dos

SpotAuditor 5.3.2 – ‘Key’ Denial of Service

#Exploit Title: SpotAuditor 5.3.2 - 'Key' Denial of Service

GHIA CamIP 1.2 for iOS – ‘Password’ Denial of Service (PoC)

# Exploit Title: GHIA CamIP 1.2 for iOS - 'Password' Denial of Service (PoC)

SpotAuditor 5.3.2 – ‘Base64’ Denial Of Service (PoC)

#Exploit Title: SpotAuditor 5.3.2 - 'Base64' Denial Of Service (PoC)

Microsoft DirectX SDK 2010 – ‘.PIXrun’ Denial Of Service (PoC)

#Exploit Title: Microsoft DirectX SDK 2010 - '.PIXrun' Denial Of Service (PoC)

InduSoft Web Studio 8.1 SP1 – “Atributos” Denial of Service (PoC)

# Exploit Title: InduSoft Web Studio 8.1 SP1 - "Atributos" Denial of Service (PoC)

iNetTools for iOS 8.20 – ‘Whois’ Denial of Service (PoC)

# Exploit Title: iNetTools for iOS 8.20 - 'Whois' Denial of Service (PoC)

InTouch Machine Edition 8.1 SP1 – ‘Atributos’ Denial of Service (PoC)

# Exploit Title: InTouch Machine Edition 8.1 SP1 - 'Atributos' Denial of Service (PoC)

SMPlayer 19.5.0 – Denial of Service (PoC)

# Title : SMPlayer 19.5.0 - Denial of Service (PoC)

Internet Explorer – Use-After-Free in JScript Arguments During toJSON Callback

There is a use-after-free issue in JSCript (triggerable via Internet Explorer) where the members of the 'arguments' o...

iOS 12.4 – Sandbox Escape due to Integer Overflow in mediaserverd

mediaserverd has various media parsing responsibilities; its reachable from various sandboxes

Ubuntu 19.10 – Refcount Underflow and Type Confusion in shiftfs

Tested on Ubuntu 19.10, kernel "5.3.0-19-generic #20-Ubuntu".

Ubuntu 19.10 – ubuntu-aufs-modified mmap_region() Breaks Refcounting in overlayfs/shiftfs Error Path

Tested on 19.10.

XMedia Recode 3.4.8.6 – ‘.m3u’ Denial Of Service

#Exploit Title: XMedia Recode 3.4.8.6 - '.m3u' Denial Of Service

scadaApp for iOS 1.1.4.0 – ‘Servername’ Denial of Service (PoC)

# Exploit Title: scadaApp for iOS 1.1.4.0 - 'Servername' Denial of Service (PoC)

Centova Cast 3.2.12 – Denial of Service (PoC)

# Exploit Title: Centova Cast 3.2.12 - Denial of Service (PoC)

ipPulse 1.92 – ‘Enter Key’ Denial of Service (PoC)

# Exploit Title: ipPulse 1.92 - 'Enter Key' Denial of Service (PoC)

Foscam Video Management System 1.1.4.9 – ‘Username’ Denial of Service (PoC)

# Exploit Title: Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (PoC)

Open Proficy HMI-SCADA 5.0.0.25920 – ‘Password’ Denial of Service (PoC)

# Exploit Title: Open Proficy HMI-SCADA 5.0.0.25920 - 'Password' Denial of Service (PoC)

iSmartViewPro 1.3.34 – Denial of Service (PoC)

# Exploit Title: iSmartViewPro 1.3.34 - Denial of Service (PoC)

Siemens Desigo PX 6.00 – Denial of Service (PoC)

# Title: Siemens Desigo PX 6.00 - Denial of Service (PoC)

Bematech Printer MP-4200 – Denial of Service

# Exploit Title: Bematech Printer MP-4200 - Denial of Service

Adobe Acrobat Reader DC for Windows – Use of Uninitialized Pointer due to Malformed OTF Font (CFF Table)

We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Window...

