windows

Allok Video to DVD Burner 2.6.1217 – Buffer Overflow (SEH)

#######################################################

RGui 3.4.4 – Local Buffer Overflow

#!/usr/bin/python

VLC Media Player/Kodi/PopcornTime ‘Red Chimera’ < 2.2.5 - Memory Corruption (PoC)

"""

Open-AudIT 2.1 – CSV Macro Injection

Hi Guys,

VMware Workstation 12.5.2 – Drag n Drop Use-After-Free (Pwn2Own 2017) (PoC)

char *initial_dnd = "tools.capability.dnd_version 4";

Ncomputing vSpace Pro 10/11 – Directory Traversal

# Exploit Title: Ncomputing vSpace Pro v10 and v11 - Directory Traversal Vulnerability

VX Search 10.6.18 – ‘directory’ Local Buffer Overflow

#!/usr/bin/python

Easy File Sharing Web Server 7.2 – Stack Buffer Overflow

# Exploit Title: Easy File Sharing Web Server 7.2 stack buffer overflow

Reaper 5.78 – Local Buffer Overflow

# Exploit Title: Reaper 5.78 - Local Buffer Overflow

Brave Browser < 0.13.0 - 'window.close(self)' Denial of Service

# Exploit Title:Brave Browser < 0.13.0 Denial of Service (resource consumption) via a window.close(self) js code.

Brave Browser < 0.13.0 - 'long alert() argument' Denial of Service

# Exploit Title:Brave Browser < 0.13.0 Denial of Service (resource consumption) via a long alert() argument.

CloudMe Sync 1.11.0 – Local Buffer Overflow

#######################################################

Zortam MP3 Media Studio 23.45 – Local Buffer Overflow (SEH)

#!/usr/bin/python

Microsoft Edge – ‘OpenProcess()’ ACG Bypass

Each Edge Content process (MicrosoftEdgeCP.exe) needs to call SetProcessMitigationPolicy() on itself to enable ACG. T...

Microsoft Windows – ‘CiSetFileCache’ TOCTOU Incomplete Fix

Windows: CiSetFileCache TOCTOU CVE-2017-11830 Incomplete Fix

Microsoft Windows – ‘nt!NtQueryVirtualMemory (MemoryImageInformation)’ Kernel 64-bit Stack Memory Disclosure

We have discovered that the nt!NtQueryVirtualMemory system call invoked with the MemoryImageInformation (0x6) informa...

Microsoft Windows – ‘nt!NtQueryVirtualMemory (Memory(Privileged)BasicInformation)’ Kernel 64-bit Stack Memory Disclosure

We have discovered that the nt!NtQueryVirtualMemory system call invoked with the MemoryBasicInformation (0x0) and Mem...

Microsoft Windows – ‘nt!NtQueryInformationProcess (ProcessImageFileName)’ Kernel 64-bit Pool/Stack Memory Disclosure

We have discovered that the nt!NtQueryInformationProcess system call invoked with the ProcessImageFileName (0x1B) inf...

Microsoft Windows – ‘nt!NtQueryInformationTransactionManager (TransactionManagerRecoveryInformation)’ Kernel Pool Memory Disclosure

We have discovered that the nt!NtQueryInformationTransactionManager system call invoked with the TransactionManagerRe...

Microsoft Windows – ‘nt!NtQuerySystemInformation (SystemPageFileInformation(Ex))’ Kernel 64-bit Stack Memory Disclosure

We have discovered that the nt!NtQuerySystemInformation system call invoked with the SystemPageFileInformation (0x12)...

Microsoft Windows – ‘nt!NtQueryVolumeInformationFile’ Kernel Stack Memory Disclosure

We have discovered that the nt!NtQueryVolumeInformationFile system call invoked against certain kernel objects disclo...

Microsoft Windows – ‘nt!NtQueryAttributesFile’ Kernel Stack Memory Disclosure

We have discovered that the nt!NtQueryAttributesFile system call invoked with paths of certain kernel objects disclos...

Microsoft Windows – ‘nt!NtQueryFullAttributesFile’ Kernel Stack Memory Disclosure

We have discovered that the nt!NtQueryFullAttributesFile system call invoked with paths of certain kernel objects dis...

SysGauge Pro 4.6.12 – Local Buffer Overflow (SEH)

#!/usr/bin/python

AMD Plays.tv 1.27.5.0 – ‘plays_service.exe’ Arbitrary File Execution

########################################################################

Microsoft Credential Security Support Provider – Remote Code Execution

# credssp

GoldWave 5.70 – Local Buffer Overflow (SEH Unicode)

#!/usr/bin/python

DotNetNuke DNNarticle Module 11 – Directory Traversal

##############################

Sophos Endpoint Protection Control Panel 10.7 – Weak Password Encryption

[+] Credits: John Page (aka hyp3rlinx)

Sophos Endpoint Protection 10.7 – Tamper-Protection Bypass

[+] Credits: John Page (aka hyp3rlinx)

Microsoft Windows – Multiple Use-After-Free Issues in jscript Array Methods

Microsoft Windows Defender – ‘mpengine.dll’ Memory Corruption

Windows Defender inspects a variety of different archive formats, among others RAR.

Microsoft Edge Chakra JIT – Stack-to-Heap Copy (Incomplete Fix) (2)

Here's a snippet of JavascriptArray::BoxStackInstance.

Microsoft Edge Chakra JIT – Stack-to-Heap Copy (Incomplete Fix) (1)

Here's a snippet of JavascriptArray::BoxStackInstance. To fix issue 1420 , "deepCopy" was introduced. But it only de...

LifeSize ClearSea 3.1.4 – Directory Traversal

'''

WebLog Expert Enterprise 9.4 – Privilege Escalation

Exploit Author: bzyo

Sync Breeze Enterprise 10.4.18 – Denial of-Service (PoC)

#!/usr/bin/python

Faleemi Windows Desktop Software – (DDNS/IP) Local Buffer Overflow

'''

Advantech WebAccess < 8.1 - webvrpcs DrawSrv.dll Path BwBuildPath Stack-Based Buffer Overflow

#!/usr/bin/python2.7

SysGauge 4.5.18 – Local Denial of Service

#!/usr/bin/python

Allok WMV to AVI MPEG DVD WMV Converter 4.6.1217 – Buffer Overflow

# SWAMI KARUPASAMI THUNAI

Allok Video Joiner 4.6.1217 – Stack-Based Buffer Overflow

# SWAMI KARUPASAMI THUNAI

Allok AVI DivX MPEG to DVD Converter 2.6.1217 – Buffer Overflow (SEH)

#!/usr/bin/env python

Exodus Wallet (ElectronJS Framework) – Remote Code Execution (Metasploit)

##

GitStack – Unsanitized Argument Remote Code Execution (Metasploit)

##

Microsoft Windows Remote Assistance – XML External Entity Injection

# Exploit Title: Microsoft Windows Remote Assistance XXE

Acrolinx Server < 5.2.5 - Directory Traversal

# Exploit Title: Acrolinx Dashboard Directory Traversal

LabF nfsAxe 3.7 – Privilege Escalation

Exploit Author: bzyo

Fast AVI MPEG Splitter 1.2 – Stack-Based Buffer Overflow

# SWAMI KARUPASAMI THUNAI

Easy Avi Divx Xvid to DVD Burner 2.9.11 – ‘.avi’ Denial of Service

#!/usr/bin/python