Exploits

VxWorks 6.8 – TCP Urgent Pointer = 0 Integer Underflow

# Exploit Title: VxWorks TCP Urgent pointer = 0 integer underflow vulnerability

Mitsubishi Electric smartRTU / INEA ME-RTU – Unauthenticated Configuration Download

#!/usr/bin/python

Mitsubishi Electric smartRTU / INEA ME-RTU – Unauthenticated OS Command Injection Bind Shell

#!/usr/bin/python

Linux – Use-After-Free Reads in show_numa_stats()

On NUMA systems, the Linux fair scheduler tracks information related to NUMA

WebKit – UXSS via XSLT and Nested Document Replacements

VULNERABILITY DETAILS

Steam Windows Client – Local Privilege Escalation

$SteamRegKey = "HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\NSIS"

Open-School 3.0 / Community Edition 2.3 – Cross-Site Scripting

# Exploit Title: [title]

Daily Expense Manager 1.0 – Cross-Site Request Forgery (Delete Income)

# Exploit Title: Daily Expense Manager - CSRF (Delete Income)

Aptana Jaxer 1.0.3.4547 – Local File inclusion

# Exploit Title: Aptana Jaxer Remote Local File inclusion

Baldr Botnet Panel – Arbitrary Code Execution (Metasploit)

##

Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 – Arbitrary File Download

#Exploit Title: Joomla! component com_jssupportticket - Arbitrary File Download

Adive Framework 2.0.7 – Cross-Site Request Forgery

# Exploit Title: Adive Framework 2.0.7 – Cross-Site Request Forgery (CSRF)

Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 – SQL Injection

#Exploit Title: Joomla! component com_jssupportticket - SQL Injection

WordPress Plugin JoomSport 3.3 – SQL Injection

# Exploit Title: JoomSport 3.3 – for Sports - SQL injection

Google Chrome 74.0.3729.0 / 76.0.3789.0 – Heap Use-After-Free in blink::PresentationAvailabilityState::UpdateAvailability

macOS iMessage – Heap Overflow when Deserializing

There is a heap overflow in [NSURL initWithCoder:] that can be reached via iMessage and likely other paths. When an N...

Apache Tika 1.15 – 1.17 – Header Command Injection (Metasploit)

##

ARMBot Botnet – Arbitrary Code Execution

import requests

Sar2HTML 3.2.1 – Remote Command Execution

# Exploit Title: sar2html Remote Code Execution

Rest – Cafe and Restaurant Website CMS – ‘slug’ SQL Injection

# Exploit Title: Rest - Cafe and Restaurant Website CMS - SQL Injection

1CRM On-Premise Software 8.5.7 – Persistent Cross-Site Scripting

////////////////////////////////////////////////////////////////////////////////////

SilverSHielD 6.x – Local Privilege Escalation

##

Ultimate Loan Manager 2.0 – Cross-Site Scripting

# Exploit Title:Web Studio Ultimate Loan Manager V2.0 - Persistent Cross Site Scripting

WebIncorp ERP – SQL injection

# Exploit Title: WebIncorp ERP - SQL injection

Cisco Catalyst 3850 Series Device Manager – Cross-Site Request Forgery

# Product : Catalyst 3850 Series Device Manager

Oracle Hyperion Planning 11.1.2.3 – XML External Entity

- Exploit Title: XXE Injection Oracle Hyperion

Amcrest Cameras 2.520.AC00.18.R – Unauthenticated Audio Streaming

##

macOS / iOS NSKeyedUnarchiver – Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances

When deserializing NSObjects with the NSArchiver API [1], one can supply a whitelist of classes that are allowed to b...

macOS / iOS JavaScriptCore – Loop-Invariant Code Motion (LICM) Leaves Object Property Access Unguarded

While fuzzing JavaScriptCore, I encountered the following (modified and commented) JavaScript program which crashes j...

macOS / iOS JavaScriptCore – JSValue Use-After-Free in ValueProfiles

While fuzzing JSC, I encountered the following JS program which crashes JSC from current HEAD and release (/System/Li...

iMessage – NSArray Deserialization can Invoke Subclass that does not Retain References

When deserializing a class with initWithCoder, subclasses of that class can also be deserialized so long as they do n...

iMessage – Memory Corruption when Decoding NSKnownKeysDictionary1

There is a memory corruption vulnerability when decoding an object of class NSKnownKeysDictionary1. This class decod...

iMessage – NSKeyedUnarchiver Deserialization Allows file Backed NSData Objects

The class _NSDataFileBackedFuture can be deserialized even if secure encoding is enabled. This class is a file-backed...

Redis 4.x / 5.x – Unauthenticated Code Execution (Metasploit)

##

WordPress Plugin Simple Membership 3.8.4 – Cross-Site Request Forgery

# Exploit Title: Cross Site Request Forgery in Wordpress Simple Membership plugin

WordPress Theme Real Estate 2.8.9 – Cross-Site Scripting

# Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9

GigToDo 1.3 – Cross-Site Scripting

# Exploit Title: GigToDo - Freelance Marketplace Script v1.3 Persistent XSS Injection

Schneider Electric Pelco Endura NET55XX Encoder – Authentication Bypass (Metasploit)

##

WordPress Plugin Database Backup < 5.2 - Remote Code Execution (Metasploit)

##

Microsoft Windows 7 build 7601 (x86) – Local Privilege Escalation

#include

Moodle Filepicker 3.5.2 – Server Side Request Forgery

# Exploit Title: Server Side Request Forgery in Moodle Filepicker

pdfresurrect 0.15 – Buffer Overflow

# Exploit Title: pdfresurrect 0.15 Buffer Overflow

Ahsay Backup 8.1.1.50 – Insecure File Upload and Code Execution (Authenticated)

# Exploit Title: Ahsay Backup 8.1.1.50 - Insecure File Upload and Code Execution (Authenticated)

Ahsay Backup 7.x – 8.1.1.50 – Authenticated Arbitrary File Upload / Remote Code Execution (Metasploit)

# Exploit Title: Authenticated insecure file upload and code execution flaw in Ahsay Backup v7.x - v8.1.1.50. (Metasp...

Ahsay Backup 7.x – 8.1.1.50 – XML External Entity Injection

# Unauthenticated XML External Entity (XXE) in Ahsay Backup v7.x - v8.1.0.50.

Ovidentia 8.4.3 – Cross-Site Scripting

#-------------------------------------------------------

Ovidentia 8.4.3 – SQL Injection

#-------------------------------------------------------

MyBB < 1.8.21 - Remote Code Execution

# Exploit Title: MyBB < 1.8.21 Authenticated RCE

WebKit – Universal Cross-Site Scripting due to Synchronous Page Loads

BACKGROUND

NoviSmart CMS – SQL injection

# Exploit Title: NoviSmart CMS SQL injection