HackerOne: Subdomain takeover #2 at info.hacker.one

Summary: Hi team, looking the fix released from unbounce team at https://hackerone.com/reports/202767 i've been able to bypass it and takeover again the subdomain info.hacker.one with a new Vulnerable-Endpoint at UnbouncePages App Actual Dns Entry: F164154 Steps To Reproduce & New PoC for HackerO...

Android: pointer leak via insufficient binder message verification

When frameworks/native/libs/binder/Parcel.cpp reads e.g. a string from a parcel, it does not verify that the string doesn't overlap with any byte range that was tagged as a binder object by the sender. When an attacker sends a parcel to a victim process that contains an unexpected binder handle...

Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free (PoC)

Linux Kernel 4.4.0 Ubuntu - DCCP Double-Free PoC // // EDB Note: More information http://seclists.org/oss-sec/2017/q1/471 // // A trigger for CVE-2017-6074, crashes kernel. // Tested on 4.4.0-62-generic 83-Ubuntu kernel. // https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-6074 // //...

Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free (PoC)

// // EDB Note: More information http://seclists.org/oss-sec/2017/q1/471 // // A trigger for CVE-2017-6074, crashes kernel. // Tested on 4.4.0-62-generic 83-Ubuntu kernel. // https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-6074 // // Andrey Konovalov define GNUSOURCE include include...

INTELLITAMPER . map code execution vulnerability, CVE-2008-5755-a vulnerability warning-the black bar safety net

Author: k0shl reprint please indicate the source: http://whereisk0shl.top Vulnerability description Software download: https://www.exploit-db.com/apps/91891f4b53d5e61e66061454ab87ccc7-intellitamperv2.07.exe PoC: import sys maptheader = "\x23\x23\x23\x20\x53\x49\x54\x45\x4D"...

Files.com: CSRF @ configuration

Enter the support PIN from your test site if applicable: Enter the name of your test site if applicable: gaming2 Enter the subdomain from your test site if applicable: gaming2 Fill in the rest of your report below: ---- Greeting guys , i found a CSRF Bug at the configuration - General form in all...

Microsoft Edge Internet Explorer - HandleColumnBreakOnColumnSpanningElement Type Confusion

Microsoft Edge Internet Explorer - HandleColumnBreakOnColumnSpanningElement Type Confusion .class1 float: left; column-count: 5; .class2 column-span: all; columns: 1px; table border-spacing: 0px; function boom document.styleSheets0.media.mediaText = "aaaaaaaaaaaaaaaaaaaa"; th1.align = "right"; !-...

macOS HelpViewer 10.12.1 - XSS Leads to Arbitrary File Execution and Arbitrary File Read Exploit

Google Security Research / OSX: HelpViewer XSS leads to arbitrary file execution and arbitrary file read. HelpViewer is an application and using WebView to show a help file. You can see it simply by the command: open /Applications/Safari.app/Contents/Resources/Safari.help...

MBLS Flex CMS 0.7.2 SQL Injection / Cross Site Scripting

Title: SQL injection & Cross-site scripting in CMS Flex Credit: Bilal KARDADOU Vulnerability: SQL injection & Cross-Site scripting Vulnerable version: Flex Version 0.7.2 Vendor: MBL Solutions Ltd Vendor URL: http://www.mblsolutions.co.uk/ Product: FLEX CMS "THE INTUITIVE CONTENT MANAGEMENT SYSTEM...

Microsoft Edge / Internet Explorer HandleColumnBreakOnColumnSpanningElement Type Confusion Exploit

Microsoft Edge and Internet Explorer suffer from a type confusion in HandleColumnBreakOnColumnSpanningElement. Microsoft Edge and IE: Type confusion in HandleColumnBreakOnColumnSpanningElement CVE-2017-0037 PoC: .class1 float: left; column-count: 5; .class2 column-span: all; columns: 1px; table...

shopify-scripts: Memory corrouption in mrb_gc_mark

The memory corruption in mrbgcmark function can lead to code execution or at least DoS on mruby. PoC attached. Crash debug mr@minhrau $ ./mrubylatest/mruby/build/bench/bin/mruby ./mruby/fuzz03/crashes/mrbgcmark.rb Reading symbols from ./mrubylatest/mruby/build/bench/bin/mruby...done. gdb r...

macOS HelpViewer XSS leads to arbitrary file execution and arbitrary file read（CVE-2017-2361）

HelpViewer is an application and using WebView to show a help file. You can see it simply by the command: open /Applications/Safari.app/Contents/Resources/Safari.help or using "help:" scheme: help:openbook=com.apple.safari.help...

Apple macOS HelpViewer 10.12.1 - XSS Leads to Arbitrary File Execution / Arbitrary File Read

/ OSX: HelpViewer XSS leads to arbitrary file execution and arbitrary file read. HelpViewer is an application and using WebView to show a help file. You can see it simply by the command: open /Applications/Safari.app/Contents/Resources/Safari.help or using "help:" scheme:...

Google Chrome - layout Out-of-Bounds Read

Google Chrome - layout Out-of-Bounds Read content contain: size layout; function leak document.execCommand"selectAll"; opt.text = ""; aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa...

EasyCom For PHP 4.0.0 - Buffer Overflow (PoC)

EasyCom For PHP 4.0.0 - Buffer Overflow PoC + Credits: John Page AKA Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EASYCOM-PHP-API-BUFFER-OVERFLOW.txt + ISR: ApparitionSec Vendor: ================ easycom-aura.com Product:...

Album Lock 4.0 iOS - Directory Traversal

Album Lock 4.0 iOS - Directory Traversal Document Title: =============== Album Lock v4.0 iOS - Directory Traversal Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2033 Release Date: ============= 2017-02-20 Vulnerability Laboratory ID VL-I...

Album Lock 4.0 iOS - Directory Traversal

Document Title: =============== Album Lock v4.0 iOS - Directory Traversal Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2033 Release Date: ============= 2017-02-20 Vulnerability Laboratory ID VL-ID: ====================================...

shopify-scripts: Controlled address leak due to type confusion - ASLR bypass

There are several different places in which arguments are treated as fixnums without a prior check for their type. Since mrbvalue is a union that holds all value types, it can cause a mixup between an object pointer and an integer value: cpp typedef struct mrbvalue union mrbfloat f; void p; mrbin...

OLX: Public Vulnerable Version of Confluence https://confluence.olx.com

The public server is vulnerable to Insecure Direct Object Reference, allowing any authenticated user to read configuration files from the application such as the content of webapp directory in confluence. Link to the public issue: https://jira.atlassian.com/browse/CONF-39704 PoC: GET:...

GOM Player 2.3.10.5266 - .fpx Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: GOM Player 2.3.10.5266 - Remote heap corruption .fpx Date: 2017-02-15 Exploit Author: Peter Baris Exploit link: http://www.saptech-erp.com.au/resources/PoC.zip Software Link: http://player.gomlab.com/download.gom?language=eng CVE:...