CMS Made Simple 2.1.6 - Multiple Vulnerabilities

CMS Made Simple 2.1.6 - Multiple Vulnerabilities Title: CMSMS 2.1.6 Multiple Vulnerabilities Date: 10-05-2017 Tested on: Windows 8 64-bit Exploit Author: Osanda Malith Jayathissa @OsandaMalith Original write-up: https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/ CVE:...

Security Update for Microsoft Word 2013 (KB3178729) 64-Bit Edition

A security vulnerability exists in Microsoft Word 2013 64-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

possible memory corruption via failsafe callback

ISSUE DESCRIPTION Under certain special conditions Xen reports an exception resulting from returning to guest mode not via ordinary exception entry points, but via a so call failsafe callback. This callback, unlike exception handlers, takes 4 extra arguments on the stack the saved data selectors...

Integer Overflow

github.com/golang/protobuf is vulnerable to integer overflows. A malicious user can pass an integer larger than 64-bit to the system, causing an integer overflow and crashing the system...

Stable Channel Update for Desktop

The stable channel has been updated to 58.0.3029.96 for Windows, Mac, and Linux. This will roll out over the coming days/weeks. In order to improve stability, performance, and security, users who are currently on 32-bit version of Chrome, and 64-bit Windows with 4GB or more of memory and...

Oracle VirtualBox Guest Additions 5.1.18 - Unprivileged Windows User-Mode Guest Code Double-Free

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1227 We have discovered a heap double-free vulnerability in the latest version of VirtualBox 5.1.18, with Guest Additions and more specifically shared folders enabled in the guest operating system. The heap memory corruption take...

Microsoft Office OneNote 2007 DLL Hijacking Vulnerability

Exploit for windows platform in category local exploits ------------------------------------------------------------------------ Microsoft Office OneNote 2007 DLL side loading vulnerability ------------------------------------------------------------------------ Yorick Koster, September 2015...

Xen - Broken Check in 'memory_exchange()' Permits PV Guest Breakout

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1184 This bug report describes a vulnerability in memoryexchange that permits PV guest kernels to write to an arbitrary virtual address with hypervisor privileges. The vulnerability was introduced through a broken fix for...

CVE-2017-7269 a few tips and BUG fixes-vulnerability warning-the black bar safety net

Seen the analysis, to talk about the use of a few tips. 1. Vulnerability scope The original poc above wrote only applies to the 03 r2, in fact, the most common of 03 sp2 can also be directly reproduced, so it seems that the attack range is very large, after all, the domestic selling most of the 0...

Memory corruption

An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. A specially crafted VI file can cause a user controlled value to be used as a loop terminator resulting in internal heap...

Format string vulnerability in the use of small a-vulnerability warning-the black bar safety net

1, Preface Format string vulnerability has now been more and more rare, but in CTF the game will still often encountered. By learning this type of exploit, you can promote us by analogy with other vulnerability types, so as to further deepen the understanding of software vulnerability the basic...

Debian DLA-866-1 : libxslt security update

libxslt is vulnerable to an integer overflow in the xsltAddTextString function that can be exploited to trigger an out of bounds write on 64-bit systems. For Debian 7 'Wheezy', this problem has been fixed in version 1.1.26-14.1+deb7u3. We recommend that you upgrade your libxslt packages. NOTE:...

Cerberus FTP Server 8.0.10.3 - MLST Buffer Overflow Vulnerability

Exploit for windows platform in category dos / poc + Title: Cerberus FTP Server 8.0.10.3 – 'MLST' Remote Buffer Overflow + Credits / Discovery: Nassim Asrir + Author Contact: email protected || https://www.linkedin.com/in/nassim-asrir-b73a57122/ + Author Company: Henceforth + CVE: CVE-2017-6880...

Security Update for Microsoft Excel 2013 (KB3172542) 64-Bit Edition

A security vulnerability exists in Microsoft Excel 2013 64-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

[ASA-201703-5] libxslt: arbitrary code execution

Arch Linux Security Advisory ASA-201703-5 ========================================= Severity: Critical Date : 2017-03-12 CVE-ID : CVE-2017-5029 Package : libxslt Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-195 Summary ======= The package libxslt before...

Linux/x86-64 - Random Listener Shellcode (54 bytes)

;The MIT License MIT ;Copyright c 2017 Robert L. Taylor ;Permission is hereby granted, free of charge, to any person obtaining a ;copy of this software and associated documentation files the “Software”, ;to deal in the Software without restriction, including without limitation ;the rights to use,...

Google Does It Again: Discloses Unpatched Microsoft Edge and IE Vulnerability

This month has yet been kind of interesting for cyber security researchers, with Google successfully cracked SHA1 and the discovery of Cloudbleed bug in Cloudflare that caused the leakage of sensitive information across sites hosted behind Cloudflare. Besides this, Google last week disclosed an...

Microsoft Edge / Internet Explorer HandleColumnBreakOnColumnSpanningElement Type Confusion Exploit

Microsoft Edge and Internet Explorer suffer from a type confusion in HandleColumnBreakOnColumnSpanningElement. Microsoft Edge and IE: Type confusion in HandleColumnBreakOnColumnSpanningElement CVE-2017-0037 PoC: .class1 float: left; column-count: 5; .class2 column-span: all; columns: 1px; table...

Microsoft Edge / Internet Explorer - 'HandleColumnBreakOnColumnSpanningElement' Type Confusion

.class1 float: left; column-count: 5; .class2 column-span: all; columns: 1px; table border-spacing: 0px; function boom document.styleSheets0.media.mediaText = "aaaaaaaaaaaaaaaaaaaa"; th1.align = "right"; !-- Note: The analysis below is based on an 64-bit IE running in single process mode running ...

Microsoft Edge / Internet Explorer HandleColumnBreakOnColumnSpanningElement Type Confusion

Microsoft Edge and IE: Type confusion in HandleColumnBreakOnColumnSpanningElement CVE-2017-0037 PoC: .class1 float: left; column-count: 5; .class2 column-span: all; columns: 1px; table border-spacing: 0px; function boom document.styleSheets0.media.mediaText = "aaaaaaaaaaaaaaaaaaaa"; th1.align =...