Cisco AnyConnect Secure Mobility Client 4.3.04027 - Local Privilege Escalation

Exploit Title: Cisco AnyConnect Start Before Logon SBL local privilege escalation. CVE-2017-3813 Date: 02/27/2017 Exploit Author: @Pcchillin Software Link: http://www.cisco.com/c/en/us/support/security/anyconnect-secure-mobility-client/tsd-products-support-series-home.html Version: 4.3.04027 and...

Netgear DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery

Exploit Title: NETGEAR Firmware DGN2200v1/v2/v3/v4 CSRF which leads to RCE through CVE-2017-6334 Date: 2017-02-28 Exploit Author: SivertPL Vendor Homepage: http://netgear.com/ Software Link:...

BlueIris 4.5.1.4 - Denial of Service

import socket Title: BlueIris - Denial of Service Date: 2017-02-28 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: http://blueirissoftware.com/blueiris.exe Version: 4.5.1.4 Tested on: Windows Server 2008 R2 Standard x64 Start this fake FTP server and crea...

SysGauge 1.5.18 - Remote Buffer Overflow

Exploit Title: SysGauge 1.5.18 – buffer overflow in SMTP connection verification function leads to code execution Date: 2017-02-28 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: http://www.sysgauge.com/setups/sysgaugesetupv1.5.18.exe Version: 1.5.18 Test...

Joomla! Component OneVote! 1.0 - SQL Injection

Exploit Title: Joomla! Component OneVote! v1.0 - SQL Injection Google Dork: inurl:index.php?option=comonevote Date: 27.02.2017 Vendor Homepage: http://advcomsys.com/ Software: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/polls/onevote/ Demo:...

WePresent WiPG-1500 - Backdoor Account

Exploit Title: CVE-2017-6351 - WePresent undocumented privileged manufacturer backdoor account Date: 27/02/2017 Exploit Author: Quentin Olagne Vendor Homepage: http://www.wepresentwifi.com/ or http://www.awindinc.com/productswepresentwipg1500.html Software Link:...

MVPower DVR TV-7104HE 1.8.4 115215B9 - Shell Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule /JAWS/1.0/ def initializeinfo = superupdateinfoinfo, 'Name' = 'MVPower DVR Shell Unauthenticated Command Execution', 'Description' = %q This module...

Windows x86 - Executable Directory Search Shellcode (130 bytes)

Windows x86 - Executable Directory Search Shellcode 130 bytes. Shellcode exploit for Winx86 platform Title: Windows x86 - Executable directory search Shellcode 130 bytes Date: 26-02-2017 Author: Krzysztof Przybylski Platform: Winx86 Tested on: WinXP SP1 Shellcode Size: 130 bytes / Description:...

Linux/x86_64 - Random Listener Shellcode (54 bytes)

Linux/x8664 - Random Listener Shellcode 54 bytes. Shellcode exploit for Linx86-64 platform ;The MIT License MIT ;Copyright c 2017 Robert L. Taylor ;Permission is hereby granted, free of charge, to any person obtaining a ;copy of this software and associated documentation files the “Software”, ;to...

Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free Privilege Escalation

// // EDB Note: More information http://seclists.org/oss-sec/2017/q1/471 // // A proof-of-concept local root exploit for CVE-2017-6074. // Includes a semireliable SMAP/SMEP bypass. // Tested on 4.4.0-62-generic 83-Ubuntu kernel. // https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-607...

Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free (PoC)

// // EDB Note: More information http://seclists.org/oss-sec/2017/q1/471 // // A trigger for CVE-2017-6074, crashes kernel. // Tested on 4.4.0-62-generic 83-Ubuntu kernel. // https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-6074 // // Andrey Konovalov define GNUSOURCE include include...

Netgear DGN2200v1/v2/v3/v4 - 'dnslookup.cgi' Remote Command Execution

!/usr/bin/python Provides access to default user account, privileges can be easily elevated by using either: - a kernel exploit ex. memodipper was tested and it worked - by executing /bin/bd suid backdoor present on SOME but not all versions - by manipulating the httpd config files to trick the...

Joomla! Component Intranet Attendance Track 2.6.5 - SQL Injection

Exploit Title: Joomla! Component Intranet Attendance Track v2.6.5 - SQL Injection Google Dork: inurl:index.php?option=comintranet Date: 25.02.2017 Vendor Homepage: http://thagatpam.in/ Software Buy:...

