WebKit - detachWrapper Use-After-Free

WebKit - detachWrapper Use-After-Free ::detachWrapper /Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:...

Geovision Inc. IP CameraVideoAccess Control - Multiple Remote Command Execution Stack Overflow Double Free Unauthorized Access

Geovision Inc. IP CameraVideoAccess Control - Multiple Remote Command Execution Stack Overflow Double Free Unauthorized Access STX Subject: Geovision Inc. IP Camera/Video/Access Control Multiple Remote Command Execution - Multiple Stack Overflow - Double free - Unauthorized Access Attack vector:...

WebKit - detachWrapper Use-After-Free Exploit

Exploit for multiple platform in category dos / poc ::detachWrapper /Users/projectzero/webkit/WebKit/WebKitBuild/Release...

Node.js third-party modules: Prototype pollution attack (merge-deep)

As discussed in 309391, here's the separate report for each of the library. This one is the information for the merge-deep library. Module: merge-deep Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control part of th...

Node.js third-party modules: Prototype pollution attack (defaults-deep)

As discussed in 309391, here's the separate report for each of the library. This one is the information for the defaults-deep library. Module: https://www.npmjs.com/package/defaults-deep Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object"...

OwnCloud Server 10.0 User Enumeration

Class User Enumeration CVE Remote Yes Credit n4xh4ck5 Home https://github.com/n4xh4ck5 Vulnerable Owncloud Server 8.1 to 10.0 Once time authenticated in the application, the Owncloud funcionality let to User enumeration due the different error messages of the server. The vulnerabiblity it finds i...

Netis-WF2419 Cross Site Request Forgery

Exploit Title: Netis-WF2419 Router Cross-Site Request Forgery CSRF Date: 28/01/2018 Exploit Author: Sajibe Kanti Author Contact: https://twitter.com/@sajibekantibd Vendor Homepage: http://www.netis-systems.com/ Version: Netis-WF2419, V2.2.36123 Tested on: Windows 10 Technical Details & Descriptio...

Artifex MuJS 1.0.2 - Denial of Service

Artifex MuJS 1.0.2 - Denial of Service Hello, I want to submit the following bug: The jsstrtod function in jsdtoa.c in Artifex MuJS through 1.0.2 has an integer overflow because of incorrect exponent validation. Exploit Title: Integer signedness error leading to Out-of-bounds read that causes cra...

MixPad 5.00 Buffer Overflow

!/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: NCH Software MixPad v5.00 - Unicode Buffer Overflow Date: 21-01-2017 Vulnerable Software: NCH Software MixPad Vendor Homepage: http://www.nch.com.au/mixpad Version: v5.00 Software Link: http://www.nch.com.au/mixpad/mpsetup.exe...

Email Subscribers & Newsletters < 3.4.8 - Unauthenticated Subscriber Download

The Email Subscribers & Newsletters – Simple and Effective Email Marketing WordPress Plugin WordPress plugin was affected by an Unauthenticated Subscriber Download security vulnerability. PoC POST /?es=export ... option=viewallsubscribers...

Workable Zone 1.1 Database Disclosure

============================================================================================================================ | Title : Workable Zone v1.1 Human Resource Management System data base Disclosure Vulnerability | | Author : indoushka | | email : [email protected] | | Tested on :...

Microsoft Edge: Chakra: Deferred parsing makes wrong scopes #2(CVE-2018-0775)

Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to issue 1310 . PoC: // Enable the flag using '\n'.repeat0x1000 evalfunction f with function printf; ; ; + '\n'.repeat0x1000; PoC 2: // ./ch poc.js -ForceDeferParse functio...

Microsoft Edge: Chakra: AsmJSByteCodeGenerator::EmitCall call handling bug(CVE-2018-0780)

AsmJSByteCodeGenerator::EmitCall which is used to emit call insturctions doesn't check if an array identifier is used as callee. The method handles those invalid calls in the same way it handles valid calls such as "arridx & ...". In these cases, the index register remains NoRegister which is...

Microsoft Edge: Chakra: JIT: Incorrect bounds calculation(CVE-2018-0769)

Let's start with comments in the "GlobOpt::TrackIntSpecializedAddSubConstant" method. // Track bounds for add or sub with a constant. For instance, consider b = a + 2. The value of 'b' should track // that it is equal to the value of 'a' + 2. That part has been done above. Similarly, the value of...

Microsoft Edge: Chakra: JIT: Loop analysis bug(CVE-2018-0777)

Here's the PoC demonstrating OOB write. function optarr, start, end for let i = start; i end; i++ if i === 10 i += 0; // -- a arri = 2.3023e-320; function main let arr = new Array100; arr.fill1.1; for let i = 0; i 1000; i++ optarr, 0, 3; optarr, 0, 100000; main; What happens here is as follows: I...

Microsoft Edge Chakra AsmJSByteCodeGenerator::EmitCall Call Handling

Microsoft Edge: Chakra: AsmJSByteCodeGenerator::EmitCall call handling bug CVE-2018-0780 AsmJSByteCodeGenerator::EmitCall which is used to emit call insturctions doesn't check if an array identifier is used as callee. The method handles those invalid calls in the same way it handles valid calls...

Microsoft Edge Chakra - Incorrect Scope Handling Exploit

Exploit for windows platform in category dos / poc // PoC: function funcarg = function printfunc; // SetHasOwnLocalInClosure should be called for the param scope in the PostVisitFunction function. printfunc; function func ; // Chakra fails to distinguish whether the function is referenced in the...

Microsoft Edge Chakra Deferred Parsing

Microsoft Edge: Chakra: Deferred parsing makes wrong scopes 2 CVE-2018-0775 Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to issue 1310 . PoC: // Enable the flag using '\n'.repeat0x1000 evalfunction f with function...

Smiths Medical Medfusion 4000 - DHCP Denial of Service

Smiths Medical Medfusion 4000 - DHCP Denial of Service !/usr/bin/python3 """PoC for MQX RTCS code execution via DHCP options overflow. This is just a quick hack to prove the vulnerability and was designed to run on a private network with the target device. """ import datetime import socket def...

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes (2)

Exploit for windows platform in category dos / poc / Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to issue 1310 . PoC: / // Enable the flag using '\n'.repeat0x1000 evalfunction f with function printf; ; ; +...