Microsoft Edge - Internationalization Initialization Type Confusion (MS16-144)

Microsoft Edge - Internationalization Initialization Type Confusion MS16-144 1; , set: function ; function f var i = Intl; Intl = ; // this somehow prevents an exception that prevents laoding di, "Collator", noobj; Objec...

Microsoft Edge - Internationalization Initialization Type Confusion (MS16-144)

1; , set: function ; function f var i = Intl; Intl = ; // this somehow prevents an exception that prevents laoding di, "Collator", noobj; Object.defineProperty = f; var q = new Intl.NumberFormat"en";...

Nextcloud: Reflected XSS in U2F plugin by shipping the example endpoints

While running a RIPS scan against our instrumentalized source code it noticed that the file /apps/twofactoru2f/vendor/yubico/u2flib-server/examples/localstorage/index.php echoes on user input: F145451 I was first a tad confused because the examples have been removed from our Git repository, but t...

LocalTapiola: Creating arbitrary cookies values /cs/CookieServer (www.lahitapiola.fi)

Issue The reporter was able to inject http-headers to set custom cookies in the response. The cookie scope was .lahitapiola.fi. /cs/CookieServer.The report contained a thorough PoC and appropriate screenshots which assisted the triaging process. Fix The issue was investigated and found to be vali...

Google Android - WifiNative::setHotlist Stack Overflow

Google Android - WifiNative::setHotlist Stack Overflow Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=958 The following code in frameworks/opt/net/wifi/service/jni/comandroidserverwifiWifiNative.cpp doesn't validate the parameter params.numbssid, and then copies that number of...

Google Android - WifiNative::setHotlist Stack Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=958 The following code in frameworks/opt/net/wifi/service/jni/comandroidserverwifiWifiNative.cpp doesn't validate the parameter params.numbssid, and then copies that number of elements into a stack-allocated wifibssidhotlistparams...

shopify-scripts: Heap Overflow in mrb_arb_splice

It's similar with 192235, but the root cause is different. both of mruby and mruby-engine are crashed by the following PoC. MRBINT64 ruby ary = Array.new1023 ary0x7ffffffffffffc00,0 = Array.new1024 $ gdb -q --args ./bin/mruby test2.rb Reading symbols from ./bin/mruby...done. gdb r Starting progra...

PHP garbage collection mechanism UAF vulnerability analysis-vulnerability warning-the black bar safety net

First, the PHP garbage collection mechanism introduction Because PHP is among the presence of circular references, only the refcount of the counter as a garbage collection mechanism is not enough, so in PHP5. 3 introduced a new garbage collection mechanism. $a = array'one'; $a = &$a; unset$a; ?&...

shopify-scripts: Integer Overflow in mrb_ary_set

Hi, I found a crash in mruby. I frankly couldn't reproduce it in mruby-engine. I think it is because of memory limitation, but I'm not sure. Here is a PoC when the size of MRBINT is 32. ruby ary = Array.new0 ary0x7fffffff = 1 $ gdb -q --args ./bin/mruby ./test.rb Reading symbols from...

Nagios 4.2.4 - Local Privilege Escalation

Nagios 4.2.4 - Local Privilege Escalation !/bin/bash Source: https://legalhackers.com/advisories/Nagios-Exploit-Root-PrivEsc-CVE-2016-9566.html Nagios Core 4.2.4 Root Privilege Escalation PoC Exploit nagios-root-privesc.sh ver. 1.0 CVE-2016-9566 Discovered and coded by: Dawid Golunski...

Nagios 4.2.2 - Arbitrary Code Execution

Nagios 4.2.2 - Arbitrary Code Execution !/usr/bin/env python Source: https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html intro = """\03394m Nagios Core 4.2.0 Curl Command Injection / Code Execution PoC Exploit CVE-2016-9565 nagioscmdinjection.py ver...

TP-LINK TD-W8151N Denial Of Service

Exploit Title: TP-LINK TD-W8151N - Denial of Service Date: 2016-12-13 Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Home : http://persian-team.ir/ Tested on: Windows AND Linux Demo : https://www.youtube.com/watch?v=WrGgHvhiCGg POC : flagFresh Parameter Vulnerable POST...

SAP HANA Sinopia - default user creation policy insecure

Application: SAP HANA Versions Affected: SAP HANA SPS12 Vendor URL: SAP Bug: Insecure default configuration Reported: 13.12.2016 Vendor response: 14.12.2016 Date of Public Advisory: 14.02.2017 Reference: SAP Security Note 2407694 Author: Mathieu Geli ERPScan VULNERABILITY INFORMATION Class:...

Samsung Devices KNOX Extensions - OTP TrustZone Trustlet Stack Buffer Overflow

Samsung Devices KNOX Extensions - OTP TrustZone Trustlet Stack Buffer Overflow / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=938 As a part of the KNOX extensions available on Samsung devices, Samsung provides a TrustZone trustlet which allows the generation of OTP tokens. Th...

TP-LINK TD-W8151N - Denial of Service

Exploit Title: TP-LINK TD-W8151N - Denial of Service Date: 2016-12-13 Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Home : http://persian-team.ir/ Tested on: Windows AND Linux Demo : https://www.youtube.com/watch?v=WrGgHvhiCGg POC : flagFresh Parameter Vulnerable POST...

Chaordic Search 1.1 Cross Site Scripting

Cross Site Scripting on Chaordic Search v1.1 + Date: 09/12/2016 + Risk: LOW + CWE number: CWE-79 + Author: Felipe Andrian Peixoto + Vendor Homepage: https://www.chaordic.com.br/ + Contact: [email protected] + Tested on: Gnu/Linux + Exploit : http://busca.host/?q= XSS PAYLOAD + Payload :...

Shopify: Unauthenticated Stored XSS on <any>.myshopify.com via checkout page

Hi, I have found a stored cross site scripting vulnerability on .myshopify.com through customer's first name in the checkout page after the order is completed. Details: While processing an order on checkout.shopif.com customers are asked to enter their first name , last name , address details...

Microsoft Edge - JSON.parse Info Leak Vulnerability

Exploit for windows platform in category dos / poc var once = false; var a = 1; function f if!once a = new Array1, 2, 3; this2 = a; once = true; //alert"f " + this; return ; JSON.parse"1, 2, 4, 5", f; var n = new Numbera0; n = n 1; var s = n.toString16; n = new Numbera1; n = n 1; s = s +...

Microsoft Windows 10 (x86x64) - WLAN AutoConfig Denial of Service (PoC)

Microsoft Windows 10 x86x64 - WLAN AutoConfig Denial of Service PoC !/usr/bin/python wlanautoconfig-poc.py Windows WLAN AutoConfig Named Pipe POC Jeremy Brown jbrown3264/gmail Dec 2016 wifinetworkmanager.dll!FatalErrorchar const ,unsigned long,char const , ... AsyncPipe::ReadCompletedCallbackvoid...

Microsoft PowerShell - XML External Entity Injection Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx Vendor: ================= www.microsoft.com Product: =========== PowerShell PowerShell including Windows PowerShell and PowerShell Core is a task automation and configuration management framework from...