Microsoft Word (Win/Mac) - Crash (PoC)

Exploit for multiple platform in category dos / poc Source: https://twitter.com/halsten/status/740380171694280704 Win/Mac MSFT Word 0day POC having 3 different forced triggers. Happy exploitation! Let Word recover it, its essential, and then you can trigger the bug afterwards in 3 ways, Save,...

Microsoft Word (Windows/OSX) - Crash (PoC)

Source: https://twitter.com/halsten/status/740380171694280704 Win/Mac MSFT Word 0day POC having 3 different forced triggers. Happy exploitation! Let Word recover it, its essential, and then you can trigger the bug afterwards in 3 ways, Save, Close/Save, change format. Proof of Concept:...

CVE-2016-4437

Apache Shiro before 1.2.5, when a cipher key has not been configured for the “remember me” feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter. Recent assessments: sv3nbeast at April 17, 2020 12:15pm UTC reported: ...

Veris: Unauthenticated CSRF(User can input any value for CSRF Token)

Hello Veris, I believe you have implemented CSRF token on the registration for a reason. In my research, I found that a user supplied CSRF Token would be accepted and even saved in the browser cookie and will be the set token on subsequent request. This report is limited to the Register and Login...

Zomato: XSS on zomato.com

I found an XSS on zomato.com Here's a POC works even on Chrome - https://www.zomato.com/doha/drinks-and-nightlife-in-al-ghanim?metro='-prompt'XSS'-' I hope this helps :...

WordPress Plugin WP Mobile Detector 3.5 - Arbitrary File Upload

WordPress Plugin WP Mobile Detector 3.5 - Arbitrary File Upload Exploit Title: WP Mobile Detector =3.5 Arbitrary File upload Google Dork: inurl: /wp-includes/plugins/wp-mobile-detector Date: 1-06-2015 Exploit Author: Aaditya Purani Author Details: https://aadityapurani.com Vendor:...

WordPress WP Mobile Detector 3.5 Plugin - Arbitrary File Upload

Exploit for php platform in category web applications Exploit Title: WP Mobile Detector =3.5 Arbitrary File upload Google Dork: inurl: /wp-includes/plugins/wp-mobile-detector Date: 1-06-2015 Exploit Author: Aaditya Purani Author Details: https://aadityapurani.com Vendor:...

WordPress WP Mobile Detector 3.5 Shell Upload

Exploit Title: WP Mobile Detector =3.5 Arbitrary File upload Google Dork: inurl: /wp-includes/plugins/wp-mobile-detector Date: 1-06-2015 Exploit Author: Aaditya Purani Author Details: https://aadityapurani.com Vendor: https://wordpress.org/plugins/wp-mobile-detector/changelog Version: 3.5 Tested...

WordPress Plugin WP Mobile Detector 3.5 - Arbitrary File Upload

Exploit Title: WP Mobile Detector =3.5 Arbitrary File upload Google Dork: inurl: /wp-includes/plugins/wp-mobile-detector Date: 1-06-2015 Exploit Author: Aaditya Purani Author Details: https://aadityapurani.com Vendor: https://wordpress.org/plugins/wp-mobile-detector/changelog Version: 3.5 Tested...

Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock)

Exploit Title: ShellShock On Sun Secure Global Desktop & Oracle Global desktop Google Dork: intitle:Install the Sun Secure Global Desktop Native Client Date: 6/4/2016 Exploit Author: [email protected] Vendor Homepage: http://www.sun.com/ & http://www.oracle.com/ Software Link:...

Internet Bug Bounty: Integer Overflow in _gd2GetHeader() resulting in heap overflow

The gd2GetHeader is prone to an integer overflow, which result in heap based overflow. Tested on PHP 5.6.22 --------------- PoC --------------- $ ls poc.gd poc.php $ cat poc.php --------------- Result --------------- /php$ gdb -q --args ./php-5.6.22/sapi/cli/php poc.php Reading symbols from...

LocalTapiola: DOM XSS bypassing in Regional Office -selector

Issue A previous report https://hackerone.com/reports/127077 led the reporter to do some further investigation. During the investigation, a DOM XSS was found in one of the javascript libraries used on www.lahitapiola.fi. The report contained a brief PoC and a screenshot as proof. Fix The issue wa...

Websockify (C Implementation) 0.8.0 - Buffer Overflow (PoC)

Websockify C Implementation 0.8.0 - Buffer Overflow PoC Advisory: Websockify: Remote Code Execution via Buffer Overflow RedTeam Pentesting discovered a buffer overflow vulnerability in the C implementation of Websockify, which allows attackers to execute arbitrary code. Details ======= Product:...

Joomla! Component SecurityCheck 2.8.9 - Multiple Vulnerabilities

Joomla! Component SecurityCheck 2.8.9 - Multiple Vulnerabilities Information ------------------------------ Advisory by ADEO Security Team Name: Stored XSS and SQL Injection in Joomla SecurityCheck extension Affected Software : SecurityCheck and SecurityCheck Pro Vulnerable Versions: 2.8.9 possib...

XenMobile POC Cheat Sheet

The purpose of this cheat sheet is to provide a detailed POC checklist to assist with the implementation of On-Premise POC implementations. This checklist includes a detailed diagram of your XenMobile POC implementation populated from the information included in the filled out checklist. Addition...

TCPDump 4.5.1 - Crash (PoC)

Exploit Title: tcpdump 4.5.1 Access Violation Crash Date: 31st May 2016 Exploit Author: David Silveiro Vendor Homepage: http://www.tcpdump.org Software Link: http://www.tcpdump.org/release/tcpdump-4.5.1.tar.gz Version: 4.5.1 Tested on: Ubuntu 14 LTS from subprocess import call from shlex import...

TCPDump 4.5.1 - Crash (PoC)

TCPDump 4.5.1 - Crash PoC Exploit Title: tcpdump 4.5.1 Access Violation Crash Date: 31st May 2016 Exploit Author: David Silveiro Vendor Homepage: http://www.tcpdump.org Software Link: http://www.tcpdump.org/release/tcpdump-4.5.1.tar.gz Version: 4.5.1 Tested on: Ubuntu 14 LTS from subprocess impor...

CCextractor 0.80 - Crash (PoC)

Exploit for linux platform in category dos / poc Exploit Title: CCextractor 0.80 Access Violation Crash Date: 31st May 2016 Exploit Author: David Silveiro Xino.co.uk Vendor Homepage: http://www.ccextractor.org/ Software Link: http://www.ccextractor.org/download-ccextractor.html Version: 0.80 Test...

FreeBSD Kernel (FreeBSD 10.2 x64) - sendmsg Kernel Heap Overflow (PoC)

FreeBSD Kernel FreeBSD 10.2 x64 - sendmsg Kernel Heap Overflow PoC include include include include include include include include include include void atagetxportvoid; int kprintfconst char fmt, ...; char ostype; void resolvechar name struct kldsymlookup ksym; ksym.version = sizeofksym;...

FreeBSD Kernel (FreeBSD 10.2 < 10.3 x64) - 'SETFKEY' (PoC)

include include include include include include include include include include include include int kprintfconst char fmt, ...; char ostype; uint64t originalRip; uint64t originalRbp; void resolvechar name struct kldsymlookup ksym; ksym.version = sizeofksym; ksym.symname = name; ifkldsym0,...