Joomla! Component Spinner 360 1.3.0 - SQL Injection

Exploit Title: Joomla! Component Spinner 360 v1.3.0 - SQL Injection Google Dork: N/A Date: 25.02.2017 Vendor Homepage: https://www.cmsplugin.com/ Software : https://www.cmsplugin.com/products/components/13-spinner360 Demo: http://extensions.cmsplugin.com/extensions/j3demo/spinner-360 Version: 1.3...

Joomla! Component JomSocial - SQL Injection

Exploit Title: Joomla! Component JomSocial - SQL Injection Google Dork: N/A Date: 25.02.2017 Vendor Homepage: https://www.cmsplugin.com/ Software : http://extensions.cmsplugin.com/extensions/j3demo/jomsocial Demo: http://extensions.cmsplugin.com/extensions/j3demo/jomsocial Version: N/A Tested on:...

Joomla! Component Appointments for JomSocial 3.8.1 - SQL Injection

Exploit Title: Joomla! Component Appointments for JomSocial v3.8.1 - SQL Injection Google Dork: N/A Date: 25.02.2017 Vendor Homepage: https://www.cmsplugin.com/ Software : https://www.cmsplugin.com/products/components/1-appointments-for-jomsocial Demo:...

Joomla! Component My MSG 3.2.1 - SQL Injection

Exploit Title: Joomla! Component My MSG v3.2.1 - SQL Injection Google Dork: N/A Date: 25.02.2017 Vendor Homepage: https://www.cmsplugin.com/ Software : https://www.cmsplugin.com/products/components/10-my-msg Demo: http://extensions.cmsplugin.com/extensions/j3demo/my-msg Version: 3.2.1 Tested on:...

Joomla! Component Gnosis 1.1.2 - 'id' SQL Injection

Exploit Title: Joomla! Component Gnosis v1.1.2 - SQL Injection Google Dork: inurl:index.php?option=comgnosis Date: 25.02.2017 Vendor Homepage: http://hypermodern.org/ Software : https://extensions.joomla.org/extensions/extension/directory-a-documentation/glossary/gnosis/ Demo:...

Joomla! Component JO Facebook Gallery 4.5 - SQL Injection

Exploit Title: Joomla! Component JO Facebook Gallery v4.5 - SQL Injection Google Dork: inurl:index.php?option=comjofacebookgallery Date: 24.02.2017 Vendor Homepage: http://joomcore.com/joomla32/ Software Buy:...

Joomla! Component Community Surveys 4.3 - SQL Injection

Exploit Title: Joomla! Component Community Surveys v4.3 - SQL Injection Google Dork: inurl:index.php?option=comcommunitysurveys Date: 24.02.2017 Vendor Homepage: http://corejoomla.com/ Software Buy: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/surveys/community-surveys...

memcache-viewer - Cross-Site Scripting

Exploit Title: memcache-viewer - Stored XSS Date: 2017-02-24 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: https://github.com/chrisjameskirkham/memcache-viewer Software Link: https://github.com/chrisjameskirkham/memcache-viewer/archive/master.zip Version: Latest comm...

Apple WebKit 10.0.2 - Cross-Origin or Sandboxed IFRAME Pop-up Blocker Bypass

DOMWindow::openconst String& urlString, const AtomicString& frameName, const String& windowFeaturesString, DOMWindow& activeWindow, DOMWindow& firstWindow ... ---------------- 1 ----------------------- if !firstWindow.allowPopUp tree.findframeName return nullptr;...

Microsoft Edge / Internet Explorer - 'HandleColumnBreakOnColumnSpanningElement' Type Confusion

.class1 float: left; column-count: 5; .class2 column-span: all; columns: 1px; table border-spacing: 0px; function boom document.styleSheets0.media.mediaText = "aaaaaaaaaaaaaaaaaaaa"; th1.align = "right"; !-- Note: The analysis below is based on an 64-bit IE running in single process mode running ...

Apple WebKit 10.0.2 - 'Frame::setDocument' Universal Cross-Site Scripting

&& newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState != Document::InPageCache mdoc-prepareForDestruction; mdoc = newDocument.copyRef; ... Before setting |mdoc| to |newDocument|, it calls |prepareForDestruction| that fires unload event handlers. If we call...

Joomla! Component Community Polls 4.5.0 - SQL Injection

Exploit Title: Joomla! Component Community Polls v4.5.0 - SQL Injection Google Dork: inurl:index.php?option=comcommunitypolls Date: 24.02.2017 Vendor Homepage: http://corejoomla.com/ Software Buy: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/polls/community-polls/ Demo...