Adobe Acrobat Reader DC for Windows – Use of Uninitialized Pointer due to Malformed JBIG2Globals Stream

We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Window...

iMessage – Decoding NSSharedKeyDictionary can read ObjC Object at Attacker Controlled Address

During processing of incoming iMessages, attacker controlled data is deserialized using the

iOS IOUSBDeviceFamily 12.4.1 – ‘IOInterruptEventSource’ Heap Corruption (PoC)

# Exploit Title: iOS IOUSBDeviceFamily 12.4.1 - 'IOInterruptEventSource' Heap Corruption (PoC)

macOS XNU – Missing Locking in checkdirs_callback() Enables Race with fchdir_common()

On macOS, when a new mount point is created, the kernel uses checkdirs() to, as

WebKit – Universal XSS in JSObject::putInlineSlow and JSValue::putToPrimitive

VULNERABILITY DETAILS

JavaScriptCore – Type Confusion During Bailout when Reconstructing Arguments Objects

The following sample was found by Fuzzilli and then slightly modified. It crashes JSC in debug builds:

FileOptimizer 14.00.2524 – Denial of Service (PoC)

# Exploit Title: FileOptimizer 14.00.2524 - Denial of Service (PoC)

Apple macOS 10.15.1 – Denial of Service (PoC)

# Exploit Title: Apple macOS 10.15.1 - Denial of Service (PoC)

JavaScriptCore – GetterSetter Type Confusion During DFG Compilation

The following JavaScript program, found by Fuzzilli and slightly modified, crashes JavaScriptCore built from HEAD and...

WMV to AVI MPEG DVD WMV Convertor 4.6.1217 – Denial of Service

# Exploit Title: WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Denial of Service

WebKit – Universal XSS in HTMLFrameElementBase::isURLAllowed

VULNERABILITY DETAILS

Adobe Acrobat Reader DC for Windows – Heap-Based Buffer Overflow due to Malformed JP2 Stream (2)

We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Window...

WinRAR 5.80 (x64) – Denial of Service

# Exploit Title: winrar 5.80 64bit - Denial of Service

ActiveFax Server 6.92 Build 0316 – ‘POP3 Server’ Denial of Service

# Exploit Title: ActiveFax Server 6.92 Build 0316 - 'POP3 Server' Denial of Service

SpotAuditor 5.3.1.0 – Denial of Service

# Exploit Title: SpotAuditor 5.3.1.0 - Denial of Service

Microsoft Windows Kernel – Out-of-Bounds Read in nt!MiRelocateImage While Parsing Malformed PE File

We have encountered a Windows kernel crash in memcpy() called by nt!MiRelocateImage while trying to load a malformed ...

Microsoft Windows Kernel – Out-of-Bounds Read in CI!HashKComputeFirstPageHash While Parsing Malformed PE File

We have encountered a Windows kernel crash in CI!HashKComputeFirstPageHash while trying to load a malformed PE image ...

Microsoft Windows Kernel – Out-of-Bounds Read in nt!MiParseImageLoadConfig While Parsing Malformed PE File

We have encountered a Windows kernel crash in memcpy() called by nt!MiParseImageLoadConfig while trying to load a mal...

Microsoft Windows Kernel – Out-of-Bounds Read in CI!CipFixImageType While Parsing Malformed PE File

We have encountered a Windows kernel crash in CI!CipFixImageType while trying to load a malformed PE image into the p...

Microsoft Windows Kernel – NULL Pointer Dereference in nt!MiOffsetToProtos While Parsing Malformed PE File

We have encountered a Windows kernel crash in nt!MiOffsetToProtos while trying to load a malformed PE image into the ...

Microsoft Windows Kernel – win32k.sys TTF Font Processing Pool Corruption in win32k!ulClearTypeFilter

We have encountered a Windows kernel crash in the win32k.sys driver while processing a corrupted TTF font file. An ex...

XNU – Remote Double-Free via Data Race in IPComp Input Path

=== Summary ===

Foscam Video Management System 1.1.6.6 – ‘UID’ Denial of Service (PoC)

# Exploit Title: Foscam Video Management System 1.1.6.6 - 'UID' Denial of Service (PoC)

WebKit – Universal XSS Using Cached Pages

VULNERABILITY DETAILS

WebKit – User-agent Shadow root Leak in WebCore::ReplacementFragment::ReplacementFragment

WebKit – Universal XSS in WebCore::command

WebKit – UXSS Using JavaScript: URI and Synchronous Page Loads

VULNERABILITY DETAILS

kic 2.4a – Denial of Service

# Exploit Title: Ciftokic 2.4a - DoS Buffer Overflow