Neowise CarbonFTP v1.4 Insecure Proprietary Password Encryption CVE-2020-6857

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/NEOWISE-CARBONFTP-v1.4-INSECURE-PROPRIETARY-PASSWORD-ENCRYPTION.txt [+] twitter.com/hyp3rlinx [+] ISR: ApparitionSec [Vendor] www.neowise.com

Trend Micro Security 2019 (Consumer) Multiple Products Security Bypass Protected Service Tampering CVE-2019-19697

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-SECURITY-CONSUMER-SECURITY-BYPASS-PROTECTED-SERVICE-TAMPERING.txt [+] ISR: ApparitionSec [Vendor] www.trendmicro.com [Product

Trend Micro Security (Consumer) Multiple Products Persistent Arbitrary Code Execution CVE-2019-20357

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-SECURITY-CONSUMER-PERSISTENT-ARBITRARY-CODE-EXECUTION.txt [+] twitter.com/hyp3rlinx [+] ISR: ApparitionSec [Vendor] www.trendmicro.com

Microsoft Windows .Group File / URL Field Code Execution

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-.GROUP-FILE-URL-FIELD-CODE-EXECUTION.txt [+] twitter.com/hyp3rlinx [+] apparitionsec@gmail [+] ISR: Apparition Security [Vendor

Microsoft Windows Media Center XXE MotW Bypass (Anniversary Edition)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/WINDOWS-MEDIA-CENTER-MOTW-BYPASS-XXE-ANNIVERSARY-EDITION.txt [+] ISR: Apparition Security [Vendor] www.microsoft.com [Product] Microsoft

NAPC Xinet Elegant 6 Asset Library Web Interface v6.1.655 Pre-Auth SQL Injection 0Day CVE-2019-19245

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/NAPC-XINET-ELEGANT-6-ASSET-LIBRARY-WEB-INTERFACE-PRE-AUTH-SQL-INJECTION.txt [+] ISR: ApparitionSec [Vendor] www.napc.com [Product] Xinet Elegant 6 Asset Library

Max Secure Anti Virus Plus v19.0.4.020 Insecure Permissions CVE-2019-19382

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MAX-SECURE-PLUS-ANTIVIRUS-INSECURE-PERMISSIONS.txt [+] ISR: ApparitionSec [Vendor] www.maxpcsecure.com [Affected Product Code Base] Max

Microsoft Excel 2016 v1901 Import Error XML External Entity Injection

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-EXCEL-2016-v1901-IMPORT-ERROR-EXTERNAL-ENTITY-INJECTION.txt [+] ISR: ApparitionSec [Vendor] www.microsoft.com [Product] Excel

Trend Micro Anti-Threat Toolkit <= v1.62.0.1218 / Remote Code Execution 0day

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-ANTI-THREAT-TOOLKIT-(ATTK)-REMOTE-CODE-EXECUTION.txt [+] ISR: Apparition Security [Vendor] www.trendmicro.com [Product] Trend

NtFileSins v2.1 Windows NTFS Privileged File Access Enumeration Tool

/__/ / / / / (__ ) /_/ |_/ /_/ /_/ /_/_/\___//_/_/ /_// v2.1 By hyp3rlinx ApparitionSec ''' sin_cnt=0 internet_sin_cnt=0 found_set=set()

NtFileSins / Windows NTFS Privileged File Access Enumeration Tool

# BANNER=''' _ ___ ___ _ / | / /_ __/ (_) /__ / ___/(_)___ _ / |/ / / / / /_ / / / _ \\__ \ / / __ \/ ___/ / /| / / / / __/ / / / __/__/ / / / / (__ ) /_/ |_/ /_/ /_/ /_/_/\___//_/_/ /_// v2

Microsoft Windows PowerShell Unsanitized Filename Command Execution

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-POWERSHELL-UNSANITIZED-FILENAME-COMMAND-EXECUTION.txt [+] ISR: Apparition Security [Vendor] www.microsoft.com [Product]

