Exploits

Joomla! Component JEXTN FAQ Pro 4.0.0 – ‘id’ SQL Injection

# # # # #

Biometric Shift Employee Management System 3.0 – Local File Disclosure

# # # # #

Sendroid < 6.5.0 - SQL Injection

# Exploit Title: Sendroid - Bulk SMS Portal, Marketing Script( 5.0.0 - 6.5.0 ) - SQL Injection

SilverStripe CMS 3.6.2 – CSV Excel Macro Injection

Exploit Title: SilverStripe CMS - 3.6.2 CSV Excel Macro Injection

Trustwave SWG 11.8.0.27 – SSH Unauthorized Access

## Vulnerability Summary

Huawei Router HG532 – Arbitrary Command Execution

import threading, sys, time, random, socket, re, os, struct, array, requests

Iopsys Router – ‘dhcp’ Remote Code Execution

#!/usr/bin/python

Vitek – Remote Command Execution / Information Disclosure (PoC)

[STX]

Samsung Internet Browser – SOP Bypass (Metasploit)

##

Conarc iChannel – Improper Access Restrictions

# Exploit Title: Conarc iChannel - Unauthenticated Access/Default Webserver Misconfiguration allows for compromise of...

Ability Mail Server 3.3.2 – Cross-Site Scripting

# Exploit Title: Ability Mail Server 3.3.2 Persistent Cross Site Scripting (XSS)

BEIMS ContractorWeb 5.18.0.0 – SQL Injection

# Exploit Title: SQL Injection

Microsoft Windows Kernel – ‘NtQueryVirtualMemory(MemoryMappedFilenameInformation)’ Double-Write Ring-0 Address Leak

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1456

BrightSign Digital Signage – Multiple Vulnerablities

# Exploit Title: BrightSign Digital Signage (Multiple Vulnerabilities)

Joomla! Component NextGen Editor 2.1.0 – ‘plname’ SQL Injection

# # # # #

Microsoft Windows – ‘jscript!NameTbl::GetValDef’ Use-After-Free

Microsoft Internet Explorer 11 – ‘jscript!JSONStringifyObject’ Use-After-Free

Microsoft Windows – ‘jscript!RegExpComp::Compile’ Heap Overflow Through IE or Local Network via WPAD

Microsoft Windows – jscript.dll ‘Array.sort’ Heap Overflow

Microsoft Windows – ‘jscript!JsArraySlice’ Uninitialized Variable

Microsoft Windows – ‘jscript!RegExpFncObj::LastParen’ Out-of-Bounds Read

Intel Content Protection HECI Service – Type Confusion Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1358

Tuleap 9.6 – Second-Order PHP Object Injection (Metasploit)

##

Jenkins – XStream Groovy classpath Deserialization (Metasploit)

##

Trend Micro Smart Protection Server – Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control

# Trend Micro Smart Protection Server Multiple Vulnerabilities

Ichano AtHome IP Cameras – Multiple Vulnerabilities

## Vulnerabilities Summary

Ciuis CRM 1.0.7 – SQL Injection

# Exploit Title: [Ciuis CRM v 1.0.7 Sql Injection]

Monstra CMS 3.0.4 – (Authenticated) Arbitrary File Upload / Remote Code Execution

Exploit Title: Monstra CMS - 3.0.4 RCE

Cells Blog 3.5 – ‘bgid’ / ‘fmid’ / ‘fnid’ SQL Injection

# # # # #

Joomla! Component JB Visa 1.0 – ‘visatype’ SQL Injection

# # # # #

Joomla! Component Guru Pro – ‘promocode’ SQL Injection

# # # # #

CDex 1.96 – Buffer Overflow (PoC)

#!/usr/bin/python

Outlook for Android – Attachment Download Directory Traversal

'''

Zoom Linux Client 2.0.106600.0904 – Command Injection

[CONVISO-17-003] - Zoom Linux Client Command Injection Vulnerability (RCE)

Zoom Linux Client 2.0.106600.0904 – Stack-Based Buffer Overflow (PoC)

[CONVISO-17-002] - Zoom Linux Client Stack-based Buffer Overflow Vulnerability

Western Digital MyCloud – ‘multi_uploadify’ File Upload (Metasploit)

##

Joomla! Component User Bench 1.0 – ‘userid’ SQL Injection

# # # # #

Joomla! Component My Projects 2.0 – SQL Injection

# # # # #

GoAhead Web Server 2.5 < 3.6.5 - HTTPd 'LD_PRELOAD' Remote Code Execution

#!/usr/bin/python

ITGuard-Manager 0.0.0.1 – Remote Code Execution

# Vulnerability Title: ITGuard-Manager V0.0.0.1 PreAuth Remote Code Execution

Sync Breeze 10.2.12 – Denial of Service

=============================================

Linux kernel < 4.10.15 - Race Condition Privilege Escalation

#include

Movie Guide 2.0 – SQL Injection

# # # # #

FS Lynda Clone 1.0 – SQL Injection

Readymade Video Sharing Script 3.2 – HTML Injection

# # # # #

Paid To Read Script 2.0.5 – ‘uid’ / ‘fnum’ / ‘fn’ SQL Injection

# # # # #

Bus Booking Script 1.0 – ‘txtname’ SQL Injection

Piwigo 2.9.1 – ‘cat_true’ / ‘cat_false’ SQL Injection

# # # # #

Microsoft Office – Dynamic Data Exchange ‘DDE’ Payload Delivery (Metasploit)

##

Dup Scout Enterprise – ‘Login’ Buffer Overflow (Metasploit)

##