Exploits

Microsoft Windows Kernel – Registry Hive Loading ‘nt!RtlEqualSid’ Out-of-Bounds Read (MS16-138)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=874

WinaXe 7.7 FTP Client – Remote Buffer Overflow (Metasploit)

##

Boonex Dolphin 7.3.2 – Authentication Bypass / Remote Code Execution

#!/usr/bin/env python

Microsoft Internet Explorer 11 – MSHTML CMap­Element::Notify Use-After-Free (MS15-009)

Disk Pulse Enterprise 9.0.34 – ‘Login’ Remote Buffer Overflow (Metasploit)

##

Linux Kernel 4.4 (Ubuntu 16.04) – ‘BPF’ Local Privilege Escalation (Metasploit)

##

Schoolhos CMS 2.29 – Remote Code Execution / SQL Injection

\x0d\x0a-----------------------------26518470919255\x0d\x0a\x0d\x0a' \

ATutor 2.2.2 – Cross-Site Request Forgery (Add New Course)

# Exploit Title: ATutor_2.2.2 Learning Management System

WordPress Plugin BBS e-Franchise 1.1.1 – SQL Injection

# Exploit Title: BBS e-Franchise 1.1.1 Plugin of WordPress – Sql Injection

WordPress Plugin Product Catalog 8 1.2.0 – SQL Injection

# Exploit Title: Product Catalog 8 1.2 Plugin WordPress – Sql Injection

InvoicePlane 1.4.8 – Password Reset

# Exploit Title: InvoicePlane v1.4.8 Incorrect Access Control for password =

Microsoft WININET.dll – ‘CHttp­Header­Parser::Parse­Status­Line’ Out-of-Bounds Read (MS16-104/MS16-105)

Microsoft Internet Explorer 11/10/9 – MSHTML ‘PROPERTYDESC::Handle­Style­Component­Property’ Out-of-Bounds Read (MS16-104)

MyBB 1.8.6 – Cross-Site Scripting

Security Advisory - Curesec Research Team

4Images 1.7.13 – SQL Injection

# vulnerable app : 4images query($sql);

Adobe Connect 9.5.7 – Cross-Site Scripting

Document Title:

VBScript 5.8.7600.16385/5.8.9600.16384 – RegExpComp::PnodeParse Out-of-Bounds Read

Microsoft Windows – LSASS SMB NTLM Exchange Null-Pointer Dereference (MS16-137)

MS16-137: LSASS Remote Memory Corruption Advisory

Microsoft Windows Kernel – ‘win32k’ Denial of Service (MS16-135)

Source: https://github.com/tinysec/public/tree/master/CVE-2016-7255

e107 CMS 2.1.2 – Privilege Escalation

# Exploit Title: e107 CMS 2.1.2 Privilege Escalation

Microsoft Windows Server 2008/2012 – LDAP RootDSE Netlogon Denial of Service

#!/usr/bin/perl

WordPress Plugin 404 to 301 2.2.8 – Persistent Cross-Site Scripting

Source: https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_404_to_301_wordpress_plugin.html

WordPress Plugin WassUp Real Time Analytics 1.9 – Persistent Cross-Site Scripting

Source: https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_wassup_real_time_analytics_wordpress_plu...

MOVISTAR BHS_RTA ADSL Router – Remote File Disclosure

#!/bin/sh

D-Link DSL-2730U/2750U/2750E ADSL Router – Remote File Disclosure

#!/bin/sh

Netgear JNR1010 ADSL Router – (Authenticated) Remote File Disclosure

#!/bin/sh

Netgear WNR500/WNR612v3/JNR1010/JNR2010 ADSL Router – (Authenticated) Remote File Disclosure

#!/bin/sh

PLANET ADSL Router AND-4101 – Remote File Disclosure

#!/bin/sh

Eir D1000 Wireless Router – WAN Side Remote Command Injection (Metasploit)

=begin

Avira Antivirus 15.0.21.86 – ‘.zip’ Directory Traversal / Command Execution

# Title : Avira Antivirus >= 15.0.21.86 Command Execution (SYSTEM)

Schoolhos CMS 2.29 – ‘kelas’ SQL Injection

Document Title:

Acoem 01dB CUBE/DUO Smart Noise Monitor – Password Change

#!/bin/sh

Microsoft Internet Explorer 8/9/10/11 / IIS / CScript.exe/WScript.exe VBScript – CRegExp..Execute Use of Uninitialized Memory (MS14-080/MS14-084)

Microsoft Internet Explorer 9 – MSHTML CPtsTextParaclient::CountApes Out-of-Bounds Read

NodCMS – PHP Code Execution

Piwik 2.16.0 – ‘layout’ PHP Object Injection

---------------------------------------------------------------

Sophos Web Appliance 4.2.1.3 – Remote Code Execution

KL-001-2016-009 : Sophos Web Appliance Remote Code Execution

SweetRice 1.5.1 – Arbitrary File Upload

#/usr/bin/python

SweetRice 1.5.1 – Backup Disclosure

Title: SweetRice 1.5.1 - Backup Disclosure

IBM AIX 6.1/7.1/7.2.0.2 – ‘lsmcode’ Local Privilege Escalation

#!/usr/bin/sh

IBM AIX 5.3/6.1/7.1/7.2 – ‘lquerylv’ Local Privilege Escalation

#!/usr/bin/sh

Freefloat FTP Server 1.0 – ‘SITE ZONE’ Remote Buffer Overflow

#!/usr/bin/env python

PCMan FTP Server 2.0.7 – ‘NLST’ Remote Buffer Overflow

#!/usr/bin/env python

PCMan FTP Server 2.0.7 – ‘SITE CHMOD’ Remote Buffer Overflow

#!/usr/bin/env python

PCMan FTP Server 2.0.7 – ‘PORT’ Remote Buffer Overflow

#!/usr/bin/env python

BolinTech DreamFTP Server 1.02 – ‘RETR’ Remote Buffer Overflow

import socket

WinaXe 7.7 ‘FTP client’ – Remote Buffer Overflow

[+] Credits: John Page aka hyp3rlinx

Rapid PHP Editor 14.1 – Remote Command Execution

[+] Credits: John Page aka hyp3rlinx

SweetRice 1.5.1 – Arbitrary File Download

#/usr/bin/python

Axessh 4.2 – Denial of Service

[+] Credits: John Page aka hyp3rlinx