windows

Easy CD DVD Copy 1.3.24 – Local Buffer Overflow (SEH)

#!/usr/bin/python

WM Recorder 16.8.1 – Denial of Service

#!/usr/bin/python

Allok Quicktime to AVI MPEG DVD Converter 4.6.1217 – Stack-Based Buffer Overflow

# SWAMI KARUPASAMI THUNAI

Microsoft Windows – Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write Privilege Escalation

Windows: Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write EoP

Microsoft Windows – Desktop Bridge Virtual Registry Arbitrary File Read/Write Privilege Escalation

Internet Explorer – ‘RegExp.lastMatch’ Memory Disclosure

There is a vulnerability in Internet Explorer that could potentially be used for memory disclosure.

Firefox 44.0.2 – ASM.JS JIT-Spray Remote Code Execution

CVE-2016-1960 and ASM.JS JIT-Spray

Firefox 46.0.1 – ASM.JS JIT-Spray Remote Code Execution

CVE-2016-2819 and ASM.JS JIT-Spray

SAP NetWeaver AS JAVA CRM – Log injection Remote Command Execution

#!/usr/bin/env python

ACL Analytics 11.X – 13.0.0.579 – Arbitrary Code Execution

# Exploit Title: Arbitrary Code Execution

Advantech WebAccess < 8.3 - Directory Traversal / Remote Code Execution

#!/usr/bin/python2.7

Allok QuickTime to AVI MPEG DVD Converter 3.6.1217 – Buffer Overflow

###############################################################################

WebLog Expert Enterprise 9.4 – Denial of Service

[+] Credits: John Page (aka hyp3rlinx)

WebLog Expert Enterprise 9.4 – Authentication Bypass

[+] Credits: John Page (aka hyp3rlinx)

Softros Network Time System Server 2.3.4 – Denial of Service

[+] Credits: John Page (aka hyp3rlinx)

ActivePDF Toolkit < 8.1.0.19023 - Multiple Memory Corruptions

ActivePDF Toolkit < 8.1.0 multiple RCE

Dup Scout Enterprise 10.5.12 – ‘Share Username’ Local Buffer Overflow

#!/usr/bin/python

Xion 1.0.125 – ‘.m3u’ Local SEH-Based Unicode Venetian Exploit

#!/usr/bin/perl

iSumsoft ZIP Password Refixer 3.1.1 – Buffer Overflow

author = '''

DualDesk 20 – ‘Proxy.exe’ Denial of Service

[+] Credits: John Page (aka hyp3rlinx)

SEGGER embOS/IP FTP Server 3.22 – Denial of Service

[+] Credits: John Page (aka hyp3rlinx)

IrfanView 4.50 Email Plugin – Buffer Overflow (SEH Unicode)

#!/usr/bin/python

IrfanView 4.44 Email Plugin – Buffer Overflow (SEH)

#!/usr/bin/python

Microsoft Windows 8.1/2012 R2 – SMBv3 Null Pointer Dereference Denial of Service

# Exploit Title: Microsoft Windows SMB Client Null Pointer Dereference Denial of Service

GetGo Download Manager 5.3.0.2712 – Buffer Overflow (SEH)

#!/usr/bin/python

CloudMe Sync 1.10.9 – Stack-Based Buffer Overflow (Metasploit)

##

Disk Savvy Enterprise 10.4.18 – Stack-Based Buffer Overflow (Metasploit)

##

Parallels Remote Application Server 15.5 – Path Traversal

# Exploit Title: Parallels Remote Application Server (RAS) 15.5 Path Traversal

Armadito Antivirus 0.12.7.2 – Detection Bypass

Title: Armadito Antivirus - Malware Detection Bypass

Disk Pulse Enterprise 10.4.18 – ‘Import Command’ Buffer Overflow (SEH)

#!/usr/bin/env python

Disk Savvy Enterprise 10.4.18 – Buffer Overflow (SEH)

# Exploit Title: Disk Savvy Enterprise v10.4.18 Server - Unauthenticated Remote Buffer Overflow SEH

EChat Server 3.1 – ‘CHAT.ghp’ Buffer Overflow

# Exploit Author: Juan Sacco

Microsoft Internet Explorer 11 – ‘Js::RegexHelper::RegexReplace’ Use-After-Free

Microsoft Windows – StorSvc SvcMoveFileInheritSecurity Arbitrary File Creation Privilege Escalation

Windows: StorSvc SvcMoveFileInheritSecurity Arbitrary File Creation EoP

Microsoft Windows – Constrained Impersonation Capability Privilege Escalation

Windows: Constrained Impersonation Capability EoP

Microsoft Windows – NPFS Symlink Security Feature Bypass/Elevation of Privilege/Dangerous Behavior

Windows: NPFS Symlink Security Feature Bypass/Elevation of Privilege/Dangerous Behavior

Microsoft Windows – Global Reparse Point Security Feature Bypass/Elevation of Privilege

Windows: Global Reparse Point Security Feature Bypass/Elevation of Privilege

Microsoft Windows Kernel – ‘nt!RtlpCopyLegacyContextX86’ Stack Memory Disclosure

We have discovered a new Windows kernel memory disclosure vulnerability in the creation and copying of a CONTEXT stru...

Microsoft Edge – ‘UnmapViewOfFile’ ACG Bypass

Background:

Microsoft Edge Chakra JIT – ‘LdThis’ Type Confusion

LdThis instructions' value type is assumed to be "Object". Since "this" can be other objects like an array, it has to...

Microsoft Edge Chakra JIT – ‘NewScObjectNoCtor’ Array Type Confusion

This is similar to the previous issues 1457, 1459 (MSRC 42551, MSRC 42552).

Microsoft Edge Chakra JIT – ‘Array.prototype.reverse’ Array Type Confusion

This is simillar to the previous issue 1457. But this time, we use Array.prototype.reverse.

Microsoft Edge Chakra JIT – Array Type Confusion via InitProto Instructions

If a native array is used as a prototype, it is converted to a Var array by the Js::JavascriptNativeFloatArray::SetIs...

Microsoft Edge Chakra JIT – ImplicitCallFlags Checks Bypass

Here's a snippet of ExecuteImplicitCall which is responsible for updating the ImplicitCallFlags flag.

Microsoft Edge Chakra JIT – Memory Corruption

Let's consider the following example code.

Microsoft Edge Chakra JIT – ‘GlobOpt::OptTagChecks’ Must Consider IsLoopPrePass Properly (2)

It seems this is the patch for the bug.

GNU binutils 2.26.1 – Integer Overflow (PoC)

# Exploit Title: Objdump - Integer Overflow Crash POC

NAT32 2.2 Build 22284 – Cross-Site Request Forgery

[+] Credits: hyp3rlinx

NAT32 2.2 Build 22284 – Remote Command Execution

[+] Credits: hyp3rlinx

Flash ActiveX 18.0.0.194 – Code Execution

## CVE-2015-5112