Windows Media Center is prone to a vulnerability that may allow execution of a remote dll.

MSHTML.dll is prone to a vulnerability that may allow binary planting of crafted dlls if MSHTML.DLL of version 11.0.9600.18231 (from Internet explorer 11) is located in system32 in the target and using a crafted word document to trigger.

The default error page in Spring Boot (also know as "Whitelabel Error Page"), when a type error is detected in a parameter configured in a controller, will display the provided value. The page's rendering expands Spring Expression Language (SPEL) expressions found in the page, and it does so recursively. Because of this, a string containing an expression language provided as the value for an URL parameter may be evaluated server side while rendering the page if it's from a different type to the expected for said parameter. The "Whitelabel Error Page" is provided by default, but it can be customized. This attack has only been tested with the default error page. In particular, if SPEL is not used a the templating language for another page, or if the page doesn't print the exception due to type mismatch, the attack is not possible.

This module exploits an arbitrary file upload vulnerability in Advantech WebAccess. The specific flaw exists within the WebAccess Dashboard Viewer. Insufficient validation within the FileUpload script allows unauthenticated callers to upload arbitrary code to directories in the server where the code can be automatically executed under the high-privilege context of the IIS AppPool. Authentication is not required to exploit this vulnerability.

This module exploits a "win32k.sys" integer overflow in Windows kernel by calling to "PathToRegion" function with crafted parameters.

This module exploits a vulnerability in "Windows Secondary Logon Service" when it fails to properly manage request handles in memory. As a result, a system thread handle is obtained.

Jenkins is prone to a remote vulnerability that allows attackers to take advantage of a deserialization vulnerability present in the XStream Java library. By exploiting known methods, it is possible to remotely load a ProcessBuilder Java class, which allows the execution of system commands.

The Filter function of the VBScript engine in Microsoft Internet Explorer is prone to a type confusion vulnerability when processing specially crafted parameters. This vulnerability allows attackers to execute arbitrary code on vulnerable machines by enticing unsuspecting users to visit a specially crafted website. In order to bypass ASLR, this module also exploits a memory disclosure vulnerability from the same Microsoft security bulletin. This second vulnerability exists in the IE JavaScript engine when dealing with ArrayBuffer objects.

The specific flaw exists within the implementation of the 0x13C83 opcode in the webvrpcs Service BwWebSvc.dll . A stack-based buffer overflow vulnerability exists in a call to sprint. An attacker can use this vulnerability to execute arbitrary code in the context of an administrator of the system.

This module exploits a vulnerability in the NVIDIA Stereoscopic 3D Driver Service. It will wait for users to login on the target system, installing agents for every user, until being able to install an agent for a user in the Built In Administrators group.