multiple

Citrix Application Delivery Controller and Citrix Gateway – Remote Code Execution

#!/usr/bin/python3

Citrix Application Delivery Controller and Citrix Gateway – Remote Code Execution (PoC)

#!/bin/bash

nostromo 1.9.6 – Remote Code Execution

# Exploit Title: nostromo 1.9.6 - Remote Code Execution

ManageEngine Desktop Central – ‘FileStorage getChartImage’ Deserialization / Unauthenticated Remote Code Execution

#!/usr/bin/python3

Pulse Secure VPN – Arbitrary Command Execution (Metasploit)

##

FreeSWITCH – Event Socket Command Execution (Metasploit)

##

FusionPBX – Operator Panel exec.php Command Execution (Metasploit)

##

iMessage – Decoding NSSharedKeyDictionary can read ObjC Object at Attacker Controlled Address

During processing of incoming iMessages, attacker controlled data is deserialized using the

WebKit – Universal XSS in JSObject::putInlineSlow and JSValue::putToPrimitive

VULNERABILITY DETAILS

JavaScriptCore – Type Confusion During Bailout when Reconstructing Arguments Objects

The following sample was found by Fuzzilli and then slightly modified. It crashes JSC in debug builds:

Nostromo – Directory Traversal Remote Command Execution (Metasploit)

##

JavaScriptCore – GetterSetter Type Confusion During DFG Compilation

The following JavaScript program, found by Fuzzilli and slightly modified, crashes JavaScriptCore built from HEAD and...

WebKit – Universal XSS in HTMLFrameElementBase::isURLAllowed

VULNERABILITY DETAILS

Total.js CMS 12 – Widget JavaScript Code Injection (Metasploit)

##

WordPress Core < 5.2.3 - Viewing Unauthenticated/Password/Private Posts

So far we know that adding `?static=1` to a wordpress URL should leak its secret content

Apache Httpd mod_rewrite – Open Redirects

Normal URLs like http://redirect.local/test will be forwared to https://redirect.local/test. But by using newlines (C...

Apache Httpd mod_proxy – Error Page Cross-Site Scripting

The trick is to use a vertical tab (`%09`) and then place another URL in the tag. So once a victim clicks the link on...

AnchorCMS < 0.12.3a - Information Disclosure

# Exploit Title: Information disclosure (MySQL password) in error log

WebKit – Universal XSS Using Cached Pages

VULNERABILITY DETAILS

WebKit – User-agent Shadow root Leak in WebCore::ReplacementFragment::ReplacementFragment

WebKit – Universal XSS in WebCore::command

WebKit – UXSS Using JavaScript: URI and Synchronous Page Loads

VULNERABILITY DETAILS

DotNetNuke 9.3.2 – Cross-Site Scripting

Exploit Title: "Display Name" Stored Unauthenticated XSS in DNN v9.3.2

DotNetNuke < 9.4.0 - Cross-Site Scripting

# Exploit Title: Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0

GoAhead 2.5.0 – Host Header Injection

# Exploit Title: GoAhead Web server HTTP Header Injection.

PHP 7.1 < 7.3 - 'json serializer' disable_functions Bypass

Gila CMS < 1.11.1 - Local File Inclusion

# Exploit Title: Authenticated Local File Inclusion(LFI) in GilaCMS

Enigma NMS 65.0.0 – SQL Injection

#--------------------------------------------------------------------#

Enigma NMS 65.0.0 – OS Command Injection

#!/usr/bin/python

Enigma NMS 65.0.0 – Cross-Site Request Forgery

#--------------------------------------------------------------------#

Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN – Remote Code Execution

#!/usr/bin/python

Wolters Kluwer TeamMate 3.1 – Cross-Site Request Forgery

Hello,

Alkacon OpenCMS 10.5.x – Local File inclusion

# Exploit Title: Alkacon OpenCMS 10.5.x - Multiple LFI in Alkacon OpenCms

Alkacon OpenCMS 10.5.x – Cross-Site Scripting (2)

# Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Alkacon OpenCms

Alkacon OpenCMS 10.5.x – Cross-Site Scripting

# Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Apollo Template

Webkit JSC: JIT – Uninitialized Variable Access in ArgumentsEliminationPhase::transform

https://github.com/WebKit/webkit/blob/94e868c940d46c5745869192d07255331d00102b/Source/JavaScriptCore/dfg/DFGArguments...

Tableau – XML External Entity

# Exploit Title: Tableau XXE

Nimble Streamer 3.0.2-2 < 3.5.4-9 - Directory Traversal

# Nimble Streamer 3.0.2-2 to 3.5.4-9 - Path Traversal

Cisco UCS Director, Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data – Multiple Vulnerabilities

>> Multiple critical vulnerabilities in Cisco UCS Director, Cisco Integrated Management Controller Supervisor and Cis...

LibreOffice < 6.2.6 Macro - Python Code Execution (Metasploit)

##

Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN – Arbitrary File Disclosure (Metasploit)

# Exploit Title: File disclosure in Pulse Secure SSL VPN (metasploit)

NSKeyedUnarchiver – Info Leak in Decoding SGBigUTF8String

There is an info leak when decoding the SGBigUTF8String class using [SGBigUTF8String initWithCoder:]. This class init...

WebKit – UXSS via XSLT and Nested Document Replacements

VULNERABILITY DETAILS

ManageEngine OpManager 12.4x – Unauthenticated Remote Command Execution (Metasploit)

##

ManageEngine Application Manager 14.2 – Privilege Escalation / Remote Command Execution (Metasploit)

##

ManageEngine OpManager 12.4x – Privilege Escalation / Remote Command Execution (Metasploit)

##

Aptana Jaxer 1.0.3.4547 – Local File inclusion

# Exploit Title: Aptana Jaxer Remote Local File inclusion

Google Chrome 74.0.3729.0 / 76.0.3789.0 – Heap Use-After-Free in blink::PresentationAvailabilityState::UpdateAvailability

ARMBot Botnet – Arbitrary Code Execution

import requests

Ultimate Loan Manager 2.0 – Cross-Site Scripting

# Exploit Title:Web Studio Ultimate Loan Manager V2.0 - Persistent Cross Site Scripting