Microsoft Windows Trusted Boot CVE-2015-2552 Local Security Bypass Vulnerability

Description Microsoft Windows is prone to a local security-bypass vulnerability. A local attacker can leverage this issue to bypass certain security restrictions and perform unauthorized actions. Technologies Affected Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 for x64-based...

Microsoft Windows Tablet Input Band CVE-2015-2548 Use After Free Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability because the Tablet Input Band fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will like...

Microsoft Windows VBScript Filter Function Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code in applications using the VBScript scripting language running on vulnerable installations of Microsoft Windows. Microsoft Internet Explorer is an affected application. User interaction is required to exploit this vulnerability i...

KLA10674 Multiple vulnerabilities in Microsoft Windows

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. Improper information...

HP SiteScope DNS Tool Command Injection Exploit

This Metasploit module exploits a command injection vulnerability discovered in HP SiteScope 11.30 and earlier versions tested in 11.26 and 11.30. The vulnerability exists in the DNS Tool allowing an attacker to execute arbitrary commands in the context of the service. By default, HP SiteScope...

(Pwn2Own) Microsoft Windows secdrv.sys Uninitialized Buffer Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the secdrv.sys...

smb-vuln-conficker NSE Script

Detects Microsoft Windows systems infected by the Conficker worm. This check is dangerous and it may crash systems. Based loosely on the Simple Conficker Scanner, found here: -- This check was previously part of smb-check-vulns. Script Arguments smbdomain, smbhash, smbnoguest, smbpassword,...

smb-vuln-regsvc-dos NSE Script

Checks if a Microsoft Windows 2000 system is vulnerable to a crash in regsvc caused by a null pointer dereference. This check will crash the service if it is vulnerable and requires a guest account or higher to work. The vulnerability was discovered by Ron Bowes while working on smb-enum-sessions...

smb-vuln-ms06-025 NSE Script

Detects Microsoft Windows systems with Ras RPC service vulnerable to MS06-025. MS06-025 targets the RasRpcSumbitRequest RPC method which is a part of RASRPC interface that serves as a RPC service for configuring and getting information from the Remote Access and Routing service. RASRPC can be...

smb-vuln-ms07-029 NSE Script

Detects Microsoft Windows systems with Dns Server RPC vulnerable to MS07-029. MS07-029 targets the RDnssrvQuery and RDnssrvQuery2 RPC method which isa part of DNS Server RPC interface that serves as a RPC service for configuring and getting information from the DNS Server service. DNS Server RPC...

Mango Automation 2.6.0 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications Mango Automation 2.6.0 CSRF File Upload And Arbitrary JSP Code Execution Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation i...

Mango Automation 2.6.0 File Upload / Code Execution CSRF

Mango Automation 2.6.0 CSRF File Upload And Arbitrary JSP Code Execution Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software...

Mango Automation 2.6.0 - Multiple Vulnerabilities

Mango Automation 2.6.0 CSRF File Upload And Arbitrary JSP Code Execution Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software...

Mango Automation 2.6.0 User Enumeration

Mango Automation 2.6.0 User Enumeration Weakness Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to...

Mango Automation 2.6.0 CSRF Arbitrary Command Execution Exploit

Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description The POST parameter 'c0-param0...

Microsoft Windows Kernel - NtGdiBitBlt Buffer Overflow (MS15-097)

Microsoft Windows Kernel - NtGdiBitBlt Buffer Overflow MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=474 --- The attached PoC triggers a buffer overflow in the NtGdiBitBlt​ system call. It reproduces reliable on Win 7 32-bit with Special Pool enabled on...

Microsoft Windows Kernel - 'NtGdiBitBlt' Buffer Overflow (MS15-097)

Source: https://code.google.com/p/google-security-research/issues/detail?id=474 --- The attached PoC triggers a buffer overflow in the NtGdiBitBlt system call. It reproduces reliable on Win 7 32-bit with Special Pool enabled on win32k.sys --- Proof of Concept:...

Microsoft Windows Kernel - bGetRealizedBrush Use-After-Free (MS15-097)

Microsoft Windows Kernel - bGetRealizedBrush Use-After-Free MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=458 --- The attached testcase crashes Win 7 with Special Pool on win32k while accessing freed memory in bGetRealizedBrush​​. --- Proof of Concept:...

Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (2)

Microsoft Windows Kernel - Bitmap Handling Use-After-Free MS15-061 2 Source: https://code.google.com/p/google-security-research/issues/detail?id=311 Bitmap object Use-after-Free 2 The attached PoC triggers a blue screen due to a use after free vulnerability. The crashes are unreliable, however yo...

Microsoft Windows Kernel - UserCommitDesktopMemory Use-After-Free (MS15-073)

Microsoft Windows Kernel - UserCommitDesktopMemory Use-After-Free MS15-073 Source: https://code.google.com/p/google-security-research/issues/detail?id=335 Freed memory is accessed after switching between two desktops of which one is closed. The testcase crashes with and without special pool...