multiple

Google Chrome – Out-of-Bounds Access in RegExp Stubs

There is an out-of-bounds access in RegExp.prototype.exec and RegExp.prototype.test. The code defined in BranchIfFast...

IBM DB2 9.7/10.1/10.5/11.1 – Command Line Processor Buffer Overflow

'''

Adobe Flash – ATF Parser Heap Corruption

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1216

Adobe Flash – Image Decoding Out-of-Bounds Read

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1215

Adobe Flash – AVC Edge Processing Out-of-Bounds Read

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1212

unrar 5.40 – ‘VMSF_DELTA’ Filter Arbitrary Memory Write

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1286&desc=6

WebKit JSC – ‘Intl.getCanonicalLocales’ Heap Buffer Overflow

Object.prototype.__defineGetter__(1000, () => 2);

WebKit JSC – JIT Optimization Check Failed in IntegerCheckCombiningPhase::handleBlock

function f() {

WebKit JSC – arrayProtoFuncSplice does not Initialize all Indices

function gc() {

WebKit JSC – JSGlobalObject::haveABadTime Causes Type Confusions

VMware vSphere Data Protection 5.x/6.x – Java Deserialization

#!/usr/bin/env python

Apple macOS 10.12.3 / iOS < 10.3.2 - Userspace Entitlement Checking Race Condition

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1223

Apache Struts – REST Plugin With Dynamic Method Invocation Remote Code Execution

#!/usr/bin/python

Wireshark 2.2.0 < 2.2.12 - ROS Dissector Denial of Service

Source: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13637

Wireshark 2.2.6 – IPv6 Dissector Denial of Service

Build Information:

WebKit – ‘Element::setAttributeNodeNS’ Use-After-Free

WebKit – ‘Document::prepareForDestruction’ / ‘CachedFrame’ Universal Cross-Site Scripting

Click anywhere.

WebKit – ‘CachedFrameBase::restore’ Universal Cross-Site Scripting

Click anywhere...

WebKit – CachedFrame does not Detach Openers Universal Cross-Site Scripting

Click anywhere.

WebKit JSC – Incorrect Check in emitPutDerivedConstructorToArrowFunctionContextScope

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1173

KEMP LoadMaster 7.135.0.13245 – Persistent Cross-Site Scripting / Remote Code Execution

Vulnerability Summary

Mozilla Firefox < 53 - 'ConvolvePixel' Memory Disclosure

Mozilla Firefox < 53 - 'gfxTextRun' Out-of-Bounds Read

aaaaaaaaaaaaaaaaaa

Skia Graphics Library – Heap Overflow due to Rounding Error in SkEdge::setLine

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1155

Apple Safari 10.0.3(12602.4.8) / WebKit – ‘HTMLObjectElement::updateWidget’ Universal Cross-Site Scripting

WebKit – ‘FrameLoader::clear’ Stealing Variables via Page Navigation

Click anywhere.

WebKit – ‘enqueuePageshowEvent’ / ‘enqueuePopstateEvent’ Universal Cross-Site Scripting

WebKit – ‘ContainerNode::parserInsertBefore’ Universal Cross-Site Scripting

Sources:

WebKit – ‘ContainerNode::parserRemoveChild’ Universal Cross-Site Scripting

Apple WebKit / Safari 10.0.3(12602.4.8) – ‘Editor::Command::execute’ Universal Cross-Site Scripting

Click Anywhere.

Apple WebKit / Safari 10.0.3(12602.4.8) – ‘WebCore::FrameView::scheduleRelayout’ Use-After-Free

Apple macOS/iOS Kernel – Memory Disclosure Due to Lack of Bounds Checking in netagent Socket Option Handling

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1140

Apple macOS/iOS Kernel – Use-After-Free Due to Bad Locking in Unix Domain Socket File Descriptor Externalization

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1123

Apple macOS/iOS – ‘CAMediaTimingFunctionBuiltin’ NSKeyedArchiver Memory Corruption Due to Lack of Bounds Checking

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1175

Apple macOS/iOS – ‘TIKeyboardLayout initWithCoder:’ NSKeyedArchiver Heap Corruption Due to Rounding Error

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1172

Apple macOS/iOS – NSUnarchiver Heap Corruption Due to Lack of Bounds Checking in [NSBuiltinCharacterSet initWithCoder:]

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1170

Apple macOS/iOS – Memory Corruption Due to Bad Bounds Checking in NSCharacterSet Coding for NSKeyedUnarchiver

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1168

Tecnovision DLX Spot – SSH Backdoor Access

# Exploit Title: DlxSpot - Player4 LED video wall - Hardcoded Root SSH Password.

Mozilla Firefox 50 < 55 - Stack Overflow Denial of Service

Adobe Flash – Out-of-Bounds Read in Getting TextField Width

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1211

Adobe Flash – Margin Handling Heap Corruption

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1174

Adobe Flash – AVC Deblocking Out-of-Bounds Read

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1171

MiniUPnP MiniUPnPc < 2.0 - Remote Denial of Service

VuNote

OpenVPN 2.4.0 – Denial of Service

#!/usr/bin/env python3

Intel Active Management Technology – System Privileges

#!/usr/bin/python

wolfSSL 3.10.2 – x509 Certificate Text Parsing Off-by-One

TALOS-2017-0293

Oracle GoldenGate 12.1.2.0.0 – Remote Code Execution

#!/usr/bin/env python

Dahua Generation 2/3 – Backdoor Access

#!/usr/bin/python2.7

MySQL < 5.6.35 / < 5.7.17 - Integer Overflow

'''

Emby MediaServer 3.2.5 – Directory Traversal

Emby MediaServer 3.2.5 Directory Traversal File Disclosure Vulnerability