Apple WebKit 10.0.2 - 'FrameLoader::clear' Universal Cross-Site Scripting

domWindow; mframe.document-domWindow-resetUnlessSuspendedForDocumentSuspension; mframe.script.clearWindowShellnewDocument-domWindow, mframe.document-pageCacheState == Document::AboutToEnterPageCache; / Apple WebKit: UXSS via FrameLoader::clear When the new page is loading, FrameLoader::clear is...

Joomla! Component JooDatabase 3.1.0 - SQL Injection

Exploit Title: Joomla! Component JooDatabase v3.1.0 - SQL Injection Google Dork: inurl:index.php?option=comjoodb Date: 24.02.2017 Vendor Homepage: https://feenders.de/ Software Buy: https://extensions.joomla.org/extensions/extension/core-enhancements/coding-a-scripts-integration/joodatabase/ Demo...

Joomla! Component Community Quiz 4.3.5 - SQL Injection

Exploit Title: Joomla! Component Community Quiz v4.3.5 - SQL Injection Google Dork: inurl:index.php?option=comcommunityquiz Date: 24.02.2017 Vendor Homepage: http://corejoomla.com/ Software Buy: https://extensions.joomla.org/extensions/extension/living/education-a-culture/community-quiz/ Demo:...

Joomla! Component GPS Tools 4.0.1 - SQL Injection

Exploit Title: Joomla! Component GPS Tools v4.0.1 - SQL Injection Google Dork: inurl:index.php?option=comgpstools Date: 24.02.2017 Vendor Homepage: http://corejoomla.com/ Software Buy: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/gps-tools/ Demo:...

Joomla! Component AJAX Search for K2 2.2 - SQL Injection

Exploit Title: Joomla! Component AJAX Search for K2 v2.2 - SQL Injection Google Dork: inurl:index.php?option=comk2ajaxsearch Date: 24.02.2017 Vendor Homepage: http://taleia.software/ Software Buy:...

Linux/x86-64 - Egghunter Shellcode (38 bytes)

Linux/x86-64 - Egghunter Shellcode 38 bytes. Shellcode exploit for Linux platform / Copyright © 2017 Odzhan. All Rights Reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of...

Apple macOS HelpViewer 10.12.1 - XSS Leads to Arbitrary File Execution / Arbitrary File Read

/ OSX: HelpViewer XSS leads to arbitrary file execution and arbitrary file read. HelpViewer is an application and using WebView to show a help file. You can see it simply by the command: open /Applications/Safari.app/Contents/Resources/Safari.help or using "help:" scheme: help...

NetGain Enterprise Manager 7.2.562 - 'Ping' Command Injection

Exploit Title: NetGain Enterprise Manager – “Ping” Command Injection Date: 23.02.2017 Exploit Author: MrChaZ Vendor Homepage: http://www.netgain-systems.com/ Version: = v7.2.562 build 853 Tested on: Windows 10 Pro 64-bit 10,0 Build 14393 Description:...

Joomla! Component UserExtranet 1.3.1 - SQL Injection

Exploit Title: Joomla! Component UserExtranet v1.3.1 - SQL Injection Google Dork: inurl:index.php?option=comuserextranet Date: 23.02.2017 Vendor Homepage: http://www.beesto.com/ Software Buy: https://extensions.joomla.org/extensions/extension/access-a-security/site-access/userextranet/ Demo:...

Joomla! Component MultiTier 3.1 - SQL Injection

Exploit Title: Joomla! Component MultiTier v3.1 - SQL Injection Google Dork: inurl:index.php?option=commultitier Date: 23.02.2017 Vendor Homepage: http://www.beesto.com/ Software Buy: https://extensions.joomla.org/extensions/extension/ads-a-affiliates/affiliate-systems/multitier/ Demo:...

Joomla! Component Store for K2 3.8.2 - SQL Injection

Exploit Title: Joomla! Component Store for K2 v3.8.2 - SQL Injection Google Dork: inurl:index.php?option=comk2store Date: 23.02.2017 Vendor Homepage: http://jworkplace.com/ Software Buy: https://extensions.joomla.org/extensions/extension/extension-specific/k2-extensions/store-for-k2/ Demo:...

Fibaro Home Center 2 - Remote Command Execution / Privilege Escalation

!/usr/bin/python import requests import argparse import urllib import base64 import tarfile import os parser = argparse.ArgumentParserdescription='Fibaro RCE' parser.addargument'--rhost' parser.addargument'--lhost' parser.addargument'--lport' args = parser.parseargs f = open'run.sh', 'w'...

