multiple

Apple iOS/macOS – Sandbox Escape due to Trusted Length Field in Shared Memory used by HID Event Subsystem

io_hideventsystem is a MIG service which provides proxy access to various HID devices for untrusted

Cisco Prime Infrastructure – (Unauthenticated) Remote Code Execution

##

WebKit – ‘WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded’ Use-After-Free

TYu

WebKit – ‘WebCore::SVGTextLayoutAttributes::context’ Use-After-Free

Text

WebKit – ‘WebCore::RenderLayer::updateDescendantDependentFlags’ Use-After-Free

IYnxA?LQYP}

WebKit – ‘WebCore::SVGTRefElement::updateReferencedText’ Use-After-Free

WebKit – ‘WebCore::RenderMultiColumnSet::updateMinimumColumnHeight’ Use-After-Free

WebKit – ‘WebCore::InlineTextBox::paint’ Out-of-Bounds Read

oH{I

WebKit – ‘WebCore::Node::ensureRareData’ Use-After-Free

a

WebKit – ‘WebCore::AXObjectCache::handleMenuItemSelected’ Use-After-Free

WebKit – ‘WebCore::SVGAnimateElementBase::resetAnimatedType’ Use-After-Free

WebRTC – FEC Out-of-Bounds Read

There is an out-of-bounds read in FEC processing in WebRTC. If a very short RTP packet is received, FEC will assume t...

WebRTC – VP9 Processing Use-After-Free

There is a use-after-free in VP9 processing in WebRTC. In the method RtpFrameReferenceFinder::ManageFrameVp9 the foll...

Apache Struts 2 – Namespace Redirect OGNL Injection (Metasploit)

##

Electron WebPreferences – Remote Code Execution

CVE-2018-15685 - Electron WebPreferences Remote Code Execution

Libpango 1.40.8 – Denial of Service (PoC)

# Exploit Title: Libpango 1.40.8 - Denial of Service (PoC)

Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)

#!/usr/bin/python

IBM Sterling B2B Integrator 5.2.0.1/5.2.6.3 – Cross-Site Scripting

# Exploit Title: [IBM Sterling B2B Integrator persistent cross-site scripting]

reSIProcate 1.10.2 – Heap Overflow

'''

WebRTC – H264 NAL Packet Processing Type Confusion

Type confusion can occur when processing a H264 packet. In the method PacketBuffer::FindFrames in modules/video_codin...

WebRTC – FEC Processing Overflow

There are several calls to memcpy that can overflow the destination buffer in webrtc::UlpfecReceiverImpl::AddReceived...

WebRTC – VP8 Block Decoding Use-After-Free

There is a use-after-free in VP8 block decoding in WebRTC. The contents of the freed block is then treated a pointer,...

Skia – Heap Overflow in SkScan::FillPath due to Precision Error

There is a heap overflow in Skia when drawing paths with antialiasing turned off. This issue can be triggered in both...

Google Chrome – SwiftShader OpenGL Texture Bindings Reference Count Leak

Google Chrome – Swiftshader Blitting Floating-Point Precision Errors

Google Chrome – Swiftshader Texture Allocation Integer Overflow

There's a remotely triggerable memory corruption issue in SwiftShader that's reachable from WebGL, resulting from an ...

Open-AudIT Community 2.1.1 – Cross-Site Scripting

#######################################

Nanopool Claymore Dual Miner – APIs Remote Code Execution (Metasploit)

##

macOS/iOS – JavaScript Injection Bug in OfficeImporter

QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, ...

JavaScript Core – Arbitrary Code Execution

// Load Int library, thanks saelo!

Dicoogle PACS 2.5.0 – Directory Traversal

# Exploit Title: Dicoogle PACS 2.5.0 - Directory Traversal

Oracle WebLogic 12.1.2.0 – RMI Registry UnicastRef Object Java Deserialization Remote Code Execution

#!/usr/bin/python

Gitea 1.4.0 – Remote Code Execution

# pip install PyJWT requests

IPConfigure Orchid VMS 2.0.5 – Directory Traversal / Information Disclosure (Metasploit)

require 'msf/core'

WebRTC – VP9 Missing Frame Processing Out-of-Bounds Memory Access

There is a missing check in VP9 frame processing that could lead to memory corruption.

WebRTC – VP9 Frame Processing Out-of-Bounds Memory Access

There is a missing check in VP9 frame processing that could lead to memory corruption.

WebKit – Use-After-Free when Resuming Generator

Google Chrome – Integer Overflow when Processing WebAssembly Locals

When v8 decodes the locals of a function, it performs a check:

WebKit – WebAssembly Compilation Info Leak

XNU Kernel – Heap Overflow Due to Bad Bounds Checking in MPTCP

mptcp_usr_connectx is the handler for the connectx syscall for the AP_MULTIPATH socket family.

Apple macOS/iOS Kernel – Heap Overflow Due to Lack of Lower Size Check in getvolattrlist

getvolattrlist takes a user controlled bufferSize argument via the fgetattrlist syscall.

Epiphany 3.28.2.1 – Denial of Service

Summary:

Skia and Firefox – Integer Overflow in SkTDArray Leading to Out-of-Bounds Write

go

SAP Internet Transaction Server 6200.x – Session Fixation / Cross-Site Scripting

# Exploit Title: SAP Internet Transaction Server (ITS) 6200.X.X - Session Fixation/ Cross-Site Scripting

Oracle WebCenter Sites 11.1.1.8.0/12.2.1.x – Cross-Site Scripting

# Exploit Title: Multiple XSS Oracle WebCenter Sites (FatWire Content

Apache Struts 2 – Struts 1 Plugin Showcase OGNL Code Execution (Metasploit)

##

Google Chrome V8 – Object Allocation Size Integer Overflow

There's an integer overflow in computing the required allocation size when instantiating a new javascript object.

JasperReports – (Authenticated) File Read

TIBCO’s JasperReports ( file = new File(/home/rhino/jasperreports...mcat/webapps/jasperserver,"/WEB-INF/jsp/modules/a...

WebKit – ‘WebCore::jsElementScrollHeightGetter’ Use-After-Free

Apple macOS/iOS – ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules

ReportCrash is the daemon responsible for making crash dumps of crashing userspace processes.