Trend Micro Deep Discovery Inspector IDS / Percent Encoding IDS Bypass

the character encodings but fails to account for percent encoded HEX character payload values. [Exploit/POC] from socket import * #Bypass TM DDI IDS e.g. Rule 2452 (Wget command line injection) PoC #Discovery: hyp3rlinx - ApparitionSec #Apparition Security #Firewall Rule Bypass IP = raw_input("[

CVE-2019-13577 / MAPLE Computer WBT SNMP Administrator v2.0.195.15 / Unauthenticated Remote Buffer Overflow Code Execution 0day

D 0 O 0 LastErr ERROR_NO_SCROLLBARS (05A7) EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G) [Exploit/POC] from socket import * import struct,sys,argparse #MAPLE WBT SNMP Administrator (SnmpAdm.exe) v2.0.195.15 #CVE-2019-13577 #Remote Buffer Overflow 0day #hyp3rlinx - ApparitionSec #Pop calc.exe Windows 7 SP1 sc=("

[**Fixed Typo] Microsoft Compiled HTML Help / Uncompiled .chm File XML External Entity

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-HTML-HELP-UNCOMPILED-CHM-FILE-XML-EXTERNAL-ENTITY-INJECTION.txt [+] ISR: ApparitionSec [Vendor] www.microsoft.com [Product

Microsoft Compiled HTML Help / Uncompiled .chm File XML External Entity

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-HTML-HELP-UNCOMPILED-CHM-FILE-XML-EXTERNAL-ENTITY-INJECTION.txt [+] ISR: ApparitionSec [Vendor] www.microsoft.com [Product

Microsoft Word (2016) Deceptive File Reference ZDI-CAN-7949

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WORD-DECEPTIVE-FILE-REFERENCE.txt [+] ISR: ApparitionSec [+] Zero Day Initiative Program [Vendor] www.microsoft.com [Product

Windows PowerShell ISE / Filename Parsing Flaw Remote Code Execution 0day

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/WINDOWS-POWERSHELL-ISE-FILENAME-PARSING-FLAW-RCE-0DAY.txt [+] ISR: ApparitionSec [+] Zero Day Initiative Program [Vendor] www.microsoft.com

[**UPDATED] Microsoft Internet Explorer v11 / XML External Entity Injection 0day

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-v11-XML-EXTERNAL-ENTITY-INJECTION-0DAY.txt [+] ISR: ApparitionSec [Vendor] www.microsoft.com [Product

Microsoft Internet Explorer v11 XML External Entity Injection 0day

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-v11-XML-EXTERNAL-ENTITY-INJECTION-0DAY.txt [+] ISR: ApparitionSec [Vendor] www.microsoft.com [Product

Microsoft Windows .Reg File Dialog Box Message Spoofing 0day

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-.REG-FILE-DIALOG-BOX-MESSAGE-SPOOFING.txt [+] ISR: ApparitionSec [Vendor] www.microsoft.com [Product] A file

[**UPDATED] Microsoft Windows .Reg File Dialog Box Message Spoofing 0day

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-.REG-FILE-DIALOG-BOX-MESSAGE-SPOOFING.txt [+] ISR: ApparitionSec [Vendor] www.microsoft.com [Product] A file

Microsoft Windows ".contact" File HTML Injection Mailto: Link Remote Code Execution 0day ZDI-CAN-75

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-HTML-INJECTION-MAILTO-LINK-ARBITRARY-CODE-EXECUTION.txt [+] ISR: ApparitionSec [+] Zero Day Initiative Program [+] ZDI

Microsoft Windows VCF File Insufficient UI Warning Remote Code Execution 0day ZDI-CAN-6920

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-VCF-FILE-INSUFFICIENT-WARNING-REMOTE-CODE-EXECUTION.txt [+] ISR: ApparitionSec [+] Zero Day Initiative Program [Vendor

Microsoft Windows VCF File Insufficient UI Warning Remote Code Execution 0day ZDI-CAN-6920

