41207 matches found
ASANSUID - Local Privilege Escalation
ASANSUID - Local Privilege Escalation !/bin/bash unsanitary.sh - ASAN/SUID Local Root Exploit Exploits er, unsanitized env var passing in ASAN which leads to file clobbering as root when executing setuid root binaries compiled with ASAN. Uses an overwrite of /etc/ld.so.preload to get root on a...
Local Server 1.0.9 - Denial of Service (PoC)
Local Server 1.0.9 - Denial of Service PoC Exploit Title: Local Server 1.0.9 - Denial of Service PoC Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.ujang-rohidin.blogspot.com/ Software Link: https://sourceforge.net/projects/local-server/files/latest/download...
Microsoft SQL Server Management Studio 17.9 - .xmla XML External Entity Injection
Microsoft SQL Server Management Studio 17.9 - .xmla XML External Entity Injection Exploit Title: Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection Date: 2018-10-10 Author: John Page aka hyp3rlinx Website: hyp3rlinx.altervista.org Venodor: www.microsoft.com...
WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free
WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free ::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try...
Joomla! Component Jobs Factory 2.0.4 - SQL Injection
Joomla! Component Jobs Factory 2.0.4 - SQL Injection Exploit Title: Joomla! Component Jobs Factory 2.0.4 - SQL Injection Dork: N/A Date: 2018-09-24 Vendor Homepage: https://thephpfactory.com/ Software Link:...
Navigate CMS 2.8 - Cross-Site Scripting
Navigate CMS 2.8 - Cross-Site Scripting Title: Navigate CMS 2.8 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-09-19 Vendor: https://www.navigatecms.com/en/home Software: Navigate CMS 2.8 CVE: CVE-2018-17255 Technical Details & Description: A Reflected Cross-Site Scripting web...
XAMPP Control Panel 3.2.2 - Denial of Service (PoC)
XAMPP Control Panel 3.2.2 - Denial of Service PoC Exploit Title: XAMPP Control Panel 3.2.2 - Denial of Service PoC Exploit Author: Gionathan "John" Reale Date: 2018-09-14 Software: XAMPP Version: 3.2.2 / 7.2.9 Newest version at time of writing Download:...
Geutebrueck re_porter 16 - Cross-Site Scripting
Geutebrueck reporter 16 - Cross-Site Scripting Exploit Title: Geutebrueck reporter 16 - Cross-Site Scripting Date: 2018-08-03 Exploit Author: Kamil Suska Vendor: https://www.geutebrueck.com/enUS.html Link: https://www.sourcesecurity.com/geutebruck-re-porter-16-technical-details.html Version: prio...
GetGo Download Manager 6.2.1.3200 - Denial of Service (PoC)
GetGo Download Manager 6.2.1.3200 - Denial of Service PoC Exploit Title: GetGo Download Manager 6.2.1.3200 - Buffer Overflow Denial of Service Date: 2018-07-25 Exploit Author: Nathu Nandwani Website: http://nandtech.co CVE: CVE-2017-17849 Tested On: Windows 7 x86, Windows 10 x64 Details The...
Microsoft Windows - dnslint.exe Drive-By Download
Microsoft Windows - dnslint.exe Drive-By Download + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-DNSLINT.EXE-FORCED-DRIVE-BY-DOWNLOAD.txt + ISR: Apparition Security Greetz: indoushka | Eduardo Vendor...
FTP2FTP 1.0 - Arbitrary File Download
FTP2FTP 1.0 - Arbitrary File Download Exploit Title: FTP2FTP 1.0 - Arbitrary File Download Dork: N/A Date: 18.07.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395 Version: 1.0 Category: Webapps...
VideoInsight WebClient 5 - SQL Injection
VideoInsight WebClient 5 - SQL Injection Title: VideoInsight WebClient 5 - SQL Injection Date: 2018-05-06 Author: vosec Vendor Homepage: https://www.security.us.panasonic.com/ Software Link: https://www.security.us.panasonic.com/video-management-software/web-client/ Version: 5 Tested on: Windows...
Splunk 7.0.1 - Information Disclosure
Splunk 7.0.1 - Information Disclosure Exploit Title: Splunk 7.0.1 - Information Disclosure Date: 2018-05-23 Exploit Author: KoF2002 Vendor Homepage: https://www.splunk.com/ Version: 6.2.3 - 7.01 MAYBE ALL VERSION AFFECTED Tested on: Linux OS CVE : CVE-2018-11409 Splunk through 6.2.3 7.0.1 allows...
EMS Master Calendar 8.0.0.20180520 - Cross-Site Scripting
EMS Master Calendar 8.0.0.20180520 - Cross-Site Scripting Exploit Title: EMS Master Calendar alert'XSS'xyz...
