Exploits

Express Invoice 7.12 – ‘Customer’ Persistent Cross-Site Scripting

# Exploit Title: Express Invoice 7.12 - 'Customer' Persistent Cross-Site Scripting

Ajenti 2.1.31 – Remote Code Execution

# Title: Ajenti 2.1.31 - Remote Code Execution

Kirona-DRS 5.5.3.5 – Information Disclosure

# Exploit Title: Kirona-DRS 5.5.3.5 - Information Disclosure

Apache Httpd mod_proxy – Error Page Cross-Site Scripting

The trick is to use a vertical tab (`%09`) and then place another URL in the tag. So once a victim clicks the link on...

Apache Httpd mod_rewrite – Open Redirects

Normal URLs like http://redirect.local/test will be forwared to https://redirect.local/test. But by using newlines (C...

WordPress Core < 5.2.3 - Viewing Unauthenticated/Password/Private Posts

So far we know that adding `?static=1` to a wordpress URL should leak its secret content

National Instruments Circuit Design Suite 14.0 – Local Privilege Escalation

# Exploit Title: National Instruments Circuit Design Suite 14.0 - Local Privilege Escalation

Intelbras Router WRN150 1.0.18 – Persistent Cross-Site Scripting

# Exploit Title: Intelbras Router WRN150 1.0.18 - Persistent Cross-Site Scripting

WordPress Plugin Arforms 3.7.1 – Directory Traversal

# Exploit Title: WordPress Arforms 3.7.1 - Directory Traversal

SMA Solar Technology AG Sunny WebBox device – 1.6 – Cross-Site Request Forgery

# Exploit Title: SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery

ASX to MP3 converter 3.1.3.7 – ‘.asx’ Local Stack Overflow (DEP Bypass) (Metasploit)

##

TP-Link TL-WR1043ND 2 – Authentication Bypass

# Exploit Title: TP-Link TL-WR1043ND 2 - Authentication Bypass

Microsoft Windows Kernel – win32k.sys TTF Font Processing Pool Corruption in win32k!ulClearTypeFilter

We have encountered a Windows kernel crash in the win32k.sys driver while processing a corrupted TTF font file. An ex...

Microsoft Windows Kernel – NULL Pointer Dereference in nt!MiOffsetToProtos While Parsing Malformed PE File

We have encountered a Windows kernel crash in nt!MiOffsetToProtos while trying to load a malformed PE image into the ...

Microsoft Windows Kernel – Out-of-Bounds Read in CI!CipFixImageType While Parsing Malformed PE File

We have encountered a Windows kernel crash in CI!CipFixImageType while trying to load a malformed PE image into the p...

Microsoft Windows Kernel – Out-of-Bounds Read in nt!MiParseImageLoadConfig While Parsing Malformed PE File

We have encountered a Windows kernel crash in memcpy() called by nt!MiParseImageLoadConfig while trying to load a mal...

Microsoft Windows Kernel – Out-of-Bounds Read in CI!HashKComputeFirstPageHash While Parsing Malformed PE File

We have encountered a Windows kernel crash in CI!HashKComputeFirstPageHash while trying to load a malformed PE image ...

Microsoft Windows Kernel – Out-of-Bounds Read in nt!MiRelocateImage While Parsing Malformed PE File

We have encountered a Windows kernel crash in memcpy() called by nt!MiRelocateImage while trying to load a malformed ...

DeviceViewer 3.12.0.1 – Arbitrary Password Change

# Exploit Title: DeviceViewer 3.12.0.1 - Arbitrary Password Change

DeviceViewer 3.12.0.1 – ‘add user’ Local Buffer Overflow (DEP Bypass)

# Exploit Title: Sricam DeviceViewer 3.12.0.1 - 'add user' Local Buffer Overflow (DEP Bypass)

Foscam Video Management System 1.1.6.6 – ‘UID’ Denial of Service (PoC)

# Exploit Title: Foscam Video Management System 1.1.6.6 - 'UID' Denial of Service (PoC)

XNU – Remote Double-Free via Data Race in IPComp Input Path

=== Summary ===

Zabbix 4.4 – Authentication Bypass

# Exploit Title: Zabbix 4.4 - Authentication Bypass

Joomla! 3.4.6 – ‘configuration.php’ Remote Code Execution

# Exploit Title: Joomla 3.4.6 - 'configuration.php' Remote Code Execution

logrotten 3.15.1 – Privilege Escalation

# Exploit Title: logrotten 3.15.1 - Privilege Escalation

Zabbix 4.2 – Authentication Bypass

# Exploit Title: Zabbix 4.2 - Authentication Bypass

ASX to MP3 converter 3.1.3.7 – ‘.asx’ Local Stack Overflow (DEP)

# Exploit Title: ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (DEP)

Subrion 4.2.1 – ‘Email’ Persistant Cross-Site Scripting

# Title: Subrion 4.2.1 - 'Email' Persistant Cross-Site Scripting

IBM Bigfix Platform 9.5.9.62 – Arbitrary File Upload

# Exploit Title: IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload

CheckPoint Endpoint Security Client/ZoneAlarm 15.4.062.17802 – Privilege Escalation

# Exploit Title: CheckPoint Endpoint Security Client/ZoneAlarm 15.4.062.17802 - Privilege Escalation

freeFTP 1.0.8 – ‘PASS’ Remote Buffer Overflow

# Exploit Title: freeFTP 1.0.8 - Remote Buffer Overflow

vBulletin 5.0 < 5.5.4 - 'updateAvatar' Authenticated Remote Code Execution

';

LabCollector 5.423 – SQL Injection

# Exploit Title: LabCollector (Laboratory Information System) 5.423 - Multiples SQL Injection

Android – Binder Driver Use-After-Free

The following issue exists in the android-msm-wahoo-4.4-pie branch of https://android.googlesource.com/kernel/msm (an...

mintinstall 7.9.9 – Code Execution

# Exploit Title: mintinstall (aka Software Manager) object injection

AnchorCMS < 0.12.3a - Information Disclosure

# Exploit Title: Information disclosure (MySQL password) in error log

PHP 7.0 < 7.3 (Unix) - 'gc' disable_functions Bypass

Detrix EDMS 1.2.3.1505 – SQL Injection

#!/usr/bin/php

DOUBLEPULSAR – Payload Execution and Neutralization (Metasploit)

##

DameWare Remote Support 12.1.0.34 – Buffer Overflow (SEH)

#!/usr/bin/env python

kic 2.4a – Denial of Service

# Exploit Title: Ciftokic 2.4a - DoS Buffer Overflow

DotNetNuke < 9.4.0 - Cross-Site Scripting

# Exploit Title: Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0

DotNetNuke 9.3.2 – Cross-Site Scripting

Exploit Title: "Display Name" Stored Unauthenticated XSS in DNN v9.3.2

WebKit – UXSS Using JavaScript: URI and Synchronous Page Loads

VULNERABILITY DETAILS

WebKit – Universal XSS in WebCore::command

WebKit – User-agent Shadow root Leak in WebCore::ReplacementFragment::ReplacementFragment

WebKit – Universal XSS Using Cached Pages

VULNERABILITY DETAILS

vBulletin 5.x – Remote Command Execution (Metasploit)

##

phpIPAM 1.4 – SQL Injection

#!/usr/bin/env python3

GoAhead 2.5.0 – Host Header Injection

# Exploit Title: GoAhead Web server HTTP Header Injection.