Exploits

WordPress Plugin Site Editor 1.1.1 – Local File Inclusion

Product: Site Editor Wordpress Plugin - https://wordpress.org/plugins/site-editor/

Linux Kernel < 4.15.4 - 'show_floppy' KASLR Address Leak

#include

Google Software Updater macOS – Unsafe use of Distributed Objects Privilege Escalation

Google software updater ships with Chrome on MacOS and installs a root service (com.google.Keystone.Daemon.UpdateEngine)

Microsoft Windows Kernel – ‘NtQueryVirtualMemory(MemoryMappedFilenameInformation)’ 64-bit Pool Memory Disclosure

We have discovered that the nt!NtQueryVirtualMemory system call invoked with the 2 information class (MemoryMappedFil...

Microsoft Windows Kernel – ‘NtQueryInformationThread(ThreadBasicInformation)’ 64-bit Stack Memory Disclosure

We have discovered that the nt!NtQueryInformationThread system call invoked with the 0 information class (ThreadBasic...

Microsoft Windows Kernel – ‘nt!KiDispatchException’ 64-bit Stack Memory Disclosure

We have discovered a new Windows kernel memory disclosure vulnerability in the creation and copying of a EXCEPTION_RE...

Microsoft Windows Kernel – ‘nt!NtWaitForDebugEvent’ 64-bit Stack Memory Disclosure

We have discovered that the nt!NtWaitForDebugEvent system call discloses portions of uninitialized kernel stack memor...

Internet Explorer – ‘RegExp.lastMatch’ Memory Disclosure

There is a vulnerability in Internet Explorer that could potentially be used for memory disclosure.

Microsoft Windows – Desktop Bridge VFS Privilege Escalation

Windows: Windows: Desktop Bridge VFS EoP

Microsoft Windows – Desktop Bridge Virtual Registry Arbitrary File Read/Write Privilege Escalation

Microsoft Windows – Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write Privilege Escalation

Windows: Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write EoP

Kamailio 5.1.1 / 5.1.0 / 5.0.0 – Off-by-One Heap Overflow

'''

Intelbras Telefone IP TIP200 LITE – Local File Disclosure

# Exploit Title: [INTELBRAS TELEFONE IP TIP200/200 LITE Local File Include]

Vehicle Sales Management System – Multiple Vulnerabilities

# Exploit Title: VSMS Multiple Vulnerabilities

Coship RT3052 Wireless Router – Persistent Cross-Site Scripting

######################################################################################

Cisco node-jos < 0.11.0 - Re-sign Tokens

#!/usr/bin/env python3

OpenSSH < 6.6 SFTP - Command Execution

# OpenSSH 8 else 32

Firefox 46.0.1 – ASM.JS JIT-Spray Remote Code Execution

CVE-2016-2819 and ASM.JS JIT-Spray

Firefox 44.0.2 – ASM.JS JIT-Spray Remote Code Execution

CVE-2016-1960 and ASM.JS JIT-Spray

Contec Smart Home 4.15 – Unauthorized Password Reset

# Title : Contec smart home 4.15 Unauthorized Password Reset

Unitrends UEB 10.0 – Root Remote Code Execution

# Exploit Title: Unauthenticated root RCE for Unitrends UEB 10.0

Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation

// Tested on:

WordPress Plugin Duplicator 1.2.32 – Cross-Site Scripting

# Exploit Title : Duplicator Wordpress Migration Plugin Reflected Cross Site Scripting (XSS)

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

// Exploit Title: RCE in PATCH requests in Spring Data REST

MikroTik RouterOS < 6.41.3/6.42rc27 - SMB Buffer Overflow

#!/usr/bin/env python

Android DRM Services – Buffer Overflow

#include

Microsoft Windows Kernel (7 x86) – Local Privilege Escalation (MS17-017)

#include

SAP NetWeaver AS JAVA CRM – Log injection Remote Command Execution

#!/usr/bin/env python

SecurEnvoy SecurMail 9.1.501 – Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory < 20180312-0 >

Tuleap 9.17.99.189 – Blind SQL Injection

===============================================================================

Allok QuickTime to AVI MPEG DVD Converter 3.6.1217 – Buffer Overflow

###############################################################################

ManageEngine Applications Manager 13.5 – Remote Code Execution (Metasploit)

##

DEWESoft X3 SP1 (x64) – Remote Command Execution

[+] Credits: John Page (aka hyp3rlinx)

Prisma Industriale Checkweigher PrismaWEB 1.21 – Hard-Coded Credentials

Prisma Industriale Checkweigher PrismaWEB 1.21 Authentication Bypass

TextPattern 4.6.2 – ‘qty’ SQL Injection

=============================================

Advantech WebAccess < 8.3 - Directory Traversal / Remote Code Execution

#!/usr/bin/python2.7

SC 7.16 – Stack-Based Buffer Overflow

# Exploit Author: Juan Sacco - http://www.exploitpack.com

Eclipse Equinoxe OSGi Console – Command Execution (Metasploit)

##

ACL Analytics 11.X – 13.0.0.579 – Arbitrary Code Execution

# Exploit Title: Arbitrary Code Execution

MikroTik RouterOS < 6.38.4 (MIPSBE) - 'Chimay Red' Stack Clash Remote Code Execution

#!/usr/bin/env python3

MikroTik RouterOS < 6.38.4 (x86) - 'Chimay Red' Stack Clash Remote Code Execution

#!/usr/bin/env python2

Sony Playstation 4 (PS4) 4.55 < 5.50 - WebKit Code Execution (PoC)

function makeid() {

WebLog Expert Enterprise 9.4 – Authentication Bypass

[+] Credits: John Page (aka hyp3rlinx)

WebLog Expert Enterprise 9.4 – Denial of Service

[+] Credits: John Page (aka hyp3rlinx)

Bacula-Web < 8.0.0-rc2 - SQL Injection

# Exploit Title: Multiple SQL injection vulnerabilities in Bacula-Web

Memcached 1.5.5 – ‘Memcrashed ‘ Insufficient Control of Network Message Volume Denial of Service With Shodan API

#-- coding: utf8 --

Redaxo CMS Addon MyEvents 2.2.1 – SQL Injection

# Exploit Title: Redaxo CMS Addon MyEvents SQL Injection [ Backend ]

antMan 0.9.0c – Authentication Bypass

# Exploit Title: antMan

Softros Network Time System Server 2.3.4 – Denial of Service

[+] Credits: John Page (aka hyp3rlinx)

Bravo Tejari Web Portal – Cross-Site Request Forgery

Exploit Title: Bravo Tejari Web Portal-CSRF