Exploits

Ghostscript 9.21 – Type Confusion Arbitrary Command Execution (Metasploit)

##

Zyxel P-660HW-61 Firmware < 3.40(PE.11)C0 Router - Local File Inclusion

# Exploit Title: Zyxel P-660HW-61 < 3.40(PE.11)C0 - Local File Inclusion

Dahua Generation 2/3 – Backdoor Access

#!/usr/bin/python2.7

Alerton Webtalk 2.5/3.3 – Multiple Vulnerabilities

'''

HideMyAss Pro VPN Client for OS X 2.2.7.0 – Local Privilege Escalation

Source: https://www.securify.nl/advisory/SFY20170402/multiple_local_privilege_escalation_vulnerabilities_in_hidemyass...

HideMyAss Pro VPN Client for macOS 3.x – Local Privilege Escalation

Source: https://www.securify.nl/advisory/SFY20170408/local_privilege_escalation_vulnerability_in_hidemyass_pro_vpn_cl...

Tuleap Project Wiki 8.3 < 9.6.99.86 - Command Injection

# Tuleap - Command Injection in Project Wiki

MySQL < 5.6.35 / < 5.7.17 - Integer Overflow

'''

Emby MediaServer 3.2.5 – SQL Injection

Emby MediaServer 3.2.5 Boolean-based Blind SQL Injection Vulnerability

Emby MediaServer 3.2.5 – Password Reset

Emby MediaServer 3.2.5 Password Reset Vulnerability

Emby MediaServer 3.2.5 – Directory Traversal

Emby MediaServer 3.2.5 Directory Traversal File Disclosure Vulnerability

Panda Free Antivirus – ‘PSKMAD.sys’ Denial of Service

# Exploit Title: Panda Cloud Antivirus Free - 'PSKMAD.sys' - BSoD - denial of service

IrfanView 4.44 – Denial of Service

# Exploit Title: Irfanview - OtherExtensions Input Overflow

Admidio 3.2.8 – Cross-Site Request Forgery

# Exploit Title :Admidio 3.2.8 (CSRF to Delete Users)

TYPO3 Extension News – SQL Injection

# Exploit Title: TYPO3 News Module SQL Injection

Microsoft Internet Explorer 11.576.14393.0 – ‘CStyleSheetArray::BuildListOfMatchedRules’ Memory Corruption

aaaaaaaaaaaaa

Mercurial – Custom hg-ssh Wrapper Remote Code Exec (Metasploit)

##

Simple File Uploader – Arbitrary File Download

# Exploit Title: Simple File Uploader - Arbitrary File Download

Easy File Uploader – Arbitrary File Upload

# Exploit Title: Easy File Uploader - Arbitrary File Upload

Revive Ad Server 4.0.1 – Cross-Site Scripting / Cross-Site Request Forgery

---------------------------------------------------------------

OpenText Documentum Content Server – dm_bp_transition.ebs docbase Method Arbitrary Code Execution

'''

PrivateTunnel Client 2.8 – Local Buffer Overflow (SEH)

#!/usr/bin/python

Dell Customer Connect 1.3.28.0 – Local Privilege Escalation

# Exploit Dell Customer Connect 1.3.28.0 Privilege Escalation

FlySpray 1.0-rc4 – Cross-Site Scripting / Cross-Site Request Forgery

# Exploit Title: XSRF Stored FlySpray 1.0-rc4 (XSS2CSRF add admin account)

WordPress Plugin KittyCatfish 2.2 – SQL Injection

# Exploit Title: KittyCatfish 2.2 Plugin for WordPress - SQL Injection

WordPress Plugin Car Rental System 2.5 – SQL Injection

# Exploit Title: Car Rental System v2.5

WordPress Plugin Wow Viral Signups 2.1 – SQL Injection

# Exploit Title: Wow Viral Signups v2.1 WordPress Plugin SQL Injection

WordPress Plugin Wow Forms 2.1 – SQL Injection

# Exploit Title: Wow Forms v2.1 WordPress Plugin SQL Injection

LightDM (Ubuntu 16.04/16.10) – ‘Guest Account’ Local Privilege Escalation

Source: https://blogs.securiteam.com/index.php/archives/3134

Oracle PeopleSoft – ‘PeopleSoftServiceListeningConnector’ XML External Entity via DOCTYPE

Application: Oracle PeopleSoft

Oracle E-Business Suite 12.2.3 – ‘IESFOOTPRINT’ SQL Injection

Application: Oracle E-Business Suite

HPE OpenCall Media Platform (OCMP) 4.3.2 – Cross-Site Scripting / Remote File Inclusion

Source: https://blogs.securiteam.com/index.php/archives/3087

Microsoft Windows 2003 SP2 – ‘ERRATICGOPHER’ SMB Remote Code Execution

#!/usr/bin/env python

Apple Safari – Array concat Memory Corruption

Oracle VirtualBox Guest Additions 5.1.18 – Unprivileged Windows User-Mode Guest Code Double-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1227

Realtek Audio Driver 6.0.1.7898 (Windows 10) – Dolby Audio X2 Service Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1075

Microsoft Office Word – ‘.RTF’ Malicious HTA Execution (Metasploit)

##

WePresent WiPG-1000 – Command Injection (Metasploit)

##

October CMS 1.0.412 – Multiple Vulnerabilities

October CMS v1.0.412 several vulnerabilities

Joomla! Component Myportfolio 3.0.2 – ‘pid’ SQL Injection

# Exploit Title: Joomla Component Myportfolio 3.0.2 - SQL Injection

LogRhythm Network Monitor – Authentication Bypass / Command Injection

# Exploit Title: LogRhythm Network Monitor Auth Bypass Root RCE

SquirrelMail < 1.4.22 - Remote Code Execution

#!/bin/bash

Apple WebKit / Safari 10.0.2(12602.3.12.0.1) – ‘PrototypeMap::createEmptyStructure’ Universal Cross-Site Scripting

Apple WebKit / Safari 10.0.2(12602.3.12.0.1) – ‘operationSpreadGeneric’ Universal Cross-Site Scripting

Microsoft Windows 10 (Build 10586) – ‘IEETWCollector’ Arbitrary Directory/File Deletion Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1093

Microsoft Windows 10 – Runtime Broker ClipboardBroker Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1079

Microsoft Windows – ManagementObject Arbitrary .NET Serialization Remote Code Execution

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1081

Oracle VM VirtualBox – Guest-to-Host Privilege Escalation via Broken Length Handling in slirp Copy

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1086

Oracle VM VirtualBox – Environment and ioctl Unprivileged Host User to Host Kernel Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1091

Oracle VM VirtualBox – ‘virtio-net’ Guest-to-Host Out-of-Bounds Write

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1136