VirtualBox 5.1.22 - Windows Process DLL UNC Path Signature Bypass Privilege Escalation Exploit

Exploit for windows platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1296 VirtualBox: Windows Process DLL UNC Path Signature Bypass EoP Platform: VirtualBox v5.1.22 r115126 x64 Tested on Windows 10 Class: Elevation of Privilege Summary: The...

VirtualBox 5.1.22 - Windows Process DLL UNC Path Signature Bypass Privilege Escalation

VirtualBox 5.1.22 - Windows Process DLL UNC Path Signature Bypass Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1296 VirtualBox: Windows Process DLL UNC Path Signature Bypass EoP Platform: VirtualBox v5.1.22 r115126 x64 Tested on Windows 10 Class: Elevatio...

alphasc2.com Open Redirect vulnerability

Vulnerable URL: http://alphasc2.com/away.php?url=openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.10.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

so.28.com XSS vulnerability

Vulnerable URL: http://so.28.com/Index/dosearch?keyword=1%22%27--!%3E%3CScript%20/K/%3Econfirm/OPENBUGBOUNTY/%3C/Script%20/K/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Windows Escalate UAC Protection Bypass (Via COM Handler Hijack)

This module will bypass Windows UAC by creating COM handler registry entries in the HKCU hive. When certain high integrity processes are loaded, these registry entries are referenced resulting in the process loading user-controlled DLLs. These DLLs contain the payloads that result in elevated...

paste829.com XSS vulnerability

Open Bug Bounty ID: OBB-270684 Description| Value ---|--- Affected Website:| paste829.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

0594333.com XSS vulnerability

Vulnerable URL: http://www.0594333.com/"...

ec21.com XSS vulnerability

Vulnerable URL: https://www.ec21.com/global/sstory/SStoryList.jsp?forums=%22%3E%3Csvg/onload=%22alert%27OPENBUGBOUNTY%27%22%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 21981...

mile2.com XSS vulnerability

Vulnerable URL: https://mile2.com/mile2-online-estore/search.html?keyword=1%22--!%3E%3CSvg/OnLoad=confirm%27OPENBUGBOUNTY%27%3E%22 Details: Description| Value ---|--- Patched:| Yes, at 15.11.2017 Latest check for patch:| 15.11.2017 20:07 GMT Vulnerability type:| XSS Vulnerability status:| Publicl...

ticketfinder24.com XSS vulnerability

Vulnerable URL: http://ticketfinder24.com/?s=%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 23.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

athletesedge360.com XSS vulnerability

Open Bug Bounty ID: OBB-268774 Description| Value ---|--- Affected Website:| athletesedge360.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

solidesdesign-test3.com XSS vulnerability

Open Bug Bounty ID: OBB-268620 Description| Value ---|--- Affected Website:| solidesdesign-test3.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

eca9.com XSS vulnerability

Open Bug Bounty ID: OBB-268422 Description| Value ---|--- Affected Website:| eca9.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

innergy4every1.com XSS vulnerability

Open Bug Bounty ID: OBB-268400 Description| Value ---|--- Affected Website:| innergy4every1.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

crossfith2.com XSS vulnerability

Vulnerable URL: http://crossfith2.com/?s=%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 23.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

UPDATE: Luckystrike 2.0!

PenTestIT RSS Feed My first post regarding this malicious Microsoft Office document generator was about an older version. However a few hours ago, an update was released - Luckystrike 2.0! Major highlights for this awesome release include full support for Microsoft Word in addition to a new COM...

peachy18.com Open Redirect vulnerability

Vulnerable URL: http://www.peachy18.com/cgi-bin/atx//out.cgi?c=2=91=https://www.openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 12.08.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 40643 VIP website status:...

junpin360.com XSS vulnerability

Open Bug Bounty ID: OBB-266219 Description| Value ---|--- Affected Website:| junpin360.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

goodav17.com XSS vulnerability

Vulnerable URL: http://goodav17.com/search/...

Apple iTunes iPodService Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Apple iTunes. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the...