13100 matches found
“Dishwasher”was traced to a directory traversal vulnerability, an IOT security is getting worse and worse-vulnerability warning-the black bar safety net
Although the IOT the number of devices increases exponentially, but these smart devices security level has not increased, the user still faces a high cyber-attack risk. Miele Miele was founded in Germany one hundred years of home appliance brand, recently one model for PG8528 networked medical...
Microsoft Xbox One 10.0.14393.2152 - Code Execution (PoC)
Microsoft Xbox One 10.0.14393.2152 - Code Execution PoC For Xbox-SystemOS version: 10.0.14393.2152 rs1xboxrel1610 161208-1218 fre, 12/14/2016 Other versions will most likely need modifications to the script. Credits: - https://github.com/theori-io/chakra-2016-11 -...
HackerOne: Subdomain takeover #3 at info.hacker.one
Summary: Hi team, looking the last fix released from unbounce team at https://hackerone.com/reports/209004 i've been able again to bypass it again and takeover the subdomain info.hacker.one with a new vulnerable PARAM at UnbouncePages App Actual Dns Entry: F172446 Steps To Reproduce & New PoC for...
Mozilla Firefox: use-after-poison in nsStylePadding::GetPadding
Mozilla bug tracker link: https://bugzilla.mozilla.org/showbug.cgi?id=1340593 There is a use-after-poison issue in Firefox. The vulnerability was confirmed on the nightly ASan build. PoC: padding: inherit; function go var s = menu.style; s.setProperty"scroll-snap-destination", "1px 63%";...
Car Workshop System - SQL Injection
Car Workshop System - SQL Injection Car Workshop System, the presence of the parameter filter is not strict, leading to a sql injection vulnerability, if the other server is turned on the error display, can be directly used Google Dork: N/A Injection point:...
Apple macOS/IOS 10.12.2 (16C67) - 'mach_msg' Heap Overflow
/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1083 When sending ool memory via |machmsg| with |deallocate| flag or |MACHMSGVIRTUALCOPY| flag, |machmsg| performs moving the memory to the destination process instead of copying it. But it doesn't consider the memory entry objec...
shopify-scripts: SIGSEGV in mrb_vm_exec
PoC ------------------- The following code triggers the bug attached as testmrbvmexec.rb: def methodmissingmeth,argsyieldmeth,argsend enumfor.next Debug - mirb ------------------- x@x:/Desktop/test/mruby/bin$ gdb -q ./mirb rReading symbols from ./mirb...done. gdb r testmrbvmexec.rb Starting...
Mail.ru: Stored XSS in e.mail.ru (payload affect multiple users)
Hi, We have found a high risk level STORED XSS in e.mail.ru chat, the status change function allow to inject malicious payload in javascript & HTML, The attack affect multiple users and run in auto mode, no need a user interaction. Vulnerability affect any user that have been invited to your chat...
DzSoft PHP Editor 4.2.7 - File Enumeration Vulnerability
Exploit for windows platform in category remote exploits + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/DZSOFT-v4.2.7-PHP-EDITOR-FILE-ENUMERATION.txt + ISR: ApparitionSec Vendor: ============== www.dzsoft.com Product:...
DzSoft PHP Editor 4.2.7 - File Enumeration
DzSoft PHP Editor 4.2.7 - File Enumeration + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/DZSOFT-v4.2.7-PHP-EDITOR-FILE-ENUMERATION.txt + ISR: ApparitionSec Vendor: ============== www.dzsoft.com Product:...
IIS 6.0 WebDAV remote code execution vulnerability (CVE-2017-7269)
In Windows Server 2003 IIS6. 0 the WebDAV service ScStoragePathFromUrl a function of the presence buffer overflow vulnerability, an attacker by a order“If: http://” at the beginning of a longer header head PROPFIND request arbitrary code execution. Currently the vulnerability for install IIS6...
Apple Safari - Out-of-Bounds Read when Calling Bound Function Exploit
Exploit for multiple platform in category dos / poc var ba; function s alert"in s";...
Safari Browser: Out-of-bounds read when calling bound function(CVE-2017-2447)
There is an out-of-bounds read when reading the bound arguments array of a bound function. When Function.bind is called, the arguments to the call are transferred to an Array before they are passed to JSBoundFunction::JSBoundFunction. Since it is possible that the Array prototype has had a setter...
GitLab: Unfiltered `class` attribute in markdown code
This affects merge request/issue comments and probably other parts of the user interface. I am demonstrating PoCs on GitLab.com itself, as they don't affect anything outside of my test repo, which is private. It could be used to execute some js actions by contructing content that uses the...
DzSoft PHP Editor 4.2.7 File Enumeration
Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/DZSOFT-v4.2.7-PHP-EDITOR-FILE-ENUMERATION.txt + ISR: ApparitionSec Vendor: ============== www.dzsoft.com Product: ========================= DzSoft PHP Editor v4.2.7 DzSoft PHP...
Disk Sorter Server 9.5.12 Buffer Overflow
Title: Disk Sorter Server v9.5.12 - Local Stack-based buffer overflow + Credits / Discovery: Nassim Asrir + Author Email: [email protected] || https://www.linkedin.com/in/nassim-asrir-b73a57122/ + Author Company: Henceforth + CVE: N/A Vendor: =============== http://www.disksorter.com/ Download:...
Apple Safari - Out-of-Bounds Read when Calling Bound Function
Apple Safari - Out-of-Bounds Read when Calling Bound Function var ba; function s alert"in s"; ba = this; function g alert"in g"; return...
Apple Safari - DateTimeFormat.format Type Confusion
Apple Safari - DateTimeFormat.format Type Confusion var date = new DateDate.UTC2012, 11, 20, 3, 0, 0; var i = new Intl.DateTimeFormat; //printi; var q; function f //print"in f"; //printf.caller; q = f.caller; return 10; try i.formatvalueOf : f; catche //print"problem"; //printq; q.call0x77777777;...
Apple Safari - 'DateTimeFormat.format' Type Confusion
var date = new DateDate.UTC2012, 11, 20, 3, 0, 0; var i = new Intl.DateTimeFormat; //printi; var q; function f //print"in f"; //printf.caller; q = f.caller; return 10; try i.formatvalueOf : f; catche //print"problem"; //printq; q.call0x77777777;...