Sql injection

tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service segmentation fault via a large frame, a related issue to CVE-2017-14266...

CVE-2016-6160

tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service segmentation fault via a large frame, a related issue to CVE-2017-14266...

CVE-2016-6160

tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service segmentation fault via a large frame, a related issue to CVE-2017-14266...

CVE-2016-6160

CVE-2016-6160 affects tcpreplay’s tcprewrite utility; before version 4.1.2 it allows remote attackers to cause a denial of service (segmentation fault) by sending a large PCAP frame. The issue is related to CVE-2017-14266, which describes a heap-based buffer overflow in Tcpreplay 3.4.4 triggered ...

CVE-2016-6160

tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service segmentation fault via a large frame, a related issue to CVE-2017-14266...

Ruby: Parsing invalid unicode codepoints using json c extension (2.0.1+) triggers a segfault

Using the default json library packaged with ruby, one can trigger a segmentation fault by submitting a string with a unicode escape sequence in the range between \ud800-\udbff https://en.wikipedia.org/wiki/UTF-16U.2BD800toU.2BDFFF. This is can lead to a denial of service attack by segmentation...

shopify-scripts: Crash in print_backtrace

This crash does not affect mruby-engine because it does not print the back trace in guest. We can control the register by setting a backtrace array. PoC ruby exc = Exception.new exc.setbacktrace0x41414141 raise exc GDB $ gdb -q --args ./bin/mruby test12.rb Reading symbols from ./bin/mruby...done...

shopify-scripts: Still heap overflow in mrb_ary_splice

The fix of 192362 is still crashed with a different PoC. I think the cause of this bug is the same and I missed the incomplete fix, so you may be able to skip rewards for this one. Cause If I set the tail value to a specific value, then I can maintain the array size. The original fix only checks...

shopify-scripts: SIGSEGV - mrb_vm_exec - line:1681

PoC: ------------------- The following code triggers the bug attached as testmrbvmexec1681.rb: def try yield ensure yield end a=lambda do a.try do return end end.call Mirb - Debug: ------------------- gdb r testmrbvmexec1678.rb The program being debugged has been started already. Start it from th...

shopify-scripts: Segmentation fault on program counter

Mruby running on linux x64 gcc version 4.8.4 Ubuntu 4.8.4-2ubuntu114.04.3 poc for i in methods Kernel.initialize.publicmethods print print %i0 0 0 0end output ----------------------------------registers----------------------------------- RAX: 0x6b0e00 -- 0x80101 RBX: 0x6bef20 -- 0x6b73d0 -- 0x210...

shopify-scripts: SIGSEGV - mrb_vm_exec - vm.c in line:1272

PoC: ------------------- The following code triggers the bug attached as testmrbvmexec1272.rb: a,a,a,a=0,def e end a Sandbox: ------------------- x@x:/Desktop/research/mruby-engine/bin$ ./sandbox testmrbvmexec1272.rb ./sandbox:20: BUG Segmentation fault at 0x00000000000018 ruby 2.2.6p396 2016-11-...

shopify-scripts: Segmentation fault - mrb_gc_mark

gdb /root/mruby-engine/ext/mrubyengine/mruby/bin/mirb GNU gdb Ubuntu 7.11.1-0ubuntu116.04 7.11.1 Copyright C 2016 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent...

CVE-2016-9601

A heap based buffer overflow was found in the ghostscript jbig2decodegrayscaleimage function used to decode halftone segments in a JBIG2 image. A document PostScript or PDF with an embedded, specially crafted, jbig2 image could trigger a segmentation fault in ghostscript...

Internet Bug Bounty: Crash (DoS) when parsing a hostile TIFF

The issue was reported and resolved by PHP's security team: Ticket 73737: https://bugs.php.net/bug.php?id=73737 Git Commit: http://git.php.net/?p=php-src.git;a=commit;h=1cda0d7c2ffb62d8331c64e703131d9cabdc03ea The EXIF module in all PHP versions 5.6.9 and below, 7.1.0 and below is vulnerable to a...

QNAP NAS Devices - Heap Overflow Exploit

Exploit for linux platform in category dos / poc ================== 1 Heap overflow ================== Path: /home/httpd/cgi-bin/cgi.cgi u = valid user guest|admin 1.1 / Remote / Remote host echo -en "GET /cgi-bin/cgi.cgi?u=admin&p=fori=0;i263;i++;do echo -en "A";done HTTP/1.0\nHost: QNAP\n\n" |...

QNAP NAS Devices - Heap Overflow

QNAP NAS Devices - Heap Overflow ================== 1 Heap overflow ================== Path: /home/httpd/cgi-bin/cgi.cgi u = valid user guest|admin 1.1 / Remote / Remote host echo -en "GET /cgi-bin/cgi.cgi?u=admin&p=fori=0;i263;i++;do echo -en "A";done HTTP/1.0\nHost: QNAP\n\n" | ncat --ssl...

QNAP NAS Devices - Heap Overflow

================== 1 Heap overflow ================== Path: /home/httpd/cgi-bin/cgi.cgi u = valid user guest|admin 1.1 / Remote / Remote host echo -en "GET /cgi-bin/cgi.cgi?u=admin&p=fori=0;i263;i++;do echo -en "A";done HTTP/1.0\nHost: QNAP\n\n" | ncat --ssl 192.168.5.7 443 HTTP/1.1 200 OK Date:...

QNAP NAS Heap Overflow

Greetings, Twice I tried to use the QNAP Web page https://aid.qnap.com/event/module/nas/safereport/ for reporting vulnerability, and twice I got mailer-daemon back. So, Iall post my vulnerabilities here instead Was not meant to be 0-daya| whatever. Have a nice day and happy new year /bashis...

CVE-2016-9601

ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2decodegrayscaleimage function which is used to decode halftone segments in a JBIG2 image. A document PostScript or PDF with an embedded, specially crafted, jbig2 image could trigge...

CVE-2016-10196

Stack-based buffer overflow in the evutilparsesockaddrport function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service segmentation fault via vectors involving a long string in brackets in the ipasstring argument...