Exploits

Microsoft Windows – ‘win32k!NtGdiGetOutlineTextMetricsInternalW’ Kernel Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1144

Microsoft Windows – ‘IOCTL 0x390400, operation code 0x00020000’ Kernel KsecDD Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1147

Microsoft Windows – ‘IOCTL_MOUNTMGR_QUERY_POINTS’ Kernel Mountmgr Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1150&desc=2

Microsoft Windows – ‘0x224000 IOCTL (WmiQueryAllData)’ Kernel WMIDataDevice Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1152

Microsoft Windows – ‘win32k!NtGdiEnumFonts’ Kernel Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1153

Microsoft Windows – ‘IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS’ volmgr Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1154

Microsoft Windows – ‘IOCTL_DISK_GET_DRIVE_GEOMETRY_EX’ Kernel partmgr Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1156&desc=2

Microsoft Windows – ‘IOCTL_DISK_GET_DRIVE_LAYOUT_EX’ Kernel partmgr Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1159

Microsoft Windows – ‘nt!NtQueryVolumeInformationFile (FileFsVolumeInformation)’ Kernel Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1166

Microsoft Windows – ‘nt!NtNotifyChangeDirectoryFile’ Kernel Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1169

Microsoft Windows – ‘nt!KiDispatchException’ Kernel Stack Memory Disclosure in Exception Handling

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1177

PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution

#!/usr/bin/python

Freeware Advanced Audio Coder (FAAC) 1.28 – Denial of Service

Freeware Advanced Audio Coder (FAAC) multiple vulnerabilities

SpyCamLizard 1.230 – Remote Buffer Overflow

#!/usr/bin/python

BOA Web Server 0.94.14rc21 – Arbitrary File Access

BOA Web Server 0.94.14 - Access to arbitrary files as privileges

GNU binutils – ‘rx_decode_opcode’ Buffer Overflow

Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21587

GNU binutils – ‘disassemble_bytes’ Heap Overflow

Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21580

GNU binutils – ‘bfd_get_string’ Stack Buffer Overflow

Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21581

GNU binutils – ‘decode_pseudodbg_assert_0’ Buffer Overflow

Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21586

GNU binutils – ‘ieee_object_p’ Stack Buffer Overflow

Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21582

GNU binutils – ‘print_insn_score16’ Buffer Overflow

Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21576

GNU binutils – ‘aarch64_ext_ldst_reglist’ Buffer Overflow

Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21595

WonderCMS 2.1.0 – Cross-Site Request Forgery

Sophos XG Firewall 16.05.4 MR-4 – Path Traversal

## Vulnerabilities Summary

D-Link DSL-2640B ADSL Router – ‘dnscfg’ Remote DNS Change

#!/bin/bash

UTstarcom WA3002G4 – DNS Change

#!/bin/bash

D-Link DSL-2640U – DNS Change

#!/bin/bash

Beetel BCM96338 Router – DNS Change

#!/bin/bash

Easy File Sharing HTTP Server 7.2 – POST Buffer Overflow (Metasploit)

##

IBM Informix Dynamic Server – Code Injection / Remote Code Execution

#!/usr/local/bin/python

WebKit JSC – JSGlobalObject::haveABadTime Causes Type Confusions

WebKit JSC – arrayProtoFuncSplice does not Initialize all Indices

function gc() {

WebKit JSC – JIT Optimization Check Failed in IntegerCheckCombiningPhase::handleBlock

function f() {

WebKit JSC – ‘Intl.getCanonicalLocales’ Heap Buffer Overflow

Object.prototype.__defineGetter__(1000, () => 2);

iBall Baton iB-WRA150N – DNS Change

#!/bin/bash

VX Search Enterprise 9.7.18 – Local Buffer Overflow

import os

Avast aswSnx.sys Kernel Driver 11.1.2253 – Memory Corruption Privilege Escalation

#include

Joomla! Component JoomRecipe 1.0.3 – SQL Injection

# # # # #

Easy File Sharing Web Server 7.2 – ‘POST’ Remote Buffer Overflow (DEP Bypass)

#!/usr/bin/python

Google Chrome – V8 Private Property Arbitrary Code Execution

// Source: https://github.com/secmob/pwnfest2016/

HP PageWide Printers / HP OfficeJet Pro Printers (OfficeJet Pro 8210) – Arbitrary Code Execution

##

Sudo 1.8.20 – ‘get_process_ttyname()’ Local Privilege Escalation

#define _GNU_SOURCE

KBVault MySQL 0.16a – Arbitrary File Upload

# Exploit Title: [KBVault MySQL v0.16a - Unauthenticated File Upload to Run Code]

LG MRA58K – Out-of-Bounds Heap Read in CAVIFileParser::Destroy Resulting in Invalid Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1221

LG MRA58K – Missing Bounds-Checking in AVI Stream Parsing

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1206

LG MRA58K – ‘ASFParser::ParseHeaderExtensionObjects’ Missing Bounds-Checking

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1222

Easy MOV Converter 1.4.24 – ‘Enter User Name’ Local Buffer Overflow (SEH)

#!/usr/bin/python

GStreamer gst-plugins-bad Plugin – NULL Pointer Dereference

Source: https://bugzilla.gnome.org/show_bug.cgi?id=775120

Disk Pulse 9.7.26 – ‘Add Directory’ Local Buffer Overflow

#!/usr/bin/python

Easy File Sharing Web Server 7.2 – ‘POST’ Remote Buffer Overflow

#!/usr/bin/python