McAfee.com Redirect Cross Site Scripting

Exploit Title: Url Redirect Reflected XSS at McAfee Date: 29.06.2018 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.mcafee.com/ Software Type : Website Software Version : N/A Vulenrability : Url Redirect + Reflected XSS PoC : Method :...

Linksys.com Cross Site Scripting

Exploit Title: Reflected XSS at Linksys Date: 02.06.2018 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.linksys.com/ Software Type : Website Software Version : N/A Vulenrability : Reflected Cross-site Scripting XSS Risk : Medium PoC : Method : https://www.linksys.com/country/ + XSS...

seacms 后台getshell

作为只是审计过几次CTF线下赛的代码审计小菜鸟，暑假决定正式开始练习一些CMS的代码审计，于是便挑了SeaCMS这样一款cms进行审计，由于缺乏经验于是选择首先审计后台方面的漏洞，说实话在SeaCMS的后台部分的防护确实较少，发现了许多后台的SQL注入。。。。。后来参考SeaCMS之前的一些漏洞，终于找到了这样一个后台插入if标签从而getshell的后台getshell漏洞点。 首先演示一下整个getshell的流程： 登录面板，进入添加电影的界面，在此界面添加电影，设置图片url为if:1$GLOBALS'G'.'ET'a;//end if;...

Splinterware System Scheduler Pro 5.12 Buffer Overflow

!/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: Splinterware System Scheduler Pro 5.12 - Local Buffer Overflow SEH Date: 07-21-18 Vulnerable Software: System Scheduler Pro 5.12 Vendor Homepage: https://www.splinterware.com Version: 5.12 Software Link:...

Multi Step Form <= 1.2.5 - Multiple Unauthenticated Reflected XSS

WordPress Plugin Multi Step Form before 1.2.5 allows remote users to execute JavaScript code through Reflected XSS attacks. This issue can be exploited by unauthenticated attackers, by the use of CSRF, for example. The following parameters are vulnerable in fwsenddata function: fwdataid1 fwdataid...

GitLab: Stored XSS on Issue details page

Summary: The detail page of Issue the page that provides the content of an Issue is vulnerable to Stored XSS. Description: The two exploits are via the function of submittin an issue or the function of editing an issue. This vulnerability is reproduced in Firefox andChrome. IE11 andEdge are not. ...

Google Chrome - Swiftshader Texture Allocation Integer Overflow

There's a remotely triggerable memory corruption issue in SwiftShader that's reachable from WebGL, resulting from an integer overflow issue. In the GPU process there is validation on the sizes passed to texture creation functions to ensure that they shouldn't cause overflow. However, in the...

GhostMail Filename To Link Script Insertion

Document Title: =============== GhostMail - filename to link POST Inject Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1471 Release Date: ============= 2018-06-26 Vulnerability Laboratory ID VL-ID: ====================================...

HomeMatic Zentrale CCU2 Unauthenticated Remote Code Execution

Exploit Title: HomeMatic Zentrale CCU2 Unauthenticated RCE Date: 16-07-2018 Software Link: https://www.homematic.com/ Exploit Author: Kacper Szurek - ESET Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ YouTube: https://www.youtube.com/c/KacperSzurek Category: remot...

Microsoft Enterprise Mode Site List Manager - XML External Entity Injection Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx Vendor ============= www.microsoft Product =========== Enterprise Mode Site List Manager versions1/2 You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain...

macOSiOS - JavaScript Injection Bug in OfficeImporter

macOSiOS - JavaScript Injection Bug in OfficeImporter QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code...

PrestaShop < 1.6.1.19 - 'AES CBC' Privilege Escalation

!/usr/bin/env python3 PrestaShop = 1.6.1.19 AES Rijndael / opensslencrypt Cookie Read Charles Fol See https://ambionics.io/blog/prestashop-privilege-escalation This POC will reveal the content of an employee's cookie. By modifying it one can read/write any PrestaShop cookie. It is a simple paddin...

Chrome V8 KeyAccumulator Bug Exploit

Chrome V8 suffers from a bug in KeyAccumulator that can cause a crash. Chrome: V8: A bug with KeyAccumulator PoC: for let i = 0; i https://cs.chromium.org/chromium/src/v8/src/objects.cc?rcl=a2ca1996873f3ffa79d9495fb2cf4e7c0e51d9e9&l=18369. The new table is directly used as the backing store of th...

Microsoft Windows #MicrosoftWindows POP/MOV SS Local Privilege Elevation Exploit

This Metasploit module exploits a vulnerability in a statement in the system programming guide of the Intel 64 and IA-32 architectures software developer's manual being mishandled in various operating system kernels, resulting in unexpected behavior for DB exceptions that are deferred by MOV SS o...

Microsoft Edge Chakra JIT - BoundFunction::NewInstance Out-of-Bounds Read Exploit

Exploit for windows platform in category dos / poc / BoundFunction::NewInstance is used to handle calls to a bound function. The method first allocates a new argument array and copies the prepended arguments and others into the new argument array and calls the actual function. The problem is, it...

Microsoft Edge Chakra JIT SetConcatStrMultiItemBE Type Confusion

Microsoft Edge: Chakra: JIT: Type confusion with hoisted SetConcatStrMultiItemBE instructions CVE-2018-8229 Here's a PoC: function optstr for let i = 0; i .var s9.var = LdSlot s32s18l53.var s7.var = LdSlot s20s18l51.var s8.var = LdSlot s19s18l52.var s1Object.var = LdA 0x7FFFF47A0000...

Chrome V8 KeyAccumulator Bug

Chrome: V8: A bug with KeyAccumulator PoC: for let i = 0; i https://cs.chromium.org/chromium/src/v8/src/objects.cc?rcl=a2ca1996873f3ffa79d9495fb2cf4e7c0e51d9e9&l=18369. The new table is directly used as the backing store of the result array of "Reflect.ownKeysarr". 2. The shift method invokes the...

Microsoft Edge Chakra JIT - Out-of-Bounds ReadsWrites

Microsoft Edge Chakra JIT - Out-of-Bounds ReadsWrites / It seems that this issue is similar to the issue 1429 MSRC 42111. It might need to refresh the page several times to observe a crash. PoC: / let arr = new Uint32Array1000; for let i = 0; i 0x1000000; i++ for let j = 0; j 1; j++ i--; i++; arr...

Microsoft Edge Chakra JIT BoundFunction::NewInstance Bug

Microsoft Edge: Chakra: A bug in BoundFunction::NewInstance CVE-2018-8139 BoundFunction::NewInstance is used to handle calls to a bound function. The method first allocates a new argument array and copies the prepended arguments and others into the new argument array and calls the actual function...

phpMyAdmin Authenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'phpMyAdmin Authenticated Remote Code Execution', 'Description' = %q phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which ca...