Exploits

NetGain EM 7.2.647 build 941 – Authentication Bypass / Local File Inclusion

'''

Dup Scout Enterprise 9.7.18 – ‘.xml’ Local Buffer Overflow

author = '''

Samba 3.5.0 – Remote Code Execution

#!/usr/bin/env python

Apple macOS/iOS – Memory Corruption Due to Bad Bounds Checking in NSCharacterSet Coding for NSKeyedUnarchiver

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1168

Apple macOS/iOS – NSUnarchiver Heap Corruption Due to Lack of Bounds Checking in [NSBuiltinCharacterSet initWithCoder:]

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1170

Apple macOS/iOS – ‘TIKeyboardLayout initWithCoder:’ NSKeyedArchiver Heap Corruption Due to Rounding Error

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1172

Apple macOS/iOS – ‘CAMediaTimingFunctionBuiltin’ NSKeyedArchiver Memory Corruption Due to Lack of Bounds Checking

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1175

Apple macOS/iOS Kernel – Use-After-Free Due to Bad Locking in Unix Domain Socket File Descriptor Externalization

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1123

Apple macOS/iOS Kernel – Memory Disclosure Due to Lack of Bounds Checking in netagent Socket Option Handling

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1140

Apple macOS – Lack of Bounds Checking in HIServices Custom CFObject Serialization Local Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1219

VX Search Enterprise 9.5.12 – GET Buffer Overflow (Metasploit)

##

VMware Workstation for Linux 12.5.2 build-4638234 – ALSA Configuration Host Local Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1142

Apple macOS – ’32-bit syscall exit’ Kernel Register Leak

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1149

Apple macOS – ‘stackshot’ Raw Frame Pointers

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164

Linux Kernel 4.11 – eBPF Verifier Log Leaks Lower Half of map Pointer

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1251

Aerohive HiveOS 5.1r5 < 6.1r5 - Remote Code Execution

#!/usr/bin/python3

PlaySMS 1.4 – ‘import.php’ Remote Code Execution

# Exploit Title: PlaySMS 1.4 Remote Code Execution using Phonebook import Function in import.php

Secure Auditor 3.0 – Directory Traversal

[+] Credits: John Page aka HYP3RLINX

KMCIS CaseAware – Cross-Site Scripting

# Exploit Title: CaseAware Cross Site Scripting Vulnerability

Mantis Bug Tracker 1.3.10/2.3.0 – Cross-Site Request Forgery

[+] Credits: John Page a.k.a hyp3rlinx

Joomla! 3.7.0 – ‘com_fields’ SQL Injection

# Exploit Title: Joomla 3.7.0 - Sql Injection

Oracle PeopleSoft – Server-Side Request Forgery

Application: Oracle PeopleSoft

Belden Garrettcom 6K/10K Switches – Authentication Bypass / Memory Corruption

Introduction

SAP Business One for Android 1.2.3 – XML External Entity Injection

Exploit Title: Blind XXE (XML External Entity)in SAP

ManageEngine ServiceDesk Plus 9.0 – Authentication Bypass

Title: ManageEngine ServiceDesk Plus Application Compromise

PlaySMS 1.4 – Remote Code Execution

Exploit Title: PlaySMS 1.4 Remote Code Execution (to Poisoning admin log)

D-Link DIR-600M Wireless N 150 – Authentication Bypass

# Exploit Title: D-Link DIR-600M Wireless N 150 Login Page Bypass

Sure Thing Disc Labeler 6.2.138.0 – Buffer Overflow (PoC)

# Exploit Title: Sure Thing Disc Labeler - Stack Buffer Overflow (PoC)

Tecnovision DLX Spot – SSH Backdoor Access

# Exploit Title: DlxSpot - Player4 LED video wall - Hardcoded Root SSH Password.

Tecnovision DLX Spot – Authentication Bypass

# Exploit Title: DlxSpot - Player4 LED video wall - Admin Interface SQL

Tecnovision DLX Spot – Arbitrary File Upload

# Exploit Title: DlxSpot - Player4 LED video wall - Arbitrary File Upload

KDE 4/5 – ‘KAuth’ Local Privilege Escalation

// cc -Wall smb0k.c -pedantic -std=c11

Apple iOS < 10.3.2 - Notifications API Denial of Service

# Exploit Title: Apple iOS < 10.3.2 - Notifications API Denial of Service

Adobe Flash – AVC Deblocking Out-of-Bounds Read

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1171

Adobe Flash – Margin Handling Heap Corruption

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1174

Adobe Flash – Out-of-Bounds Read in Getting TextField Width

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1211

Microsoft Windows – COM Aggregate Marshaler/IRemUnknown2 Type Confusion Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1107

Microsoft Windows – Running Object Table Register ROTFLAGS_ALLOWANYCLIENT Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1112

Dup Scout Enterprise 9.5.14 – GET Buffer Overflow (Metasploit)

##

Serviio Media Server – checkStreamUrl Command Execution (Metasploit)

##

WordPress Plugin PHPMailer 4.6 – Host Header Command Injection (Metasploit)

##

BuilderEngine 3.5.0 – Arbitrary File Upload and Execution (Metasploit)

##

Oracle PeopleSoft – XML External Entity to SYSTEM Remote Code Execution

#!/usr/bin/python3

Mozilla Firefox 50 < 55 - Stack Overflow Denial of Service

INFOR EAM 11.0 Build 201410 – ‘filtervalue’ SQL Injection

SQL injection in INFOR EAM V11.0 Build 201410 search fields (web/base/..) via filtervalue parameter

INFOR EAM 11.0 Build 201410 – Persistent Cross-Site Scripting via Comment Fields

Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields

Microsoft Windows 8/8.1/2012 R2 (x64) – ‘EternalBlue’ SMB Remote Code Execution (MS17-010)

#!/usr/bin/python

Microsoft Windows 7/2008 R2 – ‘EternalBlue’ SMB Remote Code Execution (MS17-010)

#!/usr/bin/python

Oracle PeopleSoft Enterprise PeopleTools < 8.55 - Remote Code Execution Via Blind XML External Entity

#!/usr/bin/python3

Mailcow 0.14 – Cross-Site Request Forgery

[+] Credits: John Page a.k.a hyp3rlinx