Websecurity - Веб безпека

В даній добірці експлоіти в веб додатках:

• IBM DB2 < 9.5 pack 3a Malicious Connect Denial of Service Exploit (деталі)
• IBM DB2 < 9.5 pack 3a Malicious Data Stream Denial of Service Exploit (деталі)
• ActiveKB Knowledgebase (loadpanel.php Panel) Local File Inclusion Vuln (деталі)
• glFusion <= 1.1.2 COM_applyFilter()/cookies Blind SQL Injection Exploit (деталі)
• form2list (page.php id) Remote SQL Injection Vulnerability (деталі)
• Family Connections <= 1.8.2 Remote Shell Upload Exploit (деталі)
• Gravity Board X 2.0b SQL Injection / Post Auth Code Execution (деталі)
• AdaptBB 1.0 (topic_id) SQL Injection / Credentials Disclosure Exploit (деталі)
• Amaya 11.1 XHTML Parser Remote Buffer Overflow PoC (деталі)
• Joomla Component com_bookjoomlas 0.1 SQL Injection Vulnerability (деталі)
• XBMC 8.10 GET Request Remote Buffer Overflow Exploit (SEH) (univ) (деталі)
• FlexCMS Calendar (ItemId) Blind SQL Injection Vulnerability (деталі)
• iDB 0.2.5pa SVN 243 (skin) Local File Inclusion Exploit (деталі)
• Family Connections CMS <= 1.8.2 Blind SQL Injection Vulnerability (деталі)
• Exploits Amaya (id) Remote Stack Overflow Vulnerability (деталі)

В даній добірці експлоіти в веб додатках:

• VirtueMart <= 1.1.2 Multiple Remote Vulnerabilities (деталі)
• webEdition <= 6.0.0.4 (WE_LANGUAGE) Local File Inclusion Vulnerability (деталі)
• JobHut 1.2 Remote Password Change/Delete/Activate User Vulnerability (деталі)
• PHPRecipeBook 2.39 (course_id) Remote SQL Injection Vulnerability (деталі)
• vsp stats processor 0.45 (gamestat.php gameID) SQL Injection Vuln (деталі)
• Sun Calendar Express Web Server (DoS/XSS) Multiple Remote Vulns (деталі)
• Koschtit Image Gallery 1.82 Multiple Local File Inclusion Vulnerabilities (деталі)
• Oracle WebLogic IIS connector JSESSIONID Remote Overflow Exploit (деталі)
• XBMC 8.10 (GET Requests) Multiple Remote Buffer Overflow PoC (деталі)
• XBMC 8.10 (Get Request) Remote Buffer Overflow Exploit (win) (деталі)
• XBMC 8.10 (takescreenshot) Remote Buffer Overflow Exploit (деталі)
• XBMC 8.10 (get tag from file name) Remote Buffer Overflow Exploit (деталі)
• MyioSoft Ajax Portal 3.0 (page) SQL Injection Vulnerability (деталі)
• TinyPHPForum 3.61 File Disclosure / Code Execution Vulnerabilities (деталі)
• Exploits Amaya (URL Bar) Remote Stack Overflow Vulnerability (деталі)

В даній добірці експлоіти в веб додатках:

• Diskos CMS Manager (SQL/DB/Auth Bypass) Multiple Vulnerabilities (деталі)
• BandSite CMS 1.1.4 (members.php memid) SQL Injection Vulnerability (деталі)
• Sami HTTP Server 2.x (HEAD) Remote Denial of Service Exploit (деталі)
• Check Point Firewall-1 PKI Web Service HTTP Header Remote Overflow (деталі)
• Amaya 11.1 W3C Editor/Browser (defer) Stack Overflow PoC (деталі)
• Gravy Media CMS 1.07 Multiple Remote Vulnerabilities (деталі)
• NOKIA Siemens FlexiISN 3.1 Multiple Auth Bypass Vulnerabilities (деталі)
• X-Forum 0.6.2 Remote Command Execution Exploit (деталі)
• JobHut <= 1.2 (pk) Remote SQL Injection Vulnerability (деталі)
• Family Connection 1.8.1 Multiple Remote Vulnerabilities (деталі)
• Amaya 11.1 W3C Editor/Browser (defer) Stack Overflow Exploit (деталі)
• Community CMS 0.5 Multiple SQL Injection Vulnerabilities (деталі)
• Podcast Generator <= 1.1 Remote Code Execution Exploit (деталі)
• VirtueMart <= 1.1.2 Remote SQL Injection Exploit (meta) (деталі)
• Comersus Shopping Cart <= v6 Remote User Pass Exploit (деталі)

05.09.2009

Нещодавно я писав про переповнення стека в Microsoft IIS 5.0 та 6.0. Після якої була виявлена нова уразливість в IIS.

