OrientDB 2.2.x Remote Code Execution

This module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands. All versions from 2.2.2 up to 2.2.22 should be vulnerable. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

WMI Event Subscription Persistence Exploit

This Metasploit module will create a permanent WMI event subscription to achieve file-less persistence using one of five methods. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell'...

The vulnerability of the Android operating system allows a hacker to trigger other errors, which can lead to service failure.

The vulnerability of the Android operating system is caused by a numerical overflow. Exploiting this vulnerability can allow a remote attacker to trigger other errors, which may lead to service failure...

CVE-2017-9675

On D-Link DIR-605L devices, firmware before 2.08UIBetaB01.bin allows an unauthenticated GET request to trigger a reboot...

Windows 10 the next MS16-098 RGNOBJ integer overflow vulnerability analysis and exploit-vulnerability warning-the black bar safety net

This article with reference to , the text talked about the Windows Kernel Pool Feng Shui, SetBitmapBits/GetBitmapBits to any address read and write, etc. the use of Means, and very helpful in learning the Windows kernel exploits. Test environment: Windows 10 1511 x64 Professional Edition2016.04 2...

The vulnerability of the Input Manager Service in the Android operating system allows a hacker to trigger a temporary service failure, necessitating the correction of user settings.

The vulnerability of the Input Manager Service in the Android operating system is related to access control deficiencies. Exploiting this vulnerability can allow a malicious actor to cause temporary service interruptions, necessitating the resetting of user settings to correct the issue...

Updated openvpn packages fix security vulnerability

It was discovered that OpenVPN improperly triggered an assert when receiving an oversized control packet in some situations. A remote attacker could use this to cause a denial of service server or client crash CVE-2017-7478. It was discovered that OpenVPN improperly triggered an assert when packe...

CVE-2017-9264

In lib/conntrack.c in the firewall implementation in Open vSwitch OvS 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions extractl3ipv6, extractl4tcp, and extractl4udp that can be triggered remotely...

Design/Logic Flaw

In lib/conntrack.c in the firewall implementation in Open vSwitch OvS 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions extractl3ipv6, extractl4tcp, and extractl4udp that can be triggered remotely...

CVE-2017-9264

In lib/conntrack.c in the firewall implementation in Open vSwitch OvS 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions extractl3ipv6, extractl4tcp, and extractl4udp that can be triggered remotely...

CVE-2017-9033

Cross-site request forgery CSRF vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoptionset.cgi, related to the...

CVE-2017-2823

A use-after-free vulnerability exists in the .ISO parsing functionality of PowerISO 6.8. A specially crafted .ISO file can cause a vulnerability resulting in potential code execution. An attacker can send a specific .ISO file to trigger this vulnerability...

OpenSSL handshake renegotiation process in the presence of the vulnerability can lead to denial of service-vulnerability warning-the black bar safety net

One, Foreword OpenSSL is a very popular General-purpose encryption library, available as a Web authentication service to provide SSL/TLS Protocol Implementation. Recently, there has been found in OpenSSL in the presence of several vulnerabilities. We've written several articles on the analysis of...

Microsoft Windows MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption Exploit

This Metasploit module is a port of the Equation Group ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers. There is a buffer overflow memmove operation in Srv!SrvOs2FeaToNt. The size is calculated in Srv!SrvOs2FeaListSizeToNt, with mathematical error where a DWORD is...

Mozilla: Buffer overflow in WebGL (MFSA 2017-11, MFSA 2017-12)

A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance /opt/TrendMicro/MinorityReport/bin/ Then, all we do is create /engptnstores/prod/sensorSDK/data/si/dlpkill.sh with malicious code and get it executed... Notes: ====== - For this particular PoC, all I did was exec a bind shell using...

shopify-scripts: Null pointer dereferences in kh_copy_mt

@ssarong reported an input that triggers a null pointer dereference: https://github.com/mruby/mruby/pull/3615 The issue was addressed in https://github.com/mruby/mruby/commit/de969942338ac440294eefb2e7846a6975f4efdd...

Phpcms v9 vulnerability analysis-vulnerability warning-the black bar safety net

Recent study the source code and audit-related knowledge, will be grabbed before open source CMS vulnerability research, yesterday accidentally saw this PHPCMS vulnerability, you are ready to Analysis a lot, originally wanted to directly from the source code static analysis, but found itself on t...

Phpcms V9. 6. 0 any file write getshell vulnerability analysis-vulnerability warning-the black bar safety net

1 Introduction: It is said to be one in the underground has been around for half a 0day, which has recently been broke to, in the membership registration page, that this vulnerability without the need to login you can use, or more powerful. 2 vulnerability analysis: Follow up on the registration...

CVE-2016-7467

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider SP connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an...