Exploits

RAVPower 2.000.056 – Memory Disclosure

"""

HP Connected Backup 8.6/8.8.6 – Local Privilege Escalation

#Tested on HP Connected Backup version 8.8.2.0 on Windows 7 x64

NEC Univerge SV9100/SV8100 WebPro 10.0 – Configuration Download

NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download

LiveCRM SaaS Cloud 1.0 – SQL Injection

# # # # #

Affiligator 2.1.0 – SQL Injection

# # # # #

RSVP Invitation Online 1.0 – Cross-Site Request Forgery (Update Admin)

Easy Car Script 2014 – SQL Injection

# # # # #

Wchat 1.5 – SQL Injection

# # # # #

Zechat 1.5 – SQL Injection

# # # # #

Tumder 2.1 – SQL Injection

# # # # #

Photography CMS 1.0 – Cross-Site Request Forgery (Add Admin)

New Admin

Quickad 4.0 – SQL Injection

# # # # #

Flexible Poll 1.2 – SQL Injection

# # # # #

Blizzard Update Agent – JSON RPC DNS Rebinding

All blizzard games are installed alongside a shared tool called "Blizzard Update Agent", investor.activision.com clai...

AsusWRT Router < 3.0.0.4.380.7743 - LAN Remote Code Execution

>> Unauthenticated LAN remote code execution in AsusWRT

Herospeed – ‘TelnetSwitch’ Remote Stack Overflow / Overwrite Password / Enable TelnetD

#!/usr/bin/env python2.7

Oracle JDeveloper 11.1.x/12.x – Directory Traversal

[+] Credits: John Page (aka hyp3rlinx)

Shopware 5.2.5/5.3 – Cross-Site Scripting

Document Title:

CentOS Web Panel 0.9.8.12 – Multiple Vulnerabilities

Document Title:

PHPFreeChat 1.7 – Denial of Service

# Exploit Title: phpFreeChat 1.7 and earlier - Denial of Service

OTRS 5.0.x/6.0.x – Remote Command Execution (1)

# Exploit Title: OTRS 5.0.x/6.0.x - Remote Command Execution (1)

macOS 10.13 (17A365) – Kernel Memory Disclosure due to Lack of Bounds Checking in ‘AppleIntelCapriController::getDisplayPipeCapability’

AppleIntelCapriController::getDisplayPipeCapability reads an attacker-controlled dword value from a userclient structure

Primefaces 5.x – Remote Code Execution (Metasploit)

##

Smiths Medical Medfusion 4000 – ‘DHCP’ Denial of Service

#!/usr/bin/python3

GitStack 2.3.10 – Remote Code Execution

# Exploit: GitStack 2.3.10 Unauthenticated Remote Code Execution

Zomato Clone Script – Arbitrary File Upload

# # # # #

Reservo Image Hosting Script 1.5 – Cross-Site Scripting

# Exploit Title: Reservo Image Hosting Script 1.5 - Cross Site Scripting

D-Link DSL-2640R – DNS Change

#

Belkin N600DB Wireless Router – Multiple Vulnerabilities

# Exploit Title: Belkin N600DB Wireless Router | Multiple Vulnerabilities

SugarCRM 3.5.1 – Cross-Site Scripting

# Exploit Title: sugarCRM 3.5.1 XSS refeclted

Master IP CAM 01 – Multiple Vulnerabilities

# Exploit Title: Master IP CAM 01 Multiple Vulnerabilities

Microsoft Edge Chakra JIT – Incorrect Bounds Calculation

Let's start with comments in the "GlobOpt::TrackIntSpecializedAddSubConstant" method.

Microsoft Edge Chakra – ‘JavascriptGeneratorFunction::GetPropertyBuiltIns’ Type Confusion

Here's a snippet of the method.

Microsoft Edge Chakra – Incorrect Scope Handling

// PoC:

Microsoft Edge Chakra – Deferred Parsing Makes Wrong Scopes (2)

Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is s...

Microsoft Edge Chakra JIT – Out-of-Bounds Write

// Here's the PoC demonstrating OOB write.

Microsoft Edge Chakra – ‘AsmJSByteCodeGenerator::EmitCall’ Out-of-Bounds Read

AsmJSByteCodeGenerator::EmitCall which is used to emit call insturctions doesn't check if an array identifier is used...

Microsoft Edge Chakra JIT – Stack-to-Heap Copy

If variables don't escape the scope, the variables can be allocated to the stack. However, there are some situations,...

glibc < 2.26 - 'getcwd()' Local Privilege Escalation

#define _GNU_SOURCE

pfSense < 2.1.4 - 'status_rrd_graph_img.php' Command Injection

#!/usr/bin/env python3

ImgHosting 1.5 – Cross-Site Scripting

# Exploit Title: ImgHosting Image Storage System 1.5 - Cross-Site-Scripting

Domains & Hostings Manager PRO 3.0 – Authentication Bypass

# # # # #

SysGauge Server 3.6.18 – Remote Buffer Overflow

# Exploit Title: SysGauge Server 3.6.18 - Buffer Overflow

Disk Pulse Enterprise 10.1.18 – Remote Buffer Overflow

# Exploit Title: Disk Pulse Enterprise Server v10.1.18 - Buffer Overflow

PerfexCRM 1.9.7 – Arbitrary File Upload

# Exploit Title: PerfexCRM 1.9.7 – Unrestricted php5 File upload

RISE 1.9 – ‘search’ SQL Injection

# Exploit Title: RISE Ultimate Project Manager 1.9 - SQL Injection

Oracle E-Business Suite 12.1.3/12.2.x – Open Redirect

# Exploit Title: Oracle E-Business suite Open Redirect

Adminer 4.3.1 – Server-Side Request Forgery

[+] Credits: John Page (aka hyp3rlinx)

Oracle PeopleSoft 8.5x – Remote Code Execution

# Exploit Title: RCE vulnerability in monitor service of PeopleSoft 8.54, 8.55, 8.56

ILIAS < 5.2.4 - Cross-Site Scripting

# Exploit Title: Cross Site Scripting in ILIAS CMS 5.2.3