Microsoft Office 2007 - 'mso.dll' Use-After-Free (MS15-081)

Source: https://code.google.com/p/google-security-research/issues/detail?id=414&can=1 The following crash was observed in MS Office 2007 running under Windows 2003 x86. Microsoft Office File Validation Add-In is disabled and application verified was enabled for testing and reproduction. This samp...

Vifi Radio 1.0 - Cross-Site Request Forgery

. | | / | | \ \ | | \ / | |\ / / /\ \ / \ | Y / ^ / / || / / / / /\ /\ \ \ \ | / \ / http://h4x0resec.blogspot.com / \ | \ \ / // / \ / / / / Vifi Radio v1 - CSRF Arbitrary Change Password Exploit My + Discovered by: KnocKout Contact : [email protected] HomePage :...

Android mediaserver components exposed high-risk vulnerabilities CVE-2 0 1 5-3 8 4 2, and affects all Android devices-vulnerability warning-the black bar safety net

! On the weeks, Android broke a wave of vulnerabilities, including Stagefright, a 0day serialization vulnerabilities, the Certifi-Gate vulnerability, etc., recent trends in science and technology fellows and broke yet another high-risk VulnerabilityCVE-2 0 1 5-3 8 4 2, and this one vulnerability...

Adobe Flash - XMLSocket Destructor Not Cleared Before Setting User Data in connect

Adobe Flash - XMLSocket Destructor Not Cleared Before Setting User Data in connect Source: https://code.google.com/p/google-security-research/issues/detail?id=416&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id This issue is a variant of issue 192 , which the fix did not...

Adobe Flash - FileReference Class Type Confusion

Adobe Flash - FileReference Class Type Confusion Source: https://code.google.com/p/google-security-research/issues/detail?id=422&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There is a type confusion issue in the TextFormat constructor that is reachable because the...

Flash Broker-Based - Sandbox Escape via Timing Attack Against File Moving

Flash Broker-Based - Sandbox Escape via Timing Attack Against File Moving Source: https://code.google.com/p/google-security-research/issues/detail?id=280&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id FlashBroker - BrokerMoveFileEx TOCTOU IE PM Sandbox Escape 1. Windows 8....

Adobe Flash - FileReference Class Type Confusion

Source: https://code.google.com/p/google-security-research/issues/detail?id=422&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There is a type confusion issue in the TextFormat constructor that is reachable because the FileReference constructor does not verify that the...

Flash Broker-Based Sandbox Escape via Unexpected Directory Lock Exploit

Exploit for windows platform in category remote exploits Source: https://code.google.com/p/google-security-research/issues/detail?id=279&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id FlashBroker - Junction Check Bypass With Locked Directory IE PM Sandbox Escape 1. Windows...

Adobe Flash - Heap Use-After-Free in SurfaceFilterList::C​reateFromScriptAtom

Adobe Flash - Heap Use-After-Free in SurfaceFilterList::C​reateFromScriptAtom Source: https://code.google.com/p/google-security-research/issues/detail?id=484&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for:...

The Mac OS X operating system, and found 2 pieces of Privilege elevation 0day vulnerabilities-vulnerability warning-the black bar safety net

Apple Mac OS X operating system, and found 2 pieces new, 0day vulnerabilities, if an attacker successfully exploited, may be in the victim's equipment on elevated privileges to get root access. Vulnerability details These two vulnerabilities is by Italian security researcher Luca Todesco found, a...

Flash - PCRE Regex Compilation Zero-Length Assertion Arbitrary Bytecode Execution

Source: https://code.google.com/p/google-security-research/issues/detail?id=224&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There’s an error in the PCRE engine version used in Flash that allows the execution of arbitrary PCRE bytecode, with potential for memory corrupti...

Flash Player - Integer Overflow in Function.apply

Source: https://code.google.com/p/google-security-research/issues/detail?id=302&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for: https://code.google.com/p/chromium/issues/detail?id=470837 VULNERABILITY DETAILS An integer overflow while calling Function.apply ca...

Adobe Flash - XMLSocket Destructor Not Cleared Before Setting User Data in connect

Source: https://code.google.com/p/google-security-research/issues/detail?id=416&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id This issue is a variant of issue 192 , which the fix did not address. If XMLSocket connect is called on an object that already has a destroy...

Adobe Flash - Display List Handling Use-After-Free

Adobe Flash - Display List Handling Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=349&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Credit is to KEEN Team. 3 different PoC's in the attached zip. Proof of Concept:...

Adobe Flash - Shared Object Type Confusion

Source: https://code.google.com/p/google-security-research/issues/detail?id=434&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id The Shared Object constructor does not check that the object it is provided is of type Object before setting it to be of type SharedObject. This c...

Adobe Flash - createTextField Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=408&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There is a use-after-free in CreateTextField. If a flash file contains a MovieClip heirarcy, such as: root--l1--l2--l3 If createTextField is calle...

Adobe Flash - textfield.gridFitType Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=418&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There is a use-after-free in the TextField gridFitType setter. A PoC is below: var test = this.createTextField"test", 1, 0, 0, 100, 100; var n =...

XMPlay 3.8.1.12 - '.pls' Local Crash (PoC)

!/usr/bin/env python Exploit Title: XMPlay .pls Local Crash poc Date: 2015-08-16 Exploit Author: St0rn Twitter: st0rnpentest Vendor Homepage: http://www.un4seen.com/ Software Link: http://www.un4seen.com/download.php?xmplay38 Version: 3.8.1.12 Tested on: Windows 7 Stack Overflowing xmplay, but we...

XMPlay 3.8.1.12 - .pls Local Crash PoC

XMPlay version 3.8.1.12 .pls local crash proof of concept exploit. !/usr/bin/env python Exploit Title: XMPlay .pls Local Crash poc Date: 2015-08-16 Exploit Author: St0rn Twitter: st0rnpentest Vendor Homepage: http://www.un4seen.com/ Software Link: http://www.un4seen.com/download.php?xmplay38...

TOTOLINK Routers - Backdoor Remote Code Execution

TOTOLINK Routers - Backdoor Remote Code Execution Exploit Title: TOTOLINK backdoor and RCE exploit POC Google Dork: N/A Date: Thu Aug 13 07:33:29 MDT 2015 Exploit Author: MadMouse Vendor Homepage: http://www.totolink.net/ Software Link:...