Exploits

Google Chrome < M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races again...

Google Chrome < M72 - Use-After-Free in RenderProcessHostImpl Binding for P2PSocketDispatcherHost

There's an object-lifetime issue in the browser process in the handling of P2PSocketDispatcherHost binding in paralle...

Google Chrome < M72 - FileWriterImpl Use-After-Free

There's a use-after-free in the implementation of the FileWriter component of the mojo bindings for the filesystem API.

tcpdump < 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads

Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. Th...

Linux < 4.14.103 / < 4.19.25 - Out-of-Bounds Read and Write in SNMP NAT Module

commit cc2d58634e0f ("netfilter: nf_nat_snmp_basic: use asn1 decoder library",

macOS XNU – Copy-on-Write Behavior Bypass via Mount of User-Owned Filesystem Image

XNU has various interfaces that permit creating copy-on-write copies of data

Cisco WebEx Meetings < 33.6.6 / < 33.9.1 - Privilege Escalation

SecureAuth - SecureAuth Labs Advisory

WordPress Core 5.0 – Remote Code Execution

var wpnonce = '';

Simple Online Hotel Reservation System – SQL Injection

# Exploit Title: Simple Online Hotel Reservation System - SQL Injection / Authentication Bypass

Simple Online Hotel Reservation System – Cross-Site Request Forgery (Add Admin)

# Exploit Title: Simple Online Hotel Reservation System - Cross-Site Request Forgery (Add Admin)

Simple Online Hotel Reservation System – Cross-Site Request Forgery (Delete Admin)

# Exploit Title: Simple Online Hotel Reservation System - Cross-Site Request Forgery (Delete Admin)

FTP Server 1.32 – Denial of Service

#!/usr/bin/env python

WebKitGTK 2.23.90 / WebKitGTK+ 2.22.6 – Denial of Service

#Exploit Title: Buffer overflow

Joomla! Component J2Store < 3.3.7 - SQL Injection

# Exploit Title: J2Store Plugin for Joomla! < 3.3.6 - SQL Injection

Usermin 1.750 – Remote Command Execution (Metasploit)

##

Alcatel-Lucent (Nokia) GPON I-240W-Q – Buffer Overflow

#!/usr/bin/python3

TransMac 12.3 – Denial of Service (PoC)

# -*- coding: utf-8 -*-

Feng Office 3.7.0.5 – Remote Command Execution (Metasploit)

##

PHP 7.2 – ‘imagecolormatch()’ Out of Band Heap Write

Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 – Remote Code Execution

#!/usr/bin/env python

zzzphp CMS 1.6.1 – Remote Code Execution

# Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1

PHP Ecommerce Script 2.0.6 – Cross-Site Scripting / SQL Injection

# Exploit Title: PHP Ecommerce Script 2.0.6 - Cross Site Scripting / SQL Injection

News Website Script 2.0.5 – SQL Injection

# Exploit Title: News Website Script 2.0.5 - SQL Injection

Advance Gift Shop Pro Script 2.0.3 – SQL Injection

# Exploit Title: Advance Gift Shop Pro Script 2.0.3 - SQL Injection

Xlight FTP Server 3.9.1 – Buffer Overflow (PoC)

# Exploit Title: Xlight 3.9.1 FTP Server SEH Overwrite

Drupal < 8.6.9 - REST Module Remote Code Execution

#!/usr/bin/env python3

Drupal < 8.6.10 / < 8.5.11 - REST Module Remote Code Execution

Analyzing the patch

Quest NetVault Backup Server < 11.4.5 - Process Manager Service SQL Injection / Remote Code Execution

# Exploit Title: Quest NetVault Backup Server < 11.4.5 Process Manager Service SQL Injection Remote Code Execution Vu...

WebKit JSC – reifyStaticProperty Needs to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter

https://github.com/WebKit/webkit/blob/3fff8c40c665a09de5e3ede46fc35908f69353c3/Source/JavaScriptCore/runtime/Lookup.h...

Nuuo Central Management – (Authenticated) SQL Server SQL Injection (Metasploit)

##

Micro Focus Filr 3.4.0.217 – Path Traversal / Local Privilege Escalation

SecureAuth - SecureAuth Labs Advisory

Teracue ENC-400 – Command Injection / Missing Authentication

Introduction

WinRAR 5.61 – Path Traversal

#!/usr/bin/env python3

Memu Play 6.0.7 – Privilege Escalation

# Exploit Title: Memu Play 6.0.7 - Privilege Escalation (PoC)

C4G Basic Laboratory Information System (BLIS) 3.4 – SQL Injection

# Exploit Title: C4G Basic Laboratory Information System (BLIS) 3.4 - Multiples SQL Injection

Valentina Studio 9.0.5 Linux – ‘Host’ Buffer Overflow (PoC)

# -*- coding: utf-8 -*-

EI-Tube 3 – SQL Injection

# Exploit Title: PHP EI-Tube Script - Sql Injection

RealTerm Serial Terminal 2.0.0.70 – ‘Echo Port’ Buffer Overflow (SEH)

# Exploit Title: RealTerm: Serial Terminal 2.0.0.70 - 'Echo Port' Buffer Overflow - (SEH)

Virtual VCR Max .0a – ‘.vcr’ Buffer Overflow (PoC)

#!/usr/bin/python

ScreenStream 3.0.15 – Denial of Service

#!/usr/bin/python

MikroTik RouterOS < 6.43.12 (stable) / < 6.42.12 (long-term) - Firewall and NAT Bypass

# CVE-2019-3924

AirDrop 2.0 – Denial of Service (DoS)

#include

HotelDruid 2.3 – Cross-Site Scripting

===========================================================================================

FTPShell Server 6.83 – ‘Account name to ban’ Denial of Service (PoC)

#Exploit Title: FTPShell Server 6.83 - Denial of Service (PoC)

WinRAR 5.61 – ‘.lng’ Denial of Service

# Exploit Title: WinRAR 5.61 - Denial of Service

FaceTime – Texture Processing Memory Corruption

There is a memory corruption issue that occurs when processing a malformed RTP video stream in FaceTime. It appears t...

Android Kernel < 4.8 - ptrace seccomp Filter Bypass

The seccomp.2 manpage (http://man7.org/linux/man-pages/man2/seccomp.2.html) documents:

MatrixSSL < 4.0.2 - Stack Buffer Overflow Verifying x.509 Certificates

I happened to notice that a public X.509 certificate testcase for CVE-2014-1569 caused a stack buffer overflow in Mat...

Belkin Wemo UPnP – Remote Code Execution (Metasploit)

V##

MaxxAudio Drivers WavesSysSvc64.exe 1.6.2.0 – Local Privilege Escalation

# Exploit Title: MaxxAudio Drivers WavesSysSvc64.exe File Permissions SYSTEM Privilege Escalation