Exploits

Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。

类型: 漏洞条目
总量: 24,950
页码: 179

WebKit JSC – ‘JSObject::putInlineSlow’ / ‘JSValue::putToPrimitive’ Universal Cross-Site Scripting

2017-07-25 Google Security Research webapps

Friends in War Make or Break 1.7 – Authentication Bypass

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2017-07-25 Adam webapps

WordPress Plugin Ads Pro < 3.4 - Cross-Site Scripting / SQL Injection

# Exploit Title: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager = 5.0.12 AND time-based blind

2017-07-25 8bitsec webapps

vBulletin 5.1.2 < 5.1.9 - Unserialize Code Execution (Metasploit)

##

2017-07-24 Metasploit webapps

Microsoft Internet Explorer – ‘mshtml.dll’ Remote Code Execution (MS17-007)

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

2017-07-24 redr2e remote

CenturyLink ZyXEL PK5001Z Router – Root Remote Code Execution

#include

2017-07-24 oxagast remote

MAWK 1.3.3-17 – Local Buffer Overflow

#!/usr/bin/python

2017-07-24 Juan Sacco local

ManageEngine Desktop Central 10 Build 100087 – Remote Code Execution (Metasploit)

# Exploit Title: ManageEngine Desktop Central 10 Build 100087 RCE

2017-07-24 Kacper Szurek webapps

PaulShop – SQL Injection / Cross-Site Scripting

# Exploit Title: PaulShop CMS - Sql Injection and stored XSS

2017-07-24 BTIS Team webapps

WebKit – ‘WebCore::AccessibilityNodeObject::textUnderElement’ Use-After-Free

2017-07-24 Google Security Research dos

WebKit – ‘WebCore::AccessibilityRenderObject::handleAriaExpandedChanged’ Use-After-Free

aaa

2017-07-24 Google Security Research dos

WebKit – ‘WebCore::Node::nextSibling’ Use-After-Free

2017-07-24 Google Security Research dos

WebKit – ‘WebCore::RenderSearchField::addSearchResult’ Heap Buffer Overflow

2017-07-24 Google Security Research dos

WebKit – ‘WebCore::InputType::element’ Use-After-Free (1)

2017-07-24 Google Security Research dos

WebKit – ‘WebCore::RenderObject’ with Accessibility Enabled Use-After-Free

1

2017-07-24 Google Security Research dos

WebKit – ‘WebCore::Node::getFlag’ Use-After-Free

foo

2017-07-24 Google Security Research dos

WebKit – ‘WebCore::getCachedWrapper’ Use-After-Free

2017-07-24 Google Security Research dos

Razer Synapse 2.20.15.1104 – rzpnk.sys ZwOpenProcess (Metasploit)

##

2017-07-24 Metasploit local

IPFire < 2.19 Update Core 110 - Remote Code Execution (Metasploit)

##

2017-07-24 Metasploit remote

VICIdial 2.9 RC 1 < 2.13 RC1 - 'user_authorization' Command Execution (Metasploit)

##

2017-07-24 Metasploit remote

REDDOXX Appliance Build 2032 / 2.0.625 – Remote Command Execution

Advisory: Remote Command Execution as root in REDDOXX Appliance

2017-07-24 RedTeam Pentesting webapps

REDDOXX Appliance Build 2032 / 2.0.625 – Arbitrary File Disclosure

Advisory: Arbitrary File Disclosure with root Privileges via RdxEngine-API in REDDOXX Appliance

