Domoticz 4.10577 – Unauthenticated Remote Command Execution
#!/usr/bin/env python
multiple
multiple 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Google Chrome 72.0.3626.121 / 74.0.3725.0 – ‘NewFixedDoubleArray’ Integer Overflow
VULNERABILITY DETAILS
Netwide Assembler (NASM) 2.14rc15 – NULL Pointer Dereference (PoC)
# Exploit Title: Netwide Assembler (NASM) 2.14rc15 NULL Pointer Dereference (PoC)
Oracle Java Runtime Environment – Heap Corruption During TTF font Rendering in GlyphIterator::setCurrGlyphID
A heap corruption was observed in Oracle Java Runtime Environment version 8u202 (latest at the time of this writing) ...
Oracle Java Runtime Environment – Heap Corruption During TTF font Rendering in sc_FindExtrema4
A heap corruption was observed in Oracle Java Runtime Environment version 8u202 (latest at the time of this writing) ...
Apache Axis 1.4 – Remote Code Execution
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
Google Chrome 73.0.3683.39 / Chromium 74.0.3712.0 – ‘ReadableStream’ Internal Object Leak Type Confusion
Click to start AudioContext
Google Chrome 72.0.3626.81 – ‘V8TrustedTypePolicyOptions::ToImpl’ Type Confusion
VULNERABILITY DETAILS
WebKit JavaScriptCore – CodeBlock Dangling Watchpoints Use-After-Free
While fuzzing JavaScriptCore, I encountered the following (simplified and commented) JavaScript program which crashes...
WebKit JavaScriptCore – Out-Of-Bounds Access in FTL JIT due to LICM Moving Array Access Before the Bounds Check
While fuzzing JavaScriptCore, I encountered the following JavaScript program which crashes jsc in current HEAD and re...
iOS < 12.2 / macOS < 10.14.4 XNU - pidversion Increment During execve is Unsafe
Privileged IPC services in userspace often have to verify the security context of their client processes (such as whe...
SpiderMonkey – IonMonkey Compiled Code Fails to Update Inferred Property Types (Type Confusion)
A bug in IonMonkey leaves type inference information inconsistent, which in turn allows the compilation of JITed func...
Spidermonkey – IonMonkey Type Inference is Incorrect for Constructors Entered via OSR
A bug in IonMonkeys type inference system when JIT compiling and entering a constructor function via on-stack replace...
Apache CouchDB 2.3.1 – Cross-Site Request Forgery / Cross-Site Scripting
#####################################################################################################################...
Google Chrome < M73 - FileSystemOperationRunner Use-After-Free
There's a comment in FileSystemOperationRunner::BeginOperation
Google Chrome < M73 - MidiManagerWin Use-After-Free
MidiManagerWin uses a similar instance_id mechanism to the TaskService implementation to ensure that delayed tasks ar...
Google Chrome < M73 - Data Race in ExtensionsGuestViewMessageFilter
There appears to be a race condition in the destruction of the ExtensionsGuestViewMessageFilter if the ProcessIdToFil...
Google Chrome < M73 - Double-Destruction Race in StoragePartitionService
There's a race condition in the destruction of the BindingState for bindings to the StoragePartitionService.
NetData 1.13.0 – HTML Injection
# ************************************************************************
OrientDB 3.0.17 GA Community Edition – Cross-Site Request Forgery / Cross-Site Scripting
#####################################################################################################################...
tcpdump < 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads
Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. Th...
Google Chrome < M72 - FileWriterImpl Use-After-Free
There's a use-after-free in the implementation of the FileWriter component of the mojo bindings for the filesystem API.
Google Chrome < M72 - Use-After-Free in RenderProcessHostImpl Binding for P2PSocketDispatcherHost
There's an object-lifetime issue in the browser process in the handling of P2PSocketDispatcherHost binding in paralle...
Google Chrome < M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free
There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races again...
Google Chrome < M72 - PaymentRequest Service Use-After-Free
There are several object-lifetime issues in the browser process in the
WebKit JSC – reifyStaticProperty Needs to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter
https://github.com/WebKit/webkit/blob/3fff8c40c665a09de5e3ede46fc35908f69353c3/Source/JavaScriptCore/runtime/Lookup.h...
Quest NetVault Backup Server < 11.4.5 - Process Manager Service SQL Injection / Remote Code Execution
# Exploit Title: Quest NetVault Backup Server < 11.4.5 Process Manager Service SQL Injection Remote Code Execution Vu...
Comodo Dome Firewall 2.7.0 – Cross-Site Scripting
#####################################################################################################################...
ArangoDB Community Edition 3.4.2-1 – Cross-Site Scripting
#####################################################################################################################...
Apache CouchDB 2.3.0 – Cross-Site Scripting
#####################################################################################################################...
M/Monit 3.7.2 – Privilege Escalation
#!/usr/env/python3
Skia – Incorrect Convexity Assumptions Leading to Buffer Overflows
I was looking into the root cause of https://bugs.chromium.org/p/chromium/issues/detail?id=850350. In that bug, due t...
pfSense 2.4.4-p1 – Cross-Site Scripting
#####################################################################################################################...
Nessus 8.2.1 – Cross-Site Scripting
#####################################################################################################################...
macOS < 10.14.3 / iOS < 12.1.3 - Kernel Heap Overflow in PF_KEY due to Lack of Bounds Checking when Retrieving Statistics
Inspired by Ned Williamsons's fuzzer I took a look at the netkey code.