Reliable exploit for the Plesk PHP code injection vulnerability disclosed by Kingcope in June 2013. Can deliver inline and reverse shells using the payloads library, as well as offering (buggy) file upload features.
b76333a40c15eeb1e6e0fe351ee9f933ff24a237da980ed7dc853fd2e1f0d52cThis is a simple PHP backdoor using HTTP headers to inject the code as opposed to a GET or POST variable. Uses the fictional "Code: " header as an example, for learning purposes. This is not production code.
397d3f851a08bef7d13138eedf2b87ab8e732b35f14514f58a2162c103188aabThis is a NSE script written for nmap that adds vulnerability scanning.
a36473e6e38e4484f78ca4df6a612d03afa635b3f67c7fc0ab609db50416ec42Red Hat Security Advisory 2013-0982-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. It was found that Thunderbird allowed data to be sent in the body of XMLHttpRequest HEAD requests. In some cases this could allow attackers to conduct Cross-Site Request Forgery attacks.
91f56531f39853c2f2a1ca750e63373cbb3dcd514af9628c72e9ad093402a100Mandriva Linux Security Advisory 2013-177 - Updated dbus packages fix security vulnerability. Alexandru Cornea discovered a vulnerability in libdbus caused by an implementation bug in _dbus_printf_string_upper_bound(). This vulnerability can be exploited by a local user to crash system services that use libdbus, causing denial of service. Depending on the dbus services running, it could lead to complete system crash.
ed69c941247755b87316d8236dd675a2060fc54bc73a88d694ef3c9461b2a491Red Hat Security Advisory 2013-0981-01 - Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. It was found that Firefox allowed data to be sent in the body of XMLHttpRequest HEAD requests. In some cases this could allow attackers to conduct Cross-Site Request Forgery attacks.
bb2fefe37dacf96fb5a3a797951020c7907c180ac273dbfd9ed79f4bd0e90792IceWarp Mail Server versions 10.4.5 and below suffer from cross site scripting and XML external entity injection vulnerabilities.
84d292ec76f89464eea4d17baff572a4b0ef0577f2fb641e3f8541b6a69f2f43This bulletin summary lists two re-released Microsoft security bulletins for June, 2013.
7be8a748fe11f05e2477449bf46e22be71e0183fc7fe28d11901091eee25333cXopie Virtual Shop suffers from a cross site scripting vulnerability. Note that this advisory has site-specific information.
5ff477d1888070ff122a5d545c253879ad7281c86a03d72b36347ca511ff904fMagnolia CMS versions 4.5.8 and below suffer from multiple access control vulnerabilities that allow a non-administrative user to access and execute administrative functionalities.
fb6c27a0797c4b1ac97ad5992f8eddfb9cd896a72f7e7d7b719810e87f85d694HP Security Bulletin HPSBHF02878 - A potential security vulnerability has been identified with the HP Smart Zero Client. This vulnerability could be exploited by a local user on the device to gain unauthorized access. Revision 1 of this advisory.
91be9a52473f882f112ec519c2376429e317345e0d0a9fcedb76aeeda522a789Mandriva Linux Security Advisory 2013-178 - Updated nfs-utils packages fix a security vulnerability. It was reported that rpc.gssd in nfs-utils is vulnerable to DNS spoofing due to it depending on PTR resolution for GSSAPI authentication. Because of this, if a user where able to poison DNS to a victim's computer, they would be able to trick rpc.gssd into talking to another server than the intended server (with stricter security). If the victim has write access to the second server, and the attacker has read access (when they normally might not on the secure server), the victim could write files to that server, which the attacker could obtain (when normally they would not be able to). To the victim this is transparent because the victim's computer asks the KDC for a ticket to the second server due to reverse DNS resolution; in this case Krb5 authentication does not fail because the victim is talking to the correct server.
a1e3a132caeeb99ce5cc2a4afed913edaa8f9c54dbe4627d420f48c92e348f9fRed Hat Security Advisory 2013-0983-01 - cURL provides the libcurl library and a command line tool for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. A heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially-crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code.
a7fa5f3acd97b0e062e7116dd627f4fc0ac45395d1e94fe95cabb6cf342a2e84Against is a very fast ssh attack script which includes a multithreaded port scanning module (tcp connect) for discovering possible targets and a multithreaded brute-forcing module which attacks in parallel (multiprocessing) all discovered hosts or given ip addresses from a list.
a381147676345ca9c836e4c1462e3640dcacda8fa9c672bb180705d90835376bThe OpenID idp software "Barnraiser Prairie" suffers from a directory traversal vulnerability.
1ad81e02ee42a9511c7683f63d96e32a3ce1513c07afe374fd2a2aa94218d4d4Baby FTP Server version 1.24 suffers from a denial of service vulnerability.
57a30ba98c73848393ea7ef56c626af98d1732a7c4117166d3a53e37bb816e21
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed