Exploits

ModbusPal 1.6b – XML External Entity Injection

[+] Exploit Title: ModbusPal XXE Injection

MyBB Latest Posts on Profile Plugin 1.1 – Cross-Site Scripting

# Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting

Dell Touchpad – ‘ApMsgFwd.exe’ Denial of Service

Title: Dell Touchpad - ApMsgFwd.exe Denial Of Service

Mantis Bug Tracker 1.1.3 – ‘manage_proj_page’ PHP Code Execution (Metasploit)

##

Microsoft Windows FxCop 10/12 – XML External Entity Injection

# Exploit Title: Microsoft Windows FxCop 10/12 - XML External Entity Injection

Allok Video Splitter 3.1.12.17 – Denial of Service

###########################################################################################

FTPShell Client 6.7 – Buffer Overflow

# -*- coding: utf-8 -*-

Palo Alto Networks – ‘readSessionVarsFromFile()’ Session Corruption (Metasploit)

##

PlaySMS – ‘import.php’ (Authenticated) CSV File Upload Code Execution (Metasploit)

##

PlaySMS 1.4 – ‘sendfromfile.php?Filename’ (Authenticated) ‘Code Execution (Metasploit)

##

2345 Security Guard 3.7 – ‘2345NetFirewall.sys’ Denial of Service

# Exploit Title: 2345 Security Guard 3.7 - Denial of Service

CSP MySQL User Manager 2.3.1 – Authentication Bypass

# Exploit Title: CSP MySQL User Manager 2.3.1 - Authentication Bypass

DeviceLock Plug and Play Auditor 5.72 – Unicode Buffer Overflow (SEH)

# Exploit Title: DeviceLock Plug and Play Auditor 5.72 - Unicode Buffer Overflow (SEH)

HWiNFO 5.82-3410 – Denial of Service

#!/usr/bin/python

WordPress Plugin User Role Editor < 4.25 - Privilege Escalation

##

GNU wget – Cookie Injection

GNU Wget Cookie Injection [CVE-2018-0494]

Google Chrome V8 – Object Allocation Size Integer Overflow

There's an integer overflow in computing the required allocation size when instantiating a new javascript object.

WordPress Plugin WF Cookie Consent 1.1.3 – Cross-Site Scripting

# Exploit Title: WF Cookie Consent - Authenticated Persistent Cross-Site Scripting

Microsoft Windows WMI – Recieve Notification Exploit (Metasploit)

##

IceWarp Mail Server < 11.1.1 - Directory Traversal

Vendor: IceWarp (http://www.icewarp.com)

GPON Routers – Authentication Bypass / Command Injection

#!/bin/bash

JasperReports – (Authenticated) File Read

TIBCO’s JasperReports ( file = new File(/home/rhino/jasperreports...mcat/webapps/jasperserver,"/WEB-INF/jsp/modules/a...

LibreOffice/Open Office – ‘.odt’ Information Disclosure

#!/usr/bin/python

Easy MPEG to DVD Burner 1.7.11 – Local Buffer Overflow (SEH)

#!/usr/bin/python

WebKit – ‘WebCore::jsElementScrollHeightGetter’ Use-After-Free

Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery

# SSRF（Server Side Request Forgery） in Cockpit 0.4.4-0.5.5 (CVE-2018-9302)

xdebug < 2.5.5 - OS Command Execution (Metasploit)

##

Metasploit Framework – ‘msfd’ Remote Code Execution (via Browser) (Metasploit)

##

Metasploit Framework – ‘msfd’ Remote Code Execution (Metasploit)

##

Exim < 4.90.1 - 'base64d' Remote Code Execution

#!/usr/bin/python

Schneider Electric InduSoft Web Studio and InTouch Machine Edition – Denial of Service

What do you need to know? Tenable Research has discovered a critical remote code execution vulnerability in Schneider...

Adobe Reader PDF – Client Side Request Injection

% a PDF file using an XFA

Norton Core Secure WiFi Router – ‘BLE’ Command Injection (PoC)

# PoC command injection in BLE service of Norton Core Secure WiFi Router (CVE-2018-5234)

TBK DVR4104 / DVR4216 – Credentials Leak

# -*- coding: utf-8 -*-

Call of Duty Modern Warefare 2 – Buffer Overflow

A few years ago, I became aware of a security issue in most Call of Duty games.

WordPress Plugin Responsive Cookie Consent 1.7 / 1.6 / 1.5 – (Authenticated) Persistent Cross-Site Scripting

# Exploit Title: Wordpress Responsive Cookie Consent 1.7 / 1.6 / 1.5 - Authenticated Persistent Cross-Site Scripting

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)

##

Navicat < 12.0.27 - Oracle Connection Overflow

#!/usr/bin/python

WordPress Plugin Form Maker 1.12.20 – CSV Injection

# Exploit Title: Wordpress Plugin Form Maker version 1.12.20 vulnerable to to Formula Injection (CSV Injection)

Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root

# Exploit Title: Nagios XI 5.2.[6-9], 5.3, 5.4 Chained Remote Root

Apple macOS 10.13.2 – Double mach_port_deallocate in kextd due to Failure to Comply with MIG Ownership Rules

Here's a kextd method exposed via MIG (com.apple.KernelExtensionServer)

Apple macOS/iOS – ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules

ReportCrash is the daemon responsible for making crash dumps of crashing userspace processes.

Linux Kernel < 4.17-rc1 - 'AF_LLC' Double Free

#define _GNU_SOURCE

Jfrog Artifactory < 4.16 - Arbitrary File Upload / Remote Command Execution

# Exploit Title: Jfrog Artifactory < 4.16 - Unauthenticated Arbitrary File Upload / Remote Command Execution

WordPress Plugin WP with Spritz 1.0 – Remote File Inclusion

# Exploit Title: WordPress Plugin WP with Spritz 1.0 - Remote File Inclusion

SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response

# Exploit Title: SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response

October CMS User Plugin 1.4.5 – Persistent Cross-Site Scripting

# Exploit Title: October CMS User Plugin v1.4.5 - Persistent Cross-Site Scripting

MyBB Threads to Link Plugin 1.3 – Cross-Site Scripting

# Exploit Title: MyBB Threads to Link Plugin v1.3 - Persistent XSS

GitList 0.6 – Remote Code Execution

'''

Allok AVI to DVD SVCD VCD Converter 4.0.1217 – Buffer Overflow (SEH)

#######################################################