Zilab Remote Console Server 3.2.9 – ‘zrcs’ Unquoted Service Path
# Exploit Title : Zilab Remote Console Server 3.2.9 - 'zrcs' Unquoted Service Path
windows
windows 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Lavasoft 2.3.4.7 – ‘LavasoftTcpService’ Unquoted Service Path
# Lavasoft 2.3.4.7 - 'LavasoftTcpService' Unquoted Service Path
ActiveFax Server 6.92 Build 0316 – ‘ActiveFaxServiceNT’ Unquoted Service Path
# Exploit Title : ActiveFax Server 6.92 Build 0316 - 'ActiveFaxServiceNT' Unquoted Service Path
ActiveFax Server 6.92 Build 0316 – ‘POP3 Server’ Denial of Service
# Exploit Title: ActiveFax Server 6.92 Build 0316 - 'POP3 Server' Denial of Service
SpotAuditor 5.3.1.0 – Denial of Service
# Exploit Title: SpotAuditor 5.3.1.0 - Denial of Service
Uplay 92.0.0.6280 – Local Privilege Escalation
# Exploit Title: Uplay 92.0.0.6280 - Local Privilege Escalation
National Instruments Circuit Design Suite 14.0 – Local Privilege Escalation
# Exploit Title: National Instruments Circuit Design Suite 14.0 - Local Privilege Escalation
Microsoft Windows Kernel – Out-of-Bounds Read in nt!MiRelocateImage While Parsing Malformed PE File
We have encountered a Windows kernel crash in memcpy() called by nt!MiRelocateImage while trying to load a malformed ...
Microsoft Windows Kernel – Out-of-Bounds Read in CI!HashKComputeFirstPageHash While Parsing Malformed PE File
We have encountered a Windows kernel crash in CI!HashKComputeFirstPageHash while trying to load a malformed PE image ...
Microsoft Windows Kernel – Out-of-Bounds Read in nt!MiParseImageLoadConfig While Parsing Malformed PE File
We have encountered a Windows kernel crash in memcpy() called by nt!MiParseImageLoadConfig while trying to load a mal...
Microsoft Windows Kernel – Out-of-Bounds Read in CI!CipFixImageType While Parsing Malformed PE File
We have encountered a Windows kernel crash in CI!CipFixImageType while trying to load a malformed PE image into the p...
Microsoft Windows Kernel – NULL Pointer Dereference in nt!MiOffsetToProtos While Parsing Malformed PE File
We have encountered a Windows kernel crash in nt!MiOffsetToProtos while trying to load a malformed PE image into the ...
Microsoft Windows Kernel – win32k.sys TTF Font Processing Pool Corruption in win32k!ulClearTypeFilter
We have encountered a Windows kernel crash in the win32k.sys driver while processing a corrupted TTF font file. An ex...
Foscam Video Management System 1.1.6.6 – ‘UID’ Denial of Service (PoC)
# Exploit Title: Foscam Video Management System 1.1.6.6 - 'UID' Denial of Service (PoC)
DeviceViewer 3.12.0.1 – ‘add user’ Local Buffer Overflow (DEP Bypass)
# Exploit Title: Sricam DeviceViewer 3.12.0.1 - 'add user' Local Buffer Overflow (DEP Bypass)
DeviceViewer 3.12.0.1 – Arbitrary Password Change
# Exploit Title: DeviceViewer 3.12.0.1 - Arbitrary Password Change
freeFTP 1.0.8 – ‘PASS’ Remote Buffer Overflow
# Exploit Title: freeFTP 1.0.8 - Remote Buffer Overflow
CheckPoint Endpoint Security Client/ZoneAlarm 15.4.062.17802 – Privilege Escalation
# Exploit Title: CheckPoint Endpoint Security Client/ZoneAlarm 15.4.062.17802 - Privilege Escalation
DameWare Remote Support 12.1.0.34 – Buffer Overflow (SEH)
#!/usr/bin/env python
Mobatek MobaXterm 12.1 – Buffer Overflow (SEH)
# Title: Mobatek MobaXterm 12.1 - Buffer Overflow (SEH)
SpotIE Internet Explorer Password Recovery 2.9.5 – ‘Key’ Denial of Service
# Exploit Title: SpotIE Internet Explorer Password Recovery 2.9.5 - 'Key' Denial of Service
Microsoft Windows cryptoapi – SymCrypt Modular Inverse Algorithm Denial of Service
There's a bug in the SymCrypt multi-precision arithmetic routines that can cause an infinite loop when calculating th...
File Sharing Wizard 1.5.0 – POST SEH Overflow
import socket
Easy File Sharing Web Server 7.2 – ‘New User’ Local Overflow (SEH)
#!/usr/bin/python
DeviceViewer 3.12.0.1 – ‘creating user’ Denial of Service
#!/usr/bin/python
Microsoft Windows 10 – ‘WSReset’ UAC Protection Bypass (propsys.dll)
// ref : https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e
docPrint Pro 8.0 – SEH Buffer Overflow
import struct
AppXSvc – Privilege Escalation
#-----------------------------------------------------------------------------#
Folder Lock 7.7.9 – Denial of Service
# Exploit Title: Folder Lock v7.7.9 Denial of Service Exploit
Microsoft DirectWrite – Out-of-Bounds Read in sfac_GetSbitBitmap While Processing TTF Fonts
Microsoft DirectWrite is a modern Windows API for high-quality text rendering. A majority of its code resides in the ...
Microsoft DirectWrite – Invalid Read in SplicePixel While Processing OTF Fonts
Microsoft DirectWrite is a modern Windows API for high-quality text rendering. A majority of its code resides in the ...
Microsoft Windows NTFS – Privileged File Access Enumeration
[+] Credits: John Page (aka hyp3rlinx)
Microsoft Windows – ‘WSReset’ UAC Protection Bypass (Registry)
#### Fileless UAC bypass (WSReset.exe)
Kaseya VSA agent 9.5 – Privilege Escalation
# Exploit Title: Kaseya VSA agent
ChaosPro 3.1 – SEH Buffer Overflow
#!C:\Python27\python.exe
ChaosPro 2.1 – SEH Buffer Overflow
#!C:\Python27\python.exe
ChaosPro 2.0 – SEH Buffer Overflow
#!C:\Python27\python.exe
VX Search Enterprise 10.4.16 – ‘User-Agent’ Denial of Service
# Exploit Title: VX Search Enterprise v10.4.16 DoS
Asus Precision TouchPad 11.0.0.25 – Denial of Service
#!/usr/bin/python
Easy MP3 Downloader 4.7.8.8 – ‘Unlock Code’ Denial of Service
#!/usr/bin/python
SQL Server Password Changer 1.90 – Denial of Service
#Exploit Title: SQL Server Password Changer v1.90 Denial of Service Exploit
Outlook Password Recovery 2.10 – Denial of Service
#Exploit Title: Outlook Password Recovery v2.10 Denial of Service Exploit
Microsoft Windows 10 – SET_REPARSE_POINT_EX Mount Point Security Feature Bypass
Windows: SET_REPARSE_POINT_EX Mount Point Security Feature Bypass
LSoft ListServ < 16.5-2018a - Cross-Site Scripting
# Exploit Title: LSoft ListServ < 16.5 - Cross-Site Scripting (XSS)
RAR Password Recovery 1.80 – ‘User Name and Registration Code’ Denial of Service
# Exploit Title: RAR Password Recovery v1.80 Denial of Service Exploit