UltraISO 9.7.1.3519 - 'Output FileName' Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title: UltraISO 9.7.1.3519 - Local Buffer Overflow SEH Date: 30/01/2019 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: https://www.ultraiso.com/ Version: 9.7.1.3519 Software Link: https://www.ultraiso.com/download.html Contact: [email protected]...

Anyburn 4.3 - Convert image to file format Denial of Service Exploit

!/usr/bin/python Exploit Title: AnyBurn x86 - Denial of Service DoS Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: http://www.anyburn.com/ Version: 4.3 32-bit Software Link : http://www.anyburn.com/anyburnsetup.exe Contact: [email protected] Twitter: @telspacesystems Gree...

HTML5 Video Player 1.2.5 - Local Buffer Overflow (Non SEH)

!/usr/bin/python Exploit Title: HTML5 Video Player 1.2.5 - Local Buffer Overflow - Non SEH Date: 27/01/2019 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: http://www.html5videoplayer.net/download.html Software: http://www.html5videoplayer.net/html5videoplayer-setup.exe Contact:...

R 3.4.4 XP SP3 - Buffer Overflow (Non SEH) Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: R 3.4.4 - Local Buffer Overflow Windows XP SP3 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: https://cloud.r-project.org/bin/windows/ Contact: [email protected] Twitter:...

R 3.4.4 XP SP3 - Buffer Overflow (Non SEH)

R 3.4.4 XP SP3 - Buffer Overflow Non SEH !/usr/bin/python Exploit Title: R 3.4.4 - Local Buffer Overflow Windows XP SP3 Date: 21/01/2019 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: https://cloud.r-project.org/bin/windows/ Contact: [email protected] Twitter:...

R 3.4.4 Local Buffer Overflow

!/usr/bin/python Exploit Title: R 3.4.4 - Local Buffer Overflow Windows XP SP3 Date: 21/01/2019 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: https://cloud.r-project.org/bin/windows/ Contact: [email protected] Twitter: @telspacesystems Version: 3.4.4 Tested on: Windows X...

Lua 5.3.5 Use-After-Free

Exploit Title: Lua 5.3.5 Exploit Author: Fady Mohamed Osman https://twitter.com/fadyothman Exploit-db : http://www.exploit-db.com/author/?a=2986 Blog : https://blog.fadyothman.com/ Date: Jan. 10th 2019 Vendor Homepage: https://www.lua.org/ Software Link: https://www.lua.org/ftp/lua-5.3.5.tar.gz...

Low: curl

Issue Overview: A heap use-after-free flaw was found in curl related to closing an easy handle. When closing and cleaning up an 'easy' handle in the Curlclose function, the library code first frees a struct without nulling the pointer and might then subsequently erroneously write to a struct fiel...

Starbucks: Information Exposure Through an Error Message at news.starbucks.com

I've discovered Information Exposure Through an Error Message on your system POC link: https://news.starbucks.com/cms/index.php?/cp/login/forgottenpasswordform=http://evil.com/?id=test-test Vulnerable url --...

OpenSource ERP 6.3.1. - SQL Injection

OpenSource ERP 6.3.1. - SQL Injection Exploit Title: OpenSource ERP SQL Injection Date: 10.01.2019 Exploit Author: Emre ÖVÜNÇ Vendor Homepage: http://www.nelson-it.ch Software Link: http://sourceforge.net/projects/opensourceerp/files/Windows/erp6.3.1.exe/download Version: v6.3.1 Tested on: Window...

BMC Remedy / ITAM 7.1.00 / 9.1.02.003 Information Disclosure

Intro: Multiple security related issues were identified in the BMC Remedy + ITAM, versions 7.1.00 and 9.1.02.003 were confirmed to be vulnerable. Issues: 1. Authenticated users can access ITAM forms using forceful browsing, i.e. the forms are not accessible in the ITAM web user interface. The lis...

Low: zziplib

Issue Overview: An improper input validation was found in function zzipfetchdisktrailer of ZZIPlib, up to 0.13.68, that could lead to a crash in zzipparserootdirectory function of zzip/ip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip...

Untainted By Design: How Our MITRE ATT&CK Results Demonstrate the Resilience of Carbon Black

I started my career in cybersecurity 10 years ago as a Technical Operations Officer in the US Intelligence Community, where I had a first-hand view into the most sophisticated ongoing cyber operations in the world. One thing was always clear: attackers always found ways to stay a step ahead of th...

Medium: python34, python36

Issue Overview: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data...

BLITZ! Like a Great Middle Linebacker, An Agile & Strong EDR Solution Can Quickly Respond to an Offensive Attack

As we near the close of 2018, we should appreciate that cyberspace has become an increasingly hostile landscape. Geoplitical tensions are manifesting in cyberspace and cyber criminals have become increasingly punitive this year. We at Carbon Black have observed some interesting trends: Vapor Worm...

DevAudit - Open-source, Cross-Platform, Multi-Purpose Security Auditing Tool

DevAudit is an open-source, cross-platform, multi-purpose security auditing tool targeted at developers and teams adopting DevOps and DevSecOps that detects security vulnerabilities at multiple levels of the solution stack. DevAudit provides a wide array of auditing capabilities that automate...

Medium: mysql55

Issue Overview: Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with...

Important: ruby23, ruby24

Issue Overview: An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first...

NRCC Email Hack Highlights Lack of Visibility & Proactive Threat Hunting at Political Organizations

Earlier this week, Politico reported that the National Republican Congressional Committee NRCC suffered a major attack prior to the 2018 U.S. midterm elections, with thousands of sensitive emails from four senior aides exposed to an outside intruder. While the impact of this breach is still...

Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP

In MITREs evaluation of endpoint detection and response solutions, Windows Defender Advanced Threat Protection demonstrated industry-leading optics and detection capabilities. The breadth of telemetry, the strength of threat intelligence, and the advanced, automatic detection through machine...