Adobe Flash Player 23.0.0.162 - '.SWF' ConstantPool Critical Memory Corruption

Exploit for multiple platform in category dos / poc Application: Adobe Flash Player Platforms: Windows,OSX Versions: 23.0.0.162 and earlier Author: Francis Provencher of COSIG Website: https://cosig.gouv.qc.ca/en/advisory/ Twitter: @COSIG Date: October 11, 2016 CVE-2016-4273 COSIG-2016-35 1...

Android - Binder Generic ASLR Leak Vulnerability

Exploit for Android platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=889 The interaction between the kernel /dev/binder and the usermode Parcel.cpp mean that when a binder object is passed as BINDERTYPEBINDER or BINDERTYPEWEAKBINDER, a pointer to th...

Nextcloud: URI scheme bypass in mail app lead to HTML content spoof and opener control

Bug When we load a HTML mail from mailbox via api, etc http://nextcloud/index.php/apps/mail/accounts//folders/SU5CT1g=/messages//html Our content will be passed to HTML Purifier to strip malicious XSS patterns. After that, an filter will apply to transform acceptable URI schemes http, https, ftp,...

Contenido 4.9.11 Cross Site Scripting

Document Title: =============== Contenido v4.9.11 - Backend Multiple XSS Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1928 Release Date: ============= 2016-10-10 Vulnerability Laboratory ID VL-ID: ====================================...

BirdBlog 1.4.0 - (Add New Post) Cross-Site Request Forgery

Exploit for php platform in category web applications document.forms0.submit; !--...

BirdBlog 1.4.0 - Cross-Site Request Forgery (Add New Post)

document.forms0.submit;...

phpEnter 4.2.7 - Cross-Site Request Forgery (Add New Post)

function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "http://sitename/path/addnews.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8"; xhr.setRequestHeader"Accept-Language", "en-US,en;q=0.5"; xhr.setRequestHeader"Content-Type"...

BirdBlog 1.4.0 - Cross-Site Request Forgery (Add New Post)

BirdBlog 1.4.0 - Cross-Site Request Forgery Add New Post document.forms0.submit;...

Chrome Address Bar URL Spoofing on IOS

来源链接： http://xlab.tencent.com/cn/2016/10/11/CVE-2016-1707-Chrome-Address-Bar-URL-Spoofing-on-IOS/ （英文版）http://xisigr.com/x/cve-2016-1707/ 0x00 Vulnerability Overview Chrome浏览器地址栏欺骗漏洞CVE-2016-1707，这个漏洞笔者于2016年6月报告给Google，现在把漏洞细节分享给大家。URL Spoofing漏洞可以伪造一个合法的网站地址。攻击者可以利用这个漏洞对用户发起网络钓鱼攻击。 受影响版本：Chrome...

Yelp: Requesting Show CheckIn Alert for Non Friend User

During analysis it was observed that I was able to request "ShowCheck In Alert" Request for non friend user. I performed this application from Mobile application. Below are the steps we have to carry to achieve this: Logged in to Yelp Mobile Application Visit any added friend and click on...

Spacemarc News - Cross-Site Request Forgery (Add New Post)

Exploit Title : Spacemarc News - Cross-Site Request Forgery Add New Post Author : Besim Google Dork : - Date : 10/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.spacemarc.it Software link : http://www.hotscripts.com/listings/jump/download/107255 CSRF PoC function submitRequest...

Maian Weblog 4.0 - Cross-Site Request Forgery (Add New Post)

Maian Weblog 4.0 - Cross-Site Request Forgery Add New Post Exploit Title : Maian Weblog 4.0 - Cross-Site Request Forgery Add New Post Author : Besim Google Dork : - Date : 10/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.maianweblog.com Software link :...

Contenido v4.9.11 - (Backend) Multiple XSS Vulnerabilities

Document Title: =============== Contenido v4.9.11 - Backend Multiple XSS Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1928 Release Date: ============= 2016-10-10 Vulnerability Laboratory ID VL-ID: ====================================...

Maian Weblog 4.0 - Cross-Site Request Forgery ( Add New Post)

Exploit for php platform in category web applications Exploit Title : Maian Weblog 4.0 - Cross-Site Request Forgery Add New Post Author : Besim Google Dork : - Date : 10/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.maianweblog.com Software link :...

Leap Service - Unquoted Service Path Privilege Escalation

Exploit for windows platform in category local exploits Leap service: https://www.leapmotion.com/ By Ross Marks: http://www.rossmarks.co.uk Exploit-db: https://www.exploit-db.com/author/?a=8724 Category: Local Tested on: Windows 10 x86/x64 1 Unquoted Service Path Privilege Escalation Leap motion'...

Foxit Cloud Update Service - Unquoted Service Path Privilege Escalation

Exploit for windows platform in category local exploits Foxit Cloud Update Service: https://www.foxitsoftware.com By Ross Marks: http://www.rossmarks.co.uk Category: Local Tested on: Windows 10 x86/x64 1 Unquoted Service Path Privilege Escalation Foxit reader's "cloud safe update service" install...

Foxit Cloud Update Service Privilege Escalation

Foxit Cloud Update Service: https://www.foxitsoftware.com By Ross Marks: http://www.rossmarks.co.uk Exploit-db: https://www.exploit-db.com/author/?a=8724 Category: Local Tested on: Windows 10 x86/x64 1 Unquoted Service Path Privilege Escalation Foxit reader's "cloud safe update service" installs ...

Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- input type="hidden...

Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin)

Simple PHP Blog 0.8.4 - Cross-Site Request Forgery Add Admin that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- input t...

Simple PHP Blog 0.8.4 Cross Site Request Forgery

that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- inp...