Microsoft Internet Explorer 11.576.14393.0 - CStyleSheetArray::BuildListOfMatchedRules Memory Corrup

There is a memory corruption vulnerability in Microsoft Internet Explorer. The vulnerability was confirmed on version 11.576.14393.0 update version 11.0.38 running on Windows 10 64-bit with page heap enabled for iexplore.exe process. details transition-duration: 61s; function go document.fgColor ...

Easy File Uploader Remote Shell Upload

Exploit Title: Easy File Uploader - Arbitrary File Upload Date: 27/04/2017 Exploit Author: Daniel Godoy Vendor Homepage: https://codecanyon.net/ Software Link: https://codecanyon.net/item/easy-file-uploader-php-multiple-uploader-with-file-manager/17222287 Tested on: GNU/Linux GREETZ: Rodrigo...

TYPO3 Extension News - SQL Injection

Exploit Title: TYPO3 News Module SQL Injection Vendor Homepage: https://typo3.org/extensions/repository/view/news Exploit Author: Charles FOL Contact: https://twitter.com/ambionics Website: https://www.ambionics.io/blog/typo3-news-module-sqli !/usr/bin/python3 TYPO3 News Module SQL Injection...

Simple File Uploader - Arbitrary File Download

Simple File Uploader - Arbitrary File Download Exploit Title: Simple File Uploader - Arbitrary File Download Date: 27/04/2017 Exploit Author: Daniel Godoy Vendor Homepage: https://codecanyon.net/ Software Link:...

Revive Ad Server 4.0.1 - Cross-Site Scripting Cross-Site Request Forgery

Revive Ad Server 4.0.1 - Cross-Site Scripting Cross-Site Request Forgery --------------------------------------------------------------- Exploit Title: XSRF Stored Revive Ad Server 4.0.1 Date: 24/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT Vendor Website :...

Revive Ad Server 4.0.1 - Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications --------------------------------------------------------------- Exploit Title: XSRF Stored Revive Ad Server 4.0.1 Date: 24/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT Vendor Website : https://www.revive-adserver.com/ Software...

WordPress Plugin WP Vault Local File Inclusion

Description: Type user access: any user. $GET“wpv-image” is not escaped in include file. File / Code: Path: /wp-content/plugins/wp-vault/trunk/wp-vault.php includedirnameFILE . "/images/" . $GET"wpv-image"; if isset$GET"wpvfileid" includedirnameFILE . "/wpv-file-handler.php"; exit; else if...

Joomla MyPortfolio 3.0.2 SQL Injection

Exploit Title: Joomla Component Myportfolio 3.0.2 - SQL Injection Exploit Author: Persian Hack Team Discovered by : Mojtaba Kazemi Mojtaba MobhaM Home : https://extensions.joomla.org/extensions/extension/directory-a-documentation/portfolio/myportfolio/ Home : http://persian-team.ir/ Telegram...

Revive Ad Server 4.0.1 - Cross-Site Scripting / Cross-Site Request Forgery

--------------------------------------------------------------- Exploit Title: XSRF Stored Revive Ad Server 4.0.1 Date: 24/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT Vendor Website : https://www.revive-adserver.com/ Software download : https://www.revive-adserver.com/download/...

Weblate: demo.weblate.org is vulnerable to SWEET32 Vulnerability

Cryptographic protocols like TLS, SSH, IPsec, and OpenVPN commonly use block cipher algorithms, such as AES, Triple-DES, and Blowfish, to encrypt data between clients and servers. To use such algorithms, the data is broken into fixed-length chunks, called blocks, and each block is encrypted...

FlySpray 1.0-rc4 - Cross-Site Scripting / Cross-Site Request Forgery

Exploit Title: XSRF Stored FlySpray 1.0-rc4 XSS2CSRF add admin account Date: 19/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT : https://www.openoffice.org Version: 1.0-rc4 Tested on: Windows 7 x64 SP1 / Kali Linux Description : A vulnerability has been discovered in Flyspray , which ca...

Weblate: CSRF - Changing the full name / adding a secondary email identity of an account via a GET request

SUMMARY ---------- Hello, I have found a CSRF request via the activation email that will change the full name of the targeted account. This vulnerability exists if the attacker registers a new account and then gives his activation link to someone else. If the victim uses the received activation...

Solarwinds LEM Privilege Escalation via Controlled Sudo Path

Vulnerability Details Affected Vendor: Solarwinds Affected Product: Log and Event Manager Virtual Appliance Affected Version: v6.3.1 Platform: Embedded Linux CWE Classification: CWE-281: Improper Preservation of Permissions, CWE-708: Incorrect Ownership Assignment Impact: Privileged Access...

Joomla! Component Myportfolio 3.0.2 - pid SQL Injection

Joomla! Component Myportfolio 3.0.2 - pid SQL Injection Exploit Title: Joomla Component Myportfolio 3.0.2 - SQL Injection Exploit Author: Persian Hack Team Discovered by : Mojtaba Kazemi Mojtaba MobhaM Home :...

Easy MOV Converter 1.4.24 - Local Buffer Overflow (SEH) Exploit

Exploit for windows platform in category dos / poc !/usr/bin/python Exploit Title : Easy MOV Converter - 'Enter User Name' Field SEH Overwrite POC Date : 12/03/2017 Exploit Author : Muhann4d Vendor Homepage : http://www.divxtodvd.net/ Software Link : http://www.divxtodvd.net/easymovconverter.exe...

VirtualBox - Guest-to-Host Privilege Escalation via Broken Length Handling in slirp Copy Exploit

Exploit for windows platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1086 There is a vulnerability in VirtualBox that permits an attacker with root privileges in a virtual machine with a NAT network interface to corrupt the memory of the...

Apple WebKit: Type confusion in RenderBox with accessibility enabled（CVE-2017-2373）

There is a type confusion vulnerability that affects WebKit with accessibility enabled WebCore::AXObjectCache::gAccessibilityEnabed. PoC: function boom m.append"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; m.setAttribute"aria-labeledby", "t"; d.open = false; foo Bad cast...

Safari Browser: Memory corruption in Array concat (CVE-2017-2464)

There is an out-of-bounds memcpy in Array.concat that can lead to memory corruption. In builtins/ArrayPrototype.js, the function concatSlowPath calls a native method @appendMemcpy with a parameter resultIndex that is handled unsafely by the method. It calls JSArray::appendMemcpy, which calculates...

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Remote Code Execution Exploi

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a dlppolicyupload.cgi remote code execution vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance /opt/TrendMicro/MinorityReport/bin/ Then, all we do is create...

Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_dae.cgi Remote Code Execution Exploit

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a logquerydae.cgi remote code execution vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance + eg: ./poc.py 172.16.175.123 admin123 saturn:trendmicrothreatdiscoverylogquerydaerce mrme$...