Exploits

Adobe Flash – Out-of-Bounds Write in MP4 Edge Processing

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1322

Adobe Flash – Out-of-Bounds Read in applyToRange

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1323

FLIR Thermal Camera PT-Series (PT-334 200562) – Root Remote Code Execution

#!/bin/bash

FLIR Thermal Camera F/FC/PT/D – Information Disclosure

FLIR Systems FLIR Thermal Camera F/FC/PT/D Multiple Information Disclosures

FLIR Thermal Camera F/FC/PT/D – SSH Backdoor Access

FLIR Systems FLIR Thermal Camera F/FC/PT/D Hard-Coded SSH Credentials

FLIR Thermal Camera FC-S/PT – Command Injection

FLIR Systems FLIR Thermal Camera FC-S/PT Authenticated OS Command Injection

FLIR Thermal Camera F/FC/PT/D – Stream Disclosure

FLIR Systems FLIR Thermal Camera F/FC/PT/D Stream Disclosure

HBGK DVR 3.0.0 build20161206 – Authentication Bypass

# Exploit Title: HBGK DVR V3.0.0 build20161206 - Authentication Bypass

CyberLink LabelPrint < 2.5 - Local Buffer Overflow (SEH Unicode)

#!/usr/bin/python

Stock Photo Selling 1.0 – SQL Injection

#!/usr/bin/perl -w

Lending And Borrowing – ‘pid’ SQL Injection

# # # # #

Multi Level Marketing – SQL Injection

# # # # #

Cash Back Comparison Script 1.0 – SQL Injection

#!/usr/bin/perl -w

Claydip Airbnb Clone 1.0 – Arbitrary File Upload

# # # # #

Secure E-commerce Script 1.02 – ‘sid’ SQL Injection

# Exploit Title: Secure E-commerce Script v1.02 - SQL Injection

PHP Auction Ecommerce Script 1.6 – SQL Injection

# Exploit Title: PHP Auction Ecommerce Script v1.6 - SQL Injection

JitBit HelpDesk < 9.0.2 - Authentication Bypass

# Exploit Title: JitBit HelpDesk

PHPMyFAQ 2.9.8 – Cross-Site Scripting (1)

# Exploit Title: phpMyFAQ 2.9.8 Stored XSS

Linux Kernel < 4.13.1 - BlueTooth Buffer Overflow (PoC)

# Exploit Title: BlueBorne - Proof of Concept - Unarmed/Unweaponized -

Microsoft Edge – Chakra Incorrectly Parses Object Patterns

function f() {

Microsoft Edge Chakra – Deferred Parsing Makes Wrong Scopes

let h = function f(a0 = (function () {

Microsoft Edge Chakra – ‘Parser::ParseCatch’ Does Not Handle ‘eval()’ (Denial of Service)

function f() {

Microsoft Edge Chakra – ‘JavascriptFunction::ReparseAsmJsModule’ Incorrectly Re-parses

function Module() {

Disk Pulse Enterprise 9.9.16 – GET Buffer Overflow (Metasploit)

##

ERS Data System 1.8.1 – Java Deserialization

# Exploit Title: ERS Data System 1.8.1 Deserialize Vulnerability

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)

# E-DB Note: https://www.alphabot.com/security/blog/2017/java/Apache-Tomcat-RCE-CVE-2017-12617.html

Android Bluetooth – ‘Blueborne’ Information Leak (2)

from pwn import *

HPE < 7.2 - Java Deserialization

#!/usr/bin/env python

Microsoft Edge 38.14393.1066.0 – Memory Corruption with Partial Page Loading

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1309

Microsoft Edge 38.14393.1066.0 – ‘COptionsCollectionCacheItem::GetAt’ Out-of-Bounds Read

DenyAll WAF < 6.3.0 - Remote Code Execution (Metasploit)

##

Digirez 3.4 – Cross-Site Request Forgery (Update Admin)

#!/usr/local/bin/python

Digileave 1.2 – Cross-Site Request Forgery (Update Admin)

#!/usr/local/bin/python

DigiAffiliate 1.4 – Cross-Site Request Forgery (Update Admin)

#!/usr/local/bin/python

iBall ADSL2+ Home Router – Authentication Bypass

# Exploit Title: iBall ADSL2+ Home Router Authentication Bypass Vulnerability

Microsoft Windows Kernel – ‘win32k!NtGdiGetGlyphOutline’ Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1267&desc=2

Microsoft Windows Kernel – ‘win32k!NtGdiGetPhysicalMonitorDescription’ Stack Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1268

Microsoft Windows Kernel – ‘nt!NtSetIoCompletion / nt!NtRemoveIoCompletion’ Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1269

Microsoft Windows Kernel – ‘win32k.sys’ ‘.TTF’ Font Processing Out-of-Bounds Reads/Writes with Malformed ‘fpgm’ table ‘win32k!bGeneratePath’ (Denial of Service)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1273

Apache < 2.2.34 / < 2.4.27 - OPTIONS Memory Leak

#!/usr/bin/env python3

Microsoft Windows Kernel – ‘win32k.sys’ ‘.TTF’ Font Processing Out-of-Bounds Read with Malformed ‘glyf’ Table ‘win32k!fsc_CalcGrayRow’ (Denial of Service)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1274

Microsoft Windows Kernel – ‘win32k!NtGdiGetFontResourceInfoInternalW’ Stack Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1275

Microsoft Windows Kernel – ‘win32k!NtGdiEngCreatePalette’ Stack Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1276&desc=2

Microsoft Windows Kernel – ‘win32k!NtGdiDoBanding’ Stack Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1304

Microsoft Windows Kernel – ‘win32k!NtQueryCompositionSurfaceBinding’ Stack Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1307

Netdecision 5.8.2 – Local Privilege Escalation

// Netdecision.cpp : Defines the entry point for the console application.

WordPress Plugin Content Timeline – SQL Injection

# Exploit Title: Multiple Blind SQL Injections Wordpress Plugin: Content Timeline

PTCEvolution 5.50 – SQL Injection

# # # # #

Contact Manager 1.0 – ‘femail’ SQL Injection

# # # # #

UTStar WA3002G4 ADSL Broadband Modem – Authentication Bypass

# Exploit Title: UTStar WA3002G4 ADSL Broadband Modem Authentication Bypass Vulnerability