windows

Microsoft Edge Chakra JIT – Op_MaxInAnArray and Op_MinInAnArray can Explicitly call User-Defined JavaScript Functions

1. Call patterns like "Math.max.apply(Math, [1, 2, 3, 4, 5])" and "Math.max.apply(Math, arr)" can be optimized to dir...

Microsoft Windows – Local XPS Print Spooler Sandbox Escape

Windows: Local XPS Print Spooler Sandbox Escape

BarcodeWiz ActiveX Control < 6.7 - Buffer Overflow (PoC)

[+] Credits: John Page (aka hyp3rlinx)

DiskBoss Enterprise 8.5.12 – Denial of Service

# Exploit Title: DiskBoss Enterprise Server 8.5.12 - Denial of Service

Sync Breeze Enterprise 10.1.16 – Denial of Service

# Exploit Title: Sync Breeze Enterprise Server v10.1.16 - Denial of Service

Disk Pulse Enterprise 10.1.18 – Denial of Service

# Exploit Title: Disk Pulse Enterprise Server v10.1.18 - DOS,

VX Search Enterprise 10.1.12 – Denial of Service

# Exploit Title: VX Search Enterprise Server v10.1.12 - Denial of Service

Ayukov NFTP FTP Client 2.0 – Remote Buffer Overflow (Metasploit)

##

Microsoft Windows win32k – Using SetClassLong to Switch Between CS_CLASSDC and CS_OWNDC Corrupts DC Cache

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1389&desc=6

GetGo Download Manager 5.3.0.2712 – ‘Proxy’ Buffer Overflow

# Exploit Title: Buffer overflow vulnerability in GetGo Download Manager proxy options 5.3.0.2712

Kingsoft Antivirus/Internet Security 9+ – Local Privilege Escalation

"""

HP Mercury LoadRunner Agent magentproc.exe – Remote Command Execution (Metasploit)

##

D3DGear 5.00 Build 2175 – Buffer Overflow (PoC)

#!/usr/bin/python

NetTransport 2.96L – Remote Buffer Overflow (DEP Bypass)

#!/usr/bin/python

ALLMediaServer 0.95 – Remote Buffer Overflow (Metasploit)

require 'msf/core'

ALLMediaServer 0.95 – Buffer Overflow (PoC)

# Exploit Title: Buffer overflow in ALLPlayer ALLMediaServer 0.95 and earlier

SysGauge Server 3.6.18 – Denial of Service

# Exploit Title: SysGauge Server 3.6.18 - DOS

GetGo Download Manager 5.3.0.2712 – Buffer Overflow

# Exploit Title: Buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712

Ubiquiti UniFi Video 3.7.3 – Local Privilege Escalation

RCE Security Advisory

Microsoft Windows Kernel – ‘NtQueryVirtualMemory(MemoryMappedFilenameInformation)’ Double-Write Ring-0 Address Leak

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1456

BEIMS ContractorWeb 5.18.0.0 – SQL Injection

# Exploit Title: SQL Injection

Intel Content Protection HECI Service – Type Confusion Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1358

Microsoft Windows – ‘jscript!RegExpFncObj::LastParen’ Out-of-Bounds Read

Microsoft Windows – ‘jscript!JsArraySlice’ Uninitialized Variable

Microsoft Windows – jscript.dll ‘Array.sort’ Heap Overflow

Microsoft Windows – ‘jscript!RegExpComp::Compile’ Heap Overflow Through IE or Local Network via WPAD

Microsoft Internet Explorer 11 – ‘jscript!JSONStringifyObject’ Use-After-Free

Microsoft Windows – ‘jscript!NameTbl::GetValDef’ Use-After-Free

CDex 1.96 – Buffer Overflow (PoC)

#!/usr/bin/python

Sync Breeze 10.2.12 – Denial of Service

=============================================

Advantech WebAccess 8.2-2017.03.31 – Webvrpcs Service Opcode 80061 Stack Buffer Overflow (Metasploit)

##

Dup Scout Enterprise – ‘Login’ Buffer Overflow (Metasploit)

##

Microsoft Office – Dynamic Data Exchange ‘DDE’ Payload Delivery (Metasploit)

##

LabF nfsAxe FTP Client 3.7 – Remote Buffer Overflow (DEP Bypass)

#!/usr/bin/env python

Claymore Dual ETH + DCR/SC/LBC/PASC GPU Miner – Stack Buffer Overflow / Path Traversal

#!/usr/bin/env python

Microsoft Windows Defender – Controlled Folder Bypass Through UNC Path

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1418

Perspective ICM Investigation & Case 5.1.1.16 – Privilege Escalation

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ## # # # # # # # # # # ...

VX Search 10.2.14 – ‘command_name’ Buffer Overflow

#!/usr/bin/python

Socusoft Photo 2 Video Converter 8.0.0 – Local Buffer Overflow

# Exploit Title: Socusoft Photo 2 Video Converter v8.0.0 Local Buffer Overflow (Free and Professional variants)

Abyss Web Server < 2.11.6 - Heap Memory Corruption

[+] Credits: John Page (aka HyP3rlinX)

Dup Scout Enterprise 10.0.18 – ‘Input Directory’ Local Buffer Overflow (SEH)

#!/usr/bin/python

HP iMC Plat 7.2 – Remote Code Execution (2)

#!/opt/local/bin/python2.7

HP iMC Plat 7.2 – Remote Code Execution

#!/opt/local/bin/python2.7

ALLPlayer 7.5 – Denial of-Service (PoC)

#!/usr/bin/python

Diving Log 6.0 – XML External Entity Injection

[+] Exploit Title: Diving Log 6.0 XXE Injection

Microsoft Edge Chakra JIT – ‘GlobOpt::OptTagChecks’ Must Consider IsLoopPrePass Properly

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1365

Microsoft Edge Chakra JIT – Incorrect Function Declaration Scope

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1367

Microsoft Edge Chakra JIT – ‘Inline::InlineCallApplyTarget_Shared’ does not Return the return Instruction

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1366

Microsoft Edge Chakra JIT – ‘BailOutOnTaggedValue’ Bailouts Type Confusion

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1364

ALLPlayer 7.5 – Local Buffer Overflow (SEH Unicode)

#!/usr/bin/python