SockPuppet: A Walkthrough of a Kernel Exploit for iOS 12.4

Posted by Ned Williamson, 20% on Project Zero Introduction I have a somewhat unique opportunity in this writeup to highlight my experience as an iOS research newcomer. Many high quality iOS kernel exploitation writeups have been published, but those often feature weaker initial primitives combine...

CVE-2018-20090

An issue was discovered in Cloudera Data Science Workbench CDSW 1.4.0 through 1.4.2. Authenticated users can bypass project permission checks and gain read-write access to any project folder...

CVE-2018-20090

An issue was discovered in Cloudera Data Science Workbench CDSW 1.4.0 through 1.4.2. Authenticated users can bypass project permission checks and gain read-write access to any project folder...

CVE-2019-15803

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fdssyspassDebugPasswdret. The...

Protect

Multiple integer overflow and out of bounds read/write vulnerabilities in the SSL VPN web-mode SSH client may allow an unauthenticated attacker to cause the SSL VPN user session to break Denial of service and possibly to run arbitrary code via specially crafted packets sent from a malicious SSH...

CVE-2019-3014

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Performance Monitor. Supported versions that are affected are 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2017-7184

Out-of-bounds kernel heap access vulnerability was found in xfrm, kernel's IP framework for transforming packets. An error dealing with netlink messages from an unprivileged user leads to arbitrary read/write and privilege escalation...

VulnCheck KEV: CVE-2016-5198

Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not...

dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass

A flaw was found in dbus. The implementation of DBUSCOOKIESHA1 is susceptible to a symbolic link attack. A malicious client with write access to its own home directory could manipulate a /.dbus-keyrings symlink to cause the DBusServer to read and write in unintended locations resulting in an...

In-depth exploration found in the wild iOS exploit chain VI-vulnerability warning-the black bar safety net

In this article, we will Analysis on your iOS device to get the normal permissions of the shell of the WebKit exploit method, where all the vulnerabilities are available on iOS's sandboxed renderer process WebContent implemented shellcode code execution. Although on iOS Chrome will also be affect...

CVE-2019-11496

In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including "default" were changed to only allow access by authenticated users with sufficient...

DEBIAN-CVE-2019-16137

An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion...

JSC Exploits

Posted by Samuel Groß, Project Zero In this post, we will take a look at the WebKit exploits used to gain an initial foothold onto the iOS device and stage the privilege escalation exploits. All exploits here achieve shellcode execution inside the sandboxed renderer process WebContent on iOS...

DEBIAN-CVE-2017-18552

An issue was discovered in net/rds/afrds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rdsrecvtracklatency...

The vulnerability of the FortiOS operating system, related to access control errors, allows a perpetrator to read and write data in the memory loading sector.

The vulnerability of the FortiOS operating system is related to access control errors. Exploiting this vulnerability allows a person with administrator privileges to read and write data in the memory load sector...

VMware Workstation 14.0.x < 14.1.6 / 15.0.x < 15.0.3 Pixel Shader out-of-bounds read/write vulnerabilities (VMSA-2019-0012)

The version of VMware Workstation installed on the remote Windows host is 14.0.x prior to 14.1.6 or 15.0.x prior to 15.0.3. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported versi...

Remote code execution

Huawei PCManager with the versions before 9.0.1.66 Oversea and versions before 9.0.1.70 China have a code execution vulnerability. Successful exploitation may cause the attacker to execute code and read/write information...

QEMU: scsi-generic: possible OOB access while handling inquiry request

In QEMU 3.1, scsihandleinquiryreply in hw/scsi/scsi-generic.c allows out-of-bounds write and read operations...

CVE-2017-18446

cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API SEC-250...

KLA12118 Multiple vulnerabilities in VMware Workstation and Player

Out-of-bounds read/write vulnerabilities were found in VMware Workstation and Player. Malicious users can exploit this vulnerability to obtain sensitive information, cause denial of service. Original advisories VMSA-2019-0012 Related products VMware-Workstation VMware-Player CVE list CVE-2019-568...