Exploits

Malwarebytes AntiVirus 2.2.0 – Denial of Service (PoC)

#####################################################################################

Oracle BeeHive 2 – ‘voice-servlet processEvaluation()’ Write File (Metasploit)

##

Oracle BeeHive 2 – ‘voice-servlet prepareAudioToPlay()’ Arbitrary File Upload (Metasploit)

##

WordPress Plugin Gwolle Guestbook 1.5.3 – Remote File Inclusion

Advisory ID: HTB23275

Acunetix WVS 10 – Local Privilege Escalation

'''

Advantech Switch – ‘Shellshock’ Bash Environment Variable Command Injection (Metasploit)

##

Man-db 2.6.7.1 – Local Privilege Escalation

EDB Note:

RHEL 7.0/7.1 – ‘abrt/sosreport’ Local Privilege Escalation

#!/usr/bin/python

Kodi 15 – Web Interface Arbitrary File Access

# Exploit Title: arbitrary file access kodi web interface

abrt (Centos 7.1 / Fedora 22) – Local Privilege Escalation

#!/usr/bin/python

ntop-ng 2.0.151021 – Privilege Escalation

# Vulnerability title: ntop-ng

Invision Power Board (IP.Board) 4.1.4.x – Persistent Cross-Site Scripting

# Exploit Title: IP.Board Persistent XSS Vulnerability

Belkin N150 Wireless Router F9K1009 v1 – Multiple Vulnerabilities

##Full Disclosure:

ZenPhoto 1.4.10 – Local File Inclusion

[+] Credits: hyp3rlinx

Easy File Sharing Web Server 7.2 – Remote Buffer Overflow (SEH) (DEP Bypass + ROP)

#!/usr/bin/env python

MyCustomers CMS 1.3.873 – SQL Injection

######################

HumHub 0.11.2/0.20.0-beta.2 – SQL Injection

=== LSE Leading Security Experts GmbH - Security Advisory 2015-10-14 ===

SysAid Help Desk Software 14.4.32 b25 – SQL Injection (Metasploit)

# Exploit Title: Sysaid Helpdesk Software Unauthenticated SQLi

SAP Sybase Adaptive Server Enterprise – XML External Entity Information Disclosure

source: https://www.securityfocus.com/bid/63193/info

WordPress Plugin WP-Client 3.8.7 – Persistent Cross-Site Scripting

#####################################################################################

Acrobat Reader DC 15.008.20082.15957 – ‘.PDF’ Parsing Memory Corruption

#####################################################################################

Oracle Outside In PDF 8.5.2 – Parsing Memory Corruption (1)

#####################################################################################

Oracle Outside In PDF 8.5.2 – Parsing Memory Corruption (2)

#####################################################################################

vBulletin 5.x – Remote Code Execution

#[+] Title: Vbulletin 5.x - Remote Code Execution Exploit

Audacious 3.7 – ID3 Local Crash (PoC)

# Exploit Title: Audacious 3.7 ID3 Local Crash PoC

Nvidia Stereoscopic 3D Driver Service 7.17.13.5382 – Arbitrary Run Key Creation

Source: https://code.google.com/p/google-security-research/issues/detail?id=515

Microsoft Windows – ‘ndis.sys’ IOCTL 0x170034 (ndis!ndisNsiGetIfNameForIfIndex) Pool Buffer Overflow (MS15-117)

Source: https://code.google.com/p/google-security-research/issues/detail?id=516

Microsoft Windows – Cursor Object Memory Leak (MS15-115)

Source: https://code.google.com/p/google-security-research/issues/detail?id=510

Microsoft Windows – Race Condition DestroySMWP Use-After-Free (MS15-115)

Source: https://code.google.com/p/google-security-research/issues/detail?id=509

Microsoft Windows Kernel – Device Contexts and NtGdiSelectBitmap Use-After-Free (MS15-115)

Source: https://code.google.com/p/google-security-research/issues/detail?id=505

Joomla! 3.4.4 Component Content History – SQL Injection / Remote Code Execution (Metasploit)

##

ZTE ADSL ZXV10 W300 Modems – Multiple Vulnerabilities

# Exploit Title: [ZTE ADSL ZXV10 W300 modems - Multiple vulnerabilities]

ZTE ZXHN H108N R1A / ZXV10 W300 Routers – Multiple Vulnerabilities

# Exploit Title: [ZTE ZXHN H108N R1A + ZXV10 W300 routers - multiple

Chkrootkit – Local Privilege Escalation (Metasploit)

##

Cambium ePMP 1000 – Multiple Vulnerabilities

timeline. Ceases communication.

SuperScan 4.1 – Scan Hostname/IP Field Buffer Overflow

#!/usr/bin/env python

SuperScan 4.1 – Tools Hostname/IP/URL Field Buffer Overflow

#!/usr/bin/env python

SuperScan 4.1 – Windows Enumeration Hostname/IP/URL Field Overflow (SEH)

#!/usr/bin/env python

Sam Spade 1.14 – Decode URL Buffer Overflow Crash (PoC)

#!/usr/bin/env python

Netwin SurgeFTP Sever 23d6 – Persistent Cross-Site Scripting

# Exploit Netwin SurgeFTP Sever Stored Cross Site Scripting Vulnerabilities

Google Chrome – open-vcdiff Out-of-Bounds Read in Browser Process Integer Overflow

Source: https://code.google.com/p/google-security-research/issues/detail?id=513

F5 iControl – ‘iCall::Script’ Root Command Execution (Metasploit)

##

Horde Groupware 5.2.10 – Cross-Site Request Forgery

Advisory ID: HTB23272

WordPress Plugin Users Ultra 1.5.50 – Unrestricted Arbitrary File Upload

Description

IBM i Access 7.1 – Local Buffer Overflow / Code Execution

[+] Credits: John Page aka hyp3rlinx

CF Image Host 1.65 – Cross-Site Request Forgery

CF Image Host 1.65 – PHP Command Injection

[+] Credits: hyp3rlinx

TECO SG2 LAD Client 3.51 – ‘.gen’ Overwrite Buffer Overflow (SEH)

#!/usr/bin/perl

TECO SG2 FBD Client 3.51 – ‘.gfb’ Overwrite Buffer Overflow (SEH) (PoC)

# TECO SG2 FBD Client 3.51 SEH Overwrite Buffer Overflow Vulnerability

TECO TP3-PCLINK 2.1 – ‘.tpc’ Handling Buffer Overflow (PoC)

# TECO TP3-PCLINK 2.1 TPC File Handling Buffer Overflow Vulnerability