Microsoft Internet Explorer 9 IEFRAME - CSelection­Interact­Button­Behavior::_Update­Button­Location

Exploit for windows platform in category dos / poc function go document.exec­Command'Select­All'; document.exec­Command'superscript'; set­Timeoutfunction o­Sup­Element=document.get­Elements­By­Tag­Name'sup'0; o­Sup­Element.swap­Nodedocument.document­Element; , 0; !-- Time-line 27 September 2012:...

Microsoft Internet Explorer 9 - IEFRAME CSelection­Interact­Button­Behavior::_Update­Button­Location Use-After-Free (MS13-047)

function go document.exec­Command'Select­All'; document.exec­Command'superscript'; set­Timeoutfunction o­Sup­Element=document.get­Elements­By­Tag­Name'sup'0; o­Sup­Element.swap­Nodedocument.document­Element; , 0; !-- Time-line 27 September 2012: This vulnerability was found through fuzzing. 3...

OpenSSL 1.1.0a1.1.0b - Denial of Service

OpenSSL 1.1.0a1.1.0b - Denial of Service Exploit Title: OpenSSL 1.1.0a & 1.1.0b Heap Overflow Remote DOS vulnerability Date: 11-12-2016 Software Link: https://www.openssl.org/source/old/1.1.0/ Exploit Author: Silverfox Contact: http://twitter.com/Silverfox Website: https://www.silverf0x00.com/ CV...

Microsoft Internet Explorer MSHTML CDispNode::InsertSiblingNode Use-After-Free

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the twenty-seventh entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161207001.html. There you can find a repro that trigger...

Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (2)

Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free MS13-037 2 !-- Source: http://blog.skylined.nl/20161208001.html Synopsis A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Internet Explorer 9. I did not investigate this...

Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (2)

!-- Source: http://blog.skylined.nl/20161208001.html Synopsis A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability. Known...

Microsoft Internet Explorer 9 MSHTML CDispNode::InsertSiblingNode Use-After-Free

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the twenty-eighth entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161208001.html. There you can find a repro that triggere...

Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free (MS13-009) Exploit

Exploit for windows platform in category dos / poc window.open"Repro.xml", "iframe"; set­Timeoutfunction window.open'javascript:voidlocation.href = "about:blank";', "iframe"; , 1000; Description This is the first security vulnerability I sold to ZDI after I quit my job at Google to live off...

Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free (MS13-009)

Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free MS13-009 window.open"Repro.xml", "iframe"; set­Timeoutfunction window.open'javascript:voidlocation.href = "about:blank";', "iframe"; , 1000; Description This is the first security vulnerability I sold to ZDI after I quit my j...

Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free (MS13-009)

window.open"Repro.xml", "iframe"; set­Timeoutfunction window.open'javascript:voidlocation.href = "about:blank";', "iframe"; , 1000; Description This is the first security vulnerability I sold to ZDI after I quit my job at Google to live off security bug bounties. It appears I either did not analy...

Google Debuts Continuous Fuzzer for Open Source Software

A new Google program aimed at continuously fuzzing open source software has already detected over 150 bugs. The program, OSS-Fuzz, currently in beta mode, is designed to help unearth programming errors in open source software via fuzz testing. Fuzz testing, or fuzzing is when bits of randomly...

Microsoft Internet Explorer 9 CDoc::ExecuteScriptUri Use-After-Free

Since November I have been releasing details on all vulnerabilities I found in web-browsers that I had not released before. I will try to continue to publish all my old vulnerabilities, including those not in web-browser, as long as I can find some time to do so. If you find this information...

Opera foreignObject textNode::removeChild Use-After-Free

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the twenty-second entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these...

Opera foreignObject textNode::removeChild Use-After-Free Vulnerability

Opera suffers from a foreignObject textNode::removeChild use-after-free vulnerability. Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the twenty-second entry in that series. Unfortunately I won't be able to publish...

MS Edge CMarkup::EnsureDeleteCFState Use-After-Free

As I am sure you are by now well aware, in November I decided to start releasing details on all vulnerabilities I found in web-browsers that I had not released before. As I was unable to publish all of them within a single month, I will try to continue to publish all my old vulnerabilities,...

Google Chrome Accessibility blink::Node Corruption

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the twenty-first entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these...

Microsoft Internet Explorer 8/9/10/11 - MSHTML 'DOMImplementation' Type Confusion (MS16-009)

Source: http://blog.skylined.nl/20161128001.html Synopsis A specially crafted web-page can cause a type confusion vulnerability in Microsoft Internet Explorer 8 through to 11. An attacker can cause code to be executed with a stack layout it does not expect, or have code attempt to execute a metho...

Microsoft Internet Explorer 8 MSHTML - 'Ptls5::Ls­Find­Span­Visual­Boundaries' Memory Co

Exploit for windows platform in category dos / poc 0day.today 2018-01-02...

Fuzzing Android: tap the Android system components components of vulnerability-vulnerability warning-the black bar safety net

Full-text overview This article focuses on one can be used to find Android system components in the different types of vulnerability fuzzing method. This article describes a General purpose vulnerability discovery method, and he is how applications on Android platform. The following is a has been...

Microsoft Internet Explorer 8 jscript - 'Reg­Exp­Base::FBad­Header' Use-After-Free (MS15

Exploit for windows platform in category dos / poc // This Po­C attempts to exploit a use-after-free bug in Microsoft Internet // Explorer 8. // See http://blog.skylined.nl/20161116001.html for details. var r=new Reg­Exp"A|x|x|xx|xxxxxxxxxxxxxxxxxxxx+", "g"; "A".replacer, function // Force OLEAUT...