Exploits

Joomla! Component Event Booking 2.10.1 – SQL Injection

######################

Elantech-Smart Pad 11.9.0.0 – Unquoted Service Path Privilege Escalation

# Exploit Title: Elantech Smart-Pad Unquoted Service Path Privilege Escalation

MSI – ‘NTIOLib.sys’ / ‘WinIO.sys’ Local Privilege Escalation

#Exploit Title: MSI NTIOLib.sys, WinIO.sys local privilege escalation

Iperius Remote 1.7.0 – Unquoted Service Path Privilege Escalation

# Exploit Title: Iperius Remote 1.7.0 Unquoted Service Path Elevation of Privilege

Macro Expert 4.0 – Multiple Privilege Escalations

# Exploit Title: Macro Expert 4.0 Multiple Elevation of Privilege

Microsoft Windows 8.1 Update 2 / 10 10586 (x86/x64) – NtLoadKeyEx User Hive Attachment Point Privilege Escalation (MS16-111)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=865

Microsoft Windows – RegLoadAppKey Hive Enumeration Privilege Escalation (MS16-111)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=870

Wise Care 365 4.27 / Wise Disk Cleaner 9.29 – Unquoted Service Path Privilege Escalation

# Exploit Title: Wisecleaner Software Multiple Unquoted Service Path Elevation of Privilege

Zortam Mp3 Media Studio 21.15 – Insecure File Permissions Privilege Escalation

# Exploit Title: Zortam Mp3 Media Studio 21.15 Insecure File Permissions Privilege Escalation

Linux SELinux – W+X Protection Bypass via AIO

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=854

Adobe Flash – Video Decompression Memory Corruption

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=857

Adobe Flash – Crash When Freeing Memory After AVC decoding

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=859

Microix Timesheet Module – SQL Injection

# Exploit Title: Microix timesheet module SQL Injection

Microsoft Windows Kerberos – Security Feature Bypass (MS16-101)

# Exploit Title: Kerberos Security Feature Bypass Vulnerability (Kerberos to NTLM Fallback)

AnyDesk 2.5.0 – Unquoted Service Path Privilege Escalation

# Exploit Title: AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege

JCraft/JSch Java Secure Channel 0.1.53 – Recursive sftp-get Directory Traversal

Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725

Exponent CMS 2.3.9 – Blind SQL Injection

=============================================

Joomla! Component com_videogallerylite 1.0.9 – SQL Injection

Title: Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla

Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 – Multiple Vulnerabilities

SEC Consult has also released a blog post describing the attack scenarios

Metasploit Web UI – Diagnostic Console Command Execution (Metasploit)

##

Matrimonial Website Script 1.0.2 – SQL Injection

######################

Kaltura 11.1.0-2 – Remote Code Execution (Metasploit)

##

Symantec RAR Decomposer Engine (Multiple Products) – Out-of-Bounds Read / Out-of-Bounds Write

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=867

Microsoft Office PowerPoint 2010 – Invalid Pointer Reference

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=866

VegaDNS 0.13.2 – Remote Command Injection

#!/usr/bin/perl

Dolphin 7.3.0 – Error-Based SQL Injection

# Exploit Title: Dolphin 7.3.0 Error Based SQL Injection

PHP 5.0.0 – ‘tidy_parse_file()’ Local Buffer Overflow

BuilderEngine 3.5.0 – Arbitrary File Upload

WordPress Plugin Order Export Import for WooCommerce – Order Information Disclosure

# Exploit Title: WordPress Plugin Order Export Import for WooCommerce

EKG Gadu 1.9~pre+r2855-3+b1 – Local Buffer Overflow

# Exploit developed using Exploit Pack v6.01

SolarWinds Kiwi Syslog Server 9.5.1 – Unquoted Service Path Privilege Escalation

Document Title:

Docker Daemon – Local Privilege Escalation (Metasploit)

##

Kajona 4.7 – Cross-Site Scripting / Directory Traversal

Security Advisory - Curesec Research Team

MyBB 1.8.6 – SQL Injection

Security Advisory - Curesec Research Team

MuM MapEdit 3.2.6.0 – Multiple Vulnerabilities

# Security Advisory -- Multiple Vulnerabilities - MuM Map Edit

VMware Workstation – ‘vprintproxy.exe’ TrueType NAME Tables Heap Buffer Overflow (PoC)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=849

VMware Workstation – ‘vprintproxy.exe’ JPEG2000 Images Multiple Memory Corruptions

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=850

SolarWinds Kiwi CatTools 3.11.0 – Unquoted Service Path Privilege Escalation

Document Title:

ZineBasic 1.1 – Arbitrary File Disclosure

# Title: ZineBasic 1.1 Remote File Disclosure Exploit

ShoreTel Connect ONSITE – Blind SQL Injection

# Exploit Title: ShoreTel Connect ONSITE Blind SQL Injection Vulnerability

Cisco ASA 9.2(3) – ‘EXTRABACON’ Authentication Bypass

#

AnoBBS 1.0.1 – Remote File Inclusion

AnoBBS 1.0.1 Remote File Inclusion Exploit

Joomla! Component Catalog 1.0.7 – SQL Injection

Title: Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla

Joomla! Component Portfolio Gallery 1.0.6 – SQL Injection

Title: Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Joomla extension v1.0.6

Cisco EPC 3925 – Multiple Vulnerabilities

# Title: Cisco EPC 3925 Multiple Vulnerabilities

NetBSD – ‘mail.local(8)’ Local Privilege Escalation (Metasploit)

##

PrivateTunnel Client 2.7.0 (x64) – Local Credentials Disclosure

#####

Google Android – getpidcon Usage binder Service Replacement Race Condition

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=851

Apache Mina 2.0.13 – Remote Command Execution

Source: https://remoteawesomethoughts.blogspot.com/2016/09/apache-mina-2013-remote-command.html

Cherry Music 0.35.1 – Arbitrary File Disclosure

# Exploit Title: Cherry Music v0.35.1 directory traversal vulnerability allows authenticated users to download arbitr...