Acunetix WVS 10.0 Build 20150623 Denial Of Service

Exploit Title : Acunetix Web Vulnerability Scanner 10.0 Build 20150623 - Denial of Service PoC Discovery by: Javier Enrique Rodriguez Gutierrez Discovery Date : 2018-08-11 Vendor Homepage: https://www.acunetix.com Tested Version : 10.0 Vulnerability Type : Denial of Service PoC Tested on OS :...

Acunetix WVS 10.0 Build 20150623 - Denial of Service (PoC)

Acunetix WVS 10.0 Build 20150623 - Denial of Service PoC Exploit Title : Acunetix Web Vulnerability Scanner 10.0 Build 20150623 - Denial of Service PoC Discovery by: Javier Enrique Rodriguez Gutierrez Discovery Date : 2018-08-11 Vendor Homepage: https://www.acunetix.com Tested Version : 10.0...

IP Finder 1.5 - Denial of Service (PoC)

IP Finder 1.5 - Denial of Service PoC Exploit Title: IP Finder 1.5 - Denial of Service PoC Author: Shubham Singh Known As: Spirited Wolf Twitter: @Pwsecspirit Discovey Date: 2018-08-12 Software Link: https://securimport.com/university/index.php/videovigilancia-ip/software/429-ip-finder Tested...

Acunetix WVS 10.0 Build 20150623 - Denial of Service (PoC)

Exploit Title : Acunetix Web Vulnerability Scanner 10.0 Build 20150623 - Denial of Service PoC Discovery by: Javier Enrique Rodriguez Gutierrez Discovery Date : 2018-08-11 Vendor Homepage: https://www.acunetix.com Tested Version : 10.0 Vulnerability Type : Denial of Service PoC Tested on OS :...

Ed: Physical Laptop Takeover

At 6:16PM of August 11th of 2018, during H1-702, right before the sand storm beat the shit out of the rooftop party, we managed to perform a critical attack on Ed's infrastructure. F332214 Report Summary During our analysis and reconnaissance of how Ed program worked during the h1-702 event, we...

Slack: Possibility to freeze/crash the host system of all Slack Desktop users easily

Hello, I report here what I suspect to be a critical issue for all your users using the Slack Desktop app. Please find below my research way and the corresponding POC result: First, I started by exploring the content of the file app.asar of the Slack Dresktop application. I was firstly attrackted...

AgataSoft Auto PingMaster 1.5 - Buffer Overflow (SEH) Exploit

Exploit for windows platform in category local exploits Exploit Title: AgataSoft Auto PingMaster 1.5 - Buffer Overflow SEH Exploit Author: bzyo Twitter: @bzyo Vulnerable Software: AgataSoft Auto PingMaster 1.5 Vendor Homepage: http://agatasoft.com/ Version: 1.5 Software Link :...

QNap QVR Client 5.0.3.23100 - Denial of Service (PoC)

QNap QVR Client 5.0.3.23100 - Denial of Service PoC Exploit Title : QNap QVR Client 5.0.3.23100 - Denial of Service PoC Discovery by : Rodrigo Eduardo Rodriguez Discovery Date : 2018-08-06 Vendor Homepage: http://www.qnapsecurity.com/n/en/ Software Link :...

QNap QVR Client 5.0.3.23100 - Denial of Service (PoC)

Exploit Title : QNap QVR Client 5.0.3.23100 - Denial of Service PoC Discovery by : Rodrigo Eduardo Rodriguez Discovery Date : 2018-08-06 Vendor Homepage: http://www.qnapsecurity.com/n/en/ Software Link : http://download.qnap.com/Surveillance/Utility/QNewMon5.zip Tested Version : 5.0.3.23100...

Microsoft Windows SCF File Feature Bypass

Exploit Title: Microsoft Windows 'SCF' File 'Open File Security Warning' Feature Bypass Vulnerability Google Dork: N/A Date: August 3, 2018 Exploit Author: Eduardo Braun Prado Vendor Homepage: http://www.microsoft.com/ Software Link: http://www.microsoft.com/ Version: Windows 7 SP1, 8.1 with full...

Monero: Stack Overflow in JSON RPC Server

Summary: There is a stack overflow bug in jsonparser when parsing nesting objects. Description: Monero's json parser handled by epee libraries doesn't check object tree depth while parsing Steps To Reproduce: Up the service bash monerod run bash python2 poc.py backtrace SUMMARY: AddressSanitizer:...

Plex Media Server 1.13.2.5154 - SSDP Processing XML External Entity Injection

Plex Media Server 1.13.2.5154 - SSDP Processing XML External Entity Injection Issue: Out-of-Band XXE in Plex Media Server's SSDP Processing Reserved CVE: CVE-2018-13415 Vulnerability Overview The XML parsing engine for Plex Media Server's SSDP/UPNP functionality is vulnerable to an XML External...

FB Inboxer 1.2 SQL Injection

Exploit Title: FB Inboxer 1.2 - 'searchfield' SQL Injection Google Dork: N/A Date: 02.08.2018 Exploit Author: Azkan Mustafa AkkuA AkkuS Vendor Homepage: https://codecanyon.net/item/pageresponse-a-fb-inboxer-addon-facebook-auto-commentprivate-reply-likeshare-for-full-page/21486371 Version: 1.2...

AgataSoft Auto PingMaster 1.5 Denial Of Service

Exploit Title: AgataSoft Auto PingMaster 1.5 - 'Host name' Denial of Service PoC Discovery by: Luis Martinez Discovery Date: 2018-08-02 Vendor Homepage: http://agatasoft.com/ Software Link : http://agatasoft.com/PingMaster.exe Tested Version: 1.5 Vulnerability Type: Denial of Service DoS Local...

AgataSoft Auto PingMaster 1.5 - Host name Denial of Service (PoC)

AgataSoft Auto PingMaster 1.5 - Host name Denial of Service PoC Exploit Title: AgataSoft Auto PingMaster 1.5 - 'Host name' Denial of Service PoC Discovery by: Luis Martinez Discovery Date: 2018-08-02 Vendor Homepage: http://agatasoft.com/ Software Link : http://agatasoft.com/PingMaster.exe Tested...

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection Vulnerability

Exploit for jsp platform in category web applications Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing Reserved CVE: CVE-2018-13416 Vulnerability Overview The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processi...

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing Reserved CVE: CVE-2018-13416 Vulnerability Overview The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML...

AgataSoft Auto PingMaster 1.5 - 'Host name' Denial of Service (PoC)

Exploit Title: AgataSoft Auto PingMaster 1.5 - 'Host name' Denial of Service PoC Discovery by: Luis Martinez Discovery Date: 2018-08-02 Vendor Homepage: http://agatasoft.com/ Software Link : http://agatasoft.com/PingMaster.exe Tested Version: 1.5 Vulnerability Type: Denial of Service DoS Local...

WebRTC - H264 NAL Packet Processing Type Confusion

Type confusion can occur when processing a H264 packet. In the method PacketBuffer::FindFrames in modules/videocoding/packetbuffer.cc there is a loop on line 296 that goes through the databuffer vector backwards. The flag ish264 is set before this loop, and if it is true, the loop extracts and se...

Grammarly: `open-url` command allows opening unlimited number of tabs pointing to arbitrary URLs

Summary Attacker could trigger Grammarly extension's open-url command to open any number of tabs pointing to any origin including internal, e.g. chrome:// and cause "infinite Chrome DoS" if attacker's page is pinned. Description Page could Init Grammarly popup editor no user gesture, helper Event...