Вчора була виявлена Denial of Service уразливість у вбудованому FTP сервері в Microsoft IIS. Для даної уразливості був розроблений експлоіт.

Уразливі версії: Microsoft IIS 5.0, IIS 6.0.

• Microsoft IIS 5.0/6.0 FTP Server (Stack Exhaustion) Denial of Service (деталі)

15.10.2009

Додаткова інформація.

• Important Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution (975254) (деталі)
• Microsoft Internet Information Server ftpd zeroday (деталі)

В даній добірці експлоіти в веб додатках:

• DirectAdmin <= 1.33.1 Symlink Permission Bypass Vuln (untested) (деталі)
• WeBid 0.7.3 RC9 (upldgallery.php) Remote File Upload Vulnerability (деталі)
• PHPizabi v0.848b C1 HFP1-3 Remote Arbitrary File Upload Exploit (деталі)
• blogplus 1.0 Multiple Local File Inclusion Vulnerabilities (деталі)
• PhotoStand 1.2.0 Remote Command Execution Exploit (деталі)
• Acute Control Panel 1.0.0 (SQL/RFI) Multiple Remote Vulnerabilities (деталі)
• XM Easy Personal FTP Server <= 5.7.0 (NLST) DoS Exploit (деталі)
• Free PHP Petition Signing Script (Auth Bypass) SQL Injection Vuln (деталі)
• Simply Classified 0.2 (category_id) SQL Injection Vulnerability (деталі)
• Arcadwy Arcade Script (username) Static XSS Vulnerability (деталі)
• Moodle < 1.6.9/1.7.7/1.8.9/1.9.5 File Disclosure Vulnerability (деталі)
• My Simple Forum 7.1 (LFI) Remote Command Execution Exploit (деталі)
• glFusion <= 1.1.2 COM_applyFilter()/order SQL Injection Exploit (деталі)
• Arcadwy Arcade Script (Auth Bypass) Insecure Cookie Handling Vuln (деталі)
• iWare CMS 5.0.4 Multiple Remote SQL Injection Vulnerabilities (деталі)

В даній добірці експлоіти в веб додатках:

• Gigaset SE461 WiMAX router Remote Denial of Service Vulns (деталі)
• X-BLC 0.2.0 (get_read.php section) SQL Injection Vulnerability (деталі)
• Syzygy CMS 0.3 LFI/SQL Command Injection Exploit (деталі)
• Telnet-Ftp Service Server v1.x Multiple Vulnerabilities (post auth) (деталі)
• Codice CMS 2 Remote SQL Command Execution Exploit (деталі)
• Pluck CMS 4.6.1 (module_pages_site.php post) LFI Exploit (деталі)
• Rittal CMC-TC Processing Unit II Multiple Vulnerabilities (деталі)
• PHPizabi v0.848b C1 HFP1-3 Remote Command Execution Exploit (деталі)
• Free Arcade Script 1.0 Auth Bypass (SQL) / Upload Shell Vulnerabilities (деталі)
• IncrediMail 5.86 (XSS) Script Execution Exploit (деталі)
• Femitter FTP Server 1.x Multiple Vulnerabilities (post auth) (деталі)
• SurfMyTV Script 1.0 (view.php id) SQL Injection Vulnerability (деталі)
• PHPizabi v0.848b C1 HFP1 Remote Privilege Escalation Vulnerability (деталі)
• Jinzora Media Jukebox <= 2.8 (name) Local File Inclusion Vulnerability (деталі)
• Joomla Component mdigg 2.2.8 Blind SQL Injection Exploit (деталі)

В даній добірці експлоіти в веб додатках:

• UBB.threads 5.5.1 (message) Remote SQL Injection Vulnerability (деталі)
• phpComasy 0.9.1 (entry_id) SQL Injection Vulnerability (деталі)
• GDL 4.x (node) Remote SQL Injection Vulnerability (деталі)
• PHPRunner 4.2 (SearchOption) Blind SQL Injection Vulnerability (деталі)
• Mega File Hosting Script 1.2 (cross.php url) RFI Vulnerability (деталі)
• DeluxeBB <= 1.3 (qorder) Remote SQL Injection Vulnerability (деталі)
• Pivot 1.40.6 Remote Arbitrary File Deletion Vulnerability (деталі)
• Advanced Image Hosting (AIH) 2.3 (gal) Blind SQL Injection Vuln (деталі)
• Facil-CMS 0.1RC2 Multiple Remote Vulnerabilities (деталі)
• Bloginator v1a SQL Command Injection via Cookie Bypass Exploit (деталі)
• Bloginator v1a (Cookie Bypass/SQL) Multiple Remote Vulnerabilities (деталі)
• Hannon Hill Cascade Server Command Execution Vulnerability (post auth) (деталі)
• SW-HTTPD Server 0.x Remote Denial of Service Exploit (деталі)
• Pixie CMS (XSS/SQL) Multiple Remote Vulnerabilities (деталі)
• Exploits joomla com_lowcosthotels sql injection (деталі)

