WebKit JavaScriptCore – Out-Of-Bounds Access in FTL JIT due to LICM Moving Array Access Before the Bounds Check
While fuzzing JavaScriptCore, I encountered the following JavaScript program which crashes jsc in current HEAD and re...
dos
dos 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
iOS < 12.2 / macOS < 10.14.4 XNU - pidversion Increment During execve is Unsafe
Privileged IPC services in userspace often have to verify the security context of their client processes (such as whe...
SpiderMonkey – IonMonkey Compiled Code Fails to Update Inferred Property Types (Type Confusion)
A bug in IonMonkey leaves type inference information inconsistent, which in turn allows the compilation of JITed func...
gnutls 3.6.6 – ‘verify_crt()’ Use-After-Free
## Description of problem:
Microsoft Visio 2016 16.0.4738.1000 – ‘Log in accounts’ Denial of Service
# -⋆- coding: utf-8 -⋆-
Spidermonkey – IonMonkey Type Inference is Incorrect for Constructors Entered via OSR
A bug in IonMonkeys type inference system when JIT compiling and entering a constructor function via on-stack replace...
Microsoft Windows 7/2008 – ‘Win32k’ Denial of Service (PoC)
# Exploit Title: Microsoft Windows Win32k CVE-2019-0808 Local Privilege Escalation Vulnerability
snap – seccomp BBlacklist for TIOCSTI can be Circumvented
snap uses a seccomp filter to prevent the use of the TIOCSTI ioctl; in the
Canarytokens 2019-03-01 – Detection Bypass
## Exploit Title: Canarytokens 2019-03-01 - Detection Bypass
Google Chrome < M73 - FileSystemOperationRunner Use-After-Free
There's a comment in FileSystemOperationRunner::BeginOperation
Google Chrome < M73 - MidiManagerWin Use-After-Free
MidiManagerWin uses a similar instance_id mechanism to the TaskService implementation to ensure that delayed tasks ar...
Microsoft Edge – Flash click2play Bypass with CObjectElement::FinalCreateObject
Attached is a PoC file that bypasses Flash click2play in Microsoft Edge. This was tested on Windows 10 64bit v 1809 w...
Google Chrome < M73 - Data Race in ExtensionsGuestViewMessageFilter
There appears to be a race condition in the destruction of the ExtensionsGuestViewMessageFilter if the ProcessIdToFil...
Google Chrome < M73 - Double-Destruction Race in StoragePartitionService
There's a race condition in the destruction of the BindingState for bindings to the StoragePartitionService.
libseccomp < 2.4.0 - Incorrect Compilation of Arithmetic Comparisons
When libseccomp compiles filters for 64-bit systems, it needs to split 64-bit
WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 – Denial of Service
# Exploit Title: WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 Local Dos Exploit
WinMPG Video Convert 9.3.5 – Denial of Service
# Exploit Title: WinMPG Video Convert Local Dos Exploit
Core FTP Server FTP / SFTP Server v2 Build 674 – ‘SIZE’ Directory Traversal
# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674 SIZE Directory Traversal
Core FTP Server FTP / SFTP Server v2 Build 674 – ‘MDTM’ Directory Traversal
# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674 MDTM Directory Traversal
Microsoft Windows – ‘.reg’ File / Dialog Box Message Spoofing
[+] Credits: John Page (aka hyp3rlinx)
Core FTP 2.0 build 653 – ‘PBSZ’ Denial of Service (PoC)
# Exploit Title: Core FTP 2.0 build 653 - 'PBSZ' - Unauthenticated - Denial of Service (PoC)
Android – getpidcon() Usage in Hardware binder ServiceManager Permits ACL Bypass
We already reported four bugs in Android that are caused by the use of
Android – binder Use-After-Free via racy Initialization of ->allow_user_free
The following bug report solely looks at the situation on the upstream master
Linux < 4.20.14 - Virtual Address 0 is Mappable via Privileged write() to /proc/*/mem
By following the codepath that Andrea Arcangeli pointed out in his mails
FileZilla 3.40.0 – ‘Local search’ / ‘Local site’ Denial of Service (PoC)
# Exploit Title: FileZilla 3.40.0 - "Local search" Denial of Service (PoC)
macOS XNU – Copy-on-Write Behavior Bypass via Mount of User-Owned Filesystem Image
XNU has various interfaces that permit creating copy-on-write copies of data
Linux < 4.14.103 / < 4.19.25 - Out-of-Bounds Read and Write in SNMP NAT Module
commit cc2d58634e0f ("netfilter: nf_nat_snmp_basic: use asn1 decoder library",
tcpdump < 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads
Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. Th...
Google Chrome < M72 - FileWriterImpl Use-After-Free
There's a use-after-free in the implementation of the FileWriter component of the mojo bindings for the filesystem API.
Google Chrome < M72 - Use-After-Free in RenderProcessHostImpl Binding for P2PSocketDispatcherHost
There's an object-lifetime issue in the browser process in the handling of P2PSocketDispatcherHost binding in paralle...
Google Chrome < M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free
There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races again...
Google Chrome < M72 - PaymentRequest Service Use-After-Free
There are several object-lifetime issues in the browser process in the
TransMac 12.3 – Denial of Service (PoC)
# -*- coding: utf-8 -*-
WebKitGTK 2.23.90 / WebKitGTK+ 2.22.6 – Denial of Service
#Exploit Title: Buffer overflow
FTP Server 1.32 – Denial of Service
#!/usr/bin/env python
Xlight FTP Server 3.9.1 – Buffer Overflow (PoC)
# Exploit Title: Xlight 3.9.1 FTP Server SEH Overwrite
WebKit JSC – reifyStaticProperty Needs to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter
https://github.com/WebKit/webkit/blob/3fff8c40c665a09de5e3ede46fc35908f69353c3/Source/JavaScriptCore/runtime/Lookup.h...
ScreenStream 3.0.15 – Denial of Service
#!/usr/bin/python
Virtual VCR Max .0a – ‘.vcr’ Buffer Overflow (PoC)
#!/usr/bin/python
Valentina Studio 9.0.5 Linux – ‘Host’ Buffer Overflow (PoC)
# -*- coding: utf-8 -*-
MatrixSSL < 4.0.2 - Stack Buffer Overflow Verifying x.509 Certificates
I happened to notice that a public X.509 certificate testcase for CVE-2014-1569 caused a stack buffer overflow in Mat...
Android Kernel < 4.8 - ptrace seccomp Filter Bypass
The seccomp.2 manpage (http://man7.org/linux/man-pages/man2/seccomp.2.html) documents:
FaceTime – Texture Processing Memory Corruption
There is a memory corruption issue that occurs when processing a malformed RTP video stream in FaceTime. It appears t...