multiple

macOS < 10.14.3 / iOS < 12.1.3 XNU - 'vm_map_copy' Optimization which Requires Atomicity isn't Atomic

vm_map_copyin_internal in vm_map.c converts a region of a vm_map into "copied in" form, constructing a vm_map_copy

macOS < 10.14.3 / iOS < 12.1.3 - Sandbox Escapes due to Type Confusions and Memory Safety Issues in iohideventsystem

It's possible that this should be two separate issues but I'm filing it as one as I'm still understanding

macOS < 10.14.3 / iOS < 12.1.3 - Arbitrary mach Port Name Deallocation in XPC Services due to Invalid mach Message Parsing in _xpc_serializer_unpack

_xpc_serializer_unpack in libxpc parses mach messages which contain xpc messages.

iOS/macOS 10.13.6 – ‘if_ports_used_update_wakeuuid()’ 16-byte Uninitialized Kernel Stack Disclosure

macOS 10.13.4 introduced the file bsd/net/if_ports_used.c, which defines sysctls for inspecting

LogonBox Limited / Hypersocket Nervepoint Access Manager – (Unauthenticated) Insecure Direct Object Reference

# Exploit Title: Access Manager Unauthenticated Insecure Direct Object Reference (IDOR)

iOS/macOS – ‘task_swap_mach_voucher()’ Use-After-Free

#if 0

Lua 5.3.5 – ‘debug.upvaluejoin’ Use After Free

# Exploit Title: Lua 5.3.5

SCP Client – Multiple Vulnerabilities (SSHtranger Things)

# Exploit Title: SSHtranger Things

Oracle Reports Developer Component 12.2.1.3 – Cross-site Scripting

# Exploit Title: [Cross-site Scripting (XSS)]

WebKit JSC JIT – GetIndexedPropertyStorage Use-After-Free

The doesGC function simply takes a node, and tells if it might cause a garbage collection. This function is used to d...

Google Chrome V8 JavaScript Engine 71.0.3578.98 – Out-of-Memory in Invalid Array Length

Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (2)

#!/bin/bash

S-nail < 14.8.16 - Local Privilege Escalation

#!/bin/sh

ASAN/SUID – Local Privilege Escalation

#!/bin/bash

OpenSSH SCP Client – Write Arbitrary Files

'''

OpenSource ERP 6.3.1. – SQL Injection

#Exploit Title: OpenSource ERP SQL Injection

Google Chrome V8 JavaScript Engine 71.0.3578.98 – Out-of-Memory. Denial of Service (PoC)

Wireshark – ‘get_t61_string’ Heap Out-of-Bounds Read

The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of Wireshark, by f...

WebKit JSC – ‘JSArray::shiftCountWithArrayStorage’ Out-of-Bounds Read/Write

bool JSArray::shiftCountWithArrayStorage(VM& vm, unsigned startIndex, unsigned count, ArrayStorage* storage)

WebKit JSC – ‘AbstractValue::set’ Use-After-Free

// ./jsc --useConcurrentJIT=false ~/test.js

Deepin Linux 15 – ‘lastore-daemon’ Local Privilege Escalation

#!/bin/bash

VMware Workstation/Player < 12.5.5 - Local Privilege Escalation

#!/bin/bash

Netatalk 3.1.12 – Authentication Bypass (PoC)

import socket

Netatalk 3.1.12 – Authentication Bypass

##

Erlang – Port Mapper Daemon Cookie Remote Code Execution (Metasploit)

##

IBM Operational Decision Manager 8.x – XML External Entity Injection

# Exploit Title: [XML External Entity Injection (XXE)]

Google Chrome 70 – SQLite Magellan Crash (PoC)

Fortify Software Security Center (SSC) 17.10/17.20/18.10 – Information Disclosure (2)

Details

Fortify Software Security Center (SSC) 17.10/17.20/18.10 – Information Disclosure

Details

WebKit JIT – Int32/Double Arrays can have Proxy Objects in the Prototype Chains

Adobe ColdFusion 2018 – Arbitrary File Upload

# Exploit Title: Unrestricted file upload in Adobe ColdFusion 2018

Apache OFBiz 16.11.05 – Cross-Site Scripting

# Exploit Title: Apache OFBiz v16.11.05 - Stored Cross-Site Scripting Vulnerability

PrinterOn Enterprise 4.1.4 – Arbitrary File Deletion

# Exploit Author: bzyo

XNU – POSIX Shared Memory Mappings have Incorrect Maximum Protection

When the mmap() syscall is invoked on a POSIX shared memory segment

Kubernetes – (Authenticated) Arbitrary Requests

#!/usr/bin/env python3

Kubernetes – (Unauthenticated) Arbitrary Requests

#!/usr/bin/env python3

Wireshark – ‘find_signature’ Heap Out-of-Bounds Read

The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark (current git...

Wireshark – ‘cdma2k_message_ACTIVE_SET_RECORD_FIELDS’ Stack Corruption

The following crash due to a stack-based out-of-bounds memory access can be observed in an ASAN build of Wireshark (c...

xorg-x11-server < 1.20.3 - 'modulepath' Local Privilege Escalation

#!/bin/sh

TeamCity Agent – XML-RPC Command Execution (Metasploit)

##

WebKit JSC – BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the ‘ForInContext’ Object

This is simillar to issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration varia...

WebKit JIT – ‘ByteCodeParser::handleIntrinsicCall’ Type Confusion

case ArrayPushIntrinsic: {

WebKit JSC JIT – ‘JSPropertyNameEnumerator’ Type Confusion

When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the i...

Xorg X11 Server – SUID privilege escalation (Metasploit)

##

ImageMagick – Memory Leak

#!/bin/bash

Nutanix AOS & Prism < 5.5.5 (LTS) / < 5.8.1 (STS) - SFTP Authentication Bypass

# Exploit Title: Nutanix AOS & Prism - SFTP Authentication Bypass

Oracle Weblogic Server – Deserialization Remote Command Execution (Patch Bypass)

// All respects goes to Zhiyi Zhang of 360 ESG Codesafe Team

xorg-x11-server < 1.20.3 - Local Privilege Escalation

#CVE-2018-14665 - a LPE exploit via http://X.org fits in a tweet

Apple iOS/macOS – Kernel Memory Corruption due to Integer Overflow in IOHIDResourceQueue::enqueueReport

IOHIDResourceQueue inherits from IOSharedDataQueue and adds its own ::enqueueReport method,

Apple iOS/macOS – Sandbox Escape due to mach Message sent from Shared Memory

io_hideventsystem sets up a shared memory event queue; at the end of this shared memory buffer it puts