Atlassian Confluence Widget Connector Macro Vulnerability Exploit Update |
The Widget Connector macro in Atlassian Confluence Server allows remote attackers to achieve path traversal and remote code execution via server-side template injection.
This update adds support to control the FTP Server port number and socket timeout. |
May 14, 2019 |
CVE-2019-3396 |
Windows, Linux |
Exploits / OS Command Injection / Known Vulnerabilities |
Dnsmasq Heap buffer Overflow DoS |
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response. |
May 10, 2019 |
CVE-2017-14491 |
Linux |
Denial of Service / Remote |
Microsoft Windows Win32k DestroyClass Vulnerability Exploit Update |
This update adds support for Windows 7 64-bit. |
May 10, 2019 |
CVE-2019-0623 |
Windows |
Exploits / Local |
Atlassian Confluence Widget Connector Macro Vulnerability Exploit |
The Widget Connector macro in Atlassian Confluence Server allows remote attackers to achieve path traversal and remote code execution via server-side template injection. |
May 7, 2019 |
CVE-2019-3396 |
Windows, Linux |
Exploits / OS Command Injection / Known Vulnerabilities |
Dnsmasq Integer Underflow DoS |
In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash. |
May 4, 2019 |
CVE-2017-13704 |
Linux |
Denial of Service / Remote |
Microsoft Windows Win32k DestroyClass Vulnerability Exploit |
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. |
April 26, 2019 |
CVE-2019-0623 |
Windows |
Exploits / Local |
Microsoft Windows DCOM-RPC NTLM Reflection Elevation of Privilege Exploit Update |
This update improves the reliability by handling scenarios where the attack cannot be performed. |
April 17, 2019 |
CVE-2016-3225 |
Windows |
Exploits / Local |
Microsoft Windows Shell Remote Code Execution Vulnerability Exploit (CVE-2018-8495) |
Microsoft Windows Shell does not properly sanitize special characters in a URI, allowing the opening a dangerous files.
An attacker can leverage this vulnerability to execute code in the context of the current user. |
April 15, 2019 |
CVE-2018-8495 |
Windows |
Exploits / Client Side |
Apache Tika Server OS Command Injection Exploit |
An OS Command Injection Vulnerability was found in Apache Tika Server 1.11 |
April 12, 2019 |
CVE-2018-1335 |
Windows |
Exploits / Remote Code Execution |
Foxit Reader UAF Remote Execution Exploit |
A Buffer Overflow exists when parsing .PDF files. The vulnerability is caused due to a boundary error when handling a crafted .PDF files. |
April 11, 2019 |
CVE-2018-9948 |
Windows |
Exploits / Client Side |
Free MP3 CD Ripper Buffer Overflow SEH Exploit Update |
A Buffer Overflow exists when parsing .mp3/wma files. The vulnerability is caused due to a boundary error when handling a crafted .mp3/wma files. |
April 10, 2019 |
CVE-2019-9767 |
Windows |
Exploits / Client Side |
Microsoft Windows Win32k UaF xxxDestroyWindow Local Privilege Escalation Exploit |
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. |
April 5, 2019 |
CVE-2018-8453 |
Windows |
Exploits / Local |
Microsoft Windows DHCP Server Heap Overflow Vulnerability DoS Update |
A Heap Overflow vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server. An attacker who successfully exploited the vulnerability could run arbitrary code on the DHCP server.
This version improves the detection of the effectiveness in non-vulnerable targets. |
April 2, 2019 |
CVE-2019-0626 |
Windows |
Denial of Service / Remote |
MS17-010 exploit updates |
This update adds support for new platforms to the MS17-010 exploitation such as Windows 7 Embedded Standard edition, and also 32 bits targets. |
March 29, 2019 |
CVE-2017-0143 |
Windows |
Exploits / Remote |
WinRAR ACE filename Absolute Path Extraction Vulnerability Exploit |
Path traversal vulnerability in WinRAR when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path. |
March 23, 2019 |
CVE-2018-20250 |
Windows |
Exploits / Client Side |
STOPzilla AntiMalware Arbitrary Write szkg64 Local Privilege Escalation Exploit |
The user can write 0 where he wants. This can be used to write SecurityDescriptor and write system processes. Therefore we can elevate privileges. |
March 20, 2019 |
NOCVE-9999-120035 |
Windows |
Exploits / Local |
Linux Kernel eBPF Local Privilege Escalation Exploit |
An arbitrary memory r/w access issue was found in the Linux kernel compiled with the eBPF bpf(2) system call (CONFIG_BPF_SYSCALL) support. The issue could occur due to calculation errors in the eBPF verifier module, triggered by user supplied malicious BPF program. An unprivileged user could use this flaw to escalate their privileges on a system. Setting parameter "kernel.unprivileged_bpf_disabled=1" prevents such privilege escalation by restricting access to bpf(2) call.
|
March 16, 2019 |
CVE-2017-16995 |
Linux |
Exploits / Local |
Microsoft Windows DHCP Server Heap Overflow Vulnerability DoS |
A Heap Overflow vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server. An attacker who successfully exploited the vulnerability could run arbitrary code on the DHCP server. |
March 15, 2019 |
CVE-2019-0626 |
Windows |
Denial of Service / Remote |
Microsoft Windows Administrator UAC Elevation Bypass Update v1 |
This update improves the module to bypass UAC by adding support for Windows 10. |
March 8, 2019 |
NOCVE-9999-64489 |
Windows |
Exploits / Local |
Drupal RESTful Web Services Module Remote PHP Command Injection Exploit |
RESTful Web Services Module does not properly sanitize data from non-form sources. A vulnerability in this approach allows an unauthenticated attacker to send specially crafted requests resulting in arbitrary PHP execution. |
March 7, 2019 |
CVE-2019-6340 |
Linux |
Exploits / OS Command Injection / Known Vulnerabilities |
Cisco Webex Meetings webexservice Update Service ptUpdate Downgrade Local Privilege Escalation Exploit |
A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated local attacker, to execute arbitrary commands with SYSTEM user privileges. |
February 27, 2019 |
CVE-2019-1674 |
Windows |
Exploits / Local |
Linux snapd dirty_sock Local Privilege Escalation Exploit Update |
This module exploits a vulnerability in snapd which incorrectly validates and parses the remote socket address when performing access controls on its UNIX socket.
A local attacker could use this to access privileged socket APIs and obtain administrator privileges.
This update adds support for more platforms. |
February 22, 2019 |
CVE-2019-7304 |
Linux |
Exploits / Local |
Dokany Google Drive File Stream Kernel Buffer Overflow Privileged Escalation Exploit |
Dokan redistributable are vulnerable to a buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability.
|
February 22, 2019 |
CVE-2018-5410 |
Windows |
Exploits / Local |
Linux snapd dirty_sock Local Privilege Escalation Exploit |
This module exploits a vulnerability in snapd which incorrectly validates and parses the remote socket address when performing access controls on its UNIX socket.
A local attacker could use this to access privileged socket APIs and obtain administrator privileges. |
February 21, 2019 |
CVE-2019-7304 |
Linux |
Exploits / Local |
Kibana local file inclusion Exploit |
Specific versions of Kibana do not validate paths on a specific GET request, this can be exploited in order to execute local javascript files on the target system |
February 19, 2019 |
CVE-2018-17246 |
Linux |
Exploits / Local File Inclusion |