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-VCF-FILE-INSUFFICIENT-WARNING-REMOTE-CODE-EXECUTION.txt [+] ISR: ApparitionSec [+] Zero Day Initiative Program [Vendor

D-LINK Central WifiManager CWM-100 Server Side Request Forgery CVE-2018-15517

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/DLINK-CENTRAL-WIFI-MANAGER-CWM-100-SERVER-SIDE-REQUEST-FORGERY.txt [+] ISR: ApparitionSec ***Greetz: indoushka | Eduardo B.*** [Vendor

D-LINK Central WifiManager CWM-100 Trojan File SYSTEM Privilege Escalation CVE-2018-15515

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/DLINK-CENTRAL-WIFI-MANAGER-CWM-100-SYSTEM-PRIVILEGE-ESCALATION.txt [+] ISR: ApparitionSec ***Greetz: indoushka | Eduardo B.*** [Vendor

D-LINK Central WifiManager CWM-100 FTP Server PORT Bounce Scan CVE-2018-15516

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/DLINK-CENTRAL-WIFI-MANAGER-CWM-100-FTP-SERVER-PORT-BOUNCE-SCAN.txt [+] ISR: ApparitionSec ***Greetz: indoushka | Eduardo B.*** [Vendor

NAT32 Build (22284) Remote Code Execution CVE-2018-6940 (hyp3rlinx / apparition security)

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/NAT32-REMOTE-COMMAND-EXECUTION-CVE-2018-6940.txt [+] ISR: Apparition Security [-_-] D1rty0tis Vendor: = www.nat32.com Product: = NAT32 Build

CVE-2018-6892 CloudMe Sync <= v1.10.9 Unauthenticated Remote Buffer Overflow (hyp3rlinx / apparition security)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/CLOUDME-SYNC-UNAUTHENTICATED-REMOTE-BUFFER-OVERFLOW.txt [+] ISR: Apparition Security [+] SSD Beyond Security Submission:

Oracle JDeveloper IDE Directory Traversal CVE-2017-10273 (hyp3rlinx / apparition security)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/ORACLE-JDEVELOPER-DIRECTORY-TRAVERSAL.txt [+] ISR: apparition security Vendor: = www.oracle.com Product: ===

Adminer <= v4.3.1 Server Side Request Forgery

555- Exploit/POC: = import socket,re,ssl,warnings,subprocess,time from platform import system as system_name from os import system as system_call #Adminer Server Side Request Forgery #PortMiner Scanner Tool #by John Page (hyp3rlinx) #ISR: ApparitionSec #hyp3rlinx.altervista.org #===

CVE-2017-16884 Mist Server v2.12 Unauthenticated Persistent XSS (hyp3rlinx / ApparitionSec)

[+] Credits: John Page (aka Hyp3rlinX) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MIST-SERVER-v2.12-UNAUTHENTICATED-PERSISTENT-XSS-CVE-2017-16884.txt [+] ISR: ApparitionSec Vendor: = mistserver.org Product

CVE-2017-17055 Artica Web Proxy v3.06 Remote Code Execution (hyp3rlinx / ApparitionSec)

[+] Credits: John Page (aka Hyp3rlinX) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/ARTICA-WEB-PROXY-v3.06-REMOTE-CODE-EXECUTION-CVE-2017-17055.txt [+] ISR: ApparitionSec Vendor: === www.articatech.com Product

Abyss Web Server < v2.11.6 Memory Heap Corruption (hyp3rlinx / apparitionsec)

[+] Credits: John Page (aka HyP3rlinX) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/ABYSS-WEB-SERVER-MEMORY-HEAP-CORRUPTION.txt [+] ISR: ApparitionSec Vendor: == aprelium.com Product: === Abyss Web

Symantec Endpoint Protection (SEP) v12.1 Tamper-protection Bypass CVE-2017-6331 (hyp3rlinx)

[+] Credits: John Page a.k.a hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt [+] ISR: ApparitionSec Vendor: === www.symantec.com Product

