Microsoft Windows jscript Use-After-Free

Windows: multiple use-after-free issues in jscript Array methods CVE-2018-0935 There are multiple use-after-free issues in Array methods in jscript. When jscript executes an Array method such as Array.join, it first retrieves the length of an array. If the input is not an array but an object, the...

Microsoft Windows - Multiple Use-After-Free Issues in jscript Array Methods Exploit

Exploit for windows platform in category dos / poc !-- There are multiple use-after-free issues in Array methods in jscript. When jscript executes an Array method such as Array.join, it first retrieves the length of an array. If the input is not an array but an object, then the length property of...

Discourse: Stored XSS in "post last edited" option

There are two users: Attacker and Victim. 2. Attacker starts a private talk via private message with the Victim. 3. Attacker send a message to Victim, then he edits it or deletes it. 4. Victim sees the yellow pencil, symbol of the edit. 5. Victim clicks on yellow pencil to see the edit and the...

Microsoft Sharepoint 14.x Cross Site Scripting Vulnerability

Exploit for asp platform in category web applications + Title: Microsoft-sharepoint FilterValue Cross Site Scripting XSS + Date: 2018/04/04 + Author: Mostafa Gharzi + Team: Maher - CertCC.ir + Vendor Homepage: https://products.office.com/en-us/sharepoint/collaboration + Tested on: Windows 10 & Ka...

Sophos Endpoint Protection 10.7 Tamper Protection Bypass

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SOPHOS-ENDPOINT-PROTECTION-v10.7-TAMPER-PROTECTION-BYPASS-CVE-2018-4863.txt + ISR: Apparition Security Vendor: ============= www.sophos.com Product: =========== Sophos...

Mail.ru: [dl.beepcar.ru] CRLF Injection

CRLF Injection via Get request PoC: https://dl.beepcar.ru/qwerty%0ASet-Cookie:%20test=qwerty;domain=.beepcar.ru HTTP Response: HTTP/1.1 302 Moved Temporarily Server: nginx/1.12.2 Date: Tue, 03 Apr 2018 19:20:31 GMT Content-Type: text/html Content-Length: 161 Connection: close Location:...

ModSecurity WAF 3.0 for Nginx - Denial of Service Vulnerability

Exploit for linux platform in category dos / poc / 1. Use-After-Free UAF / During one of the engagements my team tested a WAF running in production Nginx + ModSecurity + OWASP Core Rule Set 123. In the system logs I found information about the Nginx worker processes being terminated due to memory...

Chrome V8 ElementsAccessorBase::CollectValuesOrEntriesImpl Type Confusion

Chrome: V8: Type confusion in ElementsAccessorBase::CollectValuesOrEntriesImpl CVE-2018-6064 Here's a snippet of the method. https://cs.chromium.org/chromium/src/v8/src/elements.cc?rcl=3cbf26e8a21aa76703d2c3c51adb9c96119500da&l=1051 static Maybe CollectValuesOrEntriesImpl Isolate isolate, Handle...

SharpLynx v9.2.3 Insecure File Permissions

Summary Back Office Software for Sharp POS Terminals. Catering for the needs of retail and hospitality businesses, SharpLynx has been developed as a modular software solution with options from simple program management and sales analysis through to multi-location stock control. Description...

LifeSize ClearSea 3.1.4 - Directory Traversal

''' Tittle: LifeSize ClearSea 3.1.4 Directory Traversal Vulnerabilities Author: rsp3ar Impact: Remote Code Execution Post-Authentication Recommendation: Use strong password for default 'admin' user and secure management access to the device. Please consult vendor for replacement/alternative...

Sync Breeze Enterprise 10.4.18 - Denial of-Service (PoC)

!/usr/bin/python import socket import sys from struct import pack try: server = sys.argv1 port = 9121 size = 1000 inputBuffer = b"\x41" size header = b"\x75\x19\xba\xab" header += b"\x03\x00\x00\x00" header += b"\x00\x40\x00\x00" header += pack'I', leninputBuffer header += pack'I', leninputBuffer...

Systematic SitAware NVG Denial Of Service

Exploit Title: SitAware NVG Denial of Service Date: 03/31/2018 Exploit Author: 2u53 Vendor Homepage: https://systematic.com/defence/products/c2/sitaware/ Version: 6.4 SP2 Tested on: Windows Server 2012 R2 CVE: CVE-2018-9115 Remarks: PoC needs bottlypy: https://bottlepy.org/docs/dev/...

A “Patch for the Meltdown Patch” released out of band Thursday night

The Meltdown/Spectre saga continues… Late Thursday, Microsoft released a patch for Windows 7 and Server 2008 R2 operating systems to resolve CVE-2018-1038. Apparently, this vulnerability was actually introduced by the patches released in January to mitigate the effects of Meltdown. Microsoft did...

Design/Logic Flaw

In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. A large size value may lead to a SIGABRT during an attempt at memory allocation. NOTE: some third parties have been unable to reproduce the SIGABRT when using the...

CVE-2018-9145

In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. A large size value may lead to a SIGABRT during an attempt at memory allocation. NOTE: some third parties have been unable to reproduce the SIGABRT when using the...

CVE-2018-9145

CVE-2018-9145 affects Exiv2 0.26, specifically the DataBuf::DataBuf constructor in include/exiv2/types.hpp. A large initial buffer size may cause a SIGABRT during memory allocation. Note that some third parties could not reproduce the SIGABRT with the 4-DataBuf-abort-1 PoC file. The provided docu...

CVE-2018-9145

In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. A large size value may lead to a SIGABRT during an attempt at memory allocation. NOTE: some third parties have been unable to reproduce the SIGABRT when using the...

Systematic SitAware - NVG Denial of Service

Exploit Title: SitAware NVG Denial of Service Date: 03/31/2018 Exploit Author: 2u53 Vendor Homepage: https://systematic.com/defence/products/c2/sitaware/ Version: 6.4 SP2 Tested on: Windows Server 2012 R2 CVE: CVE-2018-9115 Remarks: PoC needs bottlypy: https://bottlepy.org/docs/dev/...

Systematic SitAware - NVG Denial of Service

Systematic SitAware - NVG Denial of Service Exploit Title: SitAware NVG Denial of Service Date: 03/31/2018 Exploit Author: 2u53 Vendor Homepage: https://systematic.com/defence/products/c2/sitaware/ Version: 6.4 SP2 Tested on: Windows Server 2012 R2 CVE: CVE-2018-9115 Remarks: PoC needs bottlypy:...

D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router - Authentication Bypass

Exploit Title: D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Route Authentication Bypass CVE: CVE-2018-9032 Date: 24-03-2018 Exploit Author: Gem George Author Contact: https://www.linkedin.com/in/gemgrge Vulnerable Product: D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router...