Huawei Enjoy 6 MTK Platform Arbitrary Address Write Vulnerability

The Huawei Enjoy 6 is a smartphone from the Chinese company Huawei Huawei. An arbitrary address write vulnerability exists in the camera driver of Huawei Enjoy 6 phones using the MTK platform. The vulnerability is due to the device failing to adequately validate user input. An attacker exploits t...

Xen - Broken Check in memory_exchange() Permits PV Guest Breakout Vulnerability

Exploit for multiple platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1184 This bug report describes a vulnerability in memoryexchange that permits PV guest kernels to write to an arbitrary virtual address with hypervisor privileges. The...

unsorted bin attack analysis-vulnerability warning-the black bar safety net

One, Foreword This is before that article overflow using the FILE structure of the follow-up article, mentioned earlier is for the Shanghai network security contest pwn450 of technology to write articles, a total of two techniques, one is the overflow using the FILE structure of the body, one is...

Microsoft Windows Kernel win32k!OffsetChildren - Null Pointer Dereference

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=544 The attached PoC triggers a null pointer vulnerability in OffsetChildren on Windows 7 32-bit. By mapping the null page an attacker can leverage this vulnerability to...

Microsoft Windows Kernel - win32k!OffsetChildren Null Pointer Dereference

Microsoft Windows Kernel - win32k!OffsetChildren Null Pointer Dereference Source: https://code.google.com/p/google-security-research/issues/detail?id=544 The attached PoC triggers a null pointer vulnerability in OffsetChildren on Windows 7 32-bit. By mapping the null page an attacker can leverage...

Microsoft Windows Kernel - 'win32k!OffsetChildren' Null Pointer Dereference

Source: https://code.google.com/p/google-security-research/issues/detail?id=544 The attached PoC triggers a null pointer vulnerability in OffsetChildren on Windows 7 32-bit. By mapping the null page an attacker can leverage this vulnerability to write to an arbitrary address. --- Proof of Concept...

Fastest Internet Port Scanner: MASSCAN

This is the fastest Internet port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second. It produces results similar to nmap , the most famous port scanner. Internally, it operates more like scanrand , unicornscan , and ZMap , using asynchronous...

Apple QuickTime m1s Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the quicktime.qtx. When...

BSD ftpd 0.3.2 - Single Byte Buffer Overflow

BSD ftpd 0.3.2 - Single Byte Buffer Overflow source: https://www.securityfocus.com/bid/2124/info The ftp daemon derived from 4.x BSD source contains a serious vulnerability that may compromise root access. There exists a one byte overflow in the replydirname function. The overflow condition is du...

NetBSD 1.4 / OpenBSD 2.5 / Solaris 7.0 - 'profil(2)' Modify The Internal Data Space

/ source: https://www.securityfocus.com/bid/570/info Some BSD's use a profil2 system call that dates back to "version 6" unix. This system call arranges for the kernel to sample the PC and increment an element of an array on every profile clock tick. The security issue stems from the fact that...