160 matches found
Windows 10 the next MS16-098 RGNOBJ integer overflow vulnerability analysis and exploit-vulnerability warning-the black bar safety net
This article with reference to , the text talked about the Windows Kernel Pool Feng Shui, SetBitmapBits/GetBitmapBits to any address read and write, etc. the use of Means, and very helpful in learning the Windows kernel exploits. Test environment: Windows 10 1511 x64 Professional Edition2016.04 2...
Apple Safari 10.1 - Spread Operator Integer Overflow Remote Code Execution
Sources: https://phoenhex.re/2017-06-02/arrayspread https://github.com/phoenhex/files/blob/master/exploits/spread-overflow JavaScriptCore will allocate a JSFixedArray for every spread operand of the array literal in slowpathspread. As such, roughly 4 billion JSValues will have to be allocated,...
Apple Safari 10.1 - Spread Operator Integer Overflow Remote Code Execution
Apple Safari 10.1 - Spread Operator Integer Overflow Remote Code Execution Sources: https://phoenhex.re/2017-06-02/arrayspread https://github.com/phoenhex/files/blob/master/exploits/spread-overflow JavaScriptCore will allocate a JSFixedArray for every spread operand of the array literal in...
QNAP NVR / NAS Overflows Vulnerability
QNAP NVR and NAS devices suffer from multiple overflows. Various makes and models are affected. Full exploitation details provided. STX Subject: QNAP NVR/NAS Heap / Stack / Heap Feng Shui overflow, and "Heack Combo" to pwn Researcher: bashis January 2017 Release date: February 1, 2017 Device Mode...
QNAP NVR/NAS Devices - Buffer Overflow (PoC)
Device Model: QNAP VioStor NVR, QNAP NAS, Fujitsu Celvin NAS May be additional re-branded Attack Vector: Remote Attack Models: 1. Classic Heap Overflows 2. Classic Stack Overflow 3. Heap Feng Shui Overflow 4. "Heack Combo" Heap / Stack Combination Overflow Timeline 07/01/2017: QNAP contacted me...
Feng Office Detection
Detection of Feng Office. The script sends a connection request to the host and attempts to identify Feng Office and its version from the reply. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...
Microsoft Internet Explorer 8 jscript - 'RegExpBase::FBadHeader' Use-After-Free (MS15
Exploit for windows platform in category dos / poc // This PoC attempts to exploit a use-after-free bug in Microsoft Internet // Explorer 8. // See http://blog.skylined.nl/20161116001.html for details. var r=new RegExp"A|x|x|xx|xxxxxxxxxxxxxxxxxxxx+", "g"; "A".replacer, function // Force OLEAUT...
Microsoft Internet Explorer 8 - jscript RegExpBase::FBadHeader Use-After-Free (MS15-018)
Microsoft Internet Explorer 8 - jscript RegExpBase::FBadHeader Use-After-Free MS15-018 // This PoC attempts to exploit a use-after-free bug in Microsoft Internet // Explorer 8. // See http://blog.skylined.nl/20161116001.html for details. var r=new RegExp"A|x|x|xx|xxxxxxxxxxxxxxxxxxxx+", "g";...
VBScript 5.8.7600.16385 / 5.8.9600.16384 - RegExpComp::PnodeParse Out-of-Bounds Read Exploit
Exploit for windows platform in category dos / poc !-- Source: http://blog.skylined.nl/20161108001.html Synopsis A specially crafted script can cause the VBScript engine to read data beyond a memory block for use as a regular expression. An attacker that is able to run such a script in any...
VBScript 5.8.7600.16385/5.8.9600.16384 - RegExpComp::PnodeParse Out-of-Bounds Read
!-- Source: http://blog.skylined.nl/20161108001.html Synopsis A specially crafted script can cause the VBScript engine to read data beyond a memory block for use as a regular expression. An attacker that is able to run such a script in any application that embeds the VBScript engine may be able t...
Android Rowhammer attack vulnerability (Drammer)
Project Description Drammer is a new attack that exploits the Rowhammer hardware vulnerability on Android devices. It allows attackers to take control over your mobile device by hiding it in a malicious app that requires no permissions. Practically all devices are possibly vulnerable and must wai...
Critical Android Vulnerability 'Drammer' Impacts Millions of Handsets
Researchers have published details of a new method for exploiting a problem with Android devices tied to a hardware flaw within DRAM memory modules that can allow attackers to get root-level access to target machines. The vulnerability, dubbed Drammer, could give an attacker root access to millio...
webkit2gtk: arbitrary code execution
WebKitGTK+ allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1856. Credit to Jeonghoon Shin at A.D.D and Liang Chen, Zhen Feng, wushi of KeenLab, Tencen...
New York Judge Rules FBI Can't Force Apple to Unlock iPhone
Apple - 1; The FBI - 0 Apple Won a major court victory against the Federal Bureau of Investigation FBI in an ongoing legal battle similar to San Bernardino. In a New York case, a federal magistrate judge has ruled in favor of Apple, rejecting the U.S. government’s request to force Apple to help...
Feng Office 1.7.4 - Cross Site Scripting Vulnerabilities
No description provided by source...
Feng Office 1.7.4 - Arbitrary File Upload
No description provided by source...
Feng Office 1.7.4 - XSS / Arbitrary File Upload Exploit
Exploit for php platform in category web applications Source: http://www.securityfocus.com/bid/47049/info alert0" / alert0" / --------------------------------------------- Feng Office 1.7.4 - Arbitrary File Upload --------------------------------------------- import socket host = 'localhost' path...
Feng Office 1.7.4 - Cross-Site Scripting
Feng Office 1.7.4 - Cross-Site Scripting source: https://www.securityfocus.com/bid/47049/info alert0" / alert0" /...
Feng Office 1.7.4 - Arbitrary File Upload
import socket host = 'localhost' path = '/fengcommunity' shellpath = '/tmp' port = 80 def uploadshell: s = socket.socketsocket.AFINET, socket.SOCKSTREAM s.connecthost, port s.settimeout8 s.send'POST ' + path + '/public/assets/javascript/ckeditor/ckuploadhandler.php HTTP/1.1\r\n' 'Host:...