NVIDIA Driver – Missing Bounds Check in Escape 0x100009a
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=942
Exploits
Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
- 类型
- 漏洞条目
- 总量
- 24,950
- 页码
- 210
NVIDIA Driver – Missing Bounds Check in Escape 0x70000d5
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944
NVIDIA Driver – Stack Buffer Overflow in Escape 0x7000014
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=946
NVIDIA Driver – Stack Buffer Overflow in Escape 0x10000e9
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=947
Apple macOS 10.12 – ‘task_t’ Local Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=837
PCMan FTP Server 2.0.7 – ‘DELETE’ Remote Buffer Overflow
from ftplib import FTP
InfraPower PPS-02-S Q213V1 – Remote Command Execution
InfraPower PPS-02-S Q213V1 Unauthenticated Remote Root Command Execution
InfraPower PPS-02-S Q213V1 – Multiple Cross-Site Scripting Vulnerabilities
InfraPower PPS-02-S Q213V1 Multiple XSS Vulnerabilities
InfraPower PPS-02-S Q213V1 – Local File Disclosure
InfraPower PPS-02-S Q213V1 Local File Disclosure Vulnerability
InfraPower PPS-02-S Q213V1 – Hard-Coded Credentials
InfraPower PPS-02-S Q213V1 Hard-coded Credentials Remote Root Access
InfraPower PPS-02-S Q213V1 – Insecure Direct Object Reference
InfraPower PPS-02-S Q213V1 Insecure Direct Object Reference Authorization Bypass
InfraPower PPS-02-S Q213V1 – Authentication Bypass
InfraPower PPS-02-S Q213V1 Authentication Bypass Vulnerability
InfraPower PPS-02-S Q213V1 – Cross-Site Request Forgery
InfraPower PPS-02-S Q213V1 Cross-Site Request Forgery
GNU GTypist 2.9.5-2 – Local Buffer Overflow
# Exploit developed using Exploit Pack v6.5
uSQLite 1.0.0 – Denial of Service
#!/usr/bin/python
HP TouchSmart Calendar 4.1.4245 – Insecure File Permissions Privilege Escalation
[+] Credits: John Page aka hyp3rlinx
Joomla! 3.4.4 < 3.6.4 - Account Creation / Privilege Escalation
Source: https://github.com/XiphosResearch/exploits/tree/master/Joomraa
CherryTree 0.36.9 – Memory Corruption (PoC)
#!/usr/bin/python
Baby FTP server 1.24 – Denial of Service (2)
#!/usr/bin/python
Boonex Dolphin 7.3.2 – Authentication Bypass
# Exploit Title : Boonex Dolphin all versoin array
SmallFTPd 1.0.3 – ‘mkd’ Denial of Service
from ftplib import FTP
Komfy Switch with Camera DKZ-201S/W – WiFi Password Disclosure
#!/usr/bin/python
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method)
// $ echo pikachu|sudo tee pokeball;ls -l pokeball;gcc -pthread pokemon.c -o d;./d pokeball miltank;cat pokeball
Network Scanner 4.0.0 – Local Buffer Overflow (SEH)
#!/usr/bin/python
Orange Inventel LiveBox 5.08.3-sp – Cross-Site Request Forgery
# Exploit Title: Orange Inventel LiveBox CSRF
Microsoft Windows (x86) – ‘NDISTAPI’ Local Privilege Escalation (MS11-062)
################################################################
EC-CUBE 2.12.6 – Server-Side Request Forgery
# Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery
Industrial Secure Routers EDR-810 / EDR-G902 / EDR-G903 – Insecure Configuration Management
Title: Industrial Secure Routers - Insecure Configuration Management
Zenbership 107 – Multiple Vulnerabilities
1. ADVISORY INFORMATION
Just Dial Clone Script – ‘srch’ SQL Injection
# Exploit Title: SQL Injection in Just Dial Clone Script
FreePBX 13 – Remote Command Execution / Privilege Escalation
#!/usr/bin/env python
RealPlayer 18.1.5.705 – ‘.QCP’ Crash (PoC)
Tested on: Win7 / Win10 x64
Oracle VM VirtualBox 4.3.28 – ‘.ovf’ Crash (PoC)
#Exploit Title: Oracle VM VirtualBox 4.3.28 Crash
Oracle Netbeans IDE 8.1 – Directory Traversal
[+] Credits: John Page aka hyp3rlinx
MiCasaVerde VeraLite – Remote Code Execution
# Exploit Title: MiCasa VeraLite Remote Code Execution
Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 – XML External Entity Injection
# Exploit Title: Oracle BI Publisher (formerly XML Publisher) - XML External Entity Injection w/o authentication
Classifieds Rental Script – SQL Injection
# Exploit Title: SQL Injection in Classifieds Rental Script
Event Calendar PHP 1.5 – SQL Injection
=====================================================
SPIP 3.1.2 Template Compiler/Composer – PHP Code Execution
## SPIP 3.1.2 Template Compiler/Composer PHP Code Execution (CVE-2016-7998)
SPIP 3.1.1/3.1.2 – File Enumeration / Path Traversal
## SPIP 3.1.1/3.1.2 File Enumeration / Path Traversal (CVE-2016-7982)
SPIP 3.1.2 – Cross-Site Request Forgery
## SPIP 3.1.2 Exec Code Cross-Site Request Forgery (CVE-2016-7980)
Microsoft Windows – ‘win32k.sys’ TTF Processing RCVT TrueType Instruction Handler Out-of-Bounds Read (MS16-120)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=864
Microsoft Windows – ‘win32k.sys’ TTF Processing win32k!sbit_Embolden / win32k!ttfdCloseFontContext Use-After-Free (MS16-120)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=868
Microsoft Windows Kernel – Registry Hive Loading Negative RtlMoveMemory Size in nt!CmpCheckValueList (MS16-124)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=873
Microsoft Windows Kernel – Registry Hive Loading Relative Arbitrary Read in nt!RtlValidRelativeSecurityDescriptor (MS16-123)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=876