FTPShell Server 6.80 – Denial of Service
# Exploit Title: FTPShell Server 6.80 - Local Denial of Service
dos
dos 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
AMD / ARM / Intel – Speculative Execution Variant 4 Speculative Store Bypass
======== Intro / Overview ========
Microsoft Edge Chakra JIT – Magic Value Type Confusion
BOOL JavascriptNativeFloatArray::SetItem(uint32 index, double dValue)
Siemens SIMATIC S7-1500 CPU – Remote Denial of Service
# Exploit Title: Siemens SIMATIC S7-1500 CPU - Remote Denial of Service
Microsoft Edge Chakra JIT – Bound Check Elimination Bug
Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks....
Linux < 4.16.9 / < 4.14.41 - 4-byte Infoleak via Uninitialized Struct Field in compat adjtimex Syscall
Commit 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native
WhatsApp 2.18.31 – Memory Corruption
#!/usr/bin/env python
2345 Security Guard 3.7 – ‘2345NsProtect.sys’ Denial of Service
# Exploit Title: [BSOD by IOCTL 0x8000200D in 2345NsProtect.sys of 2345 Security Guard 3.7]
2345 Security Guard 3.7 – ‘2345BdPcSafe.sys’ Denial of Service
# Exploit Title: [BSOD by IOCTL 0x002220e0 in 2345BdPcSafe.sys of 2345 Security Guard 3.7]
Dell Touchpad – ‘ApMsgFwd.exe’ Denial of Service
Title: Dell Touchpad - ApMsgFwd.exe Denial Of Service
Allok Video Splitter 3.1.12.17 – Denial of Service
###########################################################################################
2345 Security Guard 3.7 – ‘2345NetFirewall.sys’ Denial of Service
# Exploit Title: 2345 Security Guard 3.7 - Denial of Service
HWiNFO 5.82-3410 – Denial of Service
#!/usr/bin/python
Schneider Electric InduSoft Web Studio and InTouch Machine Edition – Denial of Service
What do you need to know? Tenable Research has discovered a critical remote code execution vulnerability in Schneider...
Linux Kernel < 4.17-rc1 - 'AF_LLC' Double Free
#define _GNU_SOURCE
Apple macOS/iOS – ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules
ReportCrash is the daemon responsible for making crash dumps of crashing userspace processes.
Apple macOS 10.13.2 – Double mach_port_deallocate in kextd due to Failure to Comply with MIG Ownership Rules
Here's a kextd method exposed via MIG (com.apple.KernelExtensionServer)
Navicat < 12.0.27 - Oracle Connection Overflow
#!/usr/bin/python
Chrome V8 JIT – Arrow Function Scope Fixing Bug
When the parser parses the parameter list of an arrow function contaning destructuring assignments, it can't distingu...
Chrome V8 JIT – ‘AwaitedPromise’ Update Bug
Here's a snippet of AsyncGeneratorReturn. (https://cs.chromium.org/chromium/src/v8/src/builtins/builtins-async-genera...
Chrome V8 JIT – ‘NodeProperties::InferReceiverMaps’ Type Confusion
https://cs.chromium.org/chromium/src/v8/src/compiler/node-properties.cc?rcl=df84e87191022bf6914f9570069908f10b303245&...
Adobe Flash – Out-of-Bounds Write in blur Filtering
The attached swf file causes and out-of-bounds write in blur filtering.
Adobe Flash – Info Leak in Image Inflation
The attached image causes an info leak in image inflation. It occasionally crashes when rendered, otherwise it displa...
Adobe Flash – Overflow in Slab Rendering
The attached fuzzed swf file causes heap or stack corruption (depending on platform) when rendering a slab.
