Transmission – Integer Overflows Parsing Torrent Files
I took a look at torrent file parsing in libtransmission, there are a few integer overflows because the tr_new/tr_new...
dos
dos 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Wavpack 5.1.0 – Denial of Service
# Exploit title: Wavpack 5.1.0 - Denial of Service
Microsoft Windows Kernel – ‘nt!RtlpCopyLegacyContextX86’ Stack Memory Disclosure
We have discovered a new Windows kernel memory disclosure vulnerability in the creation and copying of a CONTEXT stru...
Aastra 6755i SIP SP4 – Denial of Service
# Exploit Title: Aastra 6755i SIP SP4 | Unauthorized Remote Reboot
Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < 4.25 - Denial of Service
# Exploit Title: Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < V4.25 - Denial of Service
JBoss Remoting 6.14.18 – Denial of Service
# Exploit Title: Exploit Denial of Service JBoss Remoting (4447/9999)
Microsoft Edge – ‘UnmapViewOfFile’ ACG Bypass
Background:
Chrome V8 – ‘Runtime_RegExpReplace’ Integer Overflow
Here's a snippet of the method.
Pdfium – Out-of-Bounds Read with Shading Pattern Backed by Pattern Colorspace
Related to issue 1490 .
Pdfium – Pattern Shading Integer Overflows
This vulnerability relies on several minor oversights in the handling of shading patterns in pdfium, I'll try to deta...
Microsoft Edge Chakra JIT – ‘LdThis’ Type Confusion
LdThis instructions' value type is assumed to be "Object". Since "this" can be other objects like an array, it has to...
Microsoft Edge Chakra JIT – ‘NewScObjectNoCtor’ Array Type Confusion
This is similar to the previous issues 1457, 1459 (MSRC 42551, MSRC 42552).
Microsoft Edge Chakra JIT – ‘Array.prototype.reverse’ Array Type Confusion
This is simillar to the previous issue 1457. But this time, we use Array.prototype.reverse.
Microsoft Edge Chakra JIT – Array Type Confusion via InitProto Instructions
If a native array is used as a prototype, it is converted to a Var array by the Js::JavascriptNativeFloatArray::SetIs...
Microsoft Edge Chakra JIT – ImplicitCallFlags Checks Bypass
Here's a snippet of ExecuteImplicitCall which is responsible for updating the ImplicitCallFlags flag.
Microsoft Edge Chakra JIT – Memory Corruption
Let's consider the following example code.
Microsoft Edge Chakra JIT – ‘GlobOpt::OptTagChecks’ Must Consider IsLoopPrePass Properly (2)
It seems this is the patch for the bug.
GNU binutils 2.26.1 – Integer Overflow (PoC)
# Exploit Title: Objdump - Integer Overflow Crash POC
macOS Kernel – Use-After-Free Due to Lack of Locking in ‘AppleEmbeddedOSSupportHostClient::registerNotificationPort’
AppleEmbeddedOSSupportHost.kext is presumably involved in the communication with the OS running on the touch bar on n...
Android – ‘getpidcon’ Permission Bypass in KeyStore Service
The keystore binder service ("android.security.IKeystoreService") allows users to issue several commands related to k...
Asterisk 13.17.2 – ‘chan_skinny’ Remote Memory Corruption
# Exploit Author: Juan Sacco - http://exploitpack.com
Claymore Dual GPU Miner 10.5 – Format String
Claymore’s Dual GPU Miner 10.5 and below is vulnerable to a format strings vulnerability. This allows an unauthentica...
WordPress Core – ‘load-scripts.php’ Denial of Service
# EDB Note: python doser.py -g 'http://localhost/wp-admin/load-scripts.php?c=1&load%5B%5D=eutil,common,wp-a11y,sack,q...
LabF nfsAxe 3.7 TFTP Client – Local Buffer Overflow
#!/usr/bin/python
macOS – ‘sysctl_vfs_generic_conf’ Stack Leak Through Struct Padding
The sysctls vfs.generic.conf.* are handled by sysctl_vfs_generic_conf(), which is implemented as follows:
Artifex MuJS 1.0.2 – Integer Overflow
# Exploit Title: DoS caused by the interactive call between two functions
MixPad 5.00 – Buffer Overflow
#!/usr/bin/python
PHPFreeChat 1.7 – Denial of Service
# Exploit Title: phpFreeChat 1.7 and earlier - Denial of Service
macOS 10.13 (17A365) – Kernel Memory Disclosure due to Lack of Bounds Checking in ‘AppleIntelCapriController::getDisplayPipeCapability’
AppleIntelCapriController::getDisplayPipeCapability reads an attacker-controlled dword value from a userclient structure
Smiths Medical Medfusion 4000 – ‘DHCP’ Denial of Service
#!/usr/bin/python3
Microsoft Edge Chakra JIT – Stack-to-Heap Copy
If variables don't escape the scope, the variables can be allocated to the stack. However, there are some situations,...
Microsoft Edge Chakra – ‘AsmJSByteCodeGenerator::EmitCall’ Out-of-Bounds Read
AsmJSByteCodeGenerator::EmitCall which is used to emit call insturctions doesn't check if an array identifier is used...
Microsoft Edge Chakra JIT – Out-of-Bounds Write
// Here's the PoC demonstrating OOB write.
Microsoft Edge Chakra – Deferred Parsing Makes Wrong Scopes (2)
Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is s...
Microsoft Edge Chakra – ‘JavascriptGeneratorFunction::GetPropertyBuiltIns’ Type Confusion
Here's a snippet of the method.
Microsoft Edge Chakra JIT – Incorrect Bounds Calculation
Let's start with comments in the "GlobOpt::TrackIntSpecializedAddSubConstant" method.
OBS Studio 20.1.3 – Local Buffer Overflow
author = '''
PyroBatchFTP < 3.19 - Buffer Overflow
=============================================
Kentico CMS 11.0 – Buffer Overflow
Document Title:
Microsoft Edge Chakra – ‘AppendLeftOverItemsFromEndSegment’ Out-of-Bounds Read
Here's a snippet of AppendLeftOverItemsFromEndSegment in JavascriptArray.inl.
Microsoft Windows SMB Server (v1/v2) – Mount Point Arbitrary Device Open Privilege Escalation
Windows: SMB Server (v1 and v2) Mount Point Arbitrary Device Open EoP
Microsoft Windows – NtImpersonateAnonymousToken LPAC to Non-LPAC Privilege Escalation
Windows: NtImpersonateAnonymousToken LPAC to Non-LPAC EoP