В даній добірці експлоіти в веб додатках:

• CMS WEBjump! Multiple SQL Injection Vulnerabilities (деталі)
• PHP-Fusion Mod Book Panel (course_id) SQL Injection Vulnerability (деталі)
• RoomPHPlanning <= 1.6 (userform.php) Create Admin User Exploit (деталі)
• Joomla Djice Shoutbox 1.0 Permanent XSS Vulnerability (деталі)
• WeBid <= 0.7.3 RC9 Multiple Remote File Inclusion Vulnerabilities (деталі)
• GuildFTPd FTP Server 0.999.14 Remote Delete Files Exploit (деталі)
• Traidnt up 2.0 (Cookie) Add Extension By Pass Exploit (деталі)
• PhpMySport 1.4 (XSS/SQL) Multiple Remote Vulnerabilities (деталі)
• Kim Websites 1.0 (Auth Bypass) SQL Injection Vulnerability (деталі)
• YAP 1.1.1 (index.php page) Local File Inclusion Vulnerability (деталі)
• YAP 1.1.1 Blind SQL Injection/SQL Injection Vulnerabilities (деталі)
• Beerwin’s PHPLinkAdmin 1.0 RFI/SQL Injection Vulnerabilities (деталі)
• PPLive <= 1.9.21 (/LoadModule) URI Handlers Argument Injection Vuln (деталі)
• VLC 0.9.8a Web UI (input) Remote Denial of Service Exploit (деталі)
• Blind SQL Injection exploit for CMS NetCat v3.12 (деталі)

В даній добірці експлоіти в веб додатках:

• CelerBB 0.0.2 Multiple Remote Vulnerabilities (деталі)
• Joomla com_ijoomla_archive Blind SQL Injection Exploit (деталі)
• Wili-CMS 0.4.0 (RFI/LFI/AB) Multiple Remote Vulnerabilities (деталі)
• Blue Eye CMS <= 1.0.0 Remote Cookie SQL Injection Vulnerability (деталі)
• OneOrZero Helpdesk <= 1.6.5.7 Local File Inclusion Vulnerability (деталі)
• isiAJAX v1 (praises.php id) Remote SQL Injection Vulnerability (деталі)
• Addonics NAS Adapter Post-Auth Denial of Service Exploit (деталі)
• PHP-Fusion Mod Book Panel (bookid) SQL Injection Vulnerability (деталі)
• phpCommunity 2.1.8 (SQL/DT/XSS) Multiple Vulnerabilities (деталі)
• CS-Cart 2.0.0 Beta 3 (product_id) SQL Injection Vulnerability (деталі)
• Woltlab Burning Board 3.0.x Multiple Remote Vulnerabilities (деталі)
• PHPRecipeBook 2.24 (base_id) Remote SQL Injection Vulnerability (деталі)
• PHP Director <= 0.21 (sql into outfile) eval() Injection Exploit (деталі)
• NextApp Echo < 2.1.1 XML Injection Vulnerability (деталі)
• IBM Director <= 5.20.3su2 CIM Server Remote DoS Vulnerability (деталі)

В даній добірці експлоіти в веб додатках:

• Digital Interchange Calendar 5.7.13 Contents Change Vulnerability (деталі)
• Document Library 1.0.1 Arbitrary Change Admin Vulnerability (деталі)
• EFS Easy Chat Server Authentication Request BOF Exploit (SEH) (деталі)
• BlindBlog 1.3.1 (SQL/AB/LFI) Multiple Remote Vulnerabilities (деталі)
• Zabbix 1.6.2 Frontend Multiple Vulnerabilities (деталі)
• ghostscripter Amazon Shop (XSS/DT/RFI) Multiple Vulnerabilities (деталі)
• NovaBoard <= 1.0.1 (message) Persistent XSS Vulnerability (деталі)
• EFS Easy Chat Server (XSRF) Change Admin Pass Vulnerability (деталі)
• Yaws < 1.80 (multiple headers) Remote Denial of Service Exploit (деталі)
• Jogjacamp JProfile Gold (id_news) Remote SQL Injection Vulnerability (деталі)
• Joomla com_reservation (Itemid) Remote SQL Injection Exploit (деталі)
• Easy File Sharing Web Server 4.8 File Disclosure Vulnerability (деталі)
• EFS Easy Chat Server Authentication Request Buffer Overflow Exploit (pl) (деталі)
• Joomla com_carman 2.x (Itemid) Remote SQL Injection Exploit (деталі)
• EZ publish exploit with admin account activization (деталі)