Exploits

Oracle VM VirtualBox 5.1.14 r112924 – Unprivileged Host User to Host Kernel Privilege Escalation via ALSA config

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1141

Oracle VM VirtualBox 5.0.32 r112930 (x64) – Windows Process COM Injection Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1103

Huawei HG532n – Command Injection (Metasploit)

##

Dmitry 1.3a – Local Buffer Overflow (PoC)

################

Tenable Appliance < 4.5 - Root Remote Code Execution

#!/bin/bash

pinfo 0.6.9 – Local Buffer Overflow (PoC)

# Title: pinfo v0.6.9 - Local Buffer Overflow

Microsoft Word – ‘.RTF’ Remote Code Execution

#!/usr/bin/env python

Microsoft Windows – SMB Remote Code Execution Scanner (MS17-010) (Metasploit)

##

WinSCP 5.9.4 – ‘LIST’ Denial of Service (Metasploit)

##

Mantis Bug Tracker 1.3.0/2.3.0 – Password Reset

[+] Credits: John Page a.k.a hyp3rlinx

Linux Kernel 4.8.0 UDEV < 232 - Local Privilege Escalation

# Title: Linux Kernel 4.8.0 udev 232 - Privilege Escalation

Concrete5 CMS 8.1.0 – ‘Host’ Header Injection

[+] Credits: John Page a.k.a hyp3rlinx

VirusChaser 8.0 – Local Buffer Overflow (SEH)

# Exploit Title: Virus Chaser 8.0 - Scanner component, SEH Overflow

Mozilla Firefox – Address Bar Spoofing

GNS3 Mac OS-X 1.5.2 – ‘ubridge’ Local Privilege Escalation

#!/bin/sh

Adobe Creative Cloud Desktop Application < 4.0.0.185 - Local Privilege Escalation

[+] Credits: John Page aka hyp3rlinx

Microsoft Windows Kernel – ‘win32k.sys’ Multiple ‘NtGdiGetDIBitsInternal’ System Call

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1078

Microsoft Windows Kernel – ‘win32kfull!SfnINLPUAHDRAWMENUITEM’ Stack Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1192

agorum core Pro 7.8.1.4-251 – Cross-Site Request Forgery

agorum core Pro 7.8.1.4-251 – Persistent Cross-Site Scripting

Alienvault OSSIM/USM 5.3.4/5.3.5 – Remote Command Execution (Metasploit)

##

Solaris 7 < 11 (SPARC/x86) - 'EXTREMEPARR' dtappgather Privilege Escalation

#!/bin/ksh

Cisco Catalyst 2960 IOS 12.2(55)SE11 – ‘ROCEM’ Remote Code Execution

#!/usr/bin/python

Cisco Catalyst 2960 IOS 12.2(55)SE1 – ‘ROCEM’ Remote Code Execution

#!/usr/bin/python

Proxifier for Mac 2.18 – Multiple Vulnerabilities

Source: https://www.securify.nl/advisory/SFY20170401/multiple_local_privilege_escalation_vulnerabilities_in_proxifier...

Proxifier for Mac 2.17/2.18 – Privesc Escalation

# Source: https://m4.rkw.io/blog/cve20177643-local-root-privesc-in-proxifier-for-mac--218.html

MyClassifiedScript 5.1 – SQL Injection

# # # # #

WordPress Plugin Spider Event Calendar 1.5.51 – Blind SQL Injection

=============================================

Social Directory Script 2.0 – SQL Injection

# # # # #

FAQ Script 3.1.3 – ‘category_id’ SQL Injection

# # # # #

MyBB < 1.8.11 - 'email' MyCode Cross-Site Scripting

Description:

MyBB smilie Module < 1.8.11 - 'pathfolder' Directory Traversal

Description:

Brother MFC-J6520DW – Authentication Bypass / Password Change

Horde Groupware Webmail 3/4/5 – Multiple Remote Code Executions

Source: https://blogs.securiteam.com/index.php/archives/3107

Apple WebKit / Safari 10.0.3 (12602.4.8) – Synchronous Page Load Universal Cross-Site Scripting

click anywhere

Apple WebKit / Safari 10.0.3 (12602.4.8) – Universal Cross-Site Scripting via a Focus Event and a Link Element

Apple WebKit – ‘JSC::B3::Procedure::resetReachability’ Use-After-Free

(function () {

Apple WebKit – ‘Document::adoptNode’ Use-After-Free

Apple WebKit – ‘JSC::SymbolTableEntry::isWatchable’ Heap Buffer Overflow

(function (x = 0) {

Xen – Broken Check in ‘memory_exchange()’ Permits PV Guest Breakout

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1184

Moxa MXview 2.8 – Private Key Disclosure

[+] Credits: John Page AKA HYP3RLINX

Moxa MXview 2.8 – Denial of Service

[+] Credits: John Page AKA hyp3rlinx

Moxa MX AOPC-Server 1.5 – XML External Entity Injection

[+] Credits: John Page AKA HYP3RLINX

Quest Privilege Manager 6.0.0 – Arbitrary File Write

#!/usr/bin/env python2

Jobscript4Web 4.5 – Authentication Bypass

----------------

Sony Playstation 4 (PS4) 3.50 < 4.07 - WebKit Code Execution (PoC)

PS4 4.0x Code Execution

Intellinet NFC-30IR Camera – Multiple Vulnerabilities

Bitcrack Cyber Security - BitLabs Advisory

Invoice Template – ‘hash’ SQL Injection

# # # # #

Document Management Template – ‘hash’ SQL Injection

# # # # #

Shopping Cart Template – ‘item’ SQL Injection

# # # # #