Parallels Desktop - Virtual Machine Escape Vulnerability

Exploit for windows platform in category local exploits + Title: Parallels Desktop - Virtual Machine Escape + Product: Parallels + Vendor: http://www.parallels.com/products/desktop/ + Affected Versions: All Version Author : Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Ma...

WebKit JSC JSObject::ensureLength Failure Check Vulnerability

WebKit JSC JSObject::ensureLength does not check if ensureLengthSlow fails. WebKit: JSC: JSObject::ensureLength doesn't check if ensureLengthSlow failed. CVE-2017-2521 Here's a snippet of JSObject::ensureLength. bool WARNUNUSEDRETURN ensureLengthVM& vm, unsigned length ASSERTlength vectorLength...

Vanilla Forums 2.0.18.7 Remote Code Execution Exploit

Vanilla Forums = 2.0.18.7 RCE shell injector inject a simple php eval shell into target that can be used for further exploitation. Usage Info usage: first, inject the shell: python injectshell.py -a http://www.attacksite.com/forumsubdomain after injecting the shell you can also inject your own...

Google Chrome 60.0.3080.5 V8 JavaScript Engine - Out-of-Bounds Write Exploit

Exploit for linux platform in category remote exploits // Source: https://halbecaf.com/2017/05/24/exploiting-a-v8-oob-write/ // // v8 exploit for https://crbug.com/716044 var oobrw = null; var leak = null; var arbrw = null; var code = function return 1; code; class BuggyArray extends Array...

Dup Scout Enterprise 9.7.18 - .xml Local Buffer Overflow Exploit

Exploit for windows platform in category local exploits author = ''' Created: ScrR1pTK1dd13 Name: Greg Priest Mail: email protected Exploit Title: Dup Scout Enterprise v9.7.18 Import Local Buffer Overflow Vuln.SEH Date: 2017.05.24 Exploit Author: Greg Priest Version: Dup Scout Enterprise v9.7.18...

Apple iOS / macOS - NSKeyedArchiver Memory Corruption Due to Lack of Bounds Checking in CAMediaTimin

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1175 CAMediaTimingFunctionBuiltin is a class in QuartzCore. Its initWithCoder: method reads an Int "index" then passes that to builtinfunction mov ebx, edi -- controlled unsigned...

Adobe Flash - Margin Handling Heap Corruption Exploit

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1174 The attached fuzzed swf causes a crash due to heap corruption when processing the margins of a rich text field. Proof of Concept:...

For the APT organization to use the EPS vulnerabilities in and mention the right vulnerability analysis-vulnerability warning-the black bar safety net

In 2015, FireEye released a Microsoft Office EPS（Encapsulated PostScript in the two vulnerability details. Wherein, a is 0day vulnerabilities, one in the attack a few weeks before playing the patch. Recently, FireEye and Microsoft Office products in the discovery of three new 0day vulnerabilities...

The next“eternal blue”6 months? Shadow Brokers organization announced that it will open more 0day vulnerabilities it! - Vulnerability warning-the black bar safety net

! 5 month 12 days late, a WannaCry worms ransomware attacks in the global network, which is considered by far the most huge extortion payment activities, the impact to nearly a hundred countries and thousands of businesses and public organizations. This virus is the use of“N. S. A. arms Gallery”i...

BuilderEngine Arbitrary File Upload / Execution Exploit

This Metasploit module exploits a vulnerability found in BuilderEngine 3.5.0 via elFinder 2.0. The jquery-file-upload plugin can be abused to upload a malicious file, which would result in arbitrary remote code execution under the context of the web server. This module requires Metasploit:...

CVE-2017-0262

Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka “Office Remote Code Execution Vulnerability”. This CVE ID is unique from CVE-2017-0261 and CVE-2017-0281. Recent assessments:...

Vanilla Forums < 2.3 - Remote Code Execution Exploit

Exploit for php platform in category remote exploits !/bin/bash / / / / / / / / / / / / / / / / / / // / / / /// / / / / // / // / // / / / / // / // , / / / ///, /,// // //,///||// // // Vanilla Forums = 2.3 Remote Code Execution RCE PoC Exploit 0day Core version no plugins, default...

CVE-2017-0222

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka “Internet Explorer Memory Corruption Vulnerability.” This CVE ID is unique from CVE-2017-0226. Recent assessments: gwillcox-r7 at November 22, 2020 3:11am UTC reported: Reported as...

Gongwalker API Manager 1.1 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: gongwalker API Manager v1.1 - CSRFAdd/Delete/Edit API Date: 2017-05-10 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: https://github.com/gongwalker/ApiManager Software Link:...

WordPress < 4.7.4 - Unauthorized Password Reset Vulnerability

Exploit for php platform in category web applications ============================================= - Discovered by: Dawid Golunski - dawidatlegalhackers.com - https://legalhackers.com - CVE-2017-8295 - Release date: 03.05.2017 - Revision 1.0 - Severity: Medium/High...

Emby MediaServer 3.2.5 - SQL Injection Vulnerability

Exploit for multiple platform in category web applications Emby MediaServer 3.2.5 Boolean-based Blind SQL Injection Vulnerability Vendor: Emby LLC Product web page: https://www.emby.media Affected version: 3.2.5 3.1.5 3.1.2 3.1.1 3.1.0 3.0.0 Summary: Emby formerly Media Browser is a media server...

CVE-2017-8291

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a “/OutputFile %pipe%” substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017. Recent assessments: gwillcox-r7 at...

Mercurial Custom hg-ssh Wrapper Remote Code Execution Exploit

This Metasploit module takes advantage of custom hg-ssh wrapper implementations that don't adequately validate parameters passed to the hg binary, allowing users to trigger a Python Debugger session, which allows arbitrary Python code execution. This module requires Metasploit:...

WordPress KittyCatfish 2.2 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: KittyCatfish 2.2 Plugin for WordPress - SQL Injection Date: 20/03/2017 Exploit Author: TAD GROUP Vendor Homepage: https://wordpress.org/plugins-wp/kittycatfish/ Software Link: https://wordpress.org/plugins-wp/kittycatfish/...

WordPress Wow Forms 2.1 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wow Forms v2.1 WordPress Plugin SQL Injection Date: 29/03/2017 Exploit Author: TAD GROUP Vendor Homepage: http://wow-company.com/ Software Link: https://wordpress.org/plugins/mwp-forms/ Version: 2.1 Contact: email protected...