Microsoft Windows - jscript!RegExpComp::Compile Heap Overflow Through IE or Local Network via WPAD

Microsoft Windows - jscript!RegExpComp::Compile Heap Overflow Through IE or Local Network via WPAD var s = 'a'; forvar i=0;i...

Microsoft Windows jscript!NameTbl::GetValDef Use-After-Free Exploit

Exploit for windows platform in category dos / poc Windows: use-after-free in jscript!NameTbl::GetValDef CVE-2017-11903 There is a use-after-free vulnerability in jscript.dll. This issue could potentially be exploited through multiple vectors: - An attacker on the local network could exploit this...

Microsoft Internet Explorer 11 jscript!JSONStringifyObject Use-After-Free Exploit

There is a use-after-free in jscript.dll library that can be exploited in IE11. IE11: use-after-free in jscript!JSONStringifyObject CVE-2017-11793 There is a use-after-free in jscript.dll library that can be exploited in IE11. PoC: ========================================= var o1 = toJSON:functio...

Microsoft Windows jscript!RegExpComp::Compile Heap Overflow Exploit

There is a heap overflow in jscript.dll when compiling a regex. This issue could potentially be exploited through multiple vectors. Windows: Heap overflow in jscript!RegExpComp::Compile through IE or local network via WPAD CVE-2017-11890 There is a heap overflow in jscript.dll when compiling a...

Microsoft Windows - jscript.dll 'Array.sort' Heap Overflow

var vars = new Array100; var arr = new Array1000; forvar i=1;i !-- ========================================= Technical details: Array.sort is implemented in JsArraySort which, depending if a comparison function was specified or not, calls JsArrayStringHeapSort or JsArrayFunctionHeapSort. These...

Microsoft Windows - jscript.dll Array.sort Heap Overflow

Microsoft Windows - jscript.dll Array.sort Heap Overflow var vars = new Array100; var arr = new Array1000; forvar i=1;i !-- ========================================= Technical details: Array.sort is implemented in JsArraySort which, depending if a comparison function was specified or not, calls...

Microsoft Windows jscript!RegExpFncObj::LastParen Out-Of-Bounds Read

Windows: out-of-bounds read in jscript!RegExpFncObj::LastParen CVE-2017-11906 There is an out-of-bounds read in jscript.dll library used in IE, WPAD and other places: PoC for IE note: page heap might be required to obsorve the crash: ========================================= function go var r= ne...

Microsoft Windows - jscript!NameTbl::GetValDef Use-After-Free

Microsoft Windows - jscript!NameTbl::GetValDef Use-After-Free var vars = new Array100; forvar i=0;i !-- ============================================ PoC for WPAD might require page heap to trigger the crash: ============================================ function...

Microsoft Windows - 'jscript!NameTbl::GetValDef' Use-After-Free

var vars = new Array100; forvar i=0;i !-- ============================================ PoC for WPAD might require page heap to trigger the crash: ============================================ function FindProxyForURLurl, host var vars = new Array100; forv...

Microsoft Windows - 'jscript!RegExpFncObj::LastParen' Out-of-Bounds Read

function go var r= new RegExpArray100.join''; ''.searchr; alertRegExp.lastParen; go; r rax=0000000000000063 rbx=000000000476fd90 rcx=0000000000000063 rdx=0000000000000064 rsi=000000000476fd90 rdi=000007fef23d37d0 rip=000007fef23d3813 rsp=00000000130f9090 rbp=00000000130f9148 r8=00000000130f9210...

Microsoft Internet Explorer 11 jscript!JSONStringifyObject Use-After-Free

IE11: use-after-free in jscript!JSONStringifyObject CVE-2017-11793 There is a use-after-free in jscript.dll library that can be exploited in IE11. PoC: ========================================= var o1 = toJSON:function alert'o1'; return o2; var o2 = toJSON:function alert'o2'; CollectGarbage; retu...

WIndows jscript!JsArraySlice Uninitialized Variable

Windows: Uninitialized variable in jscript!JsArraySlice CVE-2017-11855 There is an uninitialized variable vulnerability in jscript.dll. This issue could potentially be exploited through multiple vectors: - By opening a malicious web page in Internet Explorer. - currently untested An attacker on t...

Windows jscript!NameTbl::GetValDef Use-After-Free

Windows: use-after-free in jscript!NameTbl::GetValDef CVE-2017-11903 There is a use-after-free vulnerability in jscript.dll. This issue could potentially be exploited through multiple vectors: - An attacker on the local network could exploit this issue by posing as a WPAD Web Proxy Auto-Discovery...

X (Formerly Twitter): Persistent DOM-based XSS in https://help.twitter.com via localStorage

Summary: I've found a DOM-based XSS vulnerability in the website help.twitter.com that persists via a localStorage key lastArticleHref. The value of this localStorage key is used to dynamically generate a piece of HTML code without proper encoding or filtering allowing an attacker to inject...

Microsoft Windows Internet Explorer scripting remote code execution vulnerability (CNVD-2018-00779)

Microsoft Windows Server 2016 and others are operating systems released by Microsoft Corporation USA.Internet Explorer IE is one of the browsers. scripting engine is one of the scripting engines. A remote code execution vulnerability exists in the scripting engine of IE 9, 10, and 11 in Microsoft...

Microsoft Internet Explorer Memory Corruption Vulnerability (CNVD-2018-00741)

Internet Explorer is a web browser from Microsoft. A memory corruption vulnerability exists in Microsoft Internet Explorer, which can be exploited by an attacker to execute arbitrary code in the context of an affected application...

Microsoft Windows Internet Explorer scripting remote code execution vulnerability

Microsoft Windows 7 SP1 and others are operating systems released by Microsoft Corporation in the U.S. Internet Explorer IE is a web browser that comes with the Windows operating system. scripting engines is one of the JavaScript engine components. A remote code execution vulnerability exists in...

Microsoft Windows Edge and Internet Explorer Remote Code Execution Vulnerability (CNVD-2018-00788)

Microsoft Windows is an operating system released by Microsoft Corporation in the U.S. Edge and Internet Explorer IE are among the browsers. The former is the default browser that comes with the latest operating system, Windows 10, and the latter is the default browser that comes with operating...

Microsoft Internet Explorer Information Disclosure Vulnerability (CNVD-2018-00752)

Microsoft Windows is the operating system of Microsoft Corporation in the U.S. Internet Explorer IE is the Web browser that comes with the Windows operating system. An information disclosure vulnerability exists in Microsoft Windows IE, which arises from a program's failure to properly handle...

Microsoft Windows Internet Explorer scripting remote code execution vulnerability (CNVD-2018-00782)

Microsoft Windows Server 2016 and others are operating systems released by Microsoft Corporation USA.Internet Explorer IE is one of the browsers. scripting engine is one of the scripting engines. A remote code execution vulnerability exists in the scripting engine of IE 9, 10, and 11 in Microsoft...