9e0a7f33fc0e2999108c7fdc6WeBid versions 1.0.4 and below suffer from local file disclosure, remote file inclusion, and remote SQL injection vulnerabilities.
ac9c4aac1cb4fe45a1096c644e47b339This Metasploit module exploits a vulnerability found in WebPageTest's Upload Feature. By default, the resultimage.php file does not verify the user-supplied item before saving it to disk, and then places this item in the web directory accessable by remote users. This flaw can be abused to gain remote code execution.
c1b226b0a2afb2c37bcc29968221e367WebPageTest versions 2.6 and below suffer from local file inclusion, shell upload, file disclosure, and file deletion vulnerabilities.
6fe7fd922ccfc07bdf20f4269f11c32esflog! versions 1.00 and below suffer from local file inclusion, administrative password disclosure, and remote shell upload vulnerabilities.
f7595d6fc73ab2011bfdc0c93d3b352cphpMyBackupPro versions 2.2 and below suffer from a local file inclusion vulnerability.
aa8e9c79f09bd7316bd9dced5a67ba68webERP versions 4.08.1 and below suffer from local file inclusion and remote file inclusion vulnerabilities.
29897d5e0da40e62521121cbf9e7bd4cUCCASS versions 1.8.1 and below suffer from a remote blind SQL injection vulnerability.
1b88abfe3d8466786ced75eea0d38b68WEBO Site SpeedUp versions 1.6.1 and below suffer from local file inclusion and remote file inclusion vulnerabilities.
c648f85ddde348ddde858bf3f5bbc613LimeSurvey version 1.92+ Build 120620 suffers from remote file inclusion and traversal vulnerabilities.
e430b74e92d64901e8aa4eee3b3caf9eJoomla Captcha plugin versions 4.5.1 and below suffer from a file disclosure vulnerability.
8f27c42889b83425c6e11ecb81ef5b9fSahana Agasti versions 0.6.5 and below suffer from local file inclusion, configuration disclosure, and shell upload vulnerabilities.
a6483f98c28741a0d17df20f1f98ddb2PhpGedView versions 4.2.3 and below suffer from a local file inclusion vulnerability.
877502e76913166a7d694cff9f1ababdSahana Agasti versions 0.6.4 and below suffer from a remote SQL injection vulnerability.
a88ad6edc2dc0328288895930eefae2aChurchInfo versions 1.2.12 and below suffer from a remote SQL injection vulnerability.
af118b8d4ba1169cc144e4059a16a71bStar Downloader Free versions 1.45 and below universal SEH overwrite exploit.
52a2c7b50a848bce55d5c871d4b64095HTML Email Creator versions 2.1b668 and below local SEH overwrite exploit.
e6adee73c13f55b2a3fd5edbea6260cbJinzora Media Jukebox versions 2.8 and below suffer from a local file inclusion vulnerability.
c3db3ab7ef8a6a2682620c3cff1e1d97
© 2016 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed