WordPress SimpleForm 3.10.0 Unauthenticated Privilege Escalation

WordPress SimpleForm plugin versions through 3.10.0 contain an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts through an insecure registration AJAX action. https://packetstorm.news/download/235862...

Microsoft Windows Kernel-Mode Drivers Use-After-Free / Privilege Escalation

Microsoft Windows Kernel-Mode Drivers contain a use-after-free in Frame Server stream handling that allows an authorized local attacker to elevate privileges. The proof of concept races stream publishing and closure to obtain SeDebugPrivilege and launch a command shell...

Hikvision IP Camera Authentication Bypass

Hikvision IP cameras affected by CVE-2017-7921 allow unauthenticated retrieval of an encrypted configuration file. This proof of concept retrieves and decrypts the file to recover administrator credentials. https://packetstorm.news/download/235867...

Apache Bigtop Manager 1.1.0 TarballExtractor Arbitrary File Write

Apache Bigtop Manager version 1.1.0 TarballExtractor contains a path traversal vulnerability that allows a malicious service tarball to write files outside the intended extraction directory. !/usr/bin/env python Apache Bigtop Manager 1.1.0 TarballExtractor Arbitrary File Write Vendor: The Apache...

Google Chrome V8 Out-Of-Bounds Memory Access

Google Chrome versions prior to 142.0.7444.59 contain an inappropriate V8 implementation that allows out-of-bounds memory access via crafted JavaScript. This proof of concept demonstrates the issue in d8 and includes arbitrary read/write primitives. https://packetstorm.news/download/235610...

Google Chrome 142.0.7444.174 V8 Type Confusion

Google Chrome versions prior to 142.0.7444.175 contain a V8 type confusion vulnerability. The proof of concept uses super property access with a primitive receiver to trigger a crash. https://packetstorm.news/download/235609...

V8 12.5.227.12 Type Confusion

V8 version 12.5.227.12 contains a type confusion vulnerability involving class static block parsing. A proof of concept demonstrates stale closure slot handling after bytecode flushing. https://packetstorm.news/download/235611...

V8 11.2.214.13 Type Confusion

V8 version 11.2.214.13 contains a type confusion issue in lazy Error stack trace formatting that can leak TheHole. The supplied proof of concept demonstrates the leak. https://packetstorm.news/download/235615...

Samsung libsubextractor.so One UI 8.5 Heap Buffer Overflow

Samsung libsubextractor.so in One UI version 8.5 contains a heap buffer overflow in subtitle charset conversion. The supplied proof of concept uses a crafted ShiftJIS SRT sidecar subtitle to trigger the overflow through Samsung Video Player. https://packetstorm.news/download/235649...

Samsung libimagecodec.quram.so One UI 8.5 Out-of-Bounds Write

Samsung libimagecodec.quram.so in One UI version 8.5 contains an out-of-bounds write in progressive JPEG inverse-DCT processing caused by a scan and frame component-index mismatch. Included proof of concept JPEG files trigger heap-buffer-overflow and uninitialized-pointer write conditions...

Apache IoTDB 2.0.11 Authenticated Server-Side Request Forgery

Apache IoTDB version 2.0.11 contains an authenticated server-side request forgery vulnerability in the user-defined function mechanism. Apache IoTDB 2.0.11 Authenticated Server-Side Request Forgery Vendor: The Apache Software Foundation Product web page: https://iotdb.apache.org Affected version:...

MariaDB 13.1.0 .frm Out-Of-Bounds Read / Remote Code Execution

MariaDB version 13.1.0 and earlier versions contain an out-of-bounds read when opening crafted .frm data that can be leveraged for remote code execution by an authenticated user with required file privileges. https://packetstorm.news/download/235628...

GitLab 19.4.1 CI Lint Remote Code Execution

GitLab version 19.4.1 and other affected versions contain an integer overflow in the CI/CD regular expression compiler that can allow remote code execution. This proof of concept deploys a crafted CI configuration and repository path, then triggers CI lint processing...

Google V8 Array Sort Type Confusion

Google V8 versions prior to 15.3.48 contain a type confusion vulnerability involving Array.prototype.sort. The proof of concept demonstrates array element-kind corruption caused by a comparator that mutates its receiver. https://packetstorm.news/download/235608...

Windows 11 29617.1000 WHESVC Privilege Escalation

Windows 11 versions 26200.8457 and 29617.1000 contain a privilege-boundary issue in the Windows Health and Optimized Experiences service. The supplied proof of concept emits a Windows Diagnostics Lua ETW workflow that causes an attacker-controlled Lua module to execute as LocalSystem and writes a...

TP-Link Tapo C500 2.0 TDP Denial of Service

TP-Link Tapo C500 v2.0 firmware versions before 1.3.5 Build 260810 contain an out-of-bounds function-pointer dispatch in the TDP daemon. The proof of concept sends one unauthenticated UDP datagram that crashes the main service, causing denial of service. https://packetstorm.news/download/235635...