Adobe Flash – Overflow when Playing Sound
The attached fuzzed swf file causes heap overflow when playing a sound.
gif2apng 1.9 – ‘.gif’ Stack Buffer Overflow
# Exploit Title: gif2apng 1.9 '.gif' Stack-Buffer Overflow
VMware Workstation 12.5.2 – Drag n Drop Use-After-Free (Pwn2Own 2017) (PoC)
char *initial_dnd = "tools.capability.dnd_version 4";
PRTG Network Monitor < 18.1.39.1648 - Stack Overflow (Denial of Service)
# Exploit Title: PRTG 18.1.39.1648 - Stack Overflow
VX Search 10.6.18 – ‘directory’ Local Buffer Overflow
#!/usr/bin/python
RSVG 2.40.13 / 2.42.2 – ‘.svg’ Buffer Overflow
# Exploit Title: Buffer-overflow in RSVG while converting a malformed svg
PDFunite 0.41.0 – ‘.pdf’ Local Buffer Overflow
# Exploit Title: PDFunite Malformed pdf buffer overflow
Brave Browser < 0.13.0 - 'window.close(self)' Denial of Service
# Exploit Title:Brave Browser < 0.13.0 Denial of Service (resource consumption) via a window.close(self) js code.
Brave Browser < 0.13.0 - 'long alert() argument' Denial of Service
# Exploit Title:Brave Browser < 0.13.0 Denial of Service (resource consumption) via a long alert() argument.
Zortam MP3 Media Studio 23.45 – Local Buffer Overflow (SEH)
#!/usr/bin/python
Microsoft Edge – ‘OpenProcess()’ ACG Bypass
Each Edge Content process (MicrosoftEdgeCP.exe) needs to call SetProcessMitigationPolicy() on itself to enable ACG. T...
Microsoft Windows – ‘CiSetFileCache’ TOCTOU Incomplete Fix
Windows: CiSetFileCache TOCTOU CVE-2017-11830 Incomplete Fix
Microsoft Windows – ‘nt!NtQueryVirtualMemory (MemoryImageInformation)’ Kernel 64-bit Stack Memory Disclosure
We have discovered that the nt!NtQueryVirtualMemory system call invoked with the MemoryImageInformation (0x6) informa...
Microsoft Windows – ‘nt!NtQueryVirtualMemory (Memory(Privileged)BasicInformation)’ Kernel 64-bit Stack Memory Disclosure
We have discovered that the nt!NtQueryVirtualMemory system call invoked with the MemoryBasicInformation (0x0) and Mem...
Microsoft Windows – ‘nt!NtQueryInformationProcess (ProcessImageFileName)’ Kernel 64-bit Pool/Stack Memory Disclosure
We have discovered that the nt!NtQueryInformationProcess system call invoked with the ProcessImageFileName (0x1B) inf...
Microsoft Windows – ‘nt!NtQueryInformationTransactionManager (TransactionManagerRecoveryInformation)’ Kernel Pool Memory Disclosure
We have discovered that the nt!NtQueryInformationTransactionManager system call invoked with the TransactionManagerRe...
Microsoft Windows – ‘nt!NtQuerySystemInformation (SystemPageFileInformation(Ex))’ Kernel 64-bit Stack Memory Disclosure
We have discovered that the nt!NtQuerySystemInformation system call invoked with the SystemPageFileInformation (0x12)...
Microsoft Windows – ‘nt!NtQueryVolumeInformationFile’ Kernel Stack Memory Disclosure
We have discovered that the nt!NtQueryVolumeInformationFile system call invoked against certain kernel objects disclo...
Microsoft Windows – ‘nt!NtQueryAttributesFile’ Kernel Stack Memory Disclosure
We have discovered that the nt!NtQueryAttributesFile system call invoked with paths of certain kernel objects disclos...
Microsoft Windows – ‘nt!NtQueryFullAttributesFile’ Kernel Stack Memory Disclosure
We have discovered that the nt!NtQueryFullAttributesFile system call invoked with paths of certain kernel objects dis...
Barco ClickShare CSE-200 – Remote Denial of Service
#!/usr/bin/python
MikroTik 6.41.4 – FTP daemon Denial of Service (PoC)
################