Cobub Razor 0.8.0 - Physical Path Leakage
Cobub Razor 0.8.0 - Physical Path Leakage Exploit Title: Cobub Razor 0.8.0 Physical path Leakage Vulnerability Date: 2018-04-19 Exploit Author: Kyhvedn Vendor Homepage: http://www.cobub.com/ Software Link: https://github.com/cobub/razor Version: 0.8.0 CVE : CVE-2018-8770 PoC: URL:...
Joomla! Component JS Jobs 1.2.0 - Cross-Site Request Forgery
Joomla! Component JS Jobs 1.2.0 - Cross-Site Request Forgery Exploit Title: Joomla! Component Js Jobs - Multiple Cross Site Request Forgery Vulnerabilities Google Dork: N/A Date: 17-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage:...
Microsoft Edge - OpenProcess() ACG Bypass
Microsoft Edge - OpenProcess ACG Bypass Each Edge Content process MicrosoftEdgeCP.exe needs to call SetProcessMitigationPolicy on itself to enable ACG. The callstack when this happens is: 00 KERNELBASE!SetProcessMitigationPolicy 01 MicrosoftEdgeCP!SetProcessDynamicCodePolicy+0xc0 02...
Sophos Endpoint Protection 10.7 - Tamper-Protection Bypass
Sophos Endpoint Protection 10.7 - Tamper-Protection Bypass + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SOPHOS-ENDPOINT-PROTECTION-v10.7-TAMPER-PROTECTION-BYPASS-CVE-2018-4863.txt + ISR: Apparition Security Vendor:...
Vitek - Remote Command Execution Information Disclosure (PoC)
Vitek - Remote Command Execution Information Disclosure PoC STX Subject: Vitek RCE and Information Disclosure and possible other OEM Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis December 2017 PoC: https://github.com/mcw0/PoC Release date: December 22,...
Multiple OEM - nsd Remote Stack Format String (PoC)
Multiple OEM - nsd Remote Stack Format String PoC STX Subject: Remote Stack Format String in 'nsd' binary from multiple OEM Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis December 2017 PoC: https://github.com/mcw0/PoC Release date: December 14, 2017 Full...
TP-Link TL-MR3220 - Cross-Site Scripting
TP-Link TL-MR3220 - Cross-Site Scripting Exploit Title: Vulnerability Xss - TP-LINK TL-MR3220 Date: 12/10/2017 Exploit Author: Thiago "THX" Sena Vendor Homepage: http://www.tp-link.com.br Version: TL-MR3220 Tested on: Windows 10 CVE : CVE-2017-15291 Vulnerabilty: Cross-site scripting XSS in TP-LI...
FortiOS 5.6.0 - Cross-Site Scripting
FortiOS 5.6.0 - Cross-Site Scripting Title: FortiOS = 5.6.0 Multiple XSS Vulnerabilities Vendor: Fortinet www.fortinet.com CVE: CVE-2017-3131, CVE-2017-3132, CVE-2017-3133 Date: 28.07.2016 Author: Patryk Bogdan @patrykbogdan Affected FortiNet products: CVE-2017-3131 : FortiOS versions 5.4.0 to...
Pelco SarixSpectra Cameras - Remote Code Execution
Pelco SarixSpectra Cameras - Remote Code Execution Schneider Electric Pelco Sarix/Spectra Cameras Root Remote Code Execution Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: Sarix Enhanced - Model: IME219 Firmware: 2.1.2.0.8280-A0.0 Sarix Enhanced - Model:...
Nuevomailer 6.0 - SQL Injection
Nuevomailer 6.0 - SQL Injection Exploit Title: Nuevo mailer version = 6.0 SQL Injection Exploit Author: ALEH BOITSAU Google Dork: inurl:/inc/rdr.php? Date: 2017-06-09 Vendor Homepage: https://www.nuevomailer.com/ Version: 6.0 and below Tested on: Linux Vulnerable script: rdr.php Vulnerable...
Microsoft-Windows---'SrvOs2FeaToNt'-SMB-Remote-Code-Execution-(MS17-010)-
Description: SMBv1 SrvOs2FeaToNt OOB is prone to a remote code execution vulnerability because the application fails to perform adequate boundary-checks on user-supplied input. Srv.sys process SrvOs2FeaListSizeToNt and when the logic is not correct it leads to a cross-border copy. The vulnerabili...
Billion TrueOnline ZyXEL Routers - Multiple Vulnerabilities
Billion TrueOnline ZyXEL Routers - Multiple Vulnerabilities Multiple vulnerabilities in TrueOnline / ZyXEL / Billion routers Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 26/12/2016 /...
