Disk Pulse Enterprise 9.9.16 GET Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Disk Pulse Enterprise GET Buffer Overflow', 'Description' = %q This module exploits an SEH buffer overflow in Disk Pulse Enterprise 9.9.16. If a...

Microsoft Windows Kernel - nt!NtSetIoCompletion nt!NtRemoveIoCompletion Pool Memory Disclosure

Microsoft Windows Kernel - nt!NtSetIoCompletion nt!NtRemoveIoCompletion Pool Memory Disclosure / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1269 We have discovered that the nt!NtRemoveIoCompletion system call handler discloses 4 bytes of uninitialized pool memory to user-mo...

Ubiquiti Inc.: Remote Code Execution at http://tw.corp.ubnt.com

The researcher found a Command Injection in tw.corp.ubnt.com. While hunting i came across a host of Ubiquiti Networks tw.corp.ubnt.com , when i browsed to http://tw.corp.ubnt.com there was Dir listing enabled which contained various sensitive information. This was reported to Ubiquiti Team. Howev...

Disk Pulse Enterprise GET Buffer Overflow

A buffer overflow vulnerability exists in the web server component of Disk Pulse Enterprise Server. The vulnerability is due to insufficient bounds check. Successful exploitation of the vulnerability may cause code execution under Windows NT AUTHORITYSYSTEM account...

CVE-2017-7441

In Sophos SurfRight HitmanPro before 3.7.20 Build 286 included in the HitmanPro.Alert solution and Sophos Clean, a crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks. Because the leak occurs at the driver level, an attacker can use this vulnerability to leak some critical informatio...

PT-2017-17738

Name of the Vulnerable Software and Affected Versions Sophos SurfRight HitmanPro versions prior to 3.7.20 Build 286 Description A crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks in Sophos SurfRight HitmanPro. This issue occurs at the driver level, allowing an attacker to leak...

CVE-2017-7441: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Sophos SurfRight HitmanPro before 3.7.20 Build 286 included in the HitmanPro.Alert solution and Sophos Clean, a crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks. Because the leak occurs at the driver level, an attacker can use this vulnerability to leak some critical informatio...

Lotus Notes Diagnostic Tool 8.5/9.0 - Privilege Escalation Vulnerability

Exploit for windows platform in category local exploits Exploit Title: Lotus Notes Diagnostic Tool nsd.exe Privelege Escalation Date: 02-09-2017 Exploit Author: ParagonSec Website: https://github.com/paragonsec Version: 8.5 & 9.0 Tested on: Windows 7 Enterprise CVE: CVE-2015-0179 Vendor CVE URL:...

Lotus Notes Diagnostic Tool 8.5 / 9.0 Privilege Escalation

Exploit Title: Lotus Notes Diagnostic Tool nsd.exe Privelege Escalation Date: 02-09-2017 Exploit Author: ParagonSec Website: https://github.com/paragonsec Version: 8.5 & 9.0 Tested on: Windows 7 Enterprise CVE: CVE-2015-0179 Vendor CVE URL: http://www-01.ibm.com/support/docview.wss?uid=swg2170002...

Lotus Notes Diagnostic Tool 8.5/9.0 - Local Privilege Escalation

Exploit Title: Lotus Notes Diagnostic Tool nsd.exe Privelege Escalation Date: 02-09-2017 Exploit Author: ParagonSec Website: https://github.com/paragonsec Version: 8.5 & 9.0 Tested on: Windows 7 Enterprise CVE: CVE-2015-0179 Vendor CVE URL: http://www-01.ibm.com/support/docview.wss?uid=swg2170002...

Disk Pulse Enterprise GET Buffer Overflow

This module exploits an SEH buffer overflow in Disk Pulse Enterprise 9.9.16. If a malicious user sends a crafted HTTP GET request it is possible to execute a payload that would run under the Windows NT AUTHORITY\SYSTEM account. Module Options msf use exploit/windows/http/disk/pulseenterpriseget m...

PT-2017-3510

Name of the Vulnerable Software and Affected Versions DiskPulse versions 9.9.16 and earlier DiskSavvy versions 9.9.14 and earlier DupScout versions 9.9.14 and earlier SyncBreeze versions 9.9.16 and earlier Description The issue is caused by a buffer overflow in the web server component of the...

CVE-2017-8622

Windows Subsystem for Linux in Windows 10 1703 allows an elevation of privilege vulnerability when it fails to properly handle handles NT pipes, aka "Windows Subsystem for Linux Elevation of Privilege Vulnerability"...

CVE-2017-8622

The CVE-2017-8622 entry describes an elevation-of-privilege vulnerability in Windows Subsystem for Linux (WSL) on Windows 10 version 1703, caused by improper handling of NT pipes. A locally authenticated attacker could execute code with elevated privileges by exploiting this flaw. Public referenc...

Windows Subsystem for Linux Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles NT pipes. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker could run a...

CVE-2017-8622: Undefined Security Weakness

Windows Subsystem for Linux in Windows 10 1703 allows an elevation of privilege vulnerability when it fails to properly handle handles NT pipes, aka "Windows Subsystem for Linux Elevation of Privilege Vulnerability"...

PT-2017-18442

Name of the Vulnerable Software and Affected Versions Windows Subsystem for Linux version 10 1703 Description The issue arises from the Windows Subsystem for Linux failing to properly handle handles to NT pipes, leading to an elevation of privilege. This allows attackers to affect the system...

CVE-2016-10402: Improper Restriction of Operations within the Bounds of a Memory Buffer

Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual address in a PE file, causing an integer overflow and heap-based buffer underflow...

PT-2017-7898

Name of the Vulnerable Software and Affected Versions Avira Antivirus engine versions prior to 8.3.36.60 Description The issue allows remote code execution as NT AUTHORITYSYSTEM. This is caused by an integer overflow and heap-based buffer underflow resulting from a section header with a very larg...

NTLM, LDAP&RDP Relay vulnerability analysis-vulnerability warning-the black bar safety net

Over the past few months, the Preempt research team found and reported two of Microsoft's NT LAN Manager NTLM vulnerability. These vulnerabilities have the same problem, IE NTLM does not correctly handle two different protocols. These issues are very important, because even turn on LDAP server...