shopify-scripts: Invalid read leading to a segfault

PoC === The attached POC demonstrates invalid reads leading to a segfault. Debug info ========== gdb report: 423│ dispatchlinkedcodegenscope s, int pc 424│ 425│ mrbcode i; 426│ int pos; 427│ 428│ if !pc return; 429│ for ;; 430├─── i = s-iseqpc; gdb p pc $1 = -32730 valgrind report: ==21952==...

Smart Marketing SMS and Newsletters Forms <= 1.1.1 - Unauthenticated Cross-Site Scripting (XSS)

The Smart Marketing SMS and Newsletters Forms WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC POST /wordpress/wp-content/plugins/smart-marketing-for-wp/admin/partials/custom/egoi-for-wp-formegoi.php HTTP/1.1 Host: 127.0.0.1 Content-Type:...

HP iMC Plat 7.2 - Remote Code Execution Exploit

Exploit for windows platform in category remote exploits !/opt/local/bin/python2.7 Exploit Title: HP iMC Plat 7.2 dbman Opcode 10007 Command Injection RCE Exploit Author: Chris Lyne @lynerc Vendor Homepage: www.hpe.com Software Link:...

Linux Kernel - The Huge Dirty Cow Overwriting The Huge Zero Page (1)

Linux Kernel - The Huge Dirty Cow Overwriting The Huge Zero Page 1 // EDB Note: Source https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0 // EDB Note: Source https://github.com/bindecy/HugeDirtyCowPOC // Author Note: Before running, make sure to set transparent huge pages to...

Amber - POC Reflective PE Packer

Amber is a proof of concept packer, it can pack regularly compiled PE files into reflective PE files that can be used as multi stage infection payloads. If you want to learn the packing methodology used inside the Amber check out below. PS: This is not a complete tool some things may break so tak...

Uber: The Microsoft Store Uber App Does Not Implement Server-side Token Revocation

Summary The Microsoft Store Uber App Windows Phone Architecture does not properly revoke or expire a rider's x-uber-token upon app signout. Security Impact When a user logs out/signs off of the app, the logout process is handled only locally on the application side, and without any type of...

Android Gmail 7.11.5.176568039 - Directory Traversal in Attachment Download

Android Gmail 7.11.5.176568039 - Directory Traversal in Attachment Download ''' Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1342 There is a directory traversal issue in attachment downloads in Gmail. For non-gmail accounts, there is no path sanitization on the attachment...

Android Gmail < 7.11.5.176568039 - Directory Traversal in Attachment Download Exploit

There is a directory traversal issue in attachment downloads in Gmail. For non-gmail accounts, there is no path sanitization on the attachment filename in the email, so when attachments are downloaded, a file with any name and any contents can be written to anywhere on the filesystem that the Gma...

Razer US: POST XSS in careers.razerzone.com via the txt_email parameter.

The researcher discovered a POST based XSS on an administrative login page on our careers.razerzone.com website that would have allowed the execution of scripts in some browsers e.g. Firefox. This was fixed on 1/5. Another great report. We'd also like to acknowledge the researcher's effort in...

Microsoft Edge Chakra JIT - Inline::InlineCallApplyTarget_Shared does not Return the return Instruction

Microsoft Edge Chakra JIT - Inline::InlineCallApplyTargetShared does not Return the return Instruction / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1366 Here's a snippet of Inline::Optimize. FOREACHINSTREDITINGinstr, instrNext, func-mheadInstr switch instr-mopcode case...

Exim 4.89 - BDAT Denial of Service Exploit

Exploit for multiple platform in category dos / poc While parsing BDAT data header, exim still scans for '.' and consider it the end of mail. https://github.com/Exim/exim/blob/master/src/src/receive.cL1867 Exim goes into an incorrect state after this message is sent because the function pointer...

ALLPlayer 7.5 - Denial of-Service (PoC)

!/usr/bin/python buffer = b"http://" buffer += b"\x41" 1500 f=open"player.m3u","wb" f.writebuffer f.close...

Microsoft Edge Chakra JIT Incorrect Function Declaration Scope

Microsoft Edge: Chakra: JIT: Incorrect function declaration scope CVE-2017-11870 In the following JavaScript code, both of the print calls must print out "undefined" because of "x" is a formal parameter. But the second print call prints out "function x ". This bug may lead to type confusion in...

Microsoft Edge Chakra JIT Inline::InlineCallApplyTarget_Shared Failed Return

Microsoft Edge: Chakra: JIT: Inline::InlineCallApplyTargetShared doesn't return the return instruction CVE-2017-11841 Here's a snippet of Inline::Optimize. FOREACHINSTREDITINGinstr, instrNext, func-mheadInstr switch instr-mopcode case Js::OpCode::Label: ... if instr-AsLabelInstr-misForInExit...

CommuniGatePro 6.1.16 Cross Site Scripting

Exploit Title: CommuniGatePro webmails Multiple Stored XSS Date: 15/11/2017 Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Vendor Homepage: https://www.stalker.com/ Software Link: http://www.stalker.com/ paid product Version: 6.1.16 Tested on: production server on crystal, pron...

WebKit - WebCore::DocumentLoader::frameLoader Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function go iframe.name = "foo"; var form = document.createElement"form"; iframe.src = "data:text/html,foo"; form.submit; window.onbeforeunload = f; function f document.head.appendChilddel; ::get...

WebKit WebCore::RenderText::localCaretRect Out-Of-Bounds Read

WebKit: out-of-bounds read in WebCore::RenderText::localCaretRect CVE-2017-13785 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= max-height: 0;...

WebKit - 'WebCore::InputType::element' Use-After-Free (2)

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1345 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= / function go...

WebKit - 'WebCore::PositionIterator::decrement' Use-After-Free

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1346 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= / function jsfuzzer...

WebKit - WebCore::RenderObject::previousSibling Use-After-Free

WebKit - WebCore::RenderObject::previousSibling Use-After-Free .class9 column-span: all; function f document.execCommand"indent", false; var var00031 = window.getSelection.setBaseAndExtentsum,16,null,6; f; !-- ================================================================= ASan log:...