TP-Link Tapo C500 v2.0 ONVIF PTZ Stack Write Denial of Service

TP-Link Tapo C500 version 2.0 firmware versions before 1.3.5 Build 260810 contain an authenticated ONVIF PTZ out-of-bounds stack write vulnerability. The proof of concept sends excessive RemovePreset elements to crash the main service. https://packetstorm.news/download/235636...

Splunk Enterprise 10.4.2 Patroni REST API Remote Command Execution

Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 contain a missing authentication flaw in the Patroni REST API that permits unauthenticated network users to execute operating-system commands on search head cluster members. https://packetstorm.news/download/235638...

WordPress SimpleForm 3.10.0 Unauthenticated Privilege Escalation

WordPress SimpleForm plugin versions through 3.10.0 contain an unauthenticated privilege escalation vulnerability that allows creation of an Administrator account through a registration AJAX endpoint. https://packetstorm.news/download/235620...

FortiClient EMS 7.4.6 Authentication Bypass

Fortinet FortiClient EMS versions 7.4.5 through 7.4.6 contain an improper access control issue that allows unauthenticated access to protected API endpoints. This proof of concept demonstrates the authentication bypass using crafted client-certificate headers...

Danfoss AK-SM 8xxA Authentication Bypass

Danfoss AK-SM 8xxA series versions prior to version 4.2 contain an improper authentication vulnerability that permits a code-of-the-day authentication bypass. This proof of concept obtains the device date, derives the daily code, and exercises the alternate authentication path...

ChakraCore 1.11.4 JIT Type Confusion

ChakraCore version 1.11.4 contains a JIT optimization flaw that can cause property writes to use a stale object layout. Included JavaScript proof of concept demonstrates the issue and provides DataView arbitrary read/write and addrof primitives. https://packetstorm.news/download/235618...

Safari 11.0.1 JavaScriptCore Type Confusion

Safari version 11.0.1 JavaScriptCore contains type confusion issues that can lead to arbitrary code execution. Proof of concept code is provided for four related triggering expressions. https://packetstorm.news/download/235619...

War Thunder 2.57.1.140 Cleartext JWT Transmission

War Thunder version 2.57.1.140 transmits the authjwt bearer token in cleartext during its initial matching-server handshake. A passive observer can decompress the packet and recover the token, allowing temporary authenticated impersonation and access to game services and readable user data...

Mozilla Firefox 157 IonMonkey Out-Of-Bounds Read

Mozilla Firefox version 157 contains an IonMonkey JIT constant-folding flaw that can eliminate typed-array bounds checks and allow out-of-bounds memory reads. The proof of concept details a shift-count mismatch fixed in Firefox 158. https://packetstorm.news/download/235630...

phpwcms 1.12.3 Shell Upload

phpwcms version 1.12.3 and prior affected releases contain an unauthenticated unrestricted upload issue in public Form content. A proof of concept demonstrates uploading a .phtml marker that executes when the server maps that extension to PHP. https://packetstorm.news/download/235633...

...[ More ]

This Metasploit module exploits an authenticated command injection vulnerability in Grafana's experimental SQL Expressions feature. Affected Grafana releases are 11.0.0 through 11.0.6, 11.1.0 through 11.1.7, and 11.2.0 through 11.2.2. They pass attacker-controlled SQL expressions to DuckDB withou...

WordPress Bricksforge 3.1.8.9 Arbitrary File Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability that allows remote code execution. The included proof of concept uploads a GIF/PHP polyglot and abuses temporaryFileUploads to select a PHP filename...

V8 SuperIC Type Confusion

V8 contains a SuperIC receiver confusion issue. Included proof of concept and exploitation snippets demonstrate object address disclosure, fake objects, arbitrary memory access, and WebAssembly RWX memory access. https://packetstorm.news/download/235617...

Samsung One UI 8.5 DNG Heap Buffer Overflow

Samsung One UI version 8.5 contains a heap buffer overflow in libimagecodec.quram.so when decoding a crafted uncompressed tiled DNG image. The supplied proof of concept triggers the vulnerable Transparency Mask decoding path. https://packetstorm.news/download/235647...

WebKitGTK 2.42.0 JavaScriptCore Arbitrary Code Execution

WebKitGTK and WPE WebKit versions before 2.42.1 contain an improper check that may allow arbitrary code execution when processing malicious web content. This proof of concept triggers a JavaScriptCore DFG CSE property-access optimization error. https://packetstorm.news/download/235614...

Concrete CMS 9.5.2 Calendar Event Name Cross Site Scripting

Concrete CMS versions 8.3.0 through 9.5.2 contain a stored cross site scripting vulnerability in calendar event names that executes when an administrator views a workflow approval notification. https://packetstorm.news/download/235625...

JavaScriptCore Concurrent JIT Type Confusion

JavaScriptCore contains a TOCTOU type confusion in DFG concurrent compilation that can allow garbage collection of a constant-property cell. The supplied proof of concept exercises the condition against a vulnerable WebKit tree. https://packetstorm.news/download/235613...

