windows

Advantech WebAccess 8.3.0 – Remote Code Execution

Vulnerability Title: Advantech WebAccess Node8.3.0 "AspVBObj.dll" - Remote Code Execution

CloudMe Sync < 1.11.0 - Buffer Overflow

[+] Credits: John Page (aka hyp3rlinx)

Adobe Coldfusion 11.0.03.292866 – BlazeDS Java Object Deserialization Remote Code Execution

# Exploit Title: Adobe Coldfusion BlazeDS Java Object Deserialization RCE

MalwareFox AntiMalware 2.74.0.150 – Privilege Escalation

Title: MalwareFox AntiMalware 2.74.0.150 - Local Privilege Escalation

MalwareFox AntiMalware 2.74.0.150 – Local Privilege Escalation

Title : MalwareFox AntiMalware 2.74.0.150 - Local Privilege Escalation

Microsoft Windows – ‘EternalRomance’/’EternalSynergy’/’EternalChampion’ SMB Remote Code Execution (Metasploit) (MS17-010)

##

Microsoft Windows Subsystem for Linux – ‘execve()’ Local Privilege Escalation

#define _GNU_SOURCE

Sync Breeze Enterprise 10.4.18 – Remote Buffer Overflow (SEH)

# Exploit Title: Sync Breeze Enterprise v10.4.18 Server - Unauthenticated Remote Buffer Overflow SEH

Hotspot Shield – Information Disclosure

## Vulnerability Summary

BMC BladeLogic RSCD Agent 8.3.00.64 – Windows Users Disclosure

# Exploit Title: BMC BladeLogic RSCD agent get Windows users

LabF nfsAxe 3.7 TFTP Client – Local Buffer Overflow

#!/usr/bin/python

System Shield 5.0.0.136 – Privilege Escalation

Exploit Title - System Shield AntiVirus & AntiSpyware Arbitrary Write Privilege Escalation

Advantech WebAccess < 8.3 - SQL Injection

#!/usr/bin/python2.7

HPE iMC 7.3 – RMI Java Deserialization

# Exploit Title: HPE iMC 7.3 Java RMI Registry Deserialization RCE Vulnerability

Exodus Wallet (ElectronJS Framework) – Remote Code Execution

Sync Breeze Enterprise 9.5.16 – ‘Import Command’ Buffer Overflow (Metasploit)

##

Blizzard Update Agent – JSON RPC DNS Rebinding

All blizzard games are installed alongside a shared tool called "Blizzard Update Agent", investor.activision.com clai...

HP Connected Backup 8.6/8.8.6 – Local Privilege Escalation

#Tested on HP Connected Backup version 8.8.2.0 on Windows 7 x64

MixPad 5.00 – Buffer Overflow

#!/usr/bin/python

Microsoft Edge Chakra JIT – Stack-to-Heap Copy

If variables don't escape the scope, the variables can be allocated to the stack. However, there are some situations,...

Microsoft Edge Chakra – ‘AsmJSByteCodeGenerator::EmitCall’ Out-of-Bounds Read

AsmJSByteCodeGenerator::EmitCall which is used to emit call insturctions doesn't check if an array identifier is used...

Microsoft Edge Chakra JIT – Out-of-Bounds Write

// Here's the PoC demonstrating OOB write.

Microsoft Edge Chakra – Deferred Parsing Makes Wrong Scopes (2)

Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is s...

Microsoft Edge Chakra – Incorrect Scope Handling

// PoC:

Microsoft Edge Chakra – ‘JavascriptGeneratorFunction::GetPropertyBuiltIns’ Type Confusion

Here's a snippet of the method.

Microsoft Edge Chakra JIT – Incorrect Bounds Calculation

Let's start with comments in the "GlobOpt::TrackIntSpecializedAddSubConstant" method.

OBS Studio 20.1.3 – Local Buffer Overflow

author = '''

Disk Pulse Enterprise 10.1.18 – Remote Buffer Overflow

# Exploit Title: Disk Pulse Enterprise Server v10.1.18 - Buffer Overflow

SysGauge Server 3.6.18 – Remote Buffer Overflow

# Exploit Title: SysGauge Server 3.6.18 - Buffer Overflow

PyroBatchFTP < 3.19 - Buffer Overflow

=============================================

Kentico CMS 11.0 – Buffer Overflow

Document Title:

ALLMediaServer 0.95 – Remote Buffer Overflow

#!/usr/bin/python

Microsoft Edge Chakra – ‘AppendLeftOverItemsFromEndSegment’ Out-of-Bounds Read

Here's a snippet of AppendLeftOverItemsFromEndSegment in JavascriptArray.inl.

LabF nfsAxe 3.7 FTP Client – Stack Buffer Overflow (Metasploit)

##

Microsoft Windows SMB Server (v1/v2) – Mount Point Arbitrary Device Open Privilege Escalation

Windows: SMB Server (v1 and v2) Mount Point Arbitrary Device Open EoP

Microsoft Windows – NtImpersonateAnonymousToken LPAC to Non-LPAC Privilege Escalation

Windows: NtImpersonateAnonymousToken LPAC to Non-LPAC EoP

Microsoft Windows – NtImpersonateAnonymousToken AC to Non-AC Privilege Escalation

Windows: NtImpersonateAnonymousToken AC to Non-AC EoP

Microsoft Windows – NTFS Owner/Mandatory Label Privilege Bypass

Windows: NTFS Owner/Mandatory Label Privilege Bypass EoP

Jungo Windriver 12.5.1 – Local Privilege Escalation

// ConsoleApplication1.cpp : Defines the entry point for the console application.

HPE iMC – dbman ‘RestartDB’ Remote Command Execution (Metasploit)

##

HPE iMC – dbman ‘RestoreDBase’ Remote Command Execution (Metasploit)

##

Microsoft Edge Chakra JIT – ‘Lowerer::LowerSetConcatStrMultiItem’ Missing Integer Overflow Check

The method "Lowerer::LowerSetConcatStrMultiItem" is used to generate machine code to concatenate strings.

DiskBoss Enterprise 8.8.16 – Remote Buffer Overflow

# Exploit Title: DiskBoss

Microsoft Office – ‘Composite Moniker Remote Code Execution

## What?

Commvault Communications Service (cvd) – Command Injection (Metasploit)

##

Microsoft Windows – ‘nt!NtQuerySystemInformation (information class 138, QueryMemoryTopologyInformation)’ Kernel Pool Memory Disclosure

We have discovered that the nt!NtQuerySystemInformation system call invoked with the 138 information class discloses ...

Microsoft Windows – ‘nt!NtQueryInformationProcess (information class 76, QueryProcessEnergyValues)’ Kernel Stack Memory Disclosure

We have discovered that the nt!NtQueryInformationProcess system call invoked with the 76 information class discloses ...

Microsoft Edge Chakra JIT – Escape Analysis Bug

Escape analysis: https://en.wikipedia.org/wiki/Escape_analysis

Microsoft Edge Chakra – ‘asm.js’ Out-of-Bounds Read

Here's a snippet of AsmJSByteCodeGenerator::EmitAsmJsFunctionBody.

Microsoft Edge Chakra JIT – BackwardPass::RemoveEmptyLoopAfterMemOp Does not Insert Branches

The optimizations for memory operations may leave empty loops as follows: