Trend Micro - Multiple HTTP Problems with CoreServiceShell.exe

Exploit for windows platform in category web applications Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=775 The main component of Trend Micro Antivirus is CoreServiceShell.exe, which runs as NT AUTHORITY\SYSTEM. The CoreServiceShell includes an HTTP daemon, which is used for...

3 6 0 Marvel Team virtualization vulnerabilities the fifth bomb: CVE-2 0 1 6-3 7 1 0 Dark Portal vulnerability analysis-vulnerability warning-the black bar safety net

From 2 0 1 5 year 5 month venom vulnerabilities raging global Cloud Platform, 3 6 0 Marvel Team accumulated in kvm, xen, vmware platform on found submitted up to 2 2 pieces of high-risk security 0day vulnerabilities, these vulnerabilities will lead to a General purpose cloud system was hacked...

CVE-2016-0165

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka “Win32k Elevation of Privilege...

CVE-2016-0167

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka “Win32k Elevation of Privilege...

Microsoft Windows - Kernel NtGdiGetTextExtentExW Out-of-Bounds Memory Read

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=685 The attached Proof-of-Concept crashes Windows 7 with special pool enabled on win32k.sys. The crash is due accessing memory past the end of a buffer. Proof of Concept:...

Adobe Flash - Shape Rendering Crash

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=721 The attached fuzz case causes a crash in shape rendering. Proof of Concept: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39608.zip...

CoolPlayer (Standalone) build 2.19 - '.m3u' Stack Overflow

Exploit for windows platform in category local exploits Exploit Title: CoolPlayer Standalone build 2.19 - .m3u Stack Overflow Date: 22-03-2016 Software Link: https://sourceforge.net/projects/coolplayer/files/Coolplayer/219/CoolPlayer219Bin.zip Exploit Author: Charley Celice stmerry Contact:...

WordPress Abtest Plugin- Local File Inclusion

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Abtest - Local File Inclusion Date: 2016-03-19 Google Dork : inurl:/wp-content/plugins/abtest/ Exploit Author: CrashBandicot Vendor Homepage: https://github.com/wp-plugins/abtest Tested on: Chrome Vulnerable Fil...

WordPress DZS Videogallery Plugin <= 8.60 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Wordpress DZS Videogallery Plugin - Multiple Vulnerabilities --------------------------------------- Unauthenticated CSRF & XSS POC:...

WordPress Beauty & Clean 1.0.8 Theme - Arbitrary File Upload

Exploit for php platform in category web applications Exploit Title: Wordpress Beauty Theme File Upload Vulnerability v1.0.8 Discovery Date: 02.09.2016 Public Disclosure Date:03.09.2016 Vendor Homepage: http://www.yourinspirationweb.com Exploit Author: Colette Chamberland Wordfence Contact:...

PHP Utility Belt - Remote Code Execution (Metasploit)

Exploit for php platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'PHP Utility Belt Remote Code Execution', 'Description' = %q This module exploit...

WordPress Best Web Soft Captcha 4.1.5 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: BWS Captcha Multiple Vulnerabilities Discovery Date:12.03.2015 Public Disclosure Date:03.10.2016 Exploit Author: Colette Chamberland Contact: email protected Vendor Homepage: http://bestwebsoft.com/ Software Link:...

Secret Net 7 and Secret Net Studio 8 - Local Privilege Escalation

Secret Net 7 and Secret Net Studio 8 - Local Privilege Escalation Source: https://github.com/Cr4sh/secretnetexpl Secret Net 7 and Secret Net Studio 8 local privileges escalation exploit. 0day vulnerabilities in sncc0.sys kernel driver of Secrity Code products allows attacker to perform local...

Secret Net 7 and Secret Net Studio 8 - Privilege Escalation

Exploit for windows platform in category local exploits Source: https://github.com/Cr4sh/secretnetexpl Secret Net 7 and Secret Net Studio 8 local privileges escalation exploit. 0day vulnerabilities in sncc0.sys kernel driver of Secrity Code products allows attacker to perform local privileges...

Secret Net 7 and Secret Net Studio 8 - Local Privilege Escalation

Source: https://github.com/Cr4sh/secretnetexpl Secret Net 7 and Secret Net Studio 8 local privileges escalation exploit. 0day vulnerabilities in sncc0.sys kernel driver of Secrity Code products allows attacker to perform local privileges escalation from Guest to Local System. Also, attacker that...

Viscomsoft Calendar Active-X 2.0 - Multiple Crash PoCs

Exploit for windows platform in category dos / poc Exploit Title: Viscomsoft Calendar Active-X 2.0 - Multiple Crash PoCs Date: 01-03-2016 Exploit Author: Shantanu Khandelwal Twitter: @shantanu561993 Vendor Homepage: http://www.viscomsoft.com/ Software Link:...

Vesta Control Panel 0.9.8-15 - Persistent Cross-Site Scripting

Exploit for php platform in category web applications Exploit Title :Vesta Control Panel " http://victimserve...

Solr 3.5.0 - Arbitrary Data Deletion

Exploit for java platform in category web applications Exploit Title: All Solr Data Can Be Delete Google Dork: intext:Schema Config Analysis Schema Browser Statistics Info Distribution Ping Logging Date: 5/2/2016 Exploit Author: N37 Myanmar Vendor Homepage: http://lucene.apache.org/solr/ Software...

VK.com: Внедрение внешних сущностей в функционале импорта пользователей YouTrack

Уязвимость существует из-за возможности использования внешних сущностей XML разметки в функционале импорта пользователей YouTrack. Веб-приложение доступно по адресу youtrack.vk-cdn.net Исходя из документации https://confluence.jetbrains.com/display/YTD6/Import+Users поддерживает импорт данных...

Dell VPN client Netextender 0day analysis-vulnerability warning-the black bar safety net

The VPN client is most IT security professionals will use a tool, using it can be connected to a“restricted”local area network, anonymous Internet access, ensure network traffic security, etc. But just imagine, if the VPN client can cause the machine to the elevation of privileges? Note: currentl...