CVE-2019-7956

Adobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an Insecure Library Loading DLL hijacking vulnerability. Successful exploitation could lead to Privilege Escalation in the context of the current user...

UACME - Defeating Windows User Account Control

Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. System Requirements x86-32/x64 Windows 7/8/8.1/10 client, some methods however works on server version too. Admin account with UAC set on default settings required. Usage Run executable from command line:...

Streamripper 2.6 - Song Pattern Buffer Overflow Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: StreamRipper32 Buffer Overflow Exploit Author: Andrey Stoykov OSCP Tested On: Win7 SP1 x64 Software Link: http://streamripper.sourceforge.net/sr32/StreamRipper3226.exe Version: 2.6 Steps To Reproduce: Double...

ProClima Uncontrolled Search Path Element Vulnerability

ProClima is a thermal calculation software from Schneider Electric that can be used to determine the best thermal solution for a control panel. An uncontrolled search path element vulnerability exists in versions prior to ProClima 8.0.0. An attacker could exploit this vulnerability to execute...

Microsoft Windows 10 < build 17763 - AppXSvc Hard Link Privilege Escalation Exploit

There exists a privilege escalation vulnerability for Windows 10 builds prior to build 17763. Due to the AppXSvc's improper handling of hard links, a user can gain full privileges over a SYSTEM-owned file. The user can then utilize the new file to execute code as SYSTEM. This Metasploit module...

CVE-2019-6825

A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProClima all versions prior to version 8.0.0 which could allow a malicious DLL file, with the same name of any resident DLLs inside the software installation, to execute arbitrary code in all versions of ProClima prior to version...

Path traversal

A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProClima all versions prior to version 8.0.0 which could allow a malicious DLL file, with the same name of any resident DLLs inside the software installation, to execute arbitrary code in all versions of ProClima prior to version...

CVE-2019-6825

A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProClima all versions prior to version 8.0.0 which could allow a malicious DLL file, with the same name of any resident DLLs inside the software installation, to execute arbitrary code in all versions of ProClima prior to version...

CVE-2019-1089

An elevation of privilege vulnerability exists in rpcss.dll when the RPC service Activation Kernel improperly handles an RPC request. To exploit this vulnerability, a low level authenticated attacker could run a specially crafted application. The security update addresses this vulnerability by...

CVE-2019-1082

An elevation of privilege vulnerability exists in Microsoft Windows where a certain DLL, with Local Service privilege, is vulnerable to race planting a customized DLL.An attacker who successfully exploited this vulnerability could potentially elevate privilege to SYSTEM.The update addresses this...

CVE-2019-1082

An elevation of privilege vulnerability exists in Microsoft Windows where a certain DLL, with Local Service privilege, is vulnerable to race planting a customized DLL.An attacker who successfully exploited this vulnerability could potentially elevate privilege to SYSTEM.The update addresses this...

Privilege escalation

An elevation of privilege vulnerability exists in Microsoft Windows where a certain DLL, with Local Service privilege, is vulnerable to race planting a customized DLL.An attacker who successfully exploited this vulnerability could potentially elevate privilege to SYSTEM.The update addresses this...

Razer US: Synapse 2.21 - DLL Hijacking vulnerability

Description of Vulnerability: When Razer Synapse starts on a Windows machine it tries to load a DLL RazerConfigNative.dll from the C:\ProgramData\Razer\Synapse\Devices directory. If a malicious attacker puts the malicious DLL in that directory, Razer Synapse will load it and run the code found in...

Streamripper 2.6 Buffer Overflow

!/usr/bin/python Exploit Title: StreamRipper32 Buffer Overflow Date: 07/2019 Exploit Author: Andrey Stoykov OSCP Tested On: Win7 SP1 x64 Software Link: http://streamripper.sourceforge.net/sr32/StreamRipper3226.exe Version: 2.6 Steps To Reproduce: Double click on "Add" in the "Station/Song Section...

Streamripper 2.6 - 'Song Pattern' Buffer Overflow

!/usr/bin/python Exploit Title: StreamRipper32 Buffer Overflow Date: 07/2019 Exploit Author: Andrey Stoykov OSCP Tested On: Win7 SP1 x64 Software Link: http://streamripper.sourceforge.net/sr32/StreamRipper3226.exe Version: 2.6 Steps To Reproduce: Double click on "Add" in the "Station/Song Section...

Streamripper 2.6 - Song Pattern Buffer Overflow

Streamripper 2.6 - Song Pattern Buffer Overflow !/usr/bin/python Exploit Title: StreamRipper32 Buffer Overflow Date: 07/2019 Exploit Author: Andrey Stoykov OSCP Tested On: Win7 SP1 x64 Software Link: http://streamripper.sourceforge.net/sr32/StreamRipper3226.exe Version: 2.6 Steps To Reproduce:...

CVE-2019-5629

Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by...

CVE-2019-5629

Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by...

Design/Logic Flaw

Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by...

CVE-2019-5629

Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by...