Exploits

WDTV Live SMP 2.03.20 – Remote Password Reset

#######################################################

Firefox 50.0.1 – ASM.JS JIT-Spray Remote Code Execution

FTPGetter 5.89.0.85 – Remote Buffer Overflow (SEH)

#!/usr/bin/python

CyberArk Viewfinity 5.5.10.95 – Local Privilege Escalation

# Exploit Title: Privilege Escalation via CyberArk Viewfinity

Dasan Networks GPON ONT WiFi Router H64X Series – Authentication Bypass

Dasan Networks GPON ONT WiFi Router H64X Series Authentication Bypass

Dasan Networks GPON ONT WiFi Router H64X Series – Cross-Site Request Forgery

Dasan Networks GPON ONT WiFi Router H64X Series Cross-Site Request Forgery

Dasan Networks GPON ONT WiFi Router H64X Series – Privilege Escalation

Dasan Networks GPON ONT WiFi Router H64X Series Privilege Escalation

Dasan Networks GPON ONT WiFi Router H64X Series – Configuration Download

Dasan Networks GPON ONT WiFi Router H64X Series System Config Download

OrientDB – Code Execution

## Vulnerability Summary

Skype for Business 2016 – Cross-Site Scripting

# Exploit Title: Skype for Business 2016 XSS Injection - CVE-2017-8550

WordPress Plugin Sabai Discuss – Cross-Site Scripting

# Exploit Title: Sabai Discuss Wordpress Plugin Stored XSS vulnerability

360 Total Security – Local Privilege Escalation

## Vulnerability Summary

DataTaker DT80 dEX 1.50.012 – Information Disclosure

[+] Title: DataTaker DT80 dEX 1.50.012 - Sensitive Configurations Exposure

NfSen < 1.3.7 / AlienVault OSSIM 4.3.1 - 'customfmt' Command Injection

# Exploit Title: NfSen/AlienVault remote root exploit (command injection in customfmt parameter)

Microsoft Windows 7/8.1/2008 R2/2012 R2/2016 R2 – ‘EternalBlue’ SMB Remote Code Execution (MS17-010)

#!/usr/bin/python

NfSen < 1.3.7 / AlienVault OSSIM < 5.3.6 - Local Privilege Escalation

# Exploit Title: Local root exploit affecting NfSen

NfSen < 1.3.7 / AlienVault OSSIM 5.3.4 - Command Injection

# Exploit Title: NfSen/AlienVault remote root exploit (IPC query command injection)

Pelco Sarix/Spectra Cameras – Cross-Site Request Forgery / Cross-Site Scripting

Schneider Electric Pelco Sarix/Spectra Cameras Multiple XSS Vulnerabilities

Pelco Sarix/Spectra Cameras – Cross-Site Request Forgery (Enable SSH Root Access)

Schneider Electric Pelco Sarix/Spectra Cameras CSRF Enable SSH Root Access

Pelco Sarix/Spectra Cameras – Remote Code Execution

Schneider Electric Pelco Sarix/Spectra Cameras Root Remote Code Execution

Pelco VideoXpert 1.12.105 – Local Privilege Escalation

Schneider Electric Pelco VideoXpert Privilege Escalations

Pelco VideoXpert 1.12.105 – Directory Traversal

Schneider Electric Pelco VideoXpert Core Admin Portal Directory Traversal

Pelco VideoXpert 1.12.105 – Information Disclosure

Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information

Easy File Sharing Web Server 7.2 – GET ‘PassWD’ Remote Buffer Overflow (DEP Bypass)

#!/usr/bin/python

Firefox 54.0.1 – Denial of Service

[+] Credits: John Page aka hyp3rlinx

Yaws 1.91 – Remote File Disclosure

[+] Credits: John Page aka hyp3rlinx

Apache Struts 2.3.x Showcase – Remote Code Execution

#!/usr/bin/python

Counter Strike: Condition Zero – ‘.BSP’ Map File Code Execution

#!/usr/bin/env python

LibTIFF – ‘tif_dirwrite.c’ Denial of Service

Source: http://bugzilla.maptools.org/show_bug.cgi?id=2712

LibTIFF – ‘tif_jbig.c’ Denial of Service

Source: http://bugzilla.maptools.org/show_bug.cgi?id=2706

LibTIFF – ‘_TIFFVGetField (tiffsplit)’ Out-of-Bounds Read

Source: http://bugzilla.maptools.org/show_bug.cgi?id=2693

GoAutoDial CE 3.3 – Authentication Bypass / Command Injection (Metasploit)

##

Lepide Auditor Suite – ‘createdb()’ Web Console Database Injection / Remote Code Execution

#!/usr/bin/python

Joomla! 3.7 – SQL Injection

--==[[ code for India ]]==--

WordPress Plugin WatuPRO 5.5.1 – SQL Injection

#####################################

OpenDreamBox 2.0.0 Plugin WebAdmin – Remote Code Execution

# Exploit Title: OpenDreamBox 2.0.0 - Plugin WebAdmin RCE

Zookeeper 3.5.2 Client – Denial of Service

#!/usr/bin/python

Joomla! Component Joomanager 2.0.0 – ‘com_Joomanager’ Arbitrary File Download

#!/usr/bin/python2

Humax HG100R 2.0.6 – Backup File Download

# coding: utf-8

LG MRA58K – ‘ASFParser::SetMetaData’ Stack Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1226

Google Chrome – Out-of-Bounds Access in RegExp Stubs

There is an out-of-bounds access in RegExp.prototype.exec and RegExp.prototype.test. The code defined in BranchIfFast...

eVestigator Forensic PenTester – Man In The Middle Remote Code Execution

# Exploit Title: eVestigator Forensic PenTester v1 - Remote Code Execution via MITM

BestSafe Browser – Man In The Middle Remote Code Execution

# Exploit Title: BestSafe Browser FREE NoAds - Remote Code Execution

Australian Education App – Remote Code Execution

# Exploit Title: Australian Education App - Remote Code Execution

Odoo CRM 10.0 – Code Execution

## Vulnerability Summary

ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit)

##

Veritas/Symantec Backup Exec – SSL NDMP Connection Use-After-Free (Metasploit)

##

Flat Assembler 1.7.21 – Local Buffer Overflow

#!/usr/bin/python

Easy File Sharing Web Server 7.2 – Account Import Local Buffer Overflow (SEH)

#!/usr/bin/python

Easy File Sharing Web Server 7.2 – Unrestricted File Upload

##################################