Palo Alto Networks Terminal Services Agent 7.0.3-13 - Integer Overflow
Palo Alto Networks Terminal Services Agent 7.0.3-13 - Integer Overflow / Exploit Title - Palo Alto Networks Terminal Services Agent Integer Overflow Date - 26th January 2017 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - https://www.paloaltonetworks.com/ Tested Version - 7.0.3-13 Drive...
Apple macOS 10.12.1 iOS 10.2 - powerd Arbitrary Port Replacement
Apple macOS 10.12.1 iOS 10.2 - powerd Arbitrary Port Replacement / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=976 powerd running as root hosts the com.apple.PowerManagement.control mach service. It checks in with launchd to get a server port and then wraps that in a CFPort:...
Microsoft Windows 10 (x86x64) - WLAN AutoConfig Denial of Service (PoC)
Microsoft Windows 10 x86x64 - WLAN AutoConfig Denial of Service PoC !/usr/bin/python wlanautoconfig-poc.py Windows WLAN AutoConfig Named Pipe POC Jeremy Brown jbrown3264/gmail Dec 2016 wifinetworkmanager.dll!FatalErrorchar const ,unsigned long,char const , ... AsyncPipe::ReadCompletedCallbackvoid...
Huawei UTPS - Unquoted Service Path Privilege Escalation
Huawei UTPS - Unquoted Service Path Privilege Escalation Exploit Title: Unquoted Service Path Vulnerability in Huawei UTPS Software Date: Nov 16 2016 Author: Dhruv Shah @Snypter Website: http://security-geek.in Contact: [email protected] Category: local Vendor Homepage: http://www.huawei.com/...
Microsoft Internet Explorer 11109 - MSHTML PROPERTYDESC::HandleStyleComponentProperty Out-of-Bounds Read (MS16-104)
Microsoft Internet Explorer 11109 - MSHTML PROPERTYDESC::HandleStyleComponentProperty Out-of-Bounds Read MS16-104 // This PoC attempts to exploit a memory disclosure bug in Microsoft Internet // Explorer 11. On x64 systems, this should cause an access violation when // run with page-heap...
Microsoft Windows EdgeInternet Explorer - Isolated Private Namespace Insecure DACL Privilege Escalation (MS16-118)
Microsoft Windows EdgeInternet Explorer - Isolated Private Namespace Insecure DACL Privilege Escalation MS16-118 / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=879 Windows: Edge/IE Isolated Private Namespace Insecure DACL EoP Platform: Windows 10 10586, Edge 25.10586.0.0 not...
IObit Malware Fighter 4.3.1 - Unquoted Service Path Privilege Escalation
IObit Malware Fighter 4.3.1 - Unquoted Service Path Privilege Escalation Exploit Title: IObit Malware Fighter Unquoted Service Path Privilege Escalation Date: 12/10/2016 Author: Amir.ght Vendor Homepage: http://www.iobit.com/en/index.php Software Link:...
Subversion 1.6.61.6.12 - Code Execution
Subversion 1.6.61.6.12 - Code Execution This is an exploit for the subversion vulnerability published as CVE-2013-2088. Author: GlacierZ0ne [email protected] Exploit Type: Code Execution Access Type: Authenticated Remote Exploit Prerequisites: svn command line client available, subversion serv...
EyeLock nano NXT 3.5 - Remote Code Execution
EyeLock nano NXT 3.5 - Remote Code Execution !/usr/bin/env python EyeLock nano NXT 3.5 Remote Root Exploit Vendor: EyeLock, LLC Product web page: http://www.eyelock.com Affected version: NXT Firmware: 3.05.1193 ICM: 3.5.1 NXT Firmware: 3.04.1108 ICM: 3.4.13 NXT Firmware: 3.03.944 ICM: 3.3.2 NXT...
Ubee EVW3226 ModemRouter 1.0.20 - Multiple Vulnerabilities
Ubee EVW3226 ModemRouter 1.0.20 - Multiple Vulnerabilities ''' Ubee EVW3226 modem/router multiple vulnerabilities -------------------------------------------------- Platforms / Firmware confirmed affected: - Ubee EVW3226, 1.0.20 - Product page: http://www.ubeeinteractive.com/products/cable/evw322...
PowerFolder Server 10.4.321 - Remote Code Execution
PowerFolder Server 10.4.321 - Remote Code Execution Mogwai Security Advisory MSA-2016-01 ---------------------------------------------------------------------- Title: PowerFolder Remote Code Execution Vulnerability Product: PowerFolder Server Affected versions: 10.4.321 Linux/Windows Other versio...
