Adobe Flash TextField.type Setter - Use-After-Free

Adobe Flash TextField.type Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=577 There is a use-after-free in the TextField.type setter. If the type the field is set to is an object with toString defined, the toString function can free the field's...

Adobe Flash MovieClip.attachMovie - Use-After-Free

Adobe Flash MovieClip.attachMovie - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=571 There is a use-after-free in MovieClip.attachMovie. If a string parameter has toString defined, a number parameter has valueOf defined or an object parameter has its...

Ovidentia maillist Module 4.0 - Remote File Inclusion

Ovidentia maillist Module 4.0 - Remote File Inclusion Not for kiddies! Download: http://www.ovidentia.org/index.php?tg=fileman&sAction=getFile&id=17&gr=Y&path=Downloads%2FAdd-ons%2FModules%2Fmaillist&file=maillist-4-0.zip&idf=794 PoC: maillist-4-0/programs/mlincl.php line 4...

Microsoft Windows 8.1 - win32k Local Privilege Escalation (MS15-010)

Microsoft Windows 8.1 - win32k Local Privilege Escalation MS15-010 Exploit Title: MS15-010/CVE-2015-0057 win32k Local Privilege Escalation Date: 2015-12-17 Exploit Author: Jean-Jamil Khalife Software Link: http://www.microsoft.com Version: Windows 8.1 x64 Tested on: Windows 8.1 x64 CVE :...

Adobe Flash TextField.tabIndex Setter - Use-After-Free

Adobe Flash TextField.tabIndex Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=574 There is a use-after-free in the TextField.tabIndex setter. If the integer parameter is an object with valueOf defined, then it can free the TextField's parent,...

Adobe Flash - TextField.Variable Setter Use-After-Free

Adobe Flash - TextField.Variable Setter Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=579 There is a use-after-free in the TextField.variable setter. If the variable name that is added is an object with toString defined, the toString function can free...

Adobe Flash MovieClip.duplicateMovieClip - Use-After-Free

Adobe Flash MovieClip.duplicateMovieClip - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=591 There is a use-after-free in MovieClip.duplicateMovieClip. If the depth or movie name parameter provided is an object with toString or valueOf defined, this...

Adobe Flash MovieClip.localToGlobal - Use-After-Free

Adobe Flash MovieClip.localToGlobal - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=570 There is a use-after-free issue in MovieClip.localToGlobal. If the Number constructor is overwritten with a new constructor and MovieClip.localToGlobal is called wi...

Adobe Flash - TextField Use-After Free

Adobe Flash - TextField Use-After Free Source: https://code.google.com/p/google-security-research/issues/detail?id=583 If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's parent. A...

Adobe Flash Selection.SetSelection - Use-After-Free

Adobe Flash Selection.SetSelection - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=590 There is a use-after-free in Selection.SetSelection. If it is called with a number parameter, which is an object with valueOf defined, and this function frees the...

pfSense 2.2.5 - Directory Traversal

pfSense 2.2.5 - Directory Traversal Title : PFSense 12 1 LFI example Lfi example on step1submitphpaction; /etc/passwd /pfsensewi...

Adobe Flash TextField.setFormat - Use-After-Free

Adobe Flash TextField.setFormat - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=586 The TextField setFormat method contains a use-after-free. If an integer parameter has valueOf defined, or the object parameter overrides a constructor, this method can...

Apache 2.4.17 - Denial of Service

Apache 2.4.17 - Denial of Service Exploit Title: Apache 2.4.17 - Denial of Service Date: 17/12/2015 Exploit Author: rUnVirus Ahmed Atif Vendor Homepage: www.apache.org Software Link: https://www.apachefriends.org/download.html/ Version: 5.5.30 Tested on: windows 7 - XAMPP Version 5.5.30 Apache...

QEMU (Gentoo) - Local Privilege Escalation

QEMU Gentoo - Local Privilege Escalation / == virtfshell == Some distributions make virtfs-proxy-helper from QEMU either SUID or give it CAPCHOWN fs capabilities. This is a terrible idea. While virtfs-proxy-helper makes some sort of flimsy check to make sure its socket path doesn't already exist,...

win32k Desktop and Clipboard - Null Pointer Dereference

win32k Desktop and Clipboard - Null Pointer Dereference Source: https://code.google.com/p/google-security-research/issues/detail?id=534 The attached PoC triggers a null pointer condition on Windows 7 32-bit, which can potentially be exploited on versions of Windows that allow mapping the null pag...

Zen Cart 1.5.4 - Local File Inclusion

Zen Cart 1.5.4 - Local File Inclusion Advisory ID: HTB23282 Product: Zen Cart Vendor: Zen Ventures, LLC Vulnerable Versions: 1.5.4 Tested Version: 1.5.4 Advisory Publication: November 25, 2015 without technical details Vendor Notification: November 25, 2015 Vendor Patch: November 26, 2015 Public...

