cve-2019-1458_POC

CVE-2019-1458 : Du rapport 'exploité dans la nature' au POC Introduction En décembre, Kaspersky a publié un article de blog sur une vulnérabilité 0-day exploitée dans la nature1. Cela a piqué mon intérêt car, bien qu'ils aient décrit le fonctionnement de l'exploit, ils n'ont fourni aucun POC dans...

CVE-2016-7255

CVE-2016-7255 Exploit de escalonamento de privilégios de Prova de Conceito usando CVE-2016-7255, que visa espelhar a funcionalidade do exploit encontrado na natureza conforme descrito pela Trend Micro. Talvez seja necessário corrigir a recuperação antes de usar isso em qualquer lugar importante...

CVE-2023-28252

CVE-2023-28252 O TL;DR para os aprendizados da vulnerabilidade do Windows CVE-2023-28252 Então, neste fim de semana, estava praticando a máquina Aero no Hack The Box. A máquina é muito divertida de jogar quando se pode simular um ataque real a uma máquina Windows 11. Depois de completá-la, fiquei...

CVE-2022-4262

Exploit für CVE-2022-4262 Offizieller Chromium-Fehlerbericht. Danke an @clem1 für das Finden des ITW-Exploits. Danke an @5aelo für seine RCA zum Bug. Danke an @bjrjk für seine super ausführliche RCA zum Bug. Danke an @alisaesage für ihr Video zum Bug...

Inside the Fix: Analysis of In-the-Wild Exploit of CVE-2026-21513

Read how PatchDiff-AI uncovered the root cause of CVE-2026-21513 — an actively exploited MSHTML vulnerability — and how APT28 leveraged it in real-world attacks...

Researchers Reveal Detail for Windows Zero-Day Vulnerability Patched Last Month

Details have emerged about a now-patched security flaw in Windows Common Log File System CLFS that could be exploited by an attacker to gain elevated permissions on compromised machines. Tracked as CVE-2022-37969 CVSS score: 7.8, the issue was addressed by Microsoft as part of its Patch Tuesday...

The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)

A deep dive into an in-the-wild Android exploit Guest Post by Xingyu Jin, Android Security Research This is part one of a two-part guest blog post, where first we'll look at the root cause of the CVE-2021-0920 vulnerability. In the second post, we'll dive into the in-the-wild 0-day exploitation o...

Microsoft Releases Workarounds for Office Vulnerability Under Active Exploitation

Microsoft on Monday published guidance for a newly discovered zero-day security flaw in its Office productivity suite that could be exploited to achieve code execution on affected systems. The weakness, now assigned the identifier CVE-2022-30190, is rated 7.8 out of 10 for severity on the CVSS...

TFW you-get-really-excited-you-patch-diffed-a-0day-used-in-the-wild-but-then-find-out-it-is-the-wrong-vuln

Posted by Maddie Stone, Project Zero INTRODUCTION I’m really interested in 0-days exploited in the wild and what we, the security community, can learn about them to make 0-day hard. I explained some of Project Zero’s ideas and goals around in-the-wild 0-days in a November blog post. On December’s...

In-the-wild iOS Exploit Chain 1

Posted by Ian Beer, Project Zero TL;DR This exploit provides evidence that these exploit chains were likely written contemporaneously with their supported iOS versions; that is, the exploit techniques which were used suggest that this exploit was written around the time of iOS 10. This suggests...

In-the-wild iOS Exploit Chain 5

Posted by Ian Beer, Project Zero TL;DR This exploit chain is a three way collision between this attacker group, Brandon Azad from Project Zero, and @S0rryMybad from 360 security. On November 17th 2018, @S0rryMybad used this vulnerability to win $200,000 USD at the TianFu Cup PWN competition...

Mozilla Firefox Interleaving document.write and appendChild Exploit

No description provided by source. $Id: mozillainterleavedwrite.rb 11796 2011-02-22 20:49:44Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...