CVE-2019-18634

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist on...

Windows Kernel - Information Disclosure

Windows Kernel - Information Disclosure PoC for the SWAPGS attack CVE-2019-1125 This holds the sources for the SWAPGS attack PoC publicly shown at Black Hat USA, 2019. Contents leakgsbkva - variant 1 look for random values in kernel memory; limited to PE kernel image header leakgsbkvat - variant ...

IceWarp WebMail 11.4.4.1 Cross Site Scripting

Title: IceWarp WebMail Cross-Site Scripting Vulnerability + Date: 2020/01/27 + Author: Lutfu Mert Ceylan + Vendor Homepage: www.icewarp.com + Tested on: Windows 10 + Versions: 11.4.4.1 and before + Vulnerable Parameter: "color" Get Method + Vulnerable File: /webmail/ + Dork : inurl:/webmail/...

Microsoft Windows Kernel - Information Disclosure

PoC for the SWAPGS attack CVE-2019-1125 This holds the sources for the SWAPGS attack PoC publicly shown at Black Hat USA, 2019. Contents leakgsbkva - variant 1 look for random values in kernel memory; limited to PE kernel image header leakgsbkvat - variant 2 extract random values from kernel...

Genexis Platinum-4410 2.1 Authentication Bypass

Exploit Title: Genexis Platinum-4410 2.1 - Authentication Bypass Date: 20220-01-08 Exploit Author: Husinul Sanub Author Contact: https://www.linkedin.com/in/husinul-sanub-658239106/ Vulnerable Product: Genexis Platinum-4410 v2.1 Home Gateway Router https://genexis.co.in/product/ont/ Firmware...

Remote Desktop Gateway - 'BlueGate' Denial of Service (PoC)

include "BlueGate.h" / EDB Note: - Download Source - Download Binary / void errorconst char msg printf"ERROR: %s\n", msg; exitEXITFAILURE; void SOCKInit WSADATA wsaData; int res; res = WSAStartupMAKEWORD2, 2, &wsaData; if res != 0 error"WSAStartup failed"; void DTLSInit SSLlibraryinit;...

BOOTP Turbo 2.0 - Denial of Service (SEH) Exploit

Exploit Title: BOOTP Turbo 2.0 - Denial of Service SEHPoC Exploit Author: boku Software Vendor: Wierd Solutions Vendor Homepage: https://www.weird-solutions.com Software Link: https://www.weird-solutions.com/download/products/bootptdemoIA32.exe Version: BOOTP Turbo x86 Version 2.0 Tested On:...

BOOTP Turbo 2.0 Denial Of Service

Exploit Title: BOOTP Turbo 2.0 - Denial of Service SEHPoC Exploit Author: boku Date: 2020-01-22 Software Vendor: Wierd Solutions Vendor Homepage: https://www.weird-solutions.com Software Link: https://www.weird-solutions.com/download/products/bootptdemoIA32.exe Version: BOOTP Turbo x86 Version 2....

Remote Desktop Gateway - 'BlueGate' Denial of Service (PoC)

include "BlueGate.h" / EDB Note: - Download Binary https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47964-1.exe - Download Source https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47964-2.zip / void errorconst char msg printf"ERROR:...

PoC Exploits Do More Good Than Harm: Threatpost Poll

When it comes to the release of proof-of-concept PoC exploits, more security experts agree that the positives outweigh the negatives, according to a recent and informal Threatpost poll. Last week, Threatpost conducted a reader poll and almost 60 percent of 230 security pundits thought it was a...

Contact Form Clean and Simple < 4.7.1 - Authenticated Stored XSS

The Contact Form Clean and Simple WordPress plugin was vulnerable to Authenticated stored XSS. When a user has admin capabilities, malicious code can be submitted through the plugin's options. This code will then be executed on every page with the contact form on the front-end. PoC By checking th...

KeePass 2.44 - Denial of Service (PoC)

Exploit Title : KeePass 2.44 - Denial of Service PoC Product : KeePass Password Safe Version : Help About KeePass Help any local help area Drag&Drop HTML File Save the contents to html. Payload-1: DoS & Run Cmd //=0;i-- tryo+=x.c" + "harAti;catchereturn o;f"\"function fx,yvar i,o=\"\\\""+...

ManageEngine Network Configuration Manager 12.2 - apiKey SQL Injection

ManageEngine Network Configuration Manager 12.2 - apiKey SQL Injection Exploit Title: ManageEngine Network Configuration Manager 12.2 - 'apiKey' SQL Injection discovery Date: 2019-01-24 published : 2020-01-20 Exploit Author: AmirHadi Yazdani Vendor Homepage:...

Hospital Management System 4.0 Cross Site Scripting

Exploit Title: Hospital Management System 4.0 Stored Cross-Site Scripting Vulnerability Date: 2020-01-20 Exploit Author: Priyanka Samak Vendor Homepage: https://phpgurukul.com/ Software Link : https://phpgurukul.com/hospital-management-system-in-php/ Software : Hospital Management System Version ...

Sysax Multi Server 5.50 Denial Of Service

Exploit Title: Sysax Multi Server 5.50 - Denial of Service PoC Google Dork: NA Date: 2020-01-20 Exploit Author: Shailesh Kumavat Vendor Homepage: https://www.sysax.com/ Software Link: https://www.sysax.com/download.htmsysaxserv Version: Sysax Multi Server 5.50 Tested on: WIndow 7 CVE : if...

Sysax Multi Server 5.50 - Denial of Service (PoC)

Exploit Title: Sysax Multi Server 5.50 - Denial of Service PoC Google Dork: NA Date: 2020-01-20 Exploit Author: Shailesh Kumavat Vendor Homepage: https://www.sysax.com/ Software Link: https://www.sysax.com/download.htmsysaxserv Version: Sysax Multi Server 5.50 Tested on: WIndow 7 CVE : if...

Sysax Multi Server 5.50 - Denial of Service Exploit

Exploit Title: Sysax Multi Server 5.50 - Denial of Service PoC Exploit Author: Shailesh Kumavat Vendor Homepage: https://www.sysax.com/ Software Link: https://www.sysax.com/download.htmsysaxserv Version: Sysax Multi Server 5.50 Tested on: WIndow 7 CVE : if applicable 1 Download software install i...

Batch-Move Posts <= 1.5 - Broken Authentication leading to Unauthenticated Stored XSS

An attacker can add a Cross-Site Scripting XSS payload remotely without any authentication. The Payload gets triggered when an Admin visits the settings page of the plugin. Edit WPScanTeam: The plugin is still affected and has been closed. PoC Vulnerable code is from lines 68 to 84. The code gets...

Stripo Inc: HTTP Request Smuggling on my.stripo.email

Summary: HTTP request smuggling vulnerabilities arise when websites route HTTP requests through webservers with inconsistent HTTP parsing. By supplying a request that gets interpreted as being different lengths by different servers, an attacker can poison the back-end TCP/TLS socket and prepend...

Threatpost Poll: Are Published PoC Exploits a Good or Bad Idea?

The practice of disclosing proof-of-concept PoC exploits has long caused a debate in the security community. As the name suggests, these outline steps used to exploit a vulnerability in a system to show how it can be done — and are used to test networks and pinpoint vulnerable aspects of a system...