35 matches found
Safari - Proxy Object Type Confusion Exploit
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Safari Proxy Object Type Confusion', 'Description' = %q This module exploits a type confusion bug in the Javascript Proxy object in WebKit. The D...
WebKit JIT - Int32/Double Arrays can have Proxy Objects in the Prototype Chains Exploit
didBecomePrototype; if structurevm-hasMonoProto DeferredStructureTransitionWatchpointFire deferredvm, structurevm; Structure newStructure = Structure::changePrototypeTransitionvm, structurevm, prototype, deferred; setStructurevm, newStructure; else putDirectvm, knownPolyProtoOffset, prototype; if...
CVE-2017-5392
Weak proxy objects have weak references on multiple threads when they should only have them on one, resulting in incorrect memory usage and corruption, which leads to potentially exploitable crashes. Note: This issue only affects Firefox for Android. Other operating systems are not affected. This...
Microsoft Edge Chakra EntrySimpleObjectSlotGetter Type Confusion Exploit
Microsoft Edge Chakra suffers from an issue where EntrySimpleObjectSlotGetter can have side effects that cause a type confusion vulnerability. Microsoft Edge: Chakra: EntrySimpleObjectSlotGetter can have side effects CVE-2018-8133 function optw, arr arr0 = 1.1; let res = w.event; arr0 =...
Microsoft Edge Chakra EntrySimpleObjectSlotGetter Type Confusion
Microsoft Edge: Chakra: EntrySimpleObjectSlotGetter can have side effects CVE-2018-8133 function optw, arr arr0 = 1.1; let res = w.event; arr0 = 2.3023e-320; return res; let arr = 1.1; for let i = 0; i ::EntrySimpleObjectSlotGetter 00007fffd5cf3d50 // w.event 000001a880001235 48ffd0 call rax...
Microsoft Edge Chakra - EntrySimpleObjectSlotGetter Type Confusion
/ function optw, arr arr0 = 1.1; let res = w.event; arr0 = 2.3023e-320; return res; let arr = 1.1; for let i = 0; i ::EntrySimpleObjectSlotGetter 00007fffd5cf3d50 // w.event 000001a880001235 48ffd0 call rax 000001a880001238 488b8e30bdf0ff mov rcx,qword ptr rsi-0F42D0h 000001a88000123f f2480f10415...
Microsoft Edge - FillFromPrototypes Type Confusion Exploit
Exploit for windows platform in category dos / poc var a = new Array0x11111111, 0x22222222, 0x33333333, 0x44444444, 0x12121212, 0x23232323, 0x12345670, 0x7777; var handler = getPrototypeOf: functiontarget, name...
Microsoft Edge - FillFromPrototypes Type Confusion
Microsoft Edge - FillFromPrototypes Type Confusion var a = new Array0x11111111, 0x22222222, 0x33333333, 0x44444444, 0x12121212, 0x23232323, 0x12345670, 0x7777; var handler = getPrototypeOf: functiontarget, name // print"get proto"; return a;...
Microsoft Edge - 'FillFromPrototypes' Type Confusion
var a = new Array0x11111111, 0x22222222, 0x33333333, 0x44444444, 0x12121212, 0x23232323, 0x12345670, 0x7777; var handler = getPrototypeOf: functiontarget, name // print"get proto"; return a; ; var p = new Proxy, handler; var b =...
JDK: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 6.0.16.25, 6 R1 before SR8 FP25 6.1.8.25, 7 before SR9 FP40 7.0.9.40, 7 R1 before SR3 FP40 7.1.3.40, and 8 before SR3 8.0.3.0 uses the invoke method of the java.lang.reflect.Method class in an...
CVE-2016-0363
CVE-2016-0363 affects IBM SDK, Java Technology Edition prior to specific SR updates: 6.0.16.25 (SR16 FP25) for 6.x, 6 R1 before SR8 FP25, 7 before SR9 FP40, 7 R1 before SR3 FP40, and 8 before SR3 (6.0.3.0–? not fully listed). The vulnerability arises when the invoke method of java.lang.reflect.Me...
PT-2016-4163 · Ibm +2 · Ibm Sdk +3
Name of the Vulnerable Software and Affected Versions: IBM SDK, Java Technology Edition versions 6.0.0 through 6.0.16.24 IBM SDK, Java Technology Edition 6 R1 versions 6.1.0 through 6.1.8.24 IBM SDK, Java Technology Edition 7 versions 7.0.0 through 7.0.9.39 IBM SDK, Java Technology Edition 7 R1...
Microsoft Edge Proxy Object Universal Cross Site Scripting Vulnerability
This vulnerability allows remote attackers to inject arbitrary script code into arbitrary domains on vulnerable installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...
OS X Install.framework suid root Runner Binary Privilege Escalation Vulnerability
Exploit for macOS platform in category local exploits Source: https://code.google.com/p/google-security-research/issues/detail?id=478 The Install.framework runner suid root binary does not correctly account for the fact that Distributed Objects can be connected to by multiple clients at the same...
