Exploits

Novell ServiceDesk – (Authenticated) Arbitrary File Upload (Metasploit)

##

pfSense Community Edition 2.2.6 – Multiple Vulnerabilities

( , ) (,

Microsoft Internet Explorer 11 – MSHTML!CMarkupPointer::UnEmbed Use-After-Free

IE 11.0.9600.18230 MSHTML!CMarkupPointer::UnEmbed UAF POC

AirOS 6.x – Arbitrary File Upload

EDB-Note Source: https://hackerone.com/reports/73480

Exim – ‘perl_startup’ Local Privilege Escalation (Metasploit)

##

Microsoft Excel – Out-of-Bounds Read Code Execution (MS16-042)

#######################################################################################

pfSense Firewall 2.2.6 – Services Cross-Site Request Forgery

# Exploit Title: pfSense Firewall

Brickcom Corporation Network Cameras – Multiple Vulnerabilities

_ _ _ _

PHPmongoDB 1.0.0 – Multiple Vulnerabilities

#####################################################################################################################...

Microsoft Internet Explorer 9/10/11 – ‘CDOMStringDataList::InitFromString’ Out-of-Bounds Read (MS15-112)

IE 10-11 Windows 7 SP1 x86 - OOB Read ALSR Bypass PoC

Oracle Application Testing Suite (ATS) 12.4.0.2.0 – Authentication Bypass / Arbitrary File Upload

# Exploit Title: Oracle Application Testing Suite Authentication Bypass and Arbitrary File Upload Remote Exploit

Texas Instrument Emulator 3.03 – Local Buffer Overflow

# Exploit Author: Juan Sacco - http://www.exploitpack.com -

Dell KACE K1000 – Arbitrary File Upload (Metasploit)

##

Ovidentia troubleticketsModule 7.6 – Remote File Inclusion

# Title: Ovidentia Module troubletickets 7.6 GLOBALS[babInstallPath] Remote File Inclusion Vulnerability

Hikvision Digital Video Recorder – Cross-Site Request Forgery

WPN-XM Serverstack 0.8.6 – Cross-Site Request Forgery

[+] Credits: hyp3rlinx

OpenCart 2.1.0.2 < 2.2.0.0 - json_decode Function Remote Code Execution

OpenCart json_decode function Remote PHP Code Execution

CAM UnZip 5.1 – .’ZIP’ File Directory Traversal

[+] Credits: hyp3rlinx

RockMongo PHP MongoDB Administrator 1.1.8 – Multiple Vulnerabilities

#####################################################################################################################...

Axis Network Cameras – Multiple Vulnerabilities

_ _ _ _

Google Android – IOMX ‘getConfig’/’getParameter’ Information Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=711

Google Android – IMemory Native Interface is Insecure for IPC Use

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=706

Novell ServiceDesk 6.5/7.0.3/7.1.0 – Multiple Vulnerabilities

>> Multiple vulnerabilities in Novell Service Desk 7.1.0, 7.0.3 and 6.5

Express Zip 2.40 – Directory Traversal

#!/usr/bin/python -w

Apple Intel HD 3000 Graphics Driver 10.0.0 – Local Privilege Escalation

░▀█▀░█▀█░█░░░█▀█░█▀▀░░░█░█░█░█░█░░░█▀█░█▀▄░█▀▀░█░█░

op5 7.1.9 – Remote Command Execution

[+] Credits: hyp3rlinx

PLANET Technology IP Surveillance Cameras – Multiple Vulnerabilities

_ _ _ _

Mess Emulator 0.154-3.1 – Local Buffer Overflow

# Exploit Author: Juan Sacco - http://www.exploitpack.com -

ExaGrid – Known SSH Key and Default Password (Metasploit)

##

Asbru Web Content Management System 9.2.7 – Multiple Vulnerabilities

Asbru Web Content Management System v9.2.7 Multiple Vulnerabilities

SocialEngine 4.8.9 – SQL Injection

Advisory ID: HTB23286

Linux Kernel (x86) – Disable ASLR by Setting the RLIMIT_STACK Resource to Unlimited

Source: http://hmarco.org/bugs/CVE-2016-3672-Unlimiting-the-stack-not-longer-disables-ASLR.html

Panda Security URL Filtering < 4.3.1.9 - Local Privilege Escalation

Description:

Panda Endpoint Administration Agent < 7.50.00 - Local Privilege Escalation

Description:

Easy File Sharing HTTP Server 7.2 – Remote Overflow (SEH) (Metasploit)

##

PCMan FTP Server – ‘PUT’ Buffer Overflow (Metasploit)

##

Microsoft Internet Explorer – MSHTML!CSVGHelpers::SetAttributeStringAndPointer Use-After-Free (MS16-023)

ManageEngine Password Manager Pro 8102 to 8302 – Multiple Vulnerabilities

[Systems Affected]

Microsoft Windows Kernel – ‘win32k.sys’ Local Privilege Escalation (MS14-058)

Sources:

Xion Audio Player 1.5 (build 160) – ‘.mp3’ Crash (PoC)

# Exploit Title: Xion Audio Player new('legit.mp3'); # whatever mp3 you got handy

Hexchat IRC Client 2.11.0 – Directory Traversal

#!/usr/bin/python

Hexchat IRC Client 2.11.0 – CAP LS Handling Buffer Overflow

#!/usr/bin/python

PQI Air Pen Express 6W51-0000R2/6W51-0000R2XXX – Multiple Vulnerabilities

_ _ _ _

DameWare Remote Controller < 12.0.0.520 - Remote Code Execution

# Exploit Title: Dameware Remote Controller RCE

PHP 5.5.33/7.0.4 – SNMP Format String

WordPress Plugin Advanced Video 1.0 – Local File Inclusion

#!/usr/bin/env python

Microsoft Windows Kernel – Bitmap Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=686

Microsoft Windows Kernel – ‘NtGdiGetTextExtentExW’ Out-of-Bounds Memory Read

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=685

Adobe Flash – URLStream.readObject Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=611

Adobe Flash – textfield.maxChars Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=581