735 matches found
NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5 Exploit
Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944 The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks: ... if gsavedsize escape-size = gsavedsize; if unsigned intgsavedsize 0 do v5 = v2++; escape-datav5 = globalarrayv5...
NVIDIA Driver - No Bounds Checking in Escape 0x7000170
NVIDIA Driver - No Bounds Checking in Escape 0x7000170 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=936 The DxgkDdiEscape handler for 0x7000170 lacks proper bounds checks for the variable size input escape data, and relies on a user provided size as the upper bound for writin...
NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944 The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks: ... if gsavedsize escape-size = gsavedsize; if unsigned intgsavedsize 0 do v5 = v2++; escape-datav5 = globalarrayv5 + 77; while v2 size 0 do ii = i++; globalarrayii +...
Bumble: No rate-limit in SERVER_SECURITY_CHECK
Hi, When you login in another Ip address Badoo will ask to confirm mobile number to authenticate. The problem is that there is no limit of tries. This make this feature useless since it can be brute forced. In the video you can see at request 56 we found the right number which lead to...
Fedora Update for bash FEDORA-2016-a822b472c4
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora Update for libksba FEDORA-2016-4751a94476
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Lepton CMS 2.2.0 / 2.2.1 - PHP Code Injection
Exploit for php platform in category web applications + Credits: John Page HYP3RLINX Vendor: ================== www.lepton-cms.org Product: ================================= Lepton CMS 2.2.0 / 2.2.1 update LEPTON is an easy-to-use but full customizable Content Management System CMS. Vulnerability...
Fedora Update for python-autobahn FEDORA-2016-acda4281c9
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Xen Denial of Service Vulnerability (CNVD-2016-05534)
Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. Xen has a denial-of-service vulnerability, which can be exploited by an attacker using a PV-mode x86 32-bit hardware platform to trigger a security check that will cause the VM...
Microsoft Windows Win32k Elevation of Privilege (MS16-090: CVE-2016-3250)
An elevation of privilege vulnerability exists in Microsoft Windows Win32k. A remote attacker can bypass a security check in win32k to load a custom font from an arbitrary file on disk. Successful exploitation could allow an attacker to run arbitrary code with elevated privileges...
ATCOM PBX IP01 / IP08 / IP4 / IP2G4A - Authentication Bypass
Title: ATCOM PBX system , auth bypass exploit Author: i-Hmx contact : [email protected] Home : sec4ever.com Tested on : ATCOM IP01 , IP08 , IP4G and ip2G4A Details The mentioned system is affected by auth bypass flaw that allow an attacker to get admin access on the vulnerable machine without...
Fedora Update for python-tgcaptcha2 FEDORA-2016-5
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Struts2 S2-0 2 9 remote code execution vulnerability: a preliminary study-vulnerability warning-the black bar safety net
0×0 1 Struts2 tag library Struts2 tag libraries to use OGNL expression to access the ActionContext object in the data. In order to be able to access to the ActionContext in the variable, Struts2 the ActionContext is set to OGNL context, and the OGNL with objects added to the ActionContext. In...
Fedora Update for php-htmLawed FEDORA-2016-0
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Awesome Windows Exploitation Resources
A curated list of awesome Windows Exploitation resources. Windows stack overflows Stack Base Overflow Articles. Win32 Buffer Overflows Location, Exploitation and Prevention – by Dark spyrit 1999 Writing Stack Based Overflows on Windows – by Nish Bhalla’s 2005 Windows heap overflows Heap Base...
SS-2015-028: Missing security check on dev/build/defaults
More info at https://www.silverstripe.org/download/security-releases/ss-2015-028/...
Fedora Update for firefox FEDORA-2016-1
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
WordPress Plugin WP User Frontend < 2.3.11 - Unrestricted Arbitrary File Upload
''' Exploit Title: WordPress WP User Frontend Plugin Unrestricted File Upload Discovery Date: 2016-02-04 Public Disclosure: 2016-02-08 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: https://wedevs.com Software Link:...
Fedora Update for libxmp FEDORA-2016-8
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
kredit-3450000.mosgorcredit.com Open Redirect vulnerability
Vulnerable URL: http://kredit-3450000.mosgorcredit.com/go?https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 29.02.2016 Latest check for patch:| 29.02.2016 03:30 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...