My.WiFi USB Drive 1.0 iOS - Local File Inclusion

My.WiFi USB Drive 1.0 iOS - Local File Inclusion Document Title: =============== My.WiFi USB Drive v1.0 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1589 Release Date: ============= 2015-09-24 Vulnerability Laboratory ...

Adobe Acrobat Reader - AFParseDate JavaScript API Restrictions Bypass

Adobe Acrobat Reader - AFParseDate JavaScript API Restrictions Bypass Title: Adobe Acrobat Reader AFParseDate Javascript API Restrictions Bypass Vulnerability Date: 09/28/2015 Author: Reigning Shells, based off PoC published by Zero Day Initiative Vendor Homepage: adobe.com Version: Adobe Reader...

BisonWare BisonFTP 3.5 Directory Traversal

!/usr/bin/python title: BisonWare BisonFTP server product V3.5 Directory Traversal Vulnerability author: Jay Turla tested on Windows XP Service Pack 3 - English software link: https://www.exploit-db.com/apps/081331edfc143738a60e029192b5986e-BisonFTPServer.rar description: BisonWare BisonFTP serve...

PCMan FTP Server 2.0.7 - Directory Traversal Vulnerability

Exploit for windows platform in category remote exploits !/usr/bin/python title: PCMan FTP Server v2.0.7 Directory Traversal author: Jay Turla tested on Windows XP Service Pack 3 - English software Link: https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z description: PCMAN...

Git-1.9.5 ssh-agent.exe Buffer Overflow Exploit

Exploit for windows platform in category dos / poc Vendor: ================================ git-scm.com Product: ================================ Git-1.9.5-preview20150319.exe github.com/msysgit/msysgit/releases/tag/Git-1.9.5-preview20150319 Vulnerability Type: =================== Buffer Overflow...

SunshineCRM v1 /general/ERP/LOGIN/logincheck.php SQL注入漏洞

（0day）郑州单点科技软件有限公司开发的开源软件SunShineCRMv1版存在SQL注入漏洞漏洞分析过程如下：1、 源码分析： SunShineCRM系统登录页面index.php的POST表单action跳转到logincheck.php页面 Logincheck.php页面负责对登录的用户名和密码进行验证，虽然有校验特殊字符的代码，但却并 未过滤和转义这些特殊字符2、 POC过程： 首先检测注入是否存在 然后使用SQLMAP探测目标数据库信息，默认数据库mysql和CRM系统数据库crmmarket sqlmap-u...

Windows 10 kernel buffer overflow in NtGdiBitBlt PoC

Exploit for windows platform in category dos / poc / compile: cl.exe bug474.cpp user32.lib gdi32.lib shell32.lib / include include include include HWND notepadLPCSTR name char filename1024, title1024; FILE f=0x0; sprintfsfilename, 1024, "%s.txt", name; DWORD rc = fopens&f, filename, "w"; ifrc!=0...

kindeditor<=4.1.5文件上传漏洞

漏洞描述漏洞存在于kindeditor编辑器里，你能上传.txt和.html文件，支持php/asp/jsp/asp.net漏洞存在于小于等于kindeditor4.1.5编辑器中关键字： allinurl:/examples/uploadbutton.html allinurl:/php/uploadjson.php / .asp /...

VLC media player 2.2.1 heap corruption Exploit

Exploit for multiple platform in category dos / poc / VLC media player 2.2.1 poc crash Author : st4n Vendor link : http://www.videolan.org/vlc/ Discovered : 21.08.2015 Version : 2.2.1 Category : Local-DOS Tested On : Windows 8.1 x64 / define CRTSECURENOWARNINGS 1 include unsigned char poccrash =...

Joomla Spider Random Article Component - SQL Injection

Exploit Title : Joomla Spider Random Article Component SQL Injection vulnerability Author : Jagriti Sahu AKA Incredible Vendor Link : http://demo.web-dorado.com/spider-random-article.html Date : 22/03/2015 Discovered at : IndiShell Lab Love to : error1046 ^^ ,Team IndiShell,Codebreaker ICA...

My.WiFi USB Drive v1.0 iOS - File Upload Web Vulnerability

Document Title: =============== My.WiFi USB Drive v1.0 iOS - File Upload Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1589 Release Date: ============= 2015-09-23 Vulnerability Laboratory ID VL-ID: ====================================...

Microsoft Windows Kernel - WindowStation Use-After-Free (MS15-061)

Microsoft Windows Kernel - WindowStation Use-After-Free MS15-061 Source: https://code.google.com/p/google-security-research/issues/detail?id=295 Platform: Win7 32-bit. trigger.cpp should fire the issue, with caveats: - PoC MUST be compiled in release mode. - PoC may need to be run a few times to...

Microsoft Windows Kernel - SURFOBJ Null Pointer Dereference (MS15-061)

Microsoft Windows Kernel - SURFOBJ Null Pointer Dereference MS15-061 Source: https://code.google.com/p/google-security-research/issues/detail?id=312 This issue is very likely a null pointer issue affecting 32-bit Windows version. The offset is from add onto another offset which isn't quite zero, ...

Microsoft Windows Kernel - Use-After-Free with Printer Device Contexts (MS15-097)

Microsoft Windows Kernel - Use-After-Free with Printer Device Contexts MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=433 --- The attached PoC demonstrates a UAF condition with printer device contexts. The PoC will trigger on Win 7 32-bit with Special Pool...

Air Drive Plus 2.4 Arbitrary File Upload

Document Title: =============== Air Drive Plus v2.4 iOS - Arbitrary File Upload Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1597 Release Date: ============= 2015-09-21 Vulnerability Laboratory ID VL-ID:...

OS X Regex Engine (TRE) - Integer Signedness and Overflow Issues Vulnerability

Exploit for macOS platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=429 The OS X regex engine function tretnfarunparallel contains the following code: int tbytes; ... if !matchtags numtags = 0; else numtags = tnfa-numtags; ... int rbytes,...

Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (2)

Microsoft Windows Kernel - Bitmap Handling Use-After-Free MS15-061 2 Source: https://code.google.com/p/google-security-research/issues/detail?id=311 Bitmap object Use-after-Free 2 The attached PoC triggers a blue screen due to a use after free vulnerability. The crashes are unreliable, however yo...

Microsoft Windows Kernel - 'SURFOBJ' Null Pointer Dereference (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=312 This issue is very likely a null pointer issue affecting 32-bit Windows version. The offset is from add onto another offset which isn't quite zero, so not 100% convinced it is just a null pointer, however I wasn't abl...

Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (1)

Source: https://code.google.com/p/google-security-research/issues/detail?id=293 Platform: Win7 32-bit. trigger.cpp should fire the issue, with two caveats: - PoC will NOT work if compiled as a debug build. - PoC will trigger the condition every time but the subsequent corruption might not cause a...

Microsoft Windows Kernel - Pool Buffer Overflow Drawing Caption Bar (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=321 The PoC triggers a crashes due to a pool buffer overflow while drawing the caption bar of window. The trigger depends on the current window layout and resolution. The PoC takes an offset on the command line to be able...