remote

ManageEngine OpManager – Remote Code Execution (Metasploit)

##

CMS Bolt – Arbitrary File Upload (Metasploit)

##

Microsoft Windows Media Center – MCL (MS15-100) (Metasploit)

##

TP-Link NC200/NC220 Cloud Camera 300Mbps Wi-Fi – Hard-Coded Credentials

TP-Link NC200/NC220 Cloud Camera 300Mbps Wi-Fi Hard-Coded Credentials

Microsoft Windows Media Center – Command Execution (MS15-100)

# Title: MS15-100 Windows Media Center Command Execution

Google Android – ‘Stagefright’ Remote Code Execution

#!/usr/bin/env python

Endian Firewall – Password Change Command Injection (Metasploit)

##

PCMan FTP Server 2.0.7 – ‘RENAME’ Remote Buffer Overflow

#!/usr/bin/python

MS SQL Server 2000/2005 – SQLNS.SQLNamespace COM Object Refresh() Unhandled Pointer

PCMan FTP Server 2.0.7 – ‘GET’ Remote Buffer Overflow

#!/usr/bin/python

FHFS – FTP/HTTP File Server 2.1.2 Remote Command Execution

#!/usr/bin/python

Mozilla Firefox – ‘pdf.js’ Privileged JavaScript Injection (Metasploit)

##

Easy Address Book Web Server 1.6 – USERID Remote Buffer Overflow

#!/usr/bin/python

Easy File Sharing Web Server 6.9 – USERID Remote Buffer Overflow

#!/usr/bin/python

Flash Boundless Tunes – Universal SOP Bypass Through ActionSctipt’s Sound Object

Source: https://code.google.com/p/google-security-research/issues/detail?id=354&can=1&q=label%3AProduct-Flash%20modif...

Flash Broker-Based – Sandbox Escape via Timing Attack Against File Moving

Source: https://code.google.com/p/google-security-research/issues/detail?id=280&can=1&q=label%3AProduct-Flash%20modif...

Flash Broker-Based – Sandbox Escape via Unexpected Directory Lock

Source: https://code.google.com/p/google-security-research/issues/detail?id=279&can=1&q=label%3AProduct-Flash%20modif...

Flash Broker-Based – Sandbox Escape via Forward Slash Instead of Backslash

Source: https://code.google.com/p/google-security-research/issues/detail?id=278&can=1&q=label%3AProduct-Flash%20modif...

Werkzeug – Debug Shell Command Execution (Metasploit)

##

Symantec Endpoint Protection Manager – Authentication Bypass / Code Execution (Metasploit)

##

Easy File Management Web Server 5.6 – ‘USERID’ Remote Buffer Overflow

#!/usr/bin/python

Apache ActiveMQ 5.11.1/5.13.2 – Directory Traversal / Command Execution

I have recently been playing with Apache ActiveMQ, and came across a simple but interesting directory traversal flaw ...

Microsoft Windows HTA (HTML Application) – Remote Code Execution (MS14-064)

#!/usr/bin/php

Netsparker 2.3.x – Remote Code Execution

#!/usr/bin/python

PCMan FTP Server 2.0.7 – ‘PUT’ Remote Buffer Overflow

#!/usr/bin/python

FileZilla Client 2.2.x – Remote Buffer Overflow (SEH)

# Exploit Title: Filezilla client 2.2.X SEH buffer overflow exploit

Internet Download Manager – OLE Automation Array Remote Code Execution

#!/usr/bin/php

SysAid Help Desk ‘rdslogs’ – Arbitrary File Upload (Metasploit)

##

D-Link Devices – Cookie Command Execution (Metasploit)

##

Impero Education Pro – System Remote Command Execution

If you're unsure what Impero is, it's essentially a corporate/educational RAT. Vendor site: https://www.imperosoftwar...

Western Digital Arkeia < 11.0.12 - Remote Code Execution (Metasploit)

##

Adobe Flash – opaqueBackground Use-After-Free (Metasploit)

##

VNC Keyboard – Remote Code Execution (Metasploit)

##

Accellion FTA – getStatus verify_oauth_token Command Execution (Metasploit)

##

Adobe Flash Player – Nellymoser Audio Decoding Buffer Overflow (Metasploit)

##

Adobe Flash Player – ByteArray Use-After-Free (Metasploit)

##

Adobe Flash Player – Drawing Fill Shader Memory Corruption (Metasploit)

##

Endian Firewall < 3.0.0 - OS Command Injection (Metasploit)

##

Endian Firewall < 3.0.0 - OS Command Injection

#!/usr/bin/env python

Havij – OLE Automation Array Remote Code Execution

#!/usr/bin/php

Adobe Flash Player – ShaderJob Buffer Overflow (Metasploit)

##

CUPS < 2.0.3 - Multiple Vulnerabilities

Source: http://googleprojectzero.blogspot.se/2015/06/owning-internet-printing-case-study-in.html

Ruby on Rails 4.0.x/4.1.x/4.2.x (Web Console v2) – Whitelist Bypass Code Execution (Metasploit)

##

ProFTPd 1.3.5 – ‘mod_copy’ Command Execution (Metasploit)

##

JDownloader 2 Beta – Directory Traversal

=begin

Seagate Central 2014.0410.0026-F – Remote Command Execution

#!/usr/bin/python

D-Link Devices – HNAP SOAPAction-Header Command Execution (Metasploit)

##

Airties – login-cgi Buffer Overflow (Metasploit)

##

Realtek SDK – Miniigd UPnP SOAP Command Execution (Metasploit)

##

WebDrive 12.2 (Build #4172) – Remote Buffer Overflow

#!/usr/bin/python