Exploits

Horos 2.1.0 DICOM Medical Image Viewer – Denial of Service

#!/usr/bin/env python

Horos 2.1.0 Web Portal – Directory Traversal

Horos 2.1.0 Web Portal Remote Information Disclosure Exploit

Apple macOS 10.12 16A323 XNU Kernel / iOS 10.1.1 – ‘set_dp_control_port’ Lack of Locking Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=965

WHMCompleteSolution (WHMCS) Addon VMPanel 2.7.4 – SQL Injection

=====================================================

Microsoft Internet Explorer 9 – IEFRAME CMarkup­Pointer::Move­To­Gap Use-After-Free

WordPress Plugin Quiz And Survey Master 4.5.4/4.7.8 – Cross-Site Request Forgery

Click the submit button on the following page (in a real attack the form can be submitted without user interaction):

Microsoft Internet Explorer 9 – IEFRAME CView::Ensure­Size Use-After-Free (MS13-021)

WordPress Plugin WP Support Plus Responsive Ticket System 7.1.3 – SQL Injection

# Exploit Title: WP Support Plus Responsive Ticket System 7.1.3 – WordPress Plugin – Sql Injection

WordPress Plugin WP Private Messages 1.0.1 – SQL Injection (1)

# Exploit Title: WP Private Messages 1.0.1 – Plugin WordPress – Sql Injection

Nidesoft MP3 Converter 2.6.18 – Local Buffer Overflow (SEH)

#!python

Nagios < 4.2.2 - Arbitrary Code Execution

#!/usr/bin/env python

Nagios < 4.2.4 - Local Privilege Escalation

#!/bin/bash

Microsoft Internet Explorer 9 – MSHTML CMarkup::Reload­In­Compat­View Use-After-Free

Microsoft Internet Explorer 9 – IEFRAME CMarkup::Remove­Pointer­Pos Use-After-Free (MS13-055)

Netcore / Netis Routers – UDP Backdoor Access

#!/usr/bin/python

Adobe Animate 15.2.1.95 – Memory Corruption

[+] Credits: John Page aka hyp3rlinx

APT – Repository Signing Bypass via Memory Allocation Failure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1020

Apport 2.x (Ubuntu Desktop 12.10 < 16.04) - Local Code Execution

Both of these issues were reported to the Apport maintainers and a fix was released on 2016-12-14. The CrashDB code i...

TP-LINK TD-W8151N – Denial of Service

# Exploit Title: TP-LINK TD-W8151N - Denial of Service

McAfee Virus Scan Enterprise for Linux 1.9.2 < 2.0.2 - Remote Code Execution

'''

Joomla! Component DT Register – ‘cat’ SQL Injection

Title: SQL injection in Joomla extension DT Register

Samsung Devices KNOX Extensions – OTP Service Heap Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=935

Samsung Devices KNOX Extensions – OTP TrustZone Trustlet Stack Buffer Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=938

Google Chrome (Fedora 25 / Ubuntu 16.04) – ‘tracker-extract’ / ‘gnome-video-thumbnailer’ + ‘totem’ Drive-By Download

Source: https://scarybeastsecurity.blogspot.com/2016/12/redux-compromising-linux-using-snes.html

Serva 3.0.0 – HTTP Server Denial of Service

#!/usr/bin/env python

iOS 10.1.x – Certificate File Memory Corruption

Source: https://cxsecurity.com/issue/WLB-2016110046

Microsoft Internet Explorer 9 – IEFRAME CSelection­Interact­Button­Behavior::_Update­Button­Location Use-After-Free (MS13-047)

WordPress Plugin Multisite Post Duplicator 0.9.5.1 – Cross-Site Request Forgery

Apache 2.4.23 mod_http2 – Denial of Service

#!/usr/bin/python

Sophos Web Appliance 4.2.1.3 – block/unblock Remote Command Injection (Metasploit)

# Exploit Title: Sophos Web Appliance UnBlock/Block-IP Remote Command Injection Vulnerablity

Sophos Web Appliance 4.2.1.3 – DiagnosticTools Remote Command Injection (Metasploit)

# Exploit Title: Sophos Web Appliance diagnostic_tools wget Remote Command Injection Vulnerablity

Netgear R7000 – Cross-Site Scripting

# Exploit Title: Netgear R7000 - XSS via. DHCP hostname

OpenSSL 1.1.0a/1.1.0b – Denial of Service

# Exploit Title: OpenSSL 1.1.0a & 1.1.0b Heap Overflow Remote DOS vulnerability

ARG-W4 ADSL Router – Multiple Vulnerabilities

# Exploit Title: ARG-W4 ADSL Router - Multiple Vulnerabilities

EasyPHP Devserver 16.1.1 – Insecure File Permissions Privilege Escalation

Title: EasyPHP Devserver Insecure File Permissions Privilege Escalation

10-Strike Network File Search Pro 2.3 – Local Buffer Overflow (SEH)

#!python

Roundcube 1.2.2 – Remote Code Execution

Roundcube 1.2.2: Command Execution via Email

Microsoft Internet Explorer 9 – MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (1)

text

Microsoft Internet Explorer 9 – MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (2)

Splunk Enterprise 6.4.3 – Server-Side Request Forgery

'''

Microsoft Internet Explorer 9 – MSHTML CElement::Has­Flag Memory Corruption

Time-line

D-Link DI-524 – Cross-Site Request Forgery

Title: D-Link DI-524 - Cross-Site-Request-Forgery Vulnerability

Dual DHCP DNS Server 7.29 – Denial of Service

# Title : Dual DHCP DNS Server 7.29 Buffer Overflow (Dos)

TP-LINK TD-W8951ND – Denial of Service

# Exploit Title: TP-LINK TD-W8951ND - Denial of Service

Cisco Unified Communications Manager 7/8/9 – Directory Traversal

# Exploit Title: Cisco Unified Communications Manager Administrative Web Interface Directory traversal CVE-2013-5528

OpenSSH 7.2 – Denial of Service

################################################################################

Netgear R7000 – Command Injection

# Exploit Title: Netgear R7000 - Command Injection

Linux Kernel 4.4.0 (Ubuntu 14.04/16.04 x86-64) – ‘AF_PACKET’ Race Condition Privilege Escalation

chocobo_root.c

Microsoft PowerShell – XML External Entity Injection

[+] Credits: John Page aka hyp3rlinx

Google Android – Inter-Process munmap with User-Controlled Size in android.graphics.Bitmap

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=928