Google Chrome 123.0.6312.85 WebAssembly Type Confusion

Google Chrome version 123.0.6312.85 contains a type confusion vulnerability in WebAssembly. A proof of concept is provided. https://packetstorm.news/download/235612...

Formwork CMS 2.3.12 Cross Site Scripting

Formwork CMS versions 2.0.0 through 2.3.12 contain a stored cross site scripting vulnerability in the URI sanitizer. An authenticated page editor can use an unsanitized formaction JavaScript URI in raw Markdown HTML to execute script when a visitor activates the crafted control...

MikroTik RouterOS Before 7.24 WebFig Integer Underflow

MikroTik RouterOS versions before 7.24 contain an unauthenticated integer underflow in WebFig HTTP request body handling. The included proof of concept demonstrates denial of service against the web management service. https://packetstorm.news/download/235629...

Kirby CMS 5.5.3 Dynamic Field Option Authorization Bypass

Kirby CMS versions 4.9.0 through 4.9.5 and 5.5.0 through 5.5.3 contain an authorization bypass in query-backed Panel field options that may disclose metadata for restricted models to a limited authenticated user. Included proof of concept uses synthetic in-memory content...

WordPress Abandoned Cart Pro for WooCommerce 10.8.0 Authentication Bypass

WordPress Abandoned Cart Pro for WooCommerce versions through 10.8.0 contain an authentication bypass through forged cart recovery tokens. The supplied proof of concept checks exposed versions and forges or uses recovery links. https://packetstorm.news/download/235604...

V8 9.7 JSON.stringify TheHole Disclosure

V8 version 9.7 contains a JSON.stringify exception-handling flaw that exposes the internal TheHole value to JavaScript. The proof of concept triggers the leak and includes a partial Map corruption amplification demonstration. https://packetstorm.news/download/235616...

isolated-vm 3.1.2 Sandbox Escape

isolated-vm versions before 4.0.0 allow guest code with a live Reference to escape the sandbox and execute arbitrary code in the Node.js host process. https://packetstorm.news/download/235626...

Hyperledger FireFly Core 1.5.0 Server-Side Request Forgery

Hyperledger FireFly Core version 1.5.0 and prior versions with the webhooks event transport contain a server-side request forgery vulnerability. The proof of concept creates a webhook subscription with a supplied URL and broadcasts a message to trigger the FireFly node request...

Apache Airflow 3.3.2 Secrets Masker Deep-Nesting Secret Leak

Apache Airflow version 3.3.2 contains a secret-masking flaw that can disclose registered secrets in task logs when string values are deeply nested under non-sensitive keys. !/usr/bin/env python Apache Airflow 3.3.2 masksecret Secrets Masker Deep-Nesting Secret Leak Vendor: The Apache Software...

Microsoft Windows 11 26H1 Win32k Information Disclosure

Microsoft Windows Win32k contains an information disclosure vulnerability that allows an authorized local attacker to disclose information. Included proof of concept code reads a kernel address from the desktop heap. https://packetstorm.news/download/235377...

Craft CMS 5.6.16 Remote Code Execution

Craft CMS versions 3.0.0-RC1 through 3.9.14, 4.0.0-RC1 through 4.14.14, and 5.0.0-RC1 through 5.6.16 contain an unauthenticated remote code execution vulnerability in image transformation processing. A proof of concept is included. https://packetstorm.news/download/235386...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability in temporaryFileUploads that can permit PHP code execution. https://packetstorm.news/download/235378...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions 3.1.8.9 and prior contain an unauthenticated arbitrary file upload vulnerability through manipulated temporary upload metadata. The included proof of concept uses an inert GIF canary to validate the arbitrary file-write condition...

Aprelium Abyss Web Server X1 2.16.22.0 First-Run Console Takeover

Aprelium Abyss Web Server X1 version 2.16.22.0 permits an unauthenticated client during the first-run configuration state to create a console administrator credential, configure a log file as a CGI shell script, and execute commands as the server process. https://packetstorm.news/download/235391...

Maian Guardian 2.1 License Generator Command Injection

Maian Guardian version 2.1 contains an authenticated command injection vulnerability in its license-generation routine. The supplied proof of concept authenticates to the administrator interface, submits an injected project identifier, and retrieves a target-side execution marker...

Apache NuttX RTOS 13.1.0 6LoWPAN HC06 Decompressor Out-of-Bounds Write

Apache NuttX RTOS version 13.1.0 contains an out-of-bounds write in the 6LoWPAN HC06 header decompressor when UDP and TCP support are disabled. !/usr/bin/env python Apache NuttX RTOS 13.1.0 6LoWPAN HC06 Decompressor Kernel Out-of-Bounds Write Vendor: The Apache Software Foundation Product web pag...

Auerswald COMmander 6000 8.6D Provisioning Import Root Code Execution

Auerswald COMmander 6000 and 6000R firmware version 8.6D build 128154 contain a provisioning archive import path traversal that can overwrite a root-consumed binary and achieve unauthenticated root code execution. https://packetstorm.news/download/235392...