ASUS Memory Mapping Driver (ASMMAPASMMAP64) - Physical Memory ReadWrite
ASUS Memory Mapping Driver ASMMAPASMMAP64 - Physical Memory ReadWrite / Source: http://rol.im/asux/ ASUS Memory Mapping Driver ASMMAP/ASMMAP64: Physical Memory Read/Write PoC by slipstream/RoL - https://twitter.com/TheWack0lian - http://rol.im/chat/ The ASUS "Generic Function Service" includes a...
Trend Micro Deep Discovery Inspector 3.83.7 - Cross-Site Request Forgery
Trend Micro Deep Discovery Inspector 3.83.7 - Cross-Site Request Forgery + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-DDI-CSRF.txt Vendor: ==================== www.trendmicro.com Product:...
iTop 2.2.1 - Cross-Site Request Forgery
iTop 2.2.1 - Cross-Site Request Forgery Advisory ID: HTB23293 Product: iTop Vendor: Combodo Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Advisory Publication: February 10, 2016 without technical details Vendor Notification: February 10, 2016 Vendor Patch: February 11, 2016...
TeamPass 2.1.24 - Multiple Vulnerabilities
TeamPass 2.1.24 - Multiple Vulnerabilities Affected Product: TeamPass Vulnerability Type: Multiple XSS,CSRF, SQL injections Fixed in Version: 2.1.25 https://github.com/nilsteampassnet/TeamPass/releases/tag/2.1.25.0 Vendor Website: http://www.teampass.net Software Link: :...
Ovidentia bulletindoc Module 2.9 - Multiple Remote File Inclusions
Ovidentia bulletindoc Module 2.9 - Multiple Remote File Inclusions Title: Ovidentia Module bulletindoc 2.9 Multiple Remote File Inclusion Vulnerabilities Author: bd0rk eMail: bd0rkathackermail.com Twitter: twitter.com/bd0rk Tested on: Ubuntu-Linux Download:...
D-Link DIR-866L - Multiple Buffer Overflow Vulnerabilities
D-Link DIR-866L - Multiple Buffer Overflow Vulnerabilities Advisory Information Title: DIR-866L Buffer overflows in HNAP and send email functionalities Vendors contacted: William Brown , Patrick Cline [email protected] CVE: None Note: All these security issues have been discussed with...
D-Link DIR-818W - Multiple Vulnerabilities
D-Link DIR-818W - Multiple Vulnerabilities Advisory Information Title: DIR-818W Buffer overflows and Command injection in authentication and HNAP functionalities Vendors contacted: William Brown , Patrick Cline [email protected] CVE: None Note: All these security issues have been...
TECO SG2 FBD Client 3.51 - .gfb Overwrite Buffer Overflow (SEH) (PoC)
TECO SG2 FBD Client 3.51 - .gfb Overwrite Buffer Overflow SEH PoC TECO SG2 FBD Client 3.51 SEH Overwrite Buffer Overflow Vulnerability Vendor: TECO Electric and Machinery Co., Ltd. Product web page: http://www.teco-group.eu Download: http://globalsa.teco.com.tw/supportdownload.aspx?KindID=9...
h5ai 0.25.0 - Unrestricted Arbitrary File Upload
h5ai 0.25.0 - Unrestricted Arbitrary File Upload !/usr/bin/env python Exploit Title: h5ai 0.25.0 Unrestricted File Upload Date: 21 September 2015 Exploit Author: rTheory Vendor Homepage: https://larsjung.de/h5ai/ Vulnerable Software Link:...
Netsweeper 4.0.8 - SQL Injection Authentication Bypass
Netsweeper 4.0.8 - SQL Injection Authentication Bypass +----------------------------------------------------------------+ + Netsweeper 4.0.8 - SQL Injection Authentication Bypass Admin + +----------------------------------------------------------------+ Affected Product: Netsweeper Vendor Homepag...
4 TOTOLINK Router Models - Cross-Site Request Forgery Cross-Site Scripting
4 TOTOLINK Router Models - Cross-Site Request Forgery Cross-Site Scripting Advisory Information Title: 4 TOTOLINK router models vulnerable to CSRF and XSS attacks Advisory URL: https://pierrekim.github.io/advisories/2015-totolink-0x01.txt Blog URL:...
Havij - OLE Automation Array Remote Code Execution
Havij - OLE Automation Array Remote Code Execution !/usr/bin/php ?php Title : Havij OLE Automation Array Remote Code Execution Affected Versions: All Version Founder : ITSecTeam Tested on Windows 7 / Server 2008 Author : Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail ...
Adobe Flash Player - Arbitrary Code Execution
Adobe Flash Player - Arbitrary Code Execution Source: https://github.com/SecurityObscurity/cve-2015-0313 PoC: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/36491.zip Adobe Flash vulnerability source code cve-2015-0313 from Angler Exploit Kit Reference:...