windows

Dup Scout Enterprise 10.0.18 – ‘Import Command’ Local Buffer Overflow

#!/usr/bin/python

Trend Micro OfficeScan 11.0/XG (12.0) – Memory Corruption

[+] Credits: John Page (aka hyp3rlinx)

Microsoft Office Groove – ‘Workspace Shortcut’ Arbitrary Code Execution

Title: MS Office Groove 'Workspace Shortcut' Arbitrary Code Execution Vulnerability

DiskBoss Enterprise 8.4.16 – ‘Import Command’ Local Buffer Overflow

#!/usr/bin/python

DiskBoss Enterprise 8.4.16 – Local Buffer Overflow (PoC)

#!/usr/bin/python

Trend Micro OfficeScan 11.0/XG (12.0) – Code Execution / Memory Corruption

[+] Credits: John Page (aka hyp3rlinx)

Trend Micro OfficeScan 11.0/XG (12.0) – Man In The Middle Remote Code Execution

[+] Credits: John Page (aka hyp3rlinx)

Trend Micro OfficeScan 11.0/XG (12.0) – Image File Execution Bypass

[+] Credits: John Page (aka hyp3rlinx)

Sync Breeze Enterprise 10.0.28 – Denial of-Service (PoC)

#!/usr/bin/python

Oracle 9i XDB 9.2.0.1 – HTTP PASS Buffer Overflow

#Exploit Title:Oracle 9i XDB HTTP PASS Buffer Overflow

Disk Pulse Enterprise 10.0.12 – GET Buffer Overflow (SEH)

# Tested on Windows XP SP3 (x86)

CyberLink LabelPrint < 2.5 - Local Buffer Overflow (SEH Unicode)

#!/usr/bin/python

ERS Data System 1.8.1 – Java Deserialization

# Exploit Title: ERS Data System 1.8.1 Deserialize Vulnerability

Disk Pulse Enterprise 9.9.16 – GET Buffer Overflow (Metasploit)

##

Microsoft Edge Chakra – ‘JavascriptFunction::ReparseAsmJsModule’ Incorrectly Re-parses

function Module() {

Microsoft Edge Chakra – ‘Parser::ParseCatch’ Does Not Handle ‘eval()’ (Denial of Service)

function f() {

Microsoft Edge Chakra – Deferred Parsing Makes Wrong Scopes

let h = function f(a0 = (function () {

Microsoft Edge – Chakra Incorrectly Parses Object Patterns

function f() {

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)

# E-DB Note: https://www.alphabot.com/security/blog/2017/java/Apache-Tomcat-RCE-CVE-2017-12617.html

Microsoft Edge 38.14393.1066.0 – ‘COptionsCollectionCacheItem::GetAt’ Out-of-Bounds Read

Microsoft Edge 38.14393.1066.0 – Memory Corruption with Partial Page Loading

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1309

Microsoft Windows Kernel – ‘win32k!NtQueryCompositionSurfaceBinding’ Stack Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1307

Microsoft Windows Kernel – ‘win32k!NtGdiDoBanding’ Stack Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1304

Microsoft Windows Kernel – ‘win32k!NtGdiEngCreatePalette’ Stack Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1276&desc=2

Microsoft Windows Kernel – ‘win32k!NtGdiGetFontResourceInfoInternalW’ Stack Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1275

Microsoft Windows Kernel – ‘win32k.sys’ ‘.TTF’ Font Processing Out-of-Bounds Read with Malformed ‘glyf’ Table ‘win32k!fsc_CalcGrayRow’ (Denial of Service)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1274

Microsoft Windows Kernel – ‘win32k.sys’ ‘.TTF’ Font Processing Out-of-Bounds Reads/Writes with Malformed ‘fpgm’ table ‘win32k!bGeneratePath’ (Denial of Service)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1273

Microsoft Windows Kernel – ‘nt!NtSetIoCompletion / nt!NtRemoveIoCompletion’ Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1269

Microsoft Windows Kernel – ‘win32k!NtGdiGetPhysicalMonitorDescription’ Stack Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1268

Microsoft Windows Kernel – ‘win32k!NtGdiGetGlyphOutline’ Pool Memory Disclosure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1267&desc=2

Netdecision 5.8.2 – Local Privilege Escalation

// Netdecision.cpp : Defines the entry point for the console application.

Cloudview NMS 2.00b – Writable Directory Traversal Execution (Metasploit)

require 'msf/core'

haneWIN DNS Server 1.5.3 – Remote Buffer Overflow (Metasploit)

require 'msf/core'

Lockstep Backup for Workgroups 4.0.3 – Remote Buffer Overflow (Metasploit)

require 'msf/core'

EMC AlphaStor Device Manager – Opcode 0x72 Buffer Overflow (Metasploit)

require 'msf/core'

EMC AlphaStor Library Manager < 4.0 build 910 - Opcode 0x4f Buffer Overflow (Metasploit)

require 'msf/core'

KingScada AlarmServer 3.1.2.13 – Remote Stack Buffer Overflow (Metasploit)

require 'msf/core'

Microsoft Windows .NET Framework – Remote Code Execution

Source: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample

Carel PlantVisor 2.4.4 – Directory Traversal Information Disclosure (Metasploit)

require 'msf/core'

Carlo Gavazzi Powersoft 2.1.1.1 – Directory Traversal File Disclosure (Metasploit)

require 'msf/core'

Cloudview NMS < 2.00b - Arbitrary File Upload (Metasploit)

require 'msf/core'

Dameware Mini Remote Control 4.0 – Username Stack Buffer Overflow (Metasploit)

require 'msf/core'

Fatek Automation PLC WinProladder 3.11 Build 14701 – Stack Buffer Overflow (Metasploit)

require 'msf/core'

Indusoft Web Studio – Directory Traversal Information Disclosure (Metasploit)

require 'msf/core'

Motorola Netopia Netoctopus SDCS – Remote Stack Buffer Overflow (Metasploit)

require 'msf/core'

Sielco Sistemi Winlog 2.07.16 – Remote Buffer Overflow (Metasploit)

require 'msf/core'

Viap Automation WinPLC7 5.0.45.5921 – Recv Buffer Overflow (Metasploit)

require 'msf/core'

ZScada Modbus Buffer 2.0 – Stack Buffer Overflow (Metasploit)

require 'msf/core'

Mako Web Server 2.5 – Multiple Vulnerabilities

[+] SSD Beyond Security: https://blogs.securiteam.com/index.php/archives/3391

Jungo DriverWizard WinDriver < 12.4.0 - Kernel Pool Overflow / Local Privilege Escalation (2)

# -*- coding: utf-8 -*-