Webmin v1.850 Remote Code Execution (hyp3rlinx / apparitionsec)

[+] SSD Beyond Security: https://blogs.securiteam.com/index.php/archives/3430 [+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/WEBMIN-v1.850-REMOTE-COMMAND-EXECUTION.txt [+] ISR: ApparitionSec

Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized NT Domain / PHP Information Disclosures CVE-2017-14085 (apparitionsec / hyp3rlinx)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14085-TRENDMICRO-OFFICESCAN-XG-REMOTE-NT-DOMAIN-PHP-INFO-DISCLOSURE.txt [+] ISR: ApparitionSec Vendor

Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized Server Side Request Forgery (apparitionsec / hyp3rlinx)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-OFFICESCAN-XG-SERVER-SIDE-REQUEST-FORGERY.txt [+] ISR: ApparitionSec Vendor: == www.trendmicro.com Product

Trend Micro OfficeScan v11.0 and XG (12.0)* CURL (MITM) Remote Code Execution CVE-2017-14084 (apparitionsec / hyp3rlinx)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14084-TRENDMICRO-OFFICESCAN-XG-CURL-MITM-REMOTE-CODE-EXECUTION.txt [+] ISR: ApparitionSec Vendor: == www.trendmicro.com

Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized Start Remote Process Code Execution / DOS - INI Corruption CVE-2017-14086 (apparitionsec / hyp3rlinx)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14086-TRENDMICRO-OFFICESCAN-XG-PRE-AUTH-START-REMOTE-PROCESS-CODE-EXECUTION-MEM-CORRUPT.txt [+] ISR: ApparitionSec Vendor

Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized Remote Encryption Key Disclosure CVE-2017-14083 (apparitionsec / hyp3rlinx)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14083-TRENDMICRO-OFFICESCAN-XG-PRE-AUTH-REMOTE-ENCRYPTION-KEY-DISCLOSURE.txt [+] ISR: ApparitionSec Vendor

Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized Change Prevention Image File Execution Bypass (apparitionsec / hyp3rlinx)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-OFFICESCAN-XG-IMAGE-FILE-EXECUTION-BYPASS.txt [+] ISR: ApparitionSec Vendor: == www.trendmicro.com Product

Trend Micro OfficeScan v11.0 and XG (12.0)* Unauthorized Remote Memory Corruption CVE-2017-14089 (apparitionsec / hyp3rlinx)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14089-TRENDMICRO-OFFICESCAN-XG-PRE-AUTH-REMOTE-MEMORY-CORRUPTION.txt [+] ISR: ApparitionSec Vendor: == www.trendmicro.com

CVE-2017-14087 Trend Micro OfficeScan v11.0 and XG (12.0)* Host Header Injection (apparitionsec / hyp3rlinx)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14087-TRENDMICRO-OFFICESCAN-XG-HOST-HEADER-INJECTION.txt [+] ISR: ApparitionSec Vendor: == www.trendmicro.com Product

CVE-2017-14084 Trend Micro OfficeScan v11.0 and XG (12.0)* CURL (MITM) Remote Code Execution (apparitionsec / hyp3rlinx)

[+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14084-TRENDMICRO-OFFICESCAN-XG-CURL-MITM-REMOTE-CODE-EXECUTION.txt [+] ISR: ApparitionSec Vendor: == www.trendmicro.com

Mako Web Server v2.5 Multiple Unauthenticated Vulnerabilities (apparitionsec / hyp3rlinx)

: ApparitionSec Vulnerabilities Summary The following advisory describe three (3) vulnerabilities found in Mako Server’s tutorial page. The vulnerabilities found are: Unauthenticated Arbitrary File Write vulnerability that leads to Remote Command Execution Unauthenticated File

CVE-2017-11567 Mongoose Web Server v6.5 CSRF Command Execution ( apparitionsec @ gmail / hyp3rlinx )

[+] Credits: John Page AKA hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt [+] ISR: apparitionSec Vendor: === www.cesanta.com Product