Adobe Flash MovieClip.lineStyle - Use-After-Frees

Adobe Flash MovieClip.lineStyle - Use-After-Frees Source: https://code.google.com/p/google-security-research/issues/detail?id=558 There are a number of use-after-frees in MovieClip.lineStyle. If any of the String parameters are an object with toString defined, the toString method can delete the...

Microsoft Windows Kernel - win32k!OffsetChildren Null Pointer Dereference

Microsoft Windows Kernel - win32k!OffsetChildren Null Pointer Dereference Source: https://code.google.com/p/google-security-research/issues/detail?id=544 The attached PoC triggers a null pointer vulnerability in OffsetChildren on Windows 7 32-bit. By mapping the null page an attacker can leverage...

Adobe Flash TextField.gridFitType Setter - Use-After-Free

Adobe Flash TextField.gridFitType Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=559 There is a use-after-free in the TextField gridFitType setter. If it is set to an object with a toString method that frees the TextField, the property will be...

win32k Clipboard Bitmap - Use-After-Free

win32k Clipboard Bitmap - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=533 This PoC triggers a crash on Windows 7 32-bit with Special Pool enabled on win32k.sys. The kernel crashes due to a use-after-free condition with bitmaps in the clipboard. ---...

Adobe Flash TextField.antiAliasType Setter - Use-After-Free

Adobe Flash TextField.antiAliasType Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=560 There is a use-after-free in the TextField antiAliasType setter. If it is set to an object with a toString method that frees the TextField, the property will...

Adobe Flash GradientFill - Use-After-Frees

Adobe Flash GradientFill - Use-After-Frees Source: https://code.google.com/p/google-security-research/issues/detail?id=557 There are a number of use-after-free vulnerabilities in MovieClip.beginGradientFill. If the spreadMethod or any other string parameter is an object with toString defined, thi...

Wireshark - iseries_parse_packet Heap Buffer Overflow

Wireshark - iseriesparsepacket Heap Buffer Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=650 The following crash due to a heap-based buffer overflow can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...

Easy File Sharing Web Server 7.2 - GET Buffer Overflow (SEH)

Easy File Sharing Web Server 7.2 - GET Buffer Overflow SEH Exploit Title: Easy File Sharing Web Server 7.2 - GET HTTP request SEH Buffer Overflow Date: 12/2/2015 Exploit Author: ArminCyber Contact: [email protected] Version: 7.2 Tested on: XP SP3 EN category: Remote Exploit Usage:...

Wireshark - addresses_equal dissect_rsvp_common Use-After-Free

Wireshark - addressesequal dissectrsvpcommon Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=645 The following crash due to a use-after-free condition can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark...

Wireshark - file_read wtap_read_bytes_or_eofmp2t_find_next_pcr Stack Buffer Overflow

Wireshark - fileread wtapreadbytesoreofmp2tfindnextpcr Stack Buffer Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=655 The following crash due to a stack-based buffer overflow can be observed in an ASAN build of Wireshark current git master, by feeding a...

Wireshark - find_signature Stack Out-of-Bounds Read

Wireshark - findsignature Stack Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=643 The following crash due to a stack-based out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...

Wireshark - ascend_seek Static Out-of-Bounds Read

Wireshark - ascendseek Static Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=646 The following crash due to a static out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tsha...

Wireshark - memcpy get_value dissect_btatt SIGSEGV

Wireshark - memcpy getvalue dissectbtatt SIGSEGV Source: https://code.google.com/p/google-security-research/issues/detail?id=653 The following SIGSEGV crash due to an invalid memory write can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...

Wireshark - wmem_alloc Assertion Failure

Wireshark - wmemalloc Assertion Failure Source: https://code.google.com/p/google-security-research/issues/detail?id=662 The following crash due to an asserion failure can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark -nVxr...

Wireshark - AirPDcapPacketProcess Stack Buffer Overflow

Wireshark - AirPDcapPacketProcess Stack Buffer Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=642 The following crash due to a stack-based buffer overflow can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark ...

Wireshark - getRate Stack Out-of-Bounds Read

Wireshark - getRate Stack Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=641 The following crash due to a stack-based out-of-bounds memory read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "...

Wireshark - dissect_nbap_MACdPDU_Size SIGSEGV

Wireshark - dissectnbapMACdPDUSize SIGSEGV Source: https://code.google.com/p/google-security-research/issues/detail?id=652 The following SIGSEGV crash due to an invalid memory read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark...

Wireshark - dissect_tds7_colmetadata_token Stack Buffer Overflow

Wireshark - dissecttds7colmetadatatoken Stack Buffer Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=663 The following crash due to a stack-based buffer overflow can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to...

Wireshark - dissect_diameter_base_framed_ipv6_prefix Stack Buffer Overflow

Wireshark - dissectdiameterbaseframedipv6prefix Stack Buffer Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=644 The following crash due to a stack-based buffer overflow can be observed in an ASAN build of Wireshark current git master, by feeding a malformed...

Wireshark - dissct_rsl_ipaccess_msg Static Out-of-Bounds Read

Wireshark - dissctrslipaccessmsg Static Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=660 The following crash due to a static out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark...

