APNGDis 2.8 - filename Stack Buffer Overflow (PoC)

APNGDis 2.8 - filename Stack Buffer Overflow PoC Exploit Title: APNGDis filename Buffer Overflow Date: 14-03-2017 Exploit Author: Alwin Peppels Vendor Homepage: http://apngdis.sourceforge.net/ Software Link: https://sourceforge.net/projects/apngdis/files/2.8/ Version: 2.8 Tested on: Linux Debian ...

Joomla! Component Guesser v1.0.4 - SQL Injection

Joomla! Component Guesser v1. 0. 4 - SQL Injection Joomla! Component Guesser v1. 0. 4, There is parameter filter is not strict, leading to a sql injection vulnerability, if the other server is turned on the error display, can be directly used Google Dork: inurl:index. php? option=comguesser...

APNGDis 2.8 - 'chunk size descriptor' Heap Buffer Overflow

Exploit Title: APNGDis chunk size descriptor Buffer Overflow Date: 14-03-2017 Exploit Author: Alwin Peppels Vendor Homepage: http://apngdis.sourceforge.net/ Software Link: https://sourceforge.net/projects/apngdis/files/2.8/ Version: 2.8 Tested on: Linux Debian / Windows 7 CVE : CVE-2017-6192...

WebKit memory corruption vulnerability(CVE-2016-4657 )

Can be used for: CVE-2016-4657 Nintendo Switch Node Server Quick node.js server for the WebKit exploit. The virus can be modified in exploit.js Installing and Running cd npm i sudo node server.js Server runs on port 80 needs root unless specified otherwise. Route conntest.nintendowifi.net to your...

Easy MOV Converter 1.4.24 Denial Of Service

!/usr/bin/python Exploit Title : Easy MOV Converter - 'Enter User Name' Field SEH Overwrite POC Date : 12/03/2017 Exploit Author : Muhann4d Vendor Homepage : http://www.divxtodvd.net/ Software Link : http://www.divxtodvd.net/easymovconverter.exe Tested Version : 1.4.24 Category : Denial of Servic...

Easy MOV Converter 1.4.24 - Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title : Easy MOV Converter - 'Enter User Name' Field SEH Overwrite POC Date : 12/03/2017 Exploit Author : Muhann4d Vendor Homepage : http://www.divxtodvd.net/ Software Link : http://www.divxtodvd.net/easymovconverter.exe Tested Version : 1.4.24 Category : Denial of Servic...

Nintendo Switch - WebKit Code Execution (PoC)

Nintendo Switch - WebKit Code Execution PoC CVE-2016-4657 Switch PoC body font-size: 2em; a text-decoration: none; color: 000; a:hover color: f00; font-weight: bold; CVE-2016-4657 Nintendo Switch PoC go! reload waiting... click go. // display JS errors as alerts. Helps debugging. window.onerror =...

Easy MOV Converter 1.4.24 - Local Buffer Overflow (SEH)

Easy MOV Converter 1.4.24 - Local Buffer Overflow SEH !/usr/bin/python Exploit Title : Easy MOV Converter - 'Enter User Name' Field SEH Overwrite POC Date : 12/03/2017 Exploit Author : Muhann4d Vendor Homepage : http://www.divxtodvd.net/ Software Link : http://www.divxtodvd.net/easymovconverter.e...

shopify-scripts: sprintf gem - format string combined attack

In the sprintf gem, NOT included in mruby-engine, there are severe vulnerabilities, including information leak, and heap buffer overflow. Here are the technical details. Technical Error 1: ============== The CHECKl macro can sometimes receive negative values, that will bypass the size checks, sin...

shopify-scripts: SIGSEGV - mrb_yield_with_class

Linux Ubuntu Xenial X64 commit 63dbed00946afda34178a479cfa38fa78d620a00 Author: Yukihiro "Matz" Matsumoto Date: Tue Mar 7 15:01:09 2017 +0900 PoC def a instanceexec return aensure end a output ----------------------------------registers----------------------------------- RAX: 0x7ffff7fec7d0 RBX:...

Apache Struts2 remote code execution vulnerability S2-045 technical analysis and protection solution-vulnerability warning-the black bar safety net

Apache Struts2 Jakarta Multipart parser plug-ins the presence of a remote code execution vulnerability, the vulnerability number is CNNVD-201703-152。 The attacker can use the plugin to upload a file, modify the HTTP request header Content-Type value to trigger the vulnerability leads to remote co...

Joomla! Component OneVote! v1.0 - SQL Injection

Joomla! Component OneVote! v1. 0 - SQL Injection results. in php electionid parameters into the SQL statement exist GET the type of injection Injection point: http://localhost/PATH/components/comonevote/results. php? electionid=SQL union injected payload: +/! 50000union/+select+@@version-- - Test...

SMB denial of service vulnerability in the web application on the use-vulnerability warning-the black bar safety net

CVE-2017-0016 SMB 0 day vulnerability can lead to Windows System denial of service, the present article is mainly to explain the vulnerability in a web application use. 2017 2 2 June, security researchers announced a exists in Microsoft Windows SMB in the 0 day Vulnerability, CVE－2017-0016, the...

Joomla! Component Abstract v2.1 - SQL Injection

Joomla! Component the Abstract v2. 1 - SQL Injection Joomla! Component the Abstract v2. 1, There is a parameter filter is not strict, leading to a sql injection vulnerability Injection point: http://localhost/PATH/index. php? option=comabstract&view=conferences&layout=detail&pid=SQL...

shopify-scripts: mrb_vm_exec - null ptr dereference

Linux Ubuntu Xenial x64 commit ffdf7be7235717fb1cd30e54c24c5383f705f110 Author: Yukihiro "Matz" Matsumoto Date: Thu Mar 2 20:38:16 2017 +0900 Probably related with https://github.com/mruby/mruby/issues/3389 Old PoC 0.instanceeval super New PoC p.instanceeval super 1 ++1 output...

Adminer <= 1.4.5 - Security Bypass

The plugin is still affected and has been closed. PoC https://example.com/wp-content/plugins/adminer/inc/editor/index.php...

2017 Visual Studio Code Workspace settings code execution

The following issue constitutes an arbitrary code execution vulnerability in Visual Studio Code herein referred to as "Code". Users should upgrade to Code 1.9.0 or later. says: Visual Studio Code is a source code editor developed by Microsoft for Windows, Linux and macOS. It includes support for...

WordPress NewStatPress 1.2.4 Cross Site Scripting

------------------------------------------------------------------------ Persistent Cross-Site Scripting in the WordPress NewStatPress plugin ------------------------------------------------------------------------ Han Sahin, July 2016...

shopify-scripts: SIGSEGV - mark_context_stack

PoC ------------------- The following code triggers the bug attached as testmarkcontextstack.rb: def one tooyieldend def too yield ensure onebreakend one Debug - mirb ------------------- Starting program: /home/x/Desktop/test/mruby/bin/mirb testmarkcontextstack mirb - Embeddable Interactive Ruby...

HackerOne: Subdomain takeover #2 at info.hacker.one

Summary: Hi team, looking the fix released from unbounce team at https://hackerone.com/reports/202767 i've been able to bypass it and takeover again the subdomain info.hacker.one with a new Vulnerable-Endpoint at UnbouncePages App Actual Dns Entry: F164154 Steps To Reproduce & New PoC for HackerO...