Firefox v54.0.1 Denial Of Service

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/FIREFOX-v54.0.1-DENIAL-OF-SERVICE.txt [+] ISR: ApparitionSec Vendor: === www.mozilla.org Product: === Firefox v54.0.1

Symantec VIP Access Desktop Arbitrary DLL Execution

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/SYMANTEC-VIP-ACCESS-ARBITRARY-DLL-EXECUTION.txt [+] ISR: ApparitionSec Vendor: www.symantec.com Product: === Symantec

Microsoft MSINFO32.EXE ".NFO" Files XML External Entity

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-MSINFO32-XXE-FILE-EXFILTRATION.txt [+] ISR: ApparitionSec Vendor: = www.microsoft.com Product

Microsoft Windows Media Center "ehshell.exe" XML External Entity

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-MEDIA-CENTER-XXE-FILE-DISCLOSURE.txt [+] ISR: ApparitionSec Vendor: == www.microsoft.com Product

Core FTP LE v2.2 Remote SSH/SFTP Buffer Overflow

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/CORE-FTP-REMOTE-SSH-SFTP-BUFFER-OVERFLOW.txt [+] ISR: ApparitionSec Vendor: === www.coreftp.com Product: Core FTP LE

Putty Cleartext Password Storage

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/PUTTY.EXE-INSECURE-PASSWORD-STORAGE.txt [+] ISR: ApparitionSec Vendor: == www.chiark.greenend.org.uk Product

WinaXe v7.7 FTP 'Server Ready' CMD Remote Buffer Overflow

and Buffer Overflow Exploit #Discovery hyp3rlinx #ISR: ApparitionSec #hyp3rlinx.altervista.org #shellcode to pop calc.exe Windows 7 SP1 sc=("\x31\xF6\x56\x64\x8B\x76\x30\x8B\x76\x0C\x8B\x76\x1C\x8B" "\x6E\x08\x8B\x36\x8B\x5D\x3C\x8B\x5C\x1D\x78\x01\xEB\x8B" "\x4B\x18\x8B\x7B\

Axessh 4.2.2 Denial Of Service

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AXESSH-DENIAL-OF-SERVICE.txt [+] ISR: ApparitionSec Vendor: www.labf.com Product: = Axessh 4.2.2 Axessh is a SSH client

Rapid PHP Editor CSRF Remote Command Execution

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/RAPID-PHP-EDITOR-REMOTE-CMD-EXEC.txt [+] ISR: Apparition Security Vendor: == www.rapidphpeditor.com Product:

Axessh 4.2.2 Denial Of Service

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AXESSH-DENIAL-OF-SERVICE.txt [+] ISR: ApparitionSec Vendor: www.labf.com Product: = Axessh 4.2.2 Axessh is a SSH client

wincvs-2.0.2.4 Privilege Escalation

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/WINCVS-PRIVILEGE-ESCALATION.txt [+] ISR: ApparitionSec Vendor: == cvsgui.sourceforge.net www.wincvs.org Product: === WinCvs

Puppet Enterprise Web Interface User Enumeration

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/PUPPET-USER-ENUMERATION.txt [+] ISR: ApparitionSec Vendor: == www.puppet.com Product: === Puppet Enterprise Web

Puppet Enterprise Web Interface Authentication Redirect

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/PUPPET-AUTHENTICATION-REDIRECT.txt [+] ISR: ApparitionSec Vendor: == www.puppet.com Product: Puppet

Oracle Netbeans IDE v8.1 Import Directory Traversal

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/ORACLE-NETBEANS-IDE-DIRECTORY-TRAVERSAL.txt [+] ISR: ApparitionSec Vendor: === www.oracle.com Product: = Netbeans IDE v8.1

Snort v2.9.7.0-WIN32 DLL Hijack

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/SNORT-DLL-HIJACK.txt [+] ISR: ApparitionSec Vendor: = www.snort.org Product: === Snort v2.9.7.0-WIN32 Snort is an open-source

