CIScan 1.00 – Hostname/IP Field Overwrite (SEH) (PoC)
#!/usr/bin/python
dos
dos 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Adobe Reader DC 15.010.20060 – Memory Corruption
########################################################################################
Core FTP Server 32-bit Build 587 – Heap Overflow
# -*- coding: cp1252 -*-
Ipswitch WS_FTP LE 12.3 – Search field Overwrite (SEH) (PoC)
#!/usr/bin/python
MediaInfo 0.7.61 – Crash (PoC)
#!/usr/bin/perl -w
RPCScan 2.03 – Hostname/IP Field Overwrite (SEH) (PoC)
#!/usr/bin/python
ASUS Memory Mapping Driver (ASMMAP/ASMMAP64) – Physical Memory Read/Write
Source: http://rol.im/asux/
i.FTP 2.21 – Host Address / URL Field (SEH)
#!/usr/bin/python
Adobe Flash – MovieClip.duplicateMovieClip Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=759
Adobe Flash (Multiple Scripts) – Use-After-Free When Rendering Displays (2)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=719
CIScan 1.00 – Hostname/IP Field Crash (PoC)
#!/usr/bin/env python
RPCScan 2.03 – Hostname/IP Field Crash (PoC)
#!/usr/bin/env python
Baidu Spark Browser 43.23.1000.476 – Address Bar URL Spoofing
Google Home Page
Linux Kernel (Ubuntu 16.04) – Reference Count Overflow Using BPF Maps
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=809
McAfee LiveSafe 14.0 – Relocations Processing Memory Corruption
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=817
OpenSSL – Padding Oracle in AES-NI CBC MAC Check
Source: http://web-in-security.blogspot.ca/2016/05/curious-padding-oracle-in-openssl-cve.html
ImageMagick 7.0.1-0 / 6.9.3-9 – ‘ImageTragick ‘ Multiple Vulnerabilities
Nikolay Ermishkin from the Mail.Ru Security Team discovered several
Wireshark – ett_zbee_zcl_pwr_prof_enphases Static Out-of-Bounds Read
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=806
Wireshark – alloc_address_wmem Assertion Failure
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=804
Wireshark – dissect_2008_16_security_4 Stack Buffer Overflow
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=802
Rough Auditing Tool for Security (RATS) 2.3 – Array Out of Block Crash
# Exploit Title: RATS 2.3 Array Out of Block Crash
Microsoft Windows Kernel – ‘win32k.sys’ TTF Processing EBLC / EBSC Tables Pool Corruption (MS16-039)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=684
Microsoft Windows – CSRSS BaseSrvCheckVDM Session 0 Process Creation Privilege Escalation (MS16-048)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=692
Rough Auditing Tool for Security (RATS) 2.3 – Crash (PoC)
# Exploit Title: RATS 2.3 Crash POC
Hyper-V – ‘vmswitch.sys’ VmsMpCommonPvtHandleMulticastOids Guest to Host Kernel-Pool Overflow
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=688
Microsoft Windows Kernel – DrawMenuBarTemp Wild-Write (MS16-039)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=707
TH692 Outdoor P2P HD Waterproof IP Camera – Hard-Coded Credentials
Exploit Title: TH692- Outdoor P2P HD Waterproof IP Camera hardcoded credentials
Microsoft Internet Explorer 11 – MSHTML!CMarkupPointer::UnEmbed Use-After-Free
IE 11.0.9600.18230 MSHTML!CMarkupPointer::UnEmbed UAF POC
Google Android – IMemory Native Interface is Insecure for IPC Use
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=706
Google Android – IOMX ‘getConfig’/’getParameter’ Information Disclosure
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=711
Linux Kernel (x86) – Disable ASLR by Setting the RLIMIT_STACK Resource to Unlimited
Source: http://hmarco.org/bugs/CVE-2016-3672-Unlimiting-the-stack-not-longer-disables-ASLR.html
Hexchat IRC Client 2.11.0 – CAP LS Handling Buffer Overflow
#!/usr/bin/python
Xion Audio Player 1.5 (build 160) – ‘.mp3’ Crash (PoC)
# Exploit Title: Xion Audio Player new('legit.mp3'); # whatever mp3 you got handy
PHP 5.5.33 – Invalid Memory Write
# Exploit Title: Invalid memory write in phar on filename with \0 in name
Adobe Flash – Color.setTransform Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=451
Google Android – ‘ih264d_process_intra_mb’ Memory Corruption
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=523
Adobe Flash – textfield.maxChars Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=581
Adobe Flash – URLStream.readObject Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=611
Microsoft Windows Kernel – ‘NtGdiGetTextExtentExW’ Out-of-Bounds Memory Read
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=685
Microsoft Windows Kernel – Bitmap Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=686
Wireshark – dissect_pktc_rekey Heap Out-of-Bounds Read
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=754
Kamailio 4.3.4 – Heap Buffer Overflow
census ID: census-2016-0009
Apple QuickTime < 7.7.79.80.95 - '.PSD' Parsing Memory Corruption
#####################################################################################
Apple QuickTime < 7.7.79.80.95 - '.FPX' Parsing Memory Corruption (2)
#####################################################################################
Apple QuickTime < 7.7.79.80.95 - '.FPX' Parsing Memory Corruption (1)
#####################################################################################
Android One – mt_wifi IOCTL_GET_STRUCT Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=678
TallSoft SNMP/TFTP Server 1.0.0 – Denial of Service
# Exploit Title: TallSoft SNMP TFTP Server 1.0.0 - DoS