Adobe Flash Player ShaderJob Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Adobe Flash Player ShaderJob Buffer Overflow', 'Description' = %q This module exploits a buffer overflow vulnerability related to th...

Adobe Flash Player ShaderJob Buffer Overflow

This module exploits a buffer overflow vulnerability related to the ShaderJob workings on Adobe Flash Player. The vulnerability happens when trying to apply a Shader setting up the same Bitmap object as src and destination of the ShaderJob. Modifying the "width" attribute of the ShaderJob after...

Adobe Flash Player NetConnection Type Confusion

This module exploits a type confusion vulnerability in the NetConnection class on Adobe Flash Player. When using a correct memory layout this vulnerability allows to corrupt arbitrary memory. It can be used to overwrite dangerous objects, like vectors, and ultimately accomplish remote code...

CMS Subkarma Cross Site Scripting / SQL Injection Vulnerabilities

CMS Subkarma suffers from cross site scripting and remote SQL injection vulnerabilities. Note that this finding houses site-specific data. Multiple SQL Injection & XSS on CMS SUBKARMA Risk: High CWE number: CWE-89,CWE-79 Date: 13/10/2014 Vendor: www.jttel.com.tw Author: Felipe " Renzi " Gabriel...

MVO - Maquina Vendas Online SQL Injection

SQL Injection on MVO ? - M?quina Vendas Online Risk: High CWE number: CWE-89 Date: 13/10/2014 Vendor: adnweb.es Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on: Linux Mint ; Firefox ; Sqlmap 1.0-dev-nongit-20140906 Vulnerable File: product.php Exploits:...

CMS Subkarma Cross Site Scripting / SQL Injection

Multiple SQL Injection & XSS on CMS SUBKARMA Risk: High CWE number: CWE-89,CWE-79 Date: 13/10/2014 Vendor: www.jttel.com.tw Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on: Linux Mint ; Firefox ; Sqlmap 1.0-dev-nongit-20140906 Vulnerables File: news.php ; product.php ;...

@CMS 2.1.1 SQL Injection

SQL Injection on @CMS 2.1.1 Stable Risk: High CWE number: CWE-89 Date: 22/08/2014 Vendor: www.atcode.net Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on: Linux Mint Vulnerable File: articles.php Exploit: http://host/articles.php?catid=SQLI PoC:...

CMS Agencija O2 Cross Site Scripting / SQL Injection Vulnerabilities

CMS Agencija O2 suffers from cross site scripting and remote SQL injection vulnerabilities. SQL Injection & XSS on CMS Agencija O2 Risk: High CWE number: CWE-89,CWE-79 Date: 22/08/2014 Vendor: Agencija O2 Author: Felipe " Renzi " Gabriel Contact: email protected Tested on: Windows 8 pro & Linux...

CMS Agencija O2 Cross Site Scripting / SQL Injection

SQL Injection & XSS on CMS Agencija O2 Risk: High CWE number: CWE-89,CWE-79 Date: 22/08/2014 Vendor: Agencija O2 Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on: Windows 8 pro & Linux Mint Vulnerable File: category.php Exploits: http://host/cms/category.php?qcatid=SQLI & X...

Quack Chat 1.0 - Multiple Vulnerabilities

No description provided by source. Exploit Title: Quack Chat 1.0 - XSS / SQL Injection / Path Diclosure Date: 15 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.quack-chat.com/ Tested on: Win8 & Linux Mint Affected Version : 1.0...

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities

No description provided by source. Exploit Title: Hotel Software and Booking system 1.8 - SQL Injection / Cross Site Scripting Date: 21 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.cbhotel.eu/ Tested on: Win8 & Linux Mint Affected...

Adobe Flash Player Shader Buffer Overflow

This module exploits a buffer overflow vulnerability in Adobe Flash Player. The vulnerability occurs in the flash.Display.Shader class, when setting specially crafted data as its bytecode, as exploited in the wild in April 2014. This module has been tested successfully on the following operating...

Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free

This module exploits a use after free vulnerability in Adobe Flash Player. The vulnerability occurs in the ByteArray::UncompressViaZlibVariant method, when trying to uncompress a malformed byte stream. This module has been tested successfully on: Windows 7 SP1 32 bits, IE 8 to IE 11 and Flash...

WordPress Simple Login Registration 1.0.1 Cross Site Scripting

Exploit Title: Cross Site Scripting WP Simple Login Registration 1.0.1 - Wordpress Date: 26 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://envato.dropntheme.com/wp-simple-login-registration-plugin/ Tested on: Win8 & Linux Mint Affected...

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities

Exploit Title: Hotel Software and Booking system 1.8 - SQL Injection / Cross Site Scripting Date: 21 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.cbhotel.eu/ Tested on: Win8 & Linux Mint Affected Version : 1.8 & Anteriores. Contacts...

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities Exploit Title: Hotel Software and Booking system 1.8 - SQL Injection / Cross Site Scripting Date: 21 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.cbhotel.eu/...

Quack Chat 1.0 - Multiple Vulnerabilities

Quark Chat version 1.0 suffers from cross site scripting, path disclosure, and remote SQL injection vulnerabilities. Exploit Title: Quack Chat 1.0 - XSS / SQL Injection / Path Diclosure Date: 15 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage:...

Quack Chat 1.0 - Multiple Vulnerabilities

Exploit Title: Quack Chat 1.0 - XSS / SQL Injection / Path Diclosure Date: 15 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.quack-chat.com/ Tested on: Win8 & Linux Mint Affected Version : 1.0 Contacts: https://twitter.com/Dylanirzi11...

Quack Chat 1.0 - Multiple Vulnerabilities

Quack Chat 1.0 - Multiple Vulnerabilities Exploit Title: Quack Chat 1.0 - XSS / SQL Injection / Path Diclosure Date: 15 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.quack-chat.com/ Tested on: Win8 & Linux Mint Affected Version : 1.0...

Quark Chat 1.0 XSS / SQL Injection / Path Disclosure

Exploit Title: Quark Chat 1.0 - XSS / SQL Injection / Path Diclosure Date: 15 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.quack-chat.com/ Tested on: Win8 & Linux Mint Affected Version : 1.0 Contacts: https://twitter.com/Dylanirzi11...