dos

Google Chrome V8 JIT – ‘LoadElimination::ReduceTransitionElementsKind’ Type Confusion

I think this commit has introduced the bug: https://chromium.googlesource.com/v8/v8.git/+/9884bc5dee488bf206655f07b8a...

CyberArk Password Vault < 9.7 / < 10 - Memory Disclosure

Advisory: CyberArk Password Vault Memory Disclosure

WebKit – WebAssembly Parsing Does not Correctly Check Section Order

When a WebAssembly binary is parsed in ModuleParser::parse, it is expected to contain certain sections in a certain o...

Microsoft Windows – Multiple Use-After-Free Issues in jscript Array Methods

Microsoft Windows Defender – ‘mpengine.dll’ Memory Corruption

Windows Defender inspects a variety of different archive formats, among others RAR.

Microsoft Edge Chakra JIT – Stack-to-Heap Copy (Incomplete Fix) (2)

Here's a snippet of JavascriptArray::BoxStackInstance.

Microsoft Edge Chakra JIT – Stack-to-Heap Copy (Incomplete Fix) (1)

Here's a snippet of JavascriptArray::BoxStackInstance. To fix issue 1420 , "deepCopy" was introduced. But it only de...

Google Chrome V8 – ‘Genesis::InitializeGlobal’ Out-of-Bounds Read/Write

Bug:

Google Chrome V8 – ‘ElementsAccessorBase::CollectValuesOrEntriesImpl’ Type Confusion

Here's a snippet of the method.

Sync Breeze Enterprise 10.4.18 – Denial of-Service (PoC)

#!/usr/bin/python

Systematic SitAware – NVG Denial of Service

# Exploit Title: SitAware NVG Denial of Service

SysGauge 4.5.18 – Local Denial of Service

#!/usr/bin/python

Cisco Smart Install – Crash (PoC)

# smi_ibc_init_discovery_BoF.py

Easy Avi Divx Xvid to DVD Burner 2.9.11 – ‘.avi’ Denial of Service

#!/usr/bin/python

XenForo 2 – CSS Loader Denial of Service

# Exploit Title: XenForo CSS Loader DoS

WM Recorder 16.8.1 – Denial of Service

#!/usr/bin/python

Dell EMC NetWorker – Denial of Service

'''

Android Bluetooth – BNEP BNEP_SETUP_CONNECTION_REQUEST_MSG Out-of-Bounds Read

import os

Android Bluetooth – BNEP bnep_data_ind() Remote Heap Disclosure

import os

Kamailio 5.1.1 / 5.1.0 / 5.0.0 – Off-by-One Heap Overflow

'''

Internet Explorer – ‘RegExp.lastMatch’ Memory Disclosure

There is a vulnerability in Internet Explorer that could potentially be used for memory disclosure.

Microsoft Windows Kernel – ‘nt!NtWaitForDebugEvent’ 64-bit Stack Memory Disclosure

We have discovered that the nt!NtWaitForDebugEvent system call discloses portions of uninitialized kernel stack memor...

Microsoft Windows Kernel – ‘nt!KiDispatchException’ 64-bit Stack Memory Disclosure

We have discovered a new Windows kernel memory disclosure vulnerability in the creation and copying of a EXCEPTION_RE...

Microsoft Windows Kernel – ‘NtQueryInformationThread(ThreadBasicInformation)’ 64-bit Stack Memory Disclosure

We have discovered that the nt!NtQueryInformationThread system call invoked with the 0 information class (ThreadBasic...

Microsoft Windows Kernel – ‘NtQueryVirtualMemory(MemoryMappedFilenameInformation)’ 64-bit Pool Memory Disclosure

We have discovered that the nt!NtQueryVirtualMemory system call invoked with the 2 information class (MemoryMappedFil...

Android DRM Services – Buffer Overflow

#include

Allok QuickTime to AVI MPEG DVD Converter 3.6.1217 – Buffer Overflow

###############################################################################

WebLog Expert Enterprise 9.4 – Denial of Service

[+] Credits: John Page (aka hyp3rlinx)

Memcached 1.5.5 – ‘Memcrashed ‘ Insufficient Control of Network Message Volume Denial of Service With Shodan API

#-- coding: utf8 --

Chrome V8 JIT – Empty BytecodeJumpTable Out-of-Bounds Read

In the current implementation, the bytecode generator also emits empty jump tables.

Chrome V8 JIT – ‘GetSpecializationContext’ Type Confusion

PoC:

Chrome V8 JIT – JSBuiltinReducer::ReduceObjectCreate Fails to Ensure that the Prototype is “null”

I think this commit has introduced the bug.

Chrome V8 JIT – Simplified-lowererer IrOpcode::kStoreField, IrOpcode::kStoreElement Optimization Bug

I think this commit has introduced the bugs: https://chromium.googlesource.com/v8/v8/+/c22ca7f73ba92f22d0cd29b06bb294...

Softros Network Time System Server 2.3.4 – Denial of Service

[+] Credits: John Page (aka hyp3rlinx)

Memcached 1.5.5 – ‘Memcrashed’ Insufficient Control Network Message Volume Denial of Service (1)

memcached-PoC

Memcached 1.5.5 – ‘Memcrashed’ Insufficient Control Network Message Volume Denial of Service (2)

# Written by Alex Conrey

ActivePDF Toolkit < 8.1.0.19023 - Multiple Memory Corruptions

ActivePDF Toolkit < 8.1.0 multiple RCE

Suricata < 4.0.4 - IDS Detection Bypass

-----------------------------------------------------

DualDesk 20 – ‘Proxy.exe’ Denial of Service

[+] Credits: John Page (aka hyp3rlinx)

SEGGER embOS/IP FTP Server 3.22 – Denial of Service

[+] Credits: John Page (aka hyp3rlinx)

Apple iOS 11.2.5 / watchOS 4.2.2 / tvOS 11.2.5 – ‘bluetoothd’ Memory Corruption

//

Sony Playstation 4 (PS4) 5.01 < 5.05 - WebKit Code Execution (PoC)

PS4 5.01 WebKit Exploit PoC

netek 0.8.2 – Denial of Service

#Exploit Title : netek 0.8.2 FTP Denial of Service

Microsoft Windows 8.1/2012 R2 – SMBv3 Null Pointer Dereference Denial of Service

# Exploit Title: Microsoft Windows SMB Client Null Pointer Dereference Denial of Service

Asterisk chan_pjsip 15.2.0 – ‘SUBSCRIBE’ Stack Corruption

'''

Asterisk chan_pjsip 15.2.0 – ‘SDP fmtp’ Denial of Service

'''

Asterisk chan_pjsip 15.2.0 – ‘SDP’ Denial of Service

'''

Asterisk chan_pjsip 15.2.0 – ‘INVITE’ Denial of Service

'''

Chrome V8 – ‘TranslatedState::MaterializeCapturedObjectAt’ Type Confusion

Here'a snippet of TranslatedState::MaterializeCapturedObjectAt.

Chrome V8 – ‘PropertyArray’ Integer Overflow

Here's a snippet of the MigrateFastToFast function which is used to create a new PropertyArray object.