Xen - Broken Check in memory_exchange() Permits PV Guest Breakout

Xen - Broken Check in memoryexchange Permits PV Guest Breakout Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1184 This bug report describes a vulnerability in memoryexchange that permits PV guest kernels to write to an arbitrary virtual address with hypervisor privileges. The...

Quest Privilege Manager 6.0.0 Arbitrary File Write

!/usr/bin/env python2 """ Exploit Title: Quest Privilege Manager pmmasterd Arbitrary File Write Date: 10/Mar/2017 Exploit Author: m0t Vendor Homepage: https://www.quest.com/products/privilege-manager-for-unix/ Version: 6.0.0-27, 6.0.0-50 Tested on: ubuntu 14.04 x8664, ubuntu 16.04 x86, ubuntu 12....

Xen - Broken Check in 'memory_exchange()' Permits PV Guest Breakout

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1184 This bug report describes a vulnerability in memoryexchange that permits PV guest kernels to write to an arbitrary virtual address with hypervisor privileges. The vulnerability was introduced through a broken fix for...

WebKit Synchronous Page Load UXSS

WebKit: UXSS via a synchronous page load CVE-2017-2480 Here's a snippet of the method SubframeLoader::requestFrame which is invoked when the |src| of an iframe object is changed. bool SubframeLoader::requestFrameHTMLFrameOwnerElement& ownerElement, const String& urlString, const AtomicString&...

WebKit WebCore::toJS Use-After-Free

WebKit: WebCore::toJS use-after-free CVE-2017-2476 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar i=0;i...

Moxa MX-AOPC UA Server 1.5 XML Injection

Credits: John Page AKA HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MOXA-MX-AOPC-SERVER-v1.5-XML-EXTERNAL-ENTITY.txt + ISR: ApparitionSec Vendor: ============ www.moxa.com Product: ======================= MX-AOPC UA SERVER - 1.5 Moxa's MX-AOPC...

WebKit JSC::B3::Procedure::resetReachability Use-After-Free

WebKit: Use-after-free in JSC::B3::Procedure::resetReachability CVE-2017-2470 Note: It seems it doesn't crash the JSC compiled without Address Sanitizer. PoC: function for var i = 0; i 1000000; ++i const v = Array & 1 ? v : 1; typeof o = 'object'; ; Asan Log:...

WebKit constructJSReadableStreamDefaultReader Type Confusion

WebKit: Type confusion in constructJSReadableStreamDefaultReader CVE-2017-2457 EncodedJSValue JSCHOSTCALL constructJSReadableStreamDefaultReaderExecState& exec VM& vm = exec.vm; auto scope = DECLARETHROWSCOPEvm; JSReadableStream stream = jsDynamicDowncastexec.argument0; if !stream return...

Apple WebKit disconnectSubframes UXSS

Apple WebKit: UXSS via disconnectSubframes CVE-2017-2445 When an element is removed from a document, the function |disconnectSubframes| is called to detach its subframesiframe tag, object tag, etc.. Here is a snippet of |disconnectSubframes|. void disconnectSubframesContainerNode& root,...

WebKit HTMLInputElement Use-After-Free

WebKit: HTMLInputElement use-after-free CVE-2017-2454 There is a use-after-free security vulnerability related to how the HTMLInputElement is handled in WebKit. The vulnerability was confirmed on a nightly build of WebKit. The PoC also crashes Safari 10.0.2 on Mac. PoC:...

WebKit FormSubmission::create Use-After-Free

WebKit: use-after-free in FormSubmission::create CVE-2017-2460 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. Please note: This bug is subject to a 90 day...

Apple WebKit JSCallbackData UXSS

Apple Webkit: UXSS with JSCallbackData CVE-2017-2442 Here is the definition of |JSCallbackData| class. This class is used to call a javascript function from a DOM object. class JSCallbackDataStrong : public JSCallbackData public: JSCallbackDataStrongJSC::JSObject callback, void :...

WebKit RenderLayer Use-After-Free

WebKit: use-after-free in RenderLayer CVE-2017-2455 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the latest nightly build of WebKit. The PoC also crashes Safari 10.0.2 on Mac. PoC and ASan log follow PoC:...

Apple Webkit Named Property UXSS

Apple Webkit: UXSS by accessing a named property from an unloaded window CVE-2017-2367 The frame is not detached from an unloaded window. We can access to the new document's named properties via the following function. static bool...

WebKit ComposedTreeIterator::traverseNextInShadowTree Use-After-Free

WebKit: ComposedTreeIterator::traverseNextInShadowTree use-after-free CVE-2017-2466 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. PoC:...

e107 CMS 2.1.4 - Cross-Site Request Forgery

...

CommVault Edge 11 SP6 - Stack Buffer Overflow (PoC) Exploit

Exploit for windows platform in category dos / poc import socket import binascii import time import struct s = socket.socketsocket.AFINET, socket.SOCKSTREAM s.settimeout1 s.connect"10.101.0.85", 8400 def srp=None, r=None: if p: print "sending %d bytes: %s " % lenp/2,p payl = binascii.a2bhexp...

Coinbase: [buy.coinbase.com]Content Injection

Hello Coinbase Details I'm not sure if this issue will count, i just want to make sure that is why i submit it. The parameter code is Vulnerable in Content Injection allowing me to inject any Text. Proof Of Concept Here is my PoC: F173393 and this which the text overlaps on the modal. F173394 PoC...

Apple WebKit - table Use-After-Free Exploit

Exploit for multiple platform in category dos / poc -webkit-border-image: urlfoo 1 5 1 63 repeat; -webkit-flow-into: foo function eventhandler var a; document.execCommand"selectAll", false; output.slot = "foo"; table.deleteCaption; //trigger garbage collector forvar i=0;i foo !--...

WebKit: use-after-free in FormSubmission::create (CVE-2017-2460)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. Please note: This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available...