Category: Security

[remote] – Axis Communications MPQT/PACS 5.20.x – Server Side Include (SSI) Daemon Remote Format String Exploit

[webapps] – newsp.eu PHP Calendar Script 1.0 – User Credentials Disclosure

[webapps] – NewsP Free News Script 1.4.7 – User Credentials Disclosure

[papers] – Exploiting Apache James Server 2.3.2

[shellcode] – Linux/x86-64 – Syscall Persistent Bind Shell + (Multi-terminal) + Password + Daemon (83, 148, 177 bytes)

[remote] – OpenSSHD <= 7.2p2 – User Enumeration

[WebApps] – vBulletin 4.x – SQLi in breadcrumbs via xmlrpc API (Post-Auth)

[Remote] – DropBearSSHD <= 2015.71 – Command Injection

[Local] – Internet Explorer 11 (on Windows 10) – VBScript Memory Corruption Proof-of-Concept Exploit (MS16-051)

[WebApps] – vBulletin 5.x/4.x – Persistent XSS in AdminCP/ApiLog via xmlrpc API (Post-Auth)