dos

VBScript – VbsErase Reference Leak Use-After-Free

There is an reference leak in Microsoft VBScript that can be turned into an use-after-free given sufficient time. The...

MegaPing – Local Buffer Overflow Denial of Service

# Exploit Title: MegaPing

Exel Password Recovery 8.2.0.0 – Local Buffer Overflow Denial of Service

# Exploit Title: Excel Password Recovery Professional

AnyBurn 4.3 – Local Buffer Overflow (PoC)

# Exploit Title: AnyBurn

Microsoft Windows – ‘jscript!JsArrayFunctionHeapSort’ Out-of-Bounds Write

Google Chrome 70 – SQLite Magellan Crash (PoC)

UltraISO 9.7.1.3519 – ‘Output FileName’ Denial of Service (PoC)

# Exploit Title: UltraISO 9.7.1.3519 - 'Output FileName' Denial of Service (PoC) and Pointer to next SEH and SE handl...

Angry IP Scanner 3.5.3 – Denial of Service (PoC)

#!/usr/bin/python

WebKit JIT – Int32/Double Arrays can have Proxy Objects in the Prototype Chains

Linux – ‘userfaultfd’ Bypasses tmpfs File Permissions

Using the userfaultfd API, it is possible to first register a

GNU inetutils < 1.9.4 - 'telnet.c' Multiple Overflows (PoC)

GNU inetutils

LanSpy 2.0.1.159 – Local Buffer Overflow (PoC)

# Exploit Title: LanSpy 2.0.1.159 - Local BoF (PoC)

SmartFTP Client 9.0.2623.0 – Denial of Service (PoC)

# -*- coding: utf-8 -*-

Textpad 8.1.2 – Denial Of Service (PoC)

# Exploit Title: Textpad 8.1.2 - Denial Of Service (PoC)

Wireshark – ‘find_signature’ Heap Out-of-Bounds Read

The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark (current git...

Wireshark – ‘cdma2k_message_ACTIVE_SET_RECORD_FIELDS’ Stack Corruption

The following crash due to a stack-based out-of-bounds memory access can be observed in an ASAN build of Wireshark (c...

Microsoft Lync for Mac 2011 – Injection Forced Browsing/Download

# Exploit Title: Microsoft Lync for Mac 2011 Injection Forced Browsing/Download

Budabot 4.0 – Denial of Service (PoC)

# Exploit Title: Budabot 4.0 - Denial of Service (PoC)

Mozilla Firefox 63.0.1 – Denial of Service (PoC)

# Exploit Title: Mozilla Firefox 63.0.1 - Denial of Service (PoC)

VBScript – ‘rtFilter’ Out-of-Bounds Read

VBScript – ‘OLEAUT32!VariantClear’ and ‘scrrun!VBADictionary::put_Item’ Use-After-Free

Linux Kernel 4.8 (Ubuntu 16.04) – Leak sctp Kernel Pointer

# Exploit Title: Linux Kernel 4.8 (Ubuntu 16.04) - Leak sctp kernel pointer

WebKit JSC – BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the ‘ForInContext’ Object

This is simillar to issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration varia...

WebKit JIT – ‘ByteCodeParser::handleIntrinsicCall’ Type Confusion

case ArrayPushIntrinsic: {

WebKit JSC JIT – ‘JSPropertyNameEnumerator’ Type Confusion

When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the i...

MariaDB Client 10.1.26 – Denial of Service (PoC)

# Exploit Title: MariaDB Client 10.1.26 - Denial of Service (PoC)

Apple macOS 10.13 – ‘workq_kernreturn’ Denial of Service (PoC)

# Exploit Title: MacOS 10.13 - 'workq_kernreturn' Denial of Service (PoC)

Microsoft Edge Chakra – OP_Memset Type Confusion

Since the patch for CVE-2018-8372, it checks all inputs to native arrays, and if any input equals to the MissingItem ...

XMPlay 3.8.3 – ‘.m3u’ Denial of Service (PoC)

# Exploit Title: XMPlay 3.8.3 - '.m3u' Denial of Service (PoC)

Easy Outlook Express Recovery 2.0 – Denial of Service (PoC)

# Exploit Title: Easy Outlook Express Recovery 2.0 - Denial of Service (PoC)

Mumsoft Easy Software 2.0 – Denial of Service (PoC)

# Exploit Title: Mumsoft Easy Software 2.0 - Denial of Service (PoC)

Notepad3 1.0.2.350 – Denial of Service (PoC)

# Exploit Title: Notepad3 1.0.2.350 - Denial of Service (PoC)

Bosch Video Management System 8.0 – Configuration Client Denial of Service (PoC)

# Exploit Title: Bosch Video Management System 8.0-Configuration Client-Denial of Service (Poc)

AMPPS 2.7 – Denial of Service (PoC)

# Exploit Title: AMPPS 2.7 - Denial of Service (PoC)

Cisco Immunet < 6.2.0 / Cisco AMP For Endpoints 6.2.0 - Denial of Service

[+] Credits: John Page (aka hyp3rlinx)

Evince 3.24.0 – Command Injection

# Exploit Title: evince command line injection

CuteFTP Mac 3.1 – Denial of Service (PoC)

# Exploit Title: CuteFTP Mac 3.1 Denial of Service (PoC)

Mongoose Web Server 6.9 – Denial of Service (PoC)

# Exploit Title: Mongoose Web Server 6.9 - Denial of Service (PoC)

CuteFTP 9.3.0.3 – Denial of Service (PoC)

# Exploit Title: CuteFTP 9.3.0.3 - Denial of Service (PoC)

HeidiSQL 9.5.0.5196 – Denial of Service (PoC)

# Exploit Title: HeidiSQL 9.5.0.5196 - Denial of Service (PoC)

VSAXESS V2.6.2.70 build20171226_053 – ‘organization’ Denial of Service (PoC)

# Exploit Title: VSAXESS V2.6.2.70 build20171226_053 - 'organization' Denial of Service (PoC)

eToolz 3.4.8.0 – Denial of Service (PoC)

# Exploit Title: eToolz 3.4.8.0 - Denial of Service (PoC)

Blue Server 1.1 – Denial of Service (PoC)

# Exploit Title: Blue Server 1.1 - Denial of Service (PoC)

FaceTime – ‘VCPDecompressionDecodeFrame’ Memory Corruption

There is a heap corruption vulnerability in VCPDecompressionDecodeFrame which is called by FaceTime. This bug can be ...

FaceTime – ‘readSPSandGetDecoderParams’ Stack Corruption

There are a variety of problems that occur when processing malformed H264 streams in readSPSandGetDecoderParams, lead...

FaceTime – RTP Video Processing Heap Corruption

There is a memory corruption issue when processing a malformed RTP video stream in FaceTime that leads to a kernel pa...

Softros LAN Messenger 9.2 – Denial of Service (PoC)

# Exploit Title: Softros LAN Messenger 9.2 - Denial of Service (PoC)

Virgin Media Hub 3.0 Router – Denial of Service (PoC)

# Exploit Title: Virgin Media Hub 3.0 Router - Denial of Service (PoC)

Zint Barcode Generator 2.6 – Denial of Service (PoC)

# Exploit Title: Zint Barcode Generator 2.6 - Denial of Service (PoC)

CdCatalog 2.3.1 – Denial of Service (PoC)

# Exploit Title: CdCatalog 2.3.1 - Denial of Service (PoC)