Chrome V8 JIT – Arrow Function Scope Fixing Bug
When the parser parses the parameter list of an arrow function contaning destructuring assignments, it can't distingu...
multiple
multiple 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Chrome V8 JIT – ‘AwaitedPromise’ Update Bug
Here's a snippet of AsyncGeneratorReturn. (https://cs.chromium.org/chromium/src/v8/src/builtins/builtins-async-genera...
Chrome V8 JIT – ‘NodeProperties::InferReceiverMaps’ Type Confusion
https://cs.chromium.org/chromium/src/v8/src/compiler/node-properties.cc?rcl=df84e87191022bf6914f9570069908f10b303245&...
Adobe Flash – Out-of-Bounds Write in blur Filtering
The attached swf file causes and out-of-bounds write in blur filtering.
Adobe Flash – Info Leak in Image Inflation
The attached image causes an info leak in image inflation. It occasionally crashes when rendered, otherwise it displa...
Adobe Flash – Overflow in Slab Rendering
The attached fuzzed swf file causes heap or stack corruption (depending on platform) when rendering a slab.
Adobe Flash – Overflow when Playing Sound
The attached fuzzed swf file causes heap overflow when playing a sound.
RSVG 2.40.13 / 2.42.2 – ‘.svg’ Buffer Overflow
# Exploit Title: Buffer-overflow in RSVG while converting a malformed svg
Kodi 17.6 – Persistent Cross-Site Scripting
=============================================
Google Chrome V8 JIT – ‘LoadElimination::ReduceTransitionElementsKind’ Type Confusion
I think this commit has introduced the bug: https://chromium.googlesource.com/v8/v8.git/+/9884bc5dee488bf206655f07b8a...
WebKit – WebAssembly Parsing Does not Correctly Check Section Order
When a WebAssembly binary is parsed in ModuleParser::parse, it is expected to contain certain sections in a certain o...
Adobe Flash < 28.0.0.161 - Use-After-Free
#!/usr/bin/env python
Google Chrome V8 – ‘ElementsAccessorBase::CollectValuesOrEntriesImpl’ Type Confusion
Here's a snippet of the method.
Open-AuditIT Professional 2.1 – Cross-Site Request Forgery
# Exploit Title: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery (CSRF)
TeamCity < 9.0.2 - Disabled Registration Bypass
var login = 'testuser'; //логин пользователя
TwonkyMedia Server 7.0.11-8.5 – Persistent Cross-Site Scripting
---------------------------------------------------------------------
Cisco node-jos < 0.11.0 - Re-sign Tokens
#!/usr/bin/env python3
Prisma Industriale Checkweigher PrismaWEB 1.21 – Hard-Coded Credentials
Prisma Industriale Checkweigher PrismaWEB 1.21 Authentication Bypass
Chrome V8 JIT – Empty BytecodeJumpTable Out-of-Bounds Read
In the current implementation, the bytecode generator also emits empty jump tables.
Chrome V8 JIT – JSBuiltinReducer::ReduceObjectCreate Fails to Ensure that the Prototype is “null”
I think this commit has introduced the bug.
Chrome V8 JIT – Simplified-lowererer IrOpcode::kStoreField, IrOpcode::kStoreElement Optimization Bug
I think this commit has introduced the bugs: https://chromium.googlesource.com/v8/v8/+/c22ca7f73ba92f22d0cd29b06bb294...
Bravo Tejari Web Portal – Cross-Site Request Forgery
Exploit Title: Bravo Tejari Web Portal-CSRF
Suricata < 4.0.4 - IDS Detection Bypass
-----------------------------------------------------
antMan < 0.9.1a - Authentication Bypass
# Exploit Title: antMan
Chrome V8 – ‘TranslatedState::MaterializeCapturedObjectAt’ Type Confusion
Here'a snippet of TranslatedState::MaterializeCapturedObjectAt.
Chrome V8 – ‘PropertyArray’ Integer Overflow
Here's a snippet of the MigrateFastToFast function which is used to create a new PropertyArray object.
Transmission – Integer Overflows Parsing Torrent Files
I took a look at torrent file parsing in libtransmission, there are a few integer overflows because the tr_new/tr_new...
Wavpack 5.1.0 – Denial of Service
# Exploit title: Wavpack 5.1.0 - Denial of Service
μTorrent (uTorrent) Classic/Web – JSON-RPC Remote Code Execution / Information Disclosure
By default, utorrent create an HTTP RPC server on port 10000 (uTorrent classic) or 19575 (uTorrent web). There are nu...
Oracle Primavera P6 Enterprise Project Portfolio Management – HTTP Response Splitting
# Exploit Title: Oracle Primavera P6 Enterprise Project Portfolio Management HTTP Response Splitting
JBoss Remoting 6.14.18 – Denial of Service
# Exploit Title: Exploit Denial of Service JBoss Remoting (4447/9999)
Chrome V8 – ‘Runtime_RegExpReplace’ Integer Overflow
Here's a snippet of the method.
Pdfium – Out-of-Bounds Read with Shading Pattern Backed by Pattern Colorspace
Related to issue 1490 .
Pdfium – Pattern Shading Integer Overflows
This vulnerability relies on several minor oversights in the handling of shading patterns in pdfium, I'll try to deta...
Asterisk 13.17.2 – ‘chan_skinny’ Remote Memory Corruption
# Exploit Author: Juan Sacco - http://exploitpack.com
HPE iLO 4 < 2.53 - Add New Administrator User
#!/usr/bin/env python
Claymore Dual GPU Miner 10.5 – Format String
Claymore’s Dual GPU Miner 10.5 and below is vulnerable to a format strings vulnerability. This allows an unauthentica...
Oracle Hospitality Simphony (MICROS) 2.7 < 2.9 - Directory Traversal
# Exploit Title: Oracle Hospitality Simphony (MICROS) directory traversal