The default error page in Spring Boot (also know as "Whitelabel Error Page"), when a type error is detected in a parameter configured in a controller, will display the provided value. The page's rendering expands Spring Expression Language (SPEL) expressions found in the page, and it does so recursively. Because of this, a string containing an expression language provided as the value for an URL parameter may be evaluated server side while rendering the page if it's from a different type to the expected for said parameter. The "Whitelabel Error Page" is provided by default, but it can be customized. This attack has only been tested with the default error page. In particular, if SPEL is not used a the templating language for another page, or if the page doesn't print the exception due to type mismatch, the attack is not possible.

An authenticated user may inject arbitrary xauth commands by sending an x11 channel request that includes a newline character in the x11 cookie. The newline acts as a command separator to the xauth binary. The injected xauth commands are performed with the effective permissions of the logged in user. This attack requires the server to have 'X11Forwarding yes' enabled. This module injects source xauth command to retrieve arbitrary files.

This module exploits an arbitrary file upload vulnerability in Advantech WebAccess. The specific flaw exists within the WebAccess Dashboard Viewer. Insufficient validation within the FileUpload script allows unauthenticated callers to upload arbitrary code to directories in the server where the code can be automatically executed under the high-privilege context of the IIS AppPool. Authentication is not required to exploit this vulnerability.

This module exploits a "win32k.sys" integer overflow in Windows kernel by calling to "PathToRegion" function with crafted parameters.

The Admin framework in Apple OS X contains a hidden backdoor API to gain root privileges. A local user can exploit this flaw in the checking of XPC entitlements.

This module exploits a vulnerability in "Windows Secondary Logon Service" when it fails to properly manage request handles in memory. As a result, a system thread handle is obtained.

Jenkins is prone to a remote vulnerability that allows attackers to take advantage of a deserialization vulnerability present in the XStream Java library. By exploiting known methods, it is possible to remotely load a ProcessBuilder Java class, which allows the execution of system commands.

Exim installations compiled with Perl support do not perform sanitation of the environment before loading a perl script defined with perl_startup setting in exim config file. This can be exploited by malicious local attackers to gain root privileges.

The Filter function of the VBScript engine in Microsoft Internet Explorer is prone to a type confusion vulnerability when processing specially crafted parameters. This vulnerability allows attackers to execute arbitrary code on vulnerable machines by enticing unsuspecting users to visit a specially crafted website. In order to bypass ASLR, this module also exploits a memory disclosure vulnerability from the same Microsoft security bulletin. This second vulnerability exists in the IE JavaScript engine when dealing with ArrayBuffer objects.

The specific flaw exists within the implementation of the 0x13C83 opcode in the webvrpcs Service BwWebSvc.dll . A stack-based buffer overflow vulnerability exists in a call to sprint. An attacker can use this vulnerability to execute arbitrary code in the context of an administrator of the system.