ZendStudio IDE v13.5.1 Privilege Escalation

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/ZEND-STUDIO-PRIVILEGE-ESCALATION.txt [+] ISR: ApparitionSec Vendor: www.zend.com Product: == ZendStudio IDE v13.5.1

WSO2-CARBON v4.4.5 LOCAL FILE INCLUSION

[+] Credits: John Page aka HYP3RLINX [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-LOCAL-FILE-INCLUSION.txt [+] ISR: ApparitionSec Vendor: === www.wso2.com Product: Ws02Carbon v4.4.5 WSO2

VMWare vSphere Web Client Flash XSS

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/VMWARE-VSPHERE-FLASH-XSS.txt [+] ISR: apparitionsec Vendor: === www.vmware.com Product: VMWare vSphere Web

PHPBack v1.3.0 SQL Injection

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/PHPBACK-v1.3.0-SQL-INJECTION.txt Vendor: www.phpback.org Product: PHPBack v1.3.0 Vulnerability Type: === SQL Injection

op5 v7.1.9 Remote Command Execution

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/OP5-REMOTE-CMD-EXECUTION.txt Vendor: www.op5.com Product: === op5 v7.1.9 op5 Monitor is a software product for server, Network monitoring and

FTPShell Client v5.24 Buffer Overflow

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/FTPSHELL-v5.24-BUFFER-OVERFLOW.txt Vendor: www.ftpshell.com Product: FTPShell Client version 5.24

AccessDiver V4.301 Buffer Overflow

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/ACCESSDIVER-BUFFER-OVERFLOW.txt Vendor: == M. Jean Fages www.accessdiver.com circa 1998-2006 Product: = AccessDiver V4.301 build 5888

phpback v1.1 XSS vulnerability

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/PHPBACK-XSS.txt Vendor: www.phpback.org Product: === phpback v1.1 The open source feedback system, PHPBack is feedback a web application

Zenphoto 1.4.10 Local File Inclusion

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/ZEN-PHOTO-1.4.10-LFI.txt Vendor: www.zenphoto.org Product: === Zenphoto 1.4.10 Vulnerability Type: Local

Zenphoto 1.4.10 XSS Vulnerability

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/ZEN-PHOTO-1.4.10-XSS.txt Vendor: www.zenphoto.org Product: === Zenphoto 1.4.10 Vulnerability Type: == Cross

IBM i Access Buffer Overflow Code DOS CVE-2015-7422

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/IBMI-ACCESS-BUFFER-OVERFLOW-DOS.txt Vendor: == www.ibm.com Product: IBM i Access for Windows

IBM i Access Buffer Overflow Code Exec CVE-2015-2023

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/IBMI-CLIENT-ACCESS-BUFFER-OVERFLOW.txt Vendor: == www.ibm.com Product: IBM i Access for

CF Image Host XSS

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-CFIMAGEHOST-XSS.txt Vendor: codefuture.co.uk/projects/imagehost Product: === CF Image Host 1.65 -

CF Image Host PHP Command Injection

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-CFIMAGEHOST-PHP-CMD-INJECTION.txt Vendor: codefuture.co.uk/projects/imagehost Product: === CF Image

CF Image Host CSRF

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-CFIMAGEHOST-CSRF.txt Vendor: codefuture.co.uk/projects/imagehost Product: === CF Image Host 1.65 -

Microsoft .NET Framework XSS / Elevation of Privilege CVE-2015-6099

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-MICROSOFT-XSS-ELEVATION-OF-PRIVILEGE.txt Vendor: == www.microsoft.com Product: === Microsoft .NET Framework

NXFilter v3.0.3 CSRF

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-NXFILTER-CSRF.txt Vendor: www.nxfilter.org/p2/ Product: NXFilter v3.0.3 Vulnerability Type:

NXFilter v3.0.3 Persistent / Reflected XSS

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-NXFILTER-XSS.txt Vendor: www.nxfilter.org/p2/ Product: NXFilter v3.0.3 Vulnerability Type:

