Ayukov NFTP FTP Client 2.0 - Remote Buffer Overflow

Ayukov NFTP FTP Client 2.0 - Remote Buffer Overflow !/usr/bin/env python coding: utf-8 Description: The vulnerability was discovered during a vulnerability research lecture. This is meant to be a PoC. Exploit Title: Ayukov NFTP FTP Client - Buffer Overflow Date: 2017-10-21 Exploit Author: Berk Ce...

QIWI: apache access.log leakage via long request on https://rapida.ru/

Issue access.log is leaked by attacker who trying send many requests. Explain: Honestly i don't know how the bug is happened, but i guess if the access.log is too large, it will dump some part into the response, and attacker happily get it. Reproduce: 1. Access to https://rapida.ru/search/?q= 2...

Microsoft Game Definition File Editor 6.3.9600 - XML External Entity Injection Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MS-WINDOWS-GAME-DEFINITION-FILE-MAKER-v6.3.9600-XML-EXTERNAL-ENTITY.txt + ISR: ApparitionSec Vendor: ================...

Microsoft Game Definition File Editor 6.3.9600 - XML External Entity Injection

Microsoft Game Definition File Editor 6.3.9600 - XML External Entity Injection + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MS-WINDOWS-GAME-DEFINITION-FILE-MAKER-v6.3.9600-XML-EXTERNAL-ENTITY.txt + ISR: ApparitionSec...

Microsoft Game Definition File Editor 6.3.9600 - XML External Entity Injection

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MS-WINDOWS-GAME-DEFINITION-FILE-MAKER-v6.3.9600-XML-EXTERNAL-ENTITY.txt + ISR: ApparitionSec Vendor: ================= www.microsoft.com Product: =========== GDFMaker...

Xen - Pagetable De-typing Unbounded Recursion

Xen - Pagetable De-typing Unbounded Recursion Xen allows pagetables of the same level to map each other as readonly in PV domains. This is useful if a guest wants to use the self-referential pagetable trick for easy access to pagetables by mapped virtual address. When cleaning up a pagetable afte...

Xen - Pagetable De-typing Unbounded Recursion

Xen allows pagetables of the same level to map each other as readonly in PV domains. This is useful if a guest wants to use the self-referential pagetable trick for easy access to pagetables by mapped virtual address. When cleaning up a pagetable after the last typed reference to it has been...

Career Portal 1.0 SQL Injection

Exploit Title: Career Portal v1.0 - SQL Injection Date: 2017-10-17 Exploit Author: 8bitsec Vendor Homepage: https://codecanyon.net/item/career-portal-online-job-search-script/20767278 Software Link: https://codecanyon.net/item/career-portal-online-job-search-script/20767278 Version: 1.0 Tested on...

Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability(CVE-2017-11809)

Here's a snippet of the method that interprets a javascript function's bytecode. Js::Var Js::InterpreterStackFrame::INTERPRETERLOOPNAME PROBESTACKscriptContext, Js::Constants::MinStackInterpreter; closureInitDone Assertthis-mreader.GetCurrentOffset == 0; this-InitializeClosures; DoStackScopeSlots...

OpenText Documentum Content Server - Privilege Escalation

!/usr/bin/env python Opentext Documentum Content Server formerly known as EMC Documentum Content Server contains following design gap, which allows authenticated user to gain privileges of superuser: Content Server allows to upload content using batches TAR archives, when unpacking TAR archives...

Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability(CVE-2017-11802)

No description provided by source. The "String.prototype.replace" method can be inlined in the JIT process. So in the method, all the calls which may break the JIT assumptions must be invoked with updating "ImplicitCallFlags". But "RegexHelper::StringReplace" calls the replace function without...

OpenText Documentum Content Server - Arbitrary File Download

OpenText Documentum Content Server - Arbitrary File Download !/usr/bin/env python Opentext Documentum Content Server formerly known as EMC Documentum Content Server contains following design gap, which allows authenticated user to download arbitrary content files regardless attacker's repository...

OpenText Documentum Content Server - Arbitrary File Download Privilege Escalation

!/usr/bin/env python Opentext Documentum Content Server formerly known as EMC Documentum Content Server does not properly validate input of PUTFILE RPC-command which allows any authenticated user to hijack arbitrary file from Content Server filesystem, because some files on Content Server...

Microsoft Edge Chakra JIT - RegexHelper::StringReplace Must Call the Callback Function with Updating ImplicitCallFlags

Microsoft Edge Chakra JIT - RegexHelper::StringReplace Must Call the Callback Function with Updating ImplicitCallFlags / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1334 The "String.prototype.replace" method can be inlined in the JIT process. So in the method, all the calls...

Career Portal 1.0 - SQL Injection

Career Portal 1.0 - SQL Injection Exploit Title: Career Portal v1.0 - SQL Injection Date: 2017-10-17 Exploit Author: 8bitsec Vendor Homepage: https://codecanyon.net/item/career-portal-online-job-search-script/20767278 Software Link:...

OpenText Documentum Content Server - Arbitrary File Download Privilege Escalation

OpenText Documentum Content Server - Arbitrary File Download Privilege Escalation !/usr/bin/env python Opentext Documentum Content Server formerly known as EMC Documentum Content Server does not properly validate input of PUTFILE RPC-command which allows any authenticated user to hijack arbitrary...

Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability(CVE-2017-11799)

Bailout: "ChakraCore’s background JIT compiler generates highly optimized JIT’ed code based upon the data and infers likely usage patterns based on the profile data collected by the interpreter. Given the dynamic nature of JavaScript code, if the code gets executed in a way that breaks the profil...

Microsoft Edge Chakra JIT - 'RegexHelper::StringReplace' Must Call the Callback Function with Updating ImplicitCallFlags

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1334 The "String.prototype.replace" method can be inlined in the JIT process. So in the method, all the calls which may break the JIT assumptions must be invoked with updating "ImplicitCallFlags". But "RegexHelper::StringReplace"...

Opentext Documentum Content Server Privilege Escalation Exploit

Opentext Documentum Content Server formerly known as EMC Documentum Content Server contains a design gap that allows any authenticated user the ability to replace content of security-sensitive dmrcontent objects for example, dmrcontent related to dmmethod objects and gain superuser privileges...

Opentext Documentum Content Server File Download Exploit

Opentext Documentum Content Server formerly known as EMC Documentum Content Server contains a design gap that allows authenticated user to download arbitrary content files regardless of the attacker's repository permissions. !/usr/bin/env python Opentext Documentum Content Server formerly known a...