Easy File Sharing Web Server 7.2 - HEAD Request Buffer Overflow (SEH)

Easy File Sharing Web Server 7.2 - HEAD Request Buffer Overflow SEH Exploit Title: Easy File Sharing Web Server 7.2 - HEAD HTTP request SEH Buffer Overflow Date: 12/2/2015 Exploit Author: ArminCyber Contact: [email protected] Version: 7.2 Tested on: XP SP3 EN category: Remote Exploit Usage:...

Wireshark - dissect_zcl_pwr_prof_pwrprofstatersp Static Out-of-Bounds Read

Wireshark - dissectzclpwrprofpwrprofstatersp Static Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=661 The following crash due to a static out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed fi...

Wireshark - my_dgt_tbcd_unpack Static Buffer Overflow

Wireshark - mydgttbcdunpack Static Buffer Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=649 The following crash due to a static buffer overflow can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshar...

Ovidentia NewsLetter Module 2.2 - admin.php Remote File Inclusion

Ovidentia NewsLetter Module 2.2 - admin.php Remote File Inclusion Title: Ovidentia Module newsletter 2.2 admin.php Remote File Inclusion Exploit Author: bd0rk eMail: bd0rkathackermail.com Twitter: twitter.com/bd0rk Tested on: Ubuntu-Linux Download:...

FireEye - Wormable Remote Code Execution in MIP JAR Analysis

FireEye - Wormable Remote Code Execution in MIP JAR Analysis Source: https://code.google.com/p/google-security-research/issues/detail?id=666 The FireEye MPS Malware Protection System is vulnerable to a remote code execution vulnerability, simply from monitoring hostile traffic. FireEye is designe...

Ovidentia absences Module 2.64 - Remote File Inclusion

Ovidentia absences Module 2.64 - Remote File Inclusion Title: Ovidentia Module absences 2.64 Remote File Include Vulnerability Author: bd0rk eMail: bd0rkathackermail.com Tested on: Ubuntu-Linux Download:...

Ovidentia bulletindoc Module 2.9 - Multiple Remote File Inclusions

Ovidentia bulletindoc Module 2.9 - Multiple Remote File Inclusions Title: Ovidentia Module bulletindoc 2.9 Multiple Remote File Inclusion Vulnerabilities Author: bd0rk eMail: bd0rkathackermail.com Twitter: twitter.com/bd0rk Tested on: Ubuntu-Linux Download:...

Joomla! 1.5 3.4.5 - Object Injection Remote Command Execution

Joomla! 1.5 3.4.5 - Object Injection Remote Command Execution ''' Simple PoC for Joomla Object Injection. Gary @ Sec-1 ltd http://www.sec-1.com/ ''' import requests easyinstall requests def geturlurl, useragent: headers = 'User-Agent': useragent cookies = requests.geturl,headers=headers.cookies f...

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - _FXCLI_SetConfFileChunk Stack Buffer Overflow (PoC)

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - FXCLISetConfFileChunk Stack Buffer Overflow PoC !/usr/bin/python Title: IBM Tivoli Storage Manager FastBack Server 5.5.4.2 FXCLISetConfFileChunk Stack Buffer Overflow Vulnerability Date: 14 December 2015 Author: Gianni Gnesa gnix Vendor Homepag...

ArticleSetup Article Script 1.00 - SQL Injection

ArticleSetup Article Script 1.00 - SQL Injection Exploit Title : Article Script SQL Injection Vulnerability Exploit Author : Linux Zone Research Team Vendor Homepage: http://articlesetup.com/ Google Dork : inurl:/article.php?id= intext:Powered By Article Marketing Software Link :...

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - _FXCLI_GetConfFileChunk Stack Buffer Overflow (PoC)

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - FXCLIGetConfFileChunk Stack Buffer Overflow PoC !/usr/bin/python Title: IBM Tivoli Storage Manager FastBack Server 5.5.4.2 FXCLIGetConfFileChunk Stack Buffer Overflow Vulnerability Date: 14 December 2015 Author: Gianni Gnesa gnix Vendor Homepag...

Tequila File Hosting 1.5 - Multiple Vulnerabilities

Tequila File Hosting 1.5 - Multiple Vulnerabilities ================================================================================ Tequila File Hosting Arbitrary File Download ================================================================================ Vendor Homepage:...

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - Invalid Pointer Dereference

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - Invalid Pointer Dereference !/usr/bin/python Title: IBM Tivoli Storage Manager FastBack Server 5.5.4.2 Invalid Pointer Dereference Date: 14 December 2015 Author: Gianni Gnesa gnix Vendor Homepage: http://www.ibm.com/ Software Name: IBM Tivoli...

Adobe Flash - Type Confusion in Serialization with ObjectEncoder.dynamicPropertyWriter

Adobe Flash - Type Confusion in Serialization with ObjectEncoder.dynamicPropertyWriter Source: https://code.google.com/p/google-security-research/issues/detail?id=545 There is a type confusion issue during serialization if ObjectEncoder.dynamicPropertyWriter is overridden with a value that is not...