2017-07-24 RedTeam Pentesting webapps

Nitro Pro PDF – Multiple Vulnerabilities

## Vulnerabilities Summary

2017-07-24 SecuriTeam local

Linux Kernel – ‘BadIRET’ Local Privilege Escalation

# CVE-2014-9322 PoC for Linux kernel

2017-07-24 Ren Kimura local

NEC UNIVERGE UM4730 < 11.8 - SQL Injection

# Exploit Title: NEC UNIVERGE UM4730 < 11.8 SQL injection

2017-07-21 b0x41s webapps

Joomla! Component JoomRecipe 1.0.4 – ‘search_author’ SQL Injection

# Exploit Title: Joomla JoomRecipe 1.0.4 Component - Blind SQL Injection Vulnerability

2017-07-20 Teng webapps

Tilde CMS 1.01 – Multiple Vulnerabilities

# Exploit Title: Tilde CMS 1.01 Multiple Vulnerabilities

2017-07-20 Raffaele Forte webapps

SKILLS.com.au Industry App – Man In The Middle Remote Code Execution

# Exploit Title: SKILLS.com.au Industry App - Remote Code Execution via MITM

2017-07-20 intern0t remote

Virtual Postage (VPA) – Man In The Middle Remote Code Execution

# Exploit Title: Virtual Postage (VPA) - Remote Code Execution via MITM

2017-07-20 intern0t remote

WordPress Plugin IBPS Online Exam 1.0 – SQL Injection / Cross-Site Scripting

# Exploit Title: IBPS Online Exam Plugin for WordPress v1.0 - XSS SQLi

2017-07-20 8bitsec webapps

VACRON VIG-US731VE 1.0.18-09-B727 IP Camera – Authentication Bypass

# Exploit Title: IP Camera VACRON VIG-US731VE

2017-07-20 Viktoras webapps

Docker Daemon – Unprotected TCP Socket

# Exploit Title: Docker Daemon - Unprotected TCP Socket

2017-07-20 Martin Pizala local

Oracle E-Business Suite 12.x – Server-Side Request Forgery

# Exploit Title: Oracle E-Business Suite - Server Side Request Forgery

2017-07-19 Sarath Nair webapps

Sonicwall Secure Remote Access 8.1.0.2-14sv – Command Injection

Sonicwall Secure Remote Access (SRA) - Command Injection Vulnerabilities

2017-07-19 xort webapps

Sonicwall < 8.1.0.6-21sv - 'gencsr.cgi' Command Injection (Metasploit)

# Exploit Title: Sonicwall gencsr CGI Remote Command Injection Vulnerablity

2017-07-19 xort webapps

Sonicwall < 8.1.0.2-14sv - 'sitecustomization.cgi' Command Injection (Metasploit)

# Exploit Title: Sonicwall importlogo/sitecustomization CGI Remote Command Injection Vulnerablity

2017-07-19 xort webapps

Netscaler SD-WAN 9.1.2.26.561201 – Command Injection (Metasploit)

# Exploit Title: Citix SD-WAN logout cookie preauth Remote Command Injection Vulnerablity

2017-07-19 xort webapps

Citrix CloudBridge – ‘CAKEPHP’ Cookie Command Injection

POST /cgi-bin/login.cgi?redirect=/ HTTP/1.1

2017-07-19 xort webapps

Microsoft Windows 7 SP1 (x86) – GDI Palette Objects Local Privilege Escalation (MS17-017)

# E-DB Note:

2017-07-19 Saif local

Sophos Web Appliance 4.3.0.2 – ‘trafficType’ Remote Command Injection (Metasploit)

# Exploit Title: Sophos Web Appliance reporting JSON trafficType Remote Command Injection Vulnerablity

2017-07-18 xort webapps

Barracuda Load Balancer Firmware < 6.0.1.006 - Remote Command Injection (Metasploit)

# Exploit Title: Barracuda Load Balancer Firmware

2017-07-18 xort webapps

Hashicorp vagrant-vmware-fusion < 4.0.20 - Local Privilege Escalation

I'm a big fan of Hashicorp but this is an awful bug to have in software of their

2017-07-18 Mark Wadham local

PEGA Platform <= 7.2 ML0 - Missing Access Control / Cross-Site Scripting

Summary

2017-07-18 Daniel Correa webapps

Microsoft Internet Explorer 11.0.9600.18617 – ‘CMarkup::DestroySplayTree’ Memory Corruption

2)lt

2017-07-18 Google Security Research dos

Microsoft Internet Explorer 11.1066.14393.0 – VBScript Arithmetic Functions Type Confusion

2017-07-18 Google Security Research dos

Microsoft Windows Kernel – ‘IOCTL 0x120007 NsiGetParameter’ nsiproxy/netio Pool Memory Disclosure

We have discovered that the handler of the 0x120007 IOCTL in nsiproxy.sys (\\.\Nsi device) discloses portions of unin...

2017-07-18 Google Security Research dos

Belkin F7D7601 NetCam – Multiple Vulnerabilities

# Exploit Title: Belkin NetCam F7D7601 | Remote Command Execution

2017-07-17 Wadeek remote

Orangescrum 1.6.1 – Multiple Vulnerabilities

# Exploit Title: [Orangescrum 1.6.1 Multiple Vulnerabilities]

2017-07-16 tomplixsee webapps

Geneko Routers – Path Traversal

## Vulnerability Summary

2017-07-16 SecuriTeam webapps

Apple Mac OS X + Safari – Local Javascript Quarantine Bypass

Title: Mac OS X Local Javascript Quarantine Bypass

2017-07-15 Filippo Cavallarin local