what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 8 of 8

Files Date: 2018-05-13

Wapiti Web Application Vulnerability Scanner 3.0.1

Posted May 13, 2018

Authored by Nicolas Surribas | Site wapiti.sourceforge.net

Wapiti is a web application vulnerability scanner. It will scan the web pages of a deployed web application and will fuzz the URL parameters and forms to find common web vulnerabilities.

Changes: New module mod_methods to detect interesting methods which might be allowed by scripts (PUT, PROPFIND, etc). New module mod_ssrf to detect Server Side Request Forgery vulnerabilities (requires Internet access). Improved mod_xss and mod_permanentxss modules to reduce false positives. Many other additions, updates, and improvements.

tags | tool, web, scanner, vulnerability

systems | unix

SHA-256 | bbb8c8f572afe77319734489a6ca0b211df4b87ad294db79b8bf0bda1c5aff29

Download | Favorite | View

Libuser roothelper Privilege Escalation

Posted May 13, 2018

Authored by Brendan Coles, Qualys Security Advisory | Site metasploit.com

This Metasploit module attempts to gain root privileges on Red Hat based Linux systems, including RHEL, Fedora and CentOS, by exploiting a newline injection vulnerability in libuser and userhelper versions prior to 0.56.13-8 and version 0.60 before 0.60-7. This Metasploit module makes use of the roothelper.c exploit from Qualys to insert a new user with UID=0 in /etc/passwd. Note, the password for the current user is required by userhelper. Note, on some systems, such as Fedora 11, the user entry for the current user in /etc/passwd will become corrupted and exploitation will fail. This Metasploit module has been tested successfully on libuser packaged versions 0.56.13-4.el6 on CentOS 6.0 (x86_64); 0.56.13-5.el6 on CentOS 6.5 (x86_64); 0.60-5.el7 on CentOS 7.1-1503 (x86_64); 0.56.16-1.fc13 on Fedora 13 (i686); 0.59-1.fc19 on Fedora Desktop 19 (x86_64); 0.60-3.fc20 on Fedora Desktop 20 (x86_64); 0.60-6.fc21 on Fedora Desktop 21 (x86_64); 0.60-6.fc22 on Fedora Desktop 22 (x86_64); 0.56.13-5.el6 on Red Hat 6.6 (x86_64); and 0.60-5.el7 on Red Hat 7.0 (x86_64). RHEL 5 is vulnerable, however the installed version of glibc (2.5) is missing various functions required by roothelper.c.

tags | exploit, root

systems | linux, redhat, fedora, centos

advisories | CVE-2015-3245, CVE-2015-3246

SHA-256 | ce28cd945d7001cbd85762b794a3e30da40438ee327042dacf17e52946e63f92

Download | Favorite | View

Wuzhi CMS 4.1.0 Cross Site Scripting

Posted May 13, 2018

Authored by jiguang

Wuzhi CMS version 4.1.0 suffers from multiple cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss

advisories | CVE-2018-10311, CVE-2018-10313

SHA-256 | c0cedc50b1df2f505da91d305984a337818f600e52340905f77d9c424278a259

Download | Favorite | View

EMC RecoverPoint 4.3 Admin CLI Command Injection

Posted May 13, 2018

Authored by Paul Taylor

EMC RecoverPoint version 4.3 suffers from an administrative CLI command injectionv vulnerability.

tags | exploit

advisories | CVE-2018-1185

SHA-256 | e1c8dd80534dc37d7ecb229575ab8a053eb5443847a538b111495eea455104b4

Download | Favorite | View

Open-AudIT Community 2.2.0 Cross Site Scripting

Posted May 13, 2018

Authored by Tejesh Kolisetty

Open-AudIT Community version 2.2.0 suffers from multiple cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss

advisories | CVE-2018-10314

SHA-256 | c15d98c3120942f3112267f1483bd5771b79e8c2005e039c071b541fa3b92480

Download | Favorite | View

Open-AudIT Professional 2.1.1 Cross Site Scripting

Posted May 13, 2018

Authored by Tejesh Kolisetty

Open-AudIT Professional version 2.1.1 suffers from multiple cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss

advisories | CVE-2018-9155

SHA-256 | cad51008114e848b265f277056f8b82e15c054f321ee4dbc714cb1fa01ff7469

Download | Favorite | View

Microsoft Windows 2003 SP2 RRAS SMB Remote Code Execution

Posted May 13, 2018

Authored by Victor Portal Gonzalez

Microsoft Windows 2003 SP2 RRAS SMB remote code execution exploit.

tags | exploit, remote, code execution

systems | windows

advisories | CVE-2017-11885

SHA-256 | 5640691fee55c5d3f683e898c2361f8a438a533891a9627b3ee538e1eb24bb5a

Download | Favorite | View

XATABoost 1.0.0 SQL Injection

Posted May 13, 2018

Authored by MgThuraMoeMyint

XATABoost version 1.0.0 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection

SHA-256 | 26d8e9c46d4105c708c96ce7f2794f2f3b1dfe4021f9e1642aefabbfd93238b2

Download | Favorite | View