1531 matches found
Microsoft Internet Explorer 8 - jscript RegExpBase::FBadHeader Use-After-Free (MS15-018)
Microsoft Internet Explorer 8 - jscript RegExpBase::FBadHeader Use-After-Free MS15-018 // This PoC attempts to exploit a use-after-free bug in Microsoft Internet // Explorer 8. // See http://blog.skylined.nl/20161116001.html for details. var r=new RegExp"A|x|x|xx|xxxxxxxxxxxxxxxxxxxx+", "g";...
Moxa SoftCMS 1.5 - Denial of Service (PoC)
Moxa SoftCMS 1.5 - Denial of Service PoC ''' Title: Moxa SoftCMS 1.5 AspWebServer Denial of Service Vulnerability Author: Zhou Yu Email: [email protected] Vendor: http://www.moxa.com/ Versions affected: 1.5 or prior versions Test on: Moxa SoftCMS 1.5 on Windows 7 SP1 x32 CVE: CVE-2016-9332 Advisor...
Microsoft Internet Explorer 8 Javascript RegExpBase::FBadHeader Use-After-Free
Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the twelfth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these through...
Google Chrome Blink Serializer::doSerialize Bad Cast
Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the ninth entry in that series, and the first to not target a Microsoft browser. The below information is available in more detail on my blog at...
VBScript RegExpComp::PnodeParse Out-Of-Bounds Read
Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the sixth entry in that series. The below information is available in more detail on my blog at http://blog.skylined.nl/20161108001.html. There you can find a repro th...
Microsoft Internet Explorer 10 MSHTML CElement::GetPlainTextInScope Out-Of-Bounds Read
Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the third entry in that series. The below information is also available on my blog at http://blog.skylined.nl/20161103001.html. There you can find a repro that trigger...
High Throughput Fuzzer: Grr
High Throughput Fuzzer GRR is an x86 to amd64 binary translator. GRR was created to emulate and fuzzer DECREE challenge binaries. GRR was created for the DARPA Cyber Grand Challenge. Features Code cache persistence avoids translation overheads across separate runs. Optimization of the code cache,...
Microsoft Internet Explorer 11 MSHTML CView::CalculateImageImmunity Use-After-Free
Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the second entry in that series. The below information is also available on my blog at http://blog.skylined.nl/20161102001.html. There you can find a repro that...
Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free
var oDocumentFragment = document.createDocumentFragment, oElement = document.createElement'x'; oDocumentFragment.appendChildoElement; oElement.style.listStyleImage = "urlx"; oDocumentFragment.removeChildoElement; !-- Exploit I tried a few tricks to see if there was an easy way to reallocate the...
Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free
Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free var oDocumentFragment = document.createDocumentFragment, oElement = document.createElement'x'; oDocumentFragment.appendChildoElement; oElement.style.listStyleImage = "urlx"; oDocumentFragment.removeChildoElement;...
FreeBSD : chromium -- multiple vulnerabilities (9c135c7e-9fa4-11e6-a265-3065ec8fd3ec)
Google Chrome Releases reports : 3 security fixes in this release, including : - 642496 High CVE-2016-5177: Use after free in V8. Credit to Anonymous - 651092 CVE-2016-5178: Various fixes from internal audits, fuzzing and other initiatives. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
Unified Diagnostic Services Simulator: UDSim
Unified Diagnostic Services Simulator The UDSim is a graphical simulator that can emulate different modules in a vehicle and respond to UDS request. It was designed as a training tool to run alongside of ICSim. It also has some unique learning features and can even be used to security test...
EC-CUBE 2.12.6 - Server-Side Request Forgery Vulnerability
Exploit for php platform in category web applications Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery Date: 22/10/16 Exploit Author: Wad Deek Vendor Homepage: http://en.ec-cube.net/ Software Link: http://en.ec-cube.net/download/ Version: 2.12.6en-p1 Tested on: Xampp on Windows7 Fuzzing...
EC-CUBE 2.12.6 Server-Side Request Forgery
Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery Date: 22/10/16 Exploit Author: Wad Deek Vendor Homepage: http://en.ec-cube.net/ Software Link: http://en.ec-cube.net/download/ Version: 2.12.6en-p1 Tested on: Xampp on Windows7 Fuzzing tool:...
EC-CUBE 2.12.6 - Server-Side Request Forgery
Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery Date: 22/10/16 Exploit Author: Wad Deek Vendor Homepage: http://en.ec-cube.net/ Software Link: http://en.ec-cube.net/download/ Version: 2.12.6en-p1 Tested on: Xampp on Windows7 Fuzzing tool:...
OpenCimetiere 3.0.0-a5 Blind SQL Injection
Exploit Title: OpenCimetiere v3.0.0-a5 | Blind SQL Injection Date: 06/08/16 Exploit Author: Wad Deek Vendor Homepage: http://www.openmairie.org/ Software Link: http://www.openmairie.org/catalogue/opencimetiere/ Version: 3.0.0-a5 +3.0.0-a5 /opencimetiere/HISTORY.txt Tested on: Xampp with PostgreSQ...
Categorizator 0.3.1 SQL Injection
Exploit Title: Categorizator 0.3.1 | SQL Injection Date: 03/09/16 Exploit Author: Wad Deek Vendor Homepage: http://lelogiciellibre.net/telecharger/annuaire-web.php Software Link: ftp://ftp2.lelogiciellibre.net/lelogiciellibre/annu/categorizator031.zip Version: 0.3.1 Tested on: Xampp on Windows7...
NetBilletterie 2.8 - Multiple Vulnerabilities
NetBilletterie 2.8 - Multiple Vulnerabilities Exploit Title: NetBilletterie 2.8 | Multiple Vulnerabilities Date: 14/07/16 Exploit Author: Wadeek Website Author: https://github.com/Wad-Deek Vendor Homepage: http://net-billetterie.tuxfamily.org/ Software Link:...
Categorizator 0.3.1 - SQL Injection
Categorizator 0.3.1 - SQL Injection Exploit Title: Categorizator 0.3.1 | SQL Injection Date: 03/09/16 Exploit Author: Wad Deek Vendor Homepage: http://lelogiciellibre.net/telecharger/annuaire-web.php Software Link: ftp://ftp2.lelogiciellibre.net/lelogiciellibre/annu/categorizator031.zip Version:...
OpenCimetiere 3.0.0-a5 - Blind SQL Injection
Exploit Title: OpenCimetiere v3.0.0-a5 | Blind SQL Injection Date: 06/08/16 Exploit Author: Wad Deek Vendor Homepage: http://www.openmairie.org/ Software Link: http://www.openmairie.org/catalogue/opencimetiere/ Version: 3.0.0-a5 +3.0.0-a5 /opencimetiere/HISTORY.txt Tested on: Xampp with PostgreSQ...