dos

Core FTP 2.0 – ‘XRMD’ Denial of Service (PoC)

# Exploit Title: Core FTP 2.0 - 'XRMD' Denial of Service (PoC)

GetGo Download Manager 6.2.1.3200 – Denial of Service (PoC)

# Exploit Title: GetGo Download Manager 6.2.1.3200 - Buffer Overflow (Denial of Service)

Nagios Core 4.4.1 – Denial of Service

# Exploit Title: Nagios Core Multiple Local Denial of Service

Microsoft Windows Speech Recognition – Buffer Overflow (PoC)

# Title: Windows Speech Recognition- Buffer Overflow

TP-Link TL-WR840N – Denial of Service

# Exploit Title:- TP-Link Wireless N Router WR840N - Buffer Overflow

Google Chrome – SwiftShader OpenGL Texture Bindings Reference Count Leak

Google Chrome – Swiftshader Blitting Floating-Point Precision Errors

Google Chrome – Swiftshader Texture Allocation Integer Overflow

There's a remotely triggerable memory corruption issue in SwiftShader that's reachable from WebGL, resulting from an ...

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway – Denial of Service

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Service Control DoS

Linux (Ubuntu) – Other Users coredumps Can Be Read via setgid Directory and killpriv Bypass

Note: I am both sending this bug report to security@kernel.org and filing it in

macOS/iOS – JavaScript Injection Bug in OfficeImporter

QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, ...

G DATA Total Security 25.4.0.3 – Activex Buffer Overflow

Microsoft Edge Chakra JIT – Type Confusion with Hoisted SetConcatStrMultiItemBE Instructions

Here's a PoC:

Microsoft Edge Chakra JIT – BoundFunction::NewInstance Out-of-Bounds Read

BoundFunction::NewInstance is used to handle calls to a bound function. The method first allocates a new argument arr...

Microsoft Edge Chakra JIT – Out-of-Bounds Reads/Writes

It seems that this issue is similar to the issue 1429 (MSRC 42111). It might need to refresh the page several times...

Tor Browser < 0.3.2.10 - Use After Free (PoC)

# Exploit Title: Tor Browser - Use After Free (PoC)

OpenSLP 2.0.0 – Double-Free

'''

Delta Industrial Automation COMMGR 1.08 – Stack Buffer Overflow (PoC)

# Exploit Title: Delta Electronics Delta Industrial Automation COMMGR

SIPp 3.6 – Local Buffer Overflow (PoC)

# Exploit Title: SIPp 3.6 - Local Buffer Overflow (PoC)

Core FTP LE 2.2 – Buffer Overflow (PoC)

# Exploit Title: Core FTP LE 2.2 - Buffer Overflow (PoC)

PoDoFo 0.9.5 – Buffer Overflow (PoC)

# Exploit Title: PoDoFo 0.9.5 - Stack-Based Buffer Overflow (PoC)

KVM (Nested Virtualization) – L1 Guest Privilege Escalation

When KVM (on Intel) virtualizes another hypervisor as L1 VM it does not verify that VMX instructions from the L1 VM (...

DIGISOL DG-BR4000NG – Buffer Overflow (PoC)

# Exploit Title: DIGISOL DG-BR4000NG - Buffer Overflow (PoC)

Opencart < 3.0.2.0 - Denial of Service

#!/usr/bin/perl -w

QEMU Guest Agent 2.12.50 – Denial of Service

# Exploit Title: QEMU Guest Agent 2.12.50 - Denial of Service

Microsoft Windows 10 – Desktop Bridge Virtual Registry CVE-2018-0880 Incomplete Fix Privilege Escalation

Windows: Windows: Desktop Bridge Virtual Registry CVE-2018-0880 Incomplete Fix EoP

Microsoft Windows 10 – Desktop Bridge Activation Arbitrary Directory Creation Privilege Escalation

Windows: Desktop Bridge Activation Arbitrary Directory Creation EoP

ntp 4.2.8p11 – Local Buffer Overflow (PoC)

# Exploit Title: ntpq and ntpdc 4.2.8p11 Local Buffer Overflow

Redis 5.0 – Denial of Service

# Exploit Title: Redis 5.0 Denial of Service

rtorrent 0.9.6 – Denial of Service

# Exploit Title: rtorrent 0.9.6 - Denial of Service

WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' Denial of Service (Metasploit)

##

WebRTC – VP9 Missing Frame Processing Out-of-Bounds Memory Access

There is a missing check in VP9 frame processing that could lead to memory corruption.

WebRTC – VP9 Frame Processing Out-of-Bounds Memory Access

There is a missing check in VP9 frame processing that could lead to memory corruption.

WebKit – Use-After-Free when Resuming Generator

Google Chrome – Integer Overflow when Processing WebAssembly Locals

When v8 decodes the locals of a function, it performs a check:

WebKit – WebAssembly Compilation Info Leak

Gnome Web (Epiphany) < 3.28.2.1 - Denial of Service

# Title: Gnome Web/Epiphany Browser < 3.28.2.1 - DoS App Crash (PoC)

XNU Kernel – Heap Overflow Due to Bad Bounds Checking in MPTCP

mptcp_usr_connectx is the handler for the connectx syscall for the AP_MULTIPATH socket family.

Apple macOS/iOS Kernel – Heap Overflow Due to Lack of Lower Size Check in getvolattrlist

getvolattrlist takes a user controlled bufferSize argument via the fgetattrlist syscall.

Apple macOS Kernel – Use-After-Free Due to Lack of Locking in nvidia GeForce Driver

nvDevice::SetAppSupportBits is external method 0x107 of the nvAccelerator IOService.

PHP 7.2.2 – ‘php_stream_url_wrap_http_ex’ Buffer Overflow

Description:

Linux Kernel < 4.16.11 - 'ext4_read_inline_data()' Memory Corruption

ext4 can store data for small regular files as "inline data", meaning that the

Epiphany 3.28.2.1 – Denial of Service

Summary:

Microsoft Edge Chakra – EntrySimpleObjectSlotGetter Type Confusion

function opt(w, arr) {

Siemens SIMATIC S7-300 CPU – Remote Denial of Service

# Exploit Title: Siemens SIMATIC S7-300 CPU - Remote Denial Of Service

Symfony 2.7.0 < 4.0.10 - Denial of Service

The PDOSessionHandler class allows to store sessions on a PDO connection. Under some configurations (see below) and w...

Skia and Firefox – Integer Overflow in SkTDArray Leading to Out-of-Bounds Write

go

Microsoft Edge Chakra – Cross Context Use-After-Free

Samsung Galaxy S7 Edge – Overflow in OMACP WbXml String Extension Processing

OMACP is a protocol supported by many mobile devices which allows them to receive provisioning information over the m...

Siemens SCALANCE S613 – Remote Denial of Service

# Exploit Title: Siemens SCALANCE S613 - Remote Denial of Service