D-Link DCS Series Cameras - Insecure Crossdomain

Exploit Title: Insecure CrossDomain.XML in D-Link DCS Series Cameras Date: 22/02/2017 Exploit Author: SlidingWindow , Twitter: @KapilKhot Vendor Homepage: http://us.dlink.com/product-category/home-solutions/view/network-cameras/ Version: Tested on DCS-933L with firmware version 1.03. Other...

Teradici Management Console 2.2.0 - Privilege Escalation

Exploit Title: Teradici Management Console 2.2.0 - Web Shell Upload and Privilege Escalation Date: February 22nd, 2017 Exploit Author: hantwister Vendor Homepage: http://www.teradici.com/products-and-solutions/pcoip-products/management-console Software Link:...

Joomla! Component VehicleManager 3.9 - SQL Injection

Exploit Title: Joomla! Component VehicleManager v3.9 - SQL Injection Google Dork: inurl:index.php?option=comvehiclemanager Date: 22.02.2017 Vendor Homepage: http://ordasoft.com/ Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/vehicles/vehiclemanager-basic/ Demo:...

EasyCom For PHP 4.0.0 - Buffer Overflow (PoC)

Credits: John Page AKA Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EASYCOM-PHP-API-BUFFER-OVERFLOW.txt + ISR: ApparitionSec Vendor: ================ easycom-aura.com Product: =========================== EASYCOM AS400 iBMI PHP API...

Disk Savvy Enterprise 9.4.18 - Remote Buffer Overflow (SEH)

Exploit Title: DiskSavvy Enterprise 9.4.18 - Remote buffer overflow - SEH overwrite with WoW64 egghunters Date: 2017-02-22 Exploit Author: Peter Baris Vendor Homepage: www.saptech-erp.com.au Software Link: http://www.disksavvy.com/downloads.html Version: 9.4.18 Tested on: Windows 7 Pro SP1 x64...

Joomla! Component BookLibrary 3.6.1 - SQL Injection

Exploit Title: Joomla! Component BookLibrary v3.6.1 - SQL Injection Google Dork: inurl:index.php?option=combooklibrary Date: 22.02.2017 Vendor Homepage: http://ordasoft.com/ Software Buy: https://extensions.joomla.org/extensions/extension/living/education-a-culture/booklibrary-basic/ Demo:...

Google Chrome - 'layout' Out-of-Bounds Read

content contain: size layout; function leak document.execCommand"selectAll"; opt.text = ""; aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa...

Joomla! Component MediaLibrary Basic 3.5 - SQL Injection

Exploit Title: Joomla! Component MediaLibrary Basic v3.5 - SQL Injection Google Dork: inurl:index.php?option=combooklibrary Date: 22.02.2017 Vendor Homepage: http://ordasoft.com/ Software Buy: https://extensions.joomla.org/extensions/extension/living/education-a-culture/medialibrary-basic/ Demo:...

Joomla! Component RealEstateManager 3.9 - SQL Injection

Exploit Title: Joomla! Component RealEstateManager v3.9 - SQL Injection Google Dork: inurl:index.php?option=comrealestatemanager Date: 22.02.2017 Vendor Homepage: http://ordasoft.com/ Software Buy:...

Joomla! Component ContentMap 1.3.8 - 'contentid' SQL Injection

Exploit Title: Joomla! Component ContentMap v1.3.8 - SQL Injection Google Dork: inurl:index.php?option=comcontentmap Date: 22.02.2017 Vendor Homepage: https://www.turismo.eu/ Software Buy: https://extensions.joomla.org/extensions/extension/maps-a-weather/geotagging/contentmap/ Demo:...

EasyCom For PHP 4.0.0 - Denial of Service

Credits: John Page AKA Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EASYCOM-SQL-IPLUG-DENIAL-OF-SERVICE.txt + ISR: ApparitionSec Vendor: ================ easycom-aura.com Product: =========== SQL iPlug EasycomPHP4.0029.iC8im2.exe SQL iPlug...

DIGISOL DG-HR1400 Wireless Router - Cross-Site Request Forgery

Digisol Router CSRF Exploit - Indrajith A.N history.pushState'', '', '/' input type="hidden"...

ProjectSend r754 - Insecure Direct Object Reference

Document Title: =============== ProjectSend r754 - IDOR & Authentication Bypass Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2031 Release Date: ============= 2017-02-21 Vulnerability Laboratory ID VL-ID:...