13103 matches found
NVIDIA Driver - Escape 0x100010b Missing Bounds Check
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=927 The DxgkDdiEscape handler for escape code 0x100010b looks like: char escape100010bNvMiniportDeviceContext miniportcontext, HANDLE handle, unsigned int idx PVOID Object; if !handle dodebugthingo; Object = PVOID...
NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944 The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks: ... if gsavedsize escape-size = gsavedsize; if unsigned intgsavedsize 0 do v5 = v2++; escape-datav5 = globalarrayv5 + 77; while v2 size 0 do ii = i++; globalarrayii +...
NVIDIA Driver - Escape Code Leaks Uninitialised ExAllocatePoolWithTag Memory to Userspace
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=892 The handler for the DxgkDdiEscape escape code 0x70000D4 has the following pseudocode: void fastcall escape70000D4NvMiniportDeviceContext a1, NvEscapeData a2 Escape70000D4 escapedata; // rbx@1 PVOID allocbuf; // rsi@1 unsigned i...
NVIDIA Driver - Stack Buffer Overflow in Escape 0x7000014
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=946 There is a missing bounds check in inner loop of the escape handler for 0x7000014 that leads to a stack buffer overflow: ... for DWORD i = 0; numdata; ++i ... // size is user controlled. size = escape-datai.size; for DWORD j = ...
InfraPower PPS-02-S Q213V1 Cross Site Request Forgery
InfraPower PPS-02-S Q213V1 Cross-Site Request Forgery Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Summary: InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle IPD-02-S only to remotely monitor the...
InfraPower PPS-02-S Q213V1 - Cross-Site Request Forgery
InfraPower PPS-02-S Q213V1 Cross-Site Request Forgery Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Summary: InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle IPD-02-S only to remotely monitor the...
CherryTree 0.36.9 Memory Corruption
!/usr/bin/python CherryTree 0.36.9 - Memory Corruption PoC by n30m1nd Date: 2016-10-27 PoC Author: n30m1nd Vendor Homepage: http://www.giuspen.com/cherrytree/ Software Link: http://www.giuspen.com/software/cherrytree0.36.9setup.exe Version: Affects all versions of CherryTree prior to 0.37.6 Teste...
uSQLite 1.0.0 - Denial of Service
uSQLite 1.0.0 - Denial of Service !/usr/bin/python Exploit Title: Remote buffer overflow vulnerability in uSQLite 1.0.0 PoC Date: 27/10/1016 Exploit Author: Peter Baris Software Link: https://sourceforge.net/projects/usqlite/?source=directory Version: 1.0.0 Tested on: windows 7 and XP SP3 Longer...
CherryTree 0.36.9 - Memory Corruption (PoC)
Exploit for windows platform in category dos / poc !/usr/bin/python CherryTree 0.36.9 - Memory Corruption PoC by n30m1nd Date: 2016-10-27 PoC Author: n30m1nd Vendor Homepage: http://www.giuspen.com/cherrytree/ Software Link: http://www.giuspen.com/software/cherrytree0.36.9setup.exe Version: Affec...
CherryTree 0.36.9 - Memory Corruption (PoC)
CherryTree 0.36.9 - Memory Corruption PoC !/usr/bin/python CherryTree 0.36.9 - Memory Corruption PoC by n30m1nd Date: 2016-10-27 PoC Author: n30m1nd Vendor Homepage: http://www.giuspen.com/cherrytree/ Software Link: http://www.giuspen.com/software/cherrytree0.36.9setup.exe Version: Affects all...
CherryTree 0.36.9 - Memory Corruption (PoC)
!/usr/bin/python CherryTree 0.36.9 - Memory Corruption PoC by n30m1nd Date: 2016-10-27 PoC Author: n30m1nd Vendor Homepage: http://www.giuspen.com/cherrytree/ Software Link: http://www.giuspen.com/software/cherrytree0.36.9setup.exe Version: Affects all versions of CherryTree prior to 0.37.6 Teste...
QIWI: [vitrina.contact-sys.com] Full Path Disclosure
Уязвимый сценарий: /user/all/orders Уязвимые параметры: order, sort PoC: http://vitrina.contact-sys.com/user/all/orders?order=ordernumber&sort=desc http://vitrina.contact-sys.com/user/all/orders?order=ordernumber&sort=desc Примеры путей: █████pluginstyletable.inc...
Mail.ru: [allods.mail.ru] Cross-Site Request Forgery (Add-Item)
Hi, I found that there is no anti-csrf while adding an item for '/media.php' in allods.mail.ru, from 'https://allods.mail.ru/media.php?do=additem§ion=2' since there was no anti-csrf token, there was still an extra layer of security for csrf which I had to bypass! More Details: The upload...
CVE-2 0 1 6-5 1 9 5 DirtyC0w: Linux kernel mention the right vulnerability analysis-vulnerability warning-the black bar safety net
Vulnerability summary Vulnerability ID: CVE-2 0 1 6-5 1 9 5 Vulnerability type: kernel race condition vulnerability Vulnerability hazards: local provide the right Scope of impact: Linux kernel2.6.22 released in 2 0 0 7 This vulnerability is in the 1 0 On 1 8, is Phil Oester submitted by Linux...
Adobe Reader 9.3.0 DLL Hijacking
===================================================== Adobe Reader 9.3.0 - DLL Hijacking ===================================================== Vendor Homepage: https://www.adobe.com/ Date: 24 Oct 2016 Version : 9.3.0 Author: Ashiyane Digital Security Team Contact: [email protected]...
Network Scanner 4.0.0 - Local Buffer Overflow (SEH)
!/usr/bin/python -- coding: utf-8 -- Network Scanner Version 4.0.0.0 - SEH Overflow Exploit by n30m1nd Date: 2016-10-21 Exploit Author: n30m1nd Exploit Title: Network Scanner Version 4.0.0.0 SEH Based Exploit Vendor Homepage: http://www.mitec.cz/ Software Link:...
Harvest: Stored XSS in Restoring Archived Tasks
Hello Harvest Team, There is stored XSS in restoring archived/deleted tasks. POC: 1. Create a task with name with xss payload " 2. Now from Tasks, delete the task and the task will be archived. 3. Now Click on Manage archived tasks, to restore it back. 4. Click on the task with xss payload, XSS i...
Zenbership 107 Cross Site Request Forgery / Cross Site Scripting
ADVISORY INFORMATION ======================================== Title: Zenbership latest version - Multiple Vulnerabilities Application: Zenbership Class: Sensitive Information disclosure Versions Affected: alert'ExploitDB' HTTP Request POST /zenbership/pp-functions/formprocess.php HTTP/1.1 Host:...
Oracle VM VirtualBox 4.3.28 - '.ovf' Crash (PoC) Exploit
Exploit for windows platform in category dos / poc Exploit Title: Oracle VM VirtualBox 4.3.28 Crash Author: sultan albalawi Tested on:win7 open viryualbox --ctrl+i--choose file --double+double+double next ban= '\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x5c\x20\x20\x20\x2d\x20\x20'...
Event Calendar PHP 1.5 SQL Injection Vulnerability
Exploit for php platform in category web applications ===================================================== Event Calendar PHP 1.5 - SQL Injection ===================================================== Vendor Homepage: http://eventcalendarphp.com/ Date: 21 Oct 2016 Demo Link :...