KDE 4/5 - KAuth Privilege Escalation Exploit

Exploit for linux platform in category local exploits // cc -Wall smb0k.c -pedantic -std=c11 // // smb4k PoC, also demonstrating broader scope of a generic kde // authentication bypass vulnerability // // C 2017 Sebastian Krahmer // define POSIXCSOURCE 200112L include include include include...

Simple ASC CMS 1.2 Cross Site Scripting

Document Title: =============== Simple ASC CMS v1.2 - Guestbook Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2072 Release Date: ============= 2017-05-21 Vulnerability Laboratory ID VL-ID: ====================================...

WordPress Newsletter Supsystic 1.1.7 Cross Site Scripting

Document Title: =============== Wordpress Newsletter Supsystic 1.1.7 - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2070 Release Date: ============= 2017-05-16 Vulnerability Laboratory ID VL-ID:...

Apple macOS - stackshot Raw Frame Pointers

Apple macOS - stackshot Raw Frame Pointers Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164 This is an issue that allows unentitled root to read kernel frame pointers, which might be useful in combination with a kernel memory corruption bug. By design, the syscall...

Address bar spoofing on macOS Safari(CVE-2017-2500)

version: Safari function spoof document.write"Apple loginPlease input your Apple ID!!!But this is not apple.com!"; window.location.assign"http://www.apple.com:1234"; //or you can use the following JS code: //window.location.assign"http://access.apple.com"; setIntervalspoof,2000; setTimeoutfunctio...

Apple macOS - 'stackshot' Raw Frame Pointers

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164 This is an issue that allows unentitled root to read kernel frame pointers, which might be useful in combination with a kernel memory corruption bug. By design, the syscall stacksnapshotwithconfig permits unentitled root to du...

HTTrack v3.x - Stack Buffer Overflow Vulnerability

Document Title: =============== HTTrack v3.x - Stack Buffer Overflow Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2068 Release Date: ============= 2017-05-22 Vulnerability Laboratory ID VL-ID: ==================================== 2068...

Apple macOS - '32-bit syscall exit' Kernel Register Leak

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1149 The XNU kernel, when compiled for a x86-64 CPU, can run 32-bit x86 binaries in compatibility mode. 32-bit binaries use partly separate syscall entry and exit paths. To return to userspace, unixsyscall in...

Windows 10 x64 Edge CVE-2016-7200 & CVE-2016-7201 vulnerability analysis and exploit-vulnerability warning-the black bar safety net

The 1. Analysis of the environment Operating system: Windows 10 x64 Professional Edition 10.0.14393 browser: Microsoft Edge x64 38.14393.0 2. CVE-2016-7200 analysis This is happening in the JavascriptArray::FilterHelper, due to the type of Confusion caused by the vulnerability, look at the commit...

Sure Thing Disc Labeler 6.2.138.0 - Buffer Overflow (PoC)

Sure Thing Disc Labeler 6.2.138.0 - Buffer Overflow PoC Exploit Title: Sure Thing Disc Labeler - Stack Buffer Overflow PoC Date: 5-19-17 Exploit Author: Chance Johnson [email protected] Vendor Homepage: http://www.surething.com/ Software Link: http://www.surething.com/disclabeler Version:...

Sure Thing Disc Labeler 6.2.138.0 - Buffer Overflow (PoC)

Exploit Title: Sure Thing Disc Labeler - Stack Buffer Overflow PoC Date: 5-19-17 Exploit Author: Chance Johnson [email protected] Vendor Homepage: http://www.surething.com/ Software Link: http://www.surething.com/disclabeler Version: 6.2.138.0 Tested on: Windows 7 x64 / Windows 10 Usage: Ope...

KDE 4/5 - 'KAuth' Local Privilege Escalation

// cc -Wall smb0k.c -pedantic -std=c11 // // smb4k PoC, also demonstrating broader scope of a generic kde // authentication bypass vulnerability // // C 2017 Sebastian Krahmer // define POSIXCSOURCE 200112L include include include include include include include include include void dieconst char...

Apple iOS < 10.3.2 - Notifications API Denial of Service

Exploit for iOS platform in category dos / poc Exploit Title: Apple iOS 10.3.2 - Notifications API Denial of Service Date: 05-15-2017 Exploit Author: Sem Voigtländer @OxFEEDFACE, Vincent Desmurs @vincedes3 and Joseph Shenton Vendor Homepage: https://apple.com Software Link:...

Dup Scout Enterprise 9.5.14 - GET Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Dup Scout Enterprise GET Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability ...

Microsoft Windows 7 Kernel - win32k!xxxClientLpkDrawTextEx Stack Memory Disclosure

Microsoft Windows 7 Kernel - win32k!xxxClientLpkDrawTextEx Stack Memory Disclosure / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1182 We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 7 other...

MuPDF Fitz library font glyph scaling Code Execution Vulnerability

Summary An exploitable heap out of bounds write vulnerability exists in the Fitz graphical library part of the MuPDF renderer. A specially crafted PDF file can cause a out of bounds write resulting in heap metadata and sensitive process memory corruption leading to potential code execution. Victi...

shopify-scripts: Heap Overflow in fiber_switch triggered from Fiber.transfer

It appears as if my recommendations were ignored in the GitHub issue, so I've repeated the issue here. PoC Fiber.new.transfer 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0 Explanation The cause of this is th...

Starbucks: Missing CSRF Token On Remove Coupun From Cart

Hi, When remove coupun, there's no CSRF token, at this time i use ███████ Coupun to reproduce it. Vuln Request POST /on/demandware.store/Sites-Teavana-Site/default/Cart-RemoveCoupon HTTP/1.1 Host: www.teavana.com User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64; rv:53.0 Gecko/20100101 Firefox/53.0...

Delightful Downloads <= 1.6.6 - Unauthenticated Path Traversal

Since no authentication or authorisation checks for direct access to the jqueryFileTree.php are made, the vulnerability allows for browsing the file system on a host out of an unauthenticated context. Even though no file content can be exfiltrated this way, "hidden" files e.g. in the web...

QuickZip V4. 60 buffer overflow vulnerability details-vulnerability warning-the black bar safety net

This article will provide the reader a detailed description QuickZip v4. 60 buffer overflow vulnerability knowledge. Due to the vulnerabilities in 2010 appeared, so it's designed only for 32-bit Windows XP. So, I decided to try it in 64-bit Windows 7 reproduce the vulnerability, it would be a fun...