TCPing 2.1.0 Buffer Overflow

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-TCPING-2.1.0-BUFFER-OVERFLOW.txt Vendor: Spetnik.com Product: = Spetnik TCPing 2.1.0 / tcping.exe circa

PHP Server Monitor 3.1.1 Privilege Escalation

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPSRVMONITOR-PRIV-ESCALATE.txt Vendor: www.phpservermonitor.org

PHP Server Monitor 3.1.1 CSRF

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPSRVMONITOR-CSRF.txt Vendor: www.phpservermonitor.org

Blat.exe v2.7.6 SMTP / NNTP Mailer Buffer Overflow

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-BLAT-MAILER-BUFFER-OVERFLOW.txt Vendor: www.blat.net http://sourceforge.net/projects/blat/ Product:

AdobeWorkgroupHelper Stack Based Buffer Overflow

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-ADOBE-WRKGRP-BUFFER-OVERFLOW.txt Vendor: www.adobe.com Product: = AdobeWorkgroupHelper.exe v2.8.3.3

Zope Management Interface CSRF vulnerabilities

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-ZOPE-CSRF.txt Vendor: www.zope.org plone.org Product: Zope Management Interface 4.3.7 Zope is a

LanWhoIs.exe 1.0.1.120 Stack Buffer Overflow

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-LANWHOIS-BUFFER-OVERFLOW-10062015.txt Vendor: www.lantricks.com Product: LanWhoIs.exe 1.0.1.120

LanSpy 2.0.0.155 Buffer Overflow

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-LANSPY-BUFFER-OVERFLOW-10052015.txt Vendor: www.lantricks.com Product: LanSpy.exe LanSpy is network

FTGate 2009 Build 6.4.00 CSRF Vulnerabilities

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-FTGATE-2009-CSRF.txt Vendor: www.ftgate.com Product: FTGate 2009 SR3 May 13 2010 Build 6.4.00

Git-1.9.5 ssh-agent.exe Buffer Overflow

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-GIT-SSH-AGENT-BUFF-OVERFLOW.txt Vendor: git-scm.com Product: Git-1.9.5-preview20150319.exe

Git-1.9.5 ssh-agent.exe Buffer Overflow

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-GIT-SSH-AGENT-BUFF-OVERFLOW.txt Vendor: git-scm.com Product: Git-1.9.5-preview20150319.exe

FortiManager v5.2.2 Multiple XSS Vulnerabilities

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-FORTIMANAGER-XSS-0924.txt Vendor: www.fortinet.com Product: FortiManager v5.2.2 FortiManager is a

Microsoft Exchange Information Disclosure

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-MS-EXCHANGE-INFO-DISCLOSURE.txt Vendor: www.microsoft.com Product: Microsoft Exchange Outlook Web

IKEView.exe R60 Stack Buffer Overflow

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-IKEVIEWR60-0914.txt Vendor: www.checkpoint.com http://pingtool.org/downloads/IKEView.exe Product:

IKEView.exe Fox beta 1 Stack Buffer Overflow

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-CP_IKEVIEW-0911.txt Vendor: www.checkpoint.com Product: IKEView.exe Fox beta 1 IKEVIew.EXE is used to

JSPMySQL Administrador CSRF & XSS Vulnerabilities

[+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-JSPMYSQLADMINISTRADOR-0904.txt Vendor: JSPMySQL Administrador https://sites.google.com/site/mfpledon/producao-de-software Product:

Trend Micro Deep Discovery Authentication Bypass

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-DDI-0818.txt Vendor: www.trendmicro.com Product: === Trend Micro Deep Discovery

Trend Micro Deep Discovery XSS

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-DDI-081815b.txt Vendor: www.trendmicro.com Product:

PHPfileNavigator 2.3.3 Persistent Reflected XSS

[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPFILENAVIGATOR0812c.txt Vendor: pfn.sourceforge.net Product: === PHPfileNavigator v2.3.3

  1   2   >