Exploits

UliCMS 2019.1 ‘Spitting Lama’ – Persistent Cross-Site Scripting

# Exploit Title: UliCMS 2019.1 "Spitting Lama" - Stored Cross-Site Scripting

Ubuntu 18.04 – ‘lxd’ Privilege Escalation

#!/usr/bin/env bash

Microsoft Windows – AppX Deployment Service Local Privilege Escalation (3)

CVE-2019-0841 BYPASS #2

Supra Smart Cloud TV – ‘openLiveURL()’ Remote File Inclusion

Exploit Title: Remote file inclusion

VMware WorkStation 12.5.3 – Virtual Machine Escape

# VMware Escape Exploit

Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery

#coding=utf8

Google Chrome 73.0.3683.103 – ‘WasmMemoryObject::Grow’ Use-After-Free

IBM Websphere Application Server – Network Deployment Untrusted Data Deserialization Remote Code Execution (Metasploit)

##

LibreNMS – addhost Command Injection (Metasploit)

##

Exim 4.87 < 4.91 - (Local / Remote) Command Execution

Qualys Security Advisory

IceWarp 10.4.4 – Local File Inclusion

# Exploit Title: IceWarp

NUUO NVRMini 2 3.9.1 – ‘sscanf’ Stack Overflow

#!/usr/bin/python

Cisco RV130W 1.0.3.44 – Remote Stack Overflow

#!/usr/bin/python

DVD X Player 5.5 Pro – Local Buffer Overflow (SEH)

# Exploit Title: DVDXPlayer 5.5 Pro Local Buffer Overflow with SEH

Zoho ManageEngine ServiceDesk Plus 9.3 – ‘SiteLookup.do’ Cross-Site Scripting

# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SiteLookup.do

Zoho ManageEngine ServiceDesk Plus 9.3 – ‘SolutionSearch.do’ Cross-Site Scripting

# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SolutionSearch.do

Zoho ManageEngine ServiceDesk Plus 9.3 – ‘SearchN.do’ Cross-Site Scripting

# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SearchN.do

Zoho ManageEngine ServiceDesk Plus 9.3 – ‘PurchaseRequest.do’ Cross-Site Scripting

# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via PurchaseRequest.do

Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution

Vim/Neovim Arbitrary Code Execution via Modelines

KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities

# Exploit Title: [Dell Kace Appliance Multiple Vulnerabilities]

AUO Solar Data Recorder < 1.3.0 - Incorrect Access Control

# Exploit Title: AUO Solar Data Recorder - Incorrect Access Control

WordPress Plugin Form Maker 1.13.3 – SQL Injection

# -*- coding: utf-8 -*-

Nvidia GeForce Experience Web Helper – Command Injection

Press CTRL+V+Enter

Microsoft Windows Remote Desktop – ‘BlueKeep’ Denial of Service

import socket, sys, struct

pfSense 2.4.4-p3 (ACME Package 0.59_14) – Persistent Cross-Site Scripting

# Exploit Title: pfSense 2.4.4-p3 (ACMEPackage 0.5.7_1) - Stored Cross-Site Scripting

Free SMTP Server 2.5 – Denial of Service (PoC)

#Exploit Title: Free SMTP Server - Local Denial of Service Crash (PoC)

Spidermonkey – IonMonkey Leaks JS_OPTIMIZED_OUT Magic Value to Script

IonMonkey can, during a bailout, leak an internal JS_OPTIMIZED_OUT magic value to the running script. This magic valu...

Spidermonkey – IonMonkey Unexpected ObjectGroup in ObjectGroupDispatch Operation

While fuzzing Spidermonkey, I encountered the following (commented and modified) JavaScript program which crashes deb...

Qualcomm Android – Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL

The following issue exists in the android-msm-wahoo-4.4-pie branch of

Oracle Application Testing Suite – WebLogic Server Administration Console War Deployment (Metasploit)

##

EquityPandit 1.0 – Password Disclosure

#Exploit title: EquityPandit v1.0 - Insecure Logging

Petraware pTransformer ADC < 2.1.7.22827 - Login Bypass

# Exploit Title: Petraware pTransformer ADC before 2.1.7.22827 allows SQL

Phraseanet < 4.0.7 - Cross-Site Scripting

# Exploit title: Stored XSS vulnerability in Phraseanet DAM Open Source software

Pidgin 2.13.0 – Denial of Service (PoC)

# -*- coding: utf-8 -*-

Deltek Maconomy 2.2.5 – Local File Inclusion

# Exploit Title: Maconomy Erp local file include

Typora 0.9.9.24.6 – Directory Traversal

# Exploit Title: Code execution via path traversal

Opencart 3.0.3.2 – ‘extension/feed/google_base’ Denial of Service (PoC)

#!/bin/bash

Axessh 4.2 – ‘Log file name’ Local Stack-based Buffer Overflow

# Title: Axessh 4.2 - 'Log file name' Local Stack-based Buffer Overflow

Cyberoam SSLVPN Client 1.3.1.30 – ‘Connect To Server’ Denial of Service (PoC)

#Exploit Title: Cyberoam SSLVPN Client 1.3.1.30 - 'Connect To Server' Denial of Service (PoC)

Cyberoam SSLVPN Client 1.3.1.30 – ‘HTTP Proxy’ Denial of Service (PoC)

#Exploit Title: Cyberoam SSLVPN Client 1.3.1.30 - 'HTTP Proxy' Denial of Service (PoC)

Cyberoam Transparent Authentication Suite 2.1.2.5 – ‘Fully Qualified Domain Name’ Denial of Service (PoC)

#Exploit Title: Cyberoam Transparent Authentication Suite 2.1.2.5 - 'Fully Qualified Domain Name' Denial of Service (...

Cyberoam Transparent Authentication Suite 2.1.2.5 – ‘NetBIOS Name’ Denial of Service (PoC)

#Exploit Title: Cyberoam Transparent Authentication Suite 2.1.2.5 - 'NetBIOS Name' Denial of Service (PoC)

Cyberoam General Authentication Client 2.1.2.7 – ‘Server Address’ Denial of Service (PoC)

#Exploit Title: Cyberoam General Authentication Client 2.1.2.7 - Denial of Service (PoC)

Microsoft Internet Explorer Windows 10 1809 17763.316 – Scripting Engine Memory Corruption

# Exploit Title: Microsoft Internet Explorer Windows 10 1809 17763.316 - Scripting Engine Memory Corruption

Fast AVI MPEG Joiner – ‘License Name’ Denial of Service (PoC)

# Exploit Title: Fast AVI MPEG Joiner Dos Exploit

NetAware 1.20 – ‘Add Block’ Denial of Service (PoC)

# -*- coding: utf-8 -*-

NetAware 1.20 – ‘Share Name’ Denial of Service (PoC)

# -*- coding: utf-8 -*-

Nagios XI 5.6.1 – SQL injection

# Exploit Title: Nagiosxi username sql injection

Terminal Services Manager 3.2.1 – Denial of Service

# -*- coding: utf-8 -*-

Microsoft Windows 10 1809 – ‘CmKeyBodyRemapToVirtualForEnum’ Arbitrary Key Enumeration Privilege Escalation

Windows: CmKeyBodyRemapToVirtualForEnum Arbitrary Key Enumeration EoP