dos

Microsoft Visio 2016 16.0.4738.1000 – ‘Log in accounts’ Denial of Service

# -⋆- coding: utf-8 -⋆-

Spidermonkey – IonMonkey Type Inference is Incorrect for Constructors Entered via OSR

A bug in IonMonkeys type inference system when JIT compiling and entering a constructor function via on-stack replace...

Firefox < 66.0.1 - 'Array.prototype.slice' Buffer Overflow

Microsoft Windows 7/2008 – ‘Win32k’ Denial of Service (PoC)

# Exploit Title: Microsoft Windows Win32k CVE-2019-0808 Local Privilege Escalation Vulnerability

snap – seccomp BBlacklist for TIOCSTI can be Circumvented

snap uses a seccomp filter to prevent the use of the TIOCSTI ioctl; in the

Canarytokens 2019-03-01 – Detection Bypass

## Exploit Title: Canarytokens 2019-03-01 - Detection Bypass

Google Chrome < M73 - FileSystemOperationRunner Use-After-Free

There's a comment in FileSystemOperationRunner::BeginOperation

Google Chrome < M73 - MidiManagerWin Use-After-Free

MidiManagerWin uses a similar instance_id mechanism to the TaskService implementation to ensure that delayed tasks ar...

Microsoft Edge – Flash click2play Bypass with CObjectElement::FinalCreateObject

Attached is a PoC file that bypasses Flash click2play in Microsoft Edge. This was tested on Windows 10 64bit v 1809 w...

Microsoft VBScript – VbsErase Memory Corruption

Microsoft Internet Explorer 11 – VBScript Execution Policy Bypass in MSHTML

Google Chrome < M73 - Data Race in ExtensionsGuestViewMessageFilter

There appears to be a race condition in the destruction of the ExtensionsGuestViewMessageFilter if the ProcessIdToFil...

Google Chrome < M73 - Double-Destruction Race in StoragePartitionService

There's a race condition in the destruction of the BindingState for bindings to the StoragePartitionService.

libseccomp < 2.4.0 - Incorrect Compilation of Arithmetic Comparisons

When libseccomp compiles filters for 64-bit systems, it needs to split 64-bit

WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 – Denial of Service

# Exploit Title: WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 Local Dos Exploit

WinMPG Video Convert 9.3.5 – Denial of Service

# Exploit Title: WinMPG Video Convert Local Dos Exploit

Core FTP Server FTP / SFTP Server v2 Build 674 – ‘SIZE’ Directory Traversal

# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674 SIZE Directory Traversal

Core FTP Server FTP / SFTP Server v2 Build 674 – ‘MDTM’ Directory Traversal

# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674 MDTM Directory Traversal

Microsoft Windows – ‘.reg’ File / Dialog Box Message Spoofing

[+] Credits: John Page (aka hyp3rlinx)

Core FTP 2.0 build 653 – ‘PBSZ’ Denial of Service (PoC)

# Exploit Title: Core FTP 2.0 build 653 - 'PBSZ' - Unauthenticated - Denial of Service (PoC)

Linux Kernel 4.4 (Ubuntu 16.04) – ‘snd_timer_user_ccallback()’ Kernel Pointer Leak

#include

Android – getpidcon() Usage in Hardware binder ServiceManager Permits ACL Bypass

We already reported four bugs in Android that are caused by the use of

Android – binder Use-After-Free via racy Initialization of ->allow_user_free

The following bug report solely looks at the situation on the upstream master

Linux < 4.20.14 - Virtual Address 0 is Mappable via Privileged write() to /proc/*/mem

By following the codepath that Andrea Arcangeli pointed out in his mails

Microsoft Edge Chakra 1.11.4 – Read Permission via Type Confusion

FileZilla 3.40.0 – ‘Local search’ / ‘Local site’ Denial of Service (PoC)

# Exploit Title: FileZilla 3.40.0 - "Local search" Denial of Service (PoC)

macOS XNU – Copy-on-Write Behavior Bypass via Mount of User-Owned Filesystem Image

XNU has various interfaces that permit creating copy-on-write copies of data

Linux < 4.14.103 / < 4.19.25 - Out-of-Bounds Read and Write in SNMP NAT Module

commit cc2d58634e0f ("netfilter: nf_nat_snmp_basic: use asn1 decoder library",

tcpdump < 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads

Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. Th...

Google Chrome < M72 - FileWriterImpl Use-After-Free

There's a use-after-free in the implementation of the FileWriter component of the mojo bindings for the filesystem API.

Google Chrome < M72 - Use-After-Free in RenderProcessHostImpl Binding for P2PSocketDispatcherHost

There's an object-lifetime issue in the browser process in the handling of P2PSocketDispatcherHost binding in paralle...

Google Chrome < M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races again...

Google Chrome < M72 - PaymentRequest Service Use-After-Free

There are several object-lifetime issues in the browser process in the

TransMac 12.3 – Denial of Service (PoC)

# -*- coding: utf-8 -*-

WebKitGTK 2.23.90 / WebKitGTK+ 2.22.6 – Denial of Service

#Exploit Title: Buffer overflow

FTP Server 1.32 – Denial of Service

#!/usr/bin/env python

Xlight FTP Server 3.9.1 – Buffer Overflow (PoC)

# Exploit Title: Xlight 3.9.1 FTP Server SEH Overwrite

WebKit JSC – reifyStaticProperty Needs to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter

https://github.com/WebKit/webkit/blob/3fff8c40c665a09de5e3ede46fc35908f69353c3/Source/JavaScriptCore/runtime/Lookup.h...

AirDrop 2.0 – Denial of Service (DoS)

#include

ScreenStream 3.0.15 – Denial of Service

#!/usr/bin/python

Virtual VCR Max .0a – ‘.vcr’ Buffer Overflow (PoC)

#!/usr/bin/python

Valentina Studio 9.0.5 Linux – ‘Host’ Buffer Overflow (PoC)

# -*- coding: utf-8 -*-

MatrixSSL < 4.0.2 - Stack Buffer Overflow Verifying x.509 Certificates

I happened to notice that a public X.509 certificate testcase for CVE-2014-1569 caused a stack buffer overflow in Mat...

Android Kernel < 4.8 - ptrace seccomp Filter Bypass

The seccomp.2 manpage (http://man7.org/linux/man-pages/man2/seccomp.2.html) documents:

FaceTime – Texture Processing Memory Corruption

There is a memory corruption issue that occurs when processing a malformed RTP video stream in FaceTime. It appears t...

WinRAR 5.61 – ‘.lng’ Denial of Service

# Exploit Title: WinRAR 5.61 - Denial of Service

FTPShell Server 6.83 – ‘Account name to ban’ Denial of Service (PoC)

#Exploit Title: FTPShell Server 6.83 - Denial of Service (PoC)

BulletProof FTP Server 2019.0.0.50 – ‘SMTP Server’ Denial of Service (PoC)

#Exploit Title: BulletProof FTP Server 2019.0.0.50 - Denial of Service (PoC)

Valentina Studio 9.0.4 – ‘Host’ Denial of Service (PoC)

#Exploit Title: Valentina Studio 9.0.4 - Denial of Service (PoC)

NetSetMan 4.7.1 – ‘Workgroup’ Denial of Service (PoC)

#Exploit Title: NetSetMan 4.7.1 'Workgroup' - Denial of Service (PoC)