Subscribe via feed.
Archive for January, 2019

WebKit JSC JIT Use-After-Free

Posted by deepcore under exploit (No Respond)

The doesGC function simply takes a node, and tells if it might cause a garbage collection. This function is used to determine whether to insert write barriers. But it is missing some cases such as StringCharAt, StringCharCodeAt and GetByVal that might cause a garbage collection via rope strings. As a result, it can lead to […]

Streamworks Job Scheduler Release 7 Authentication Weakness

Posted by deepcore under exploit (No Respond)

Streamworks Job Scheduler Release 7 has all agents using the same X.509 certificates and keys issued by the vendor for authentication. The processing server component does not check received messages properly for authenticity. Agents installed on servers do not check received messages properly for authenticity. Agents and processing servers are vulnerable to the TLS Heartbleed […]

Microsoft Windows RestrictedErrorInfo Unmarshal Section Handle Use-After-Free

Posted by deepcore under exploit (No Respond)

The WinRT RestrictedErrorInfo does not correctly check the validity of a handle to a section object which results in closing an unrelated handle which can lead to an elevation of privilege.

Microsoft Windows XmlDocument Insecure Sharing Privilege Escalation

Posted by deepcore under exploit (No Respond)

A number of Partial Trust Windows Runtime classes expose the XmlDocument class across process boundaries to less privileged callers which in its current form can be used to elevate privileges and escape the Edge Content LPAC sandbox.

blueman set_dhcp_handler D-Bus Privilege Escalation

Posted by deepcore under exploit (No Respond)

This Metasploit module attempts to gain root privileges by exploiting a Python code injection vulnerability in blueman versions prior to 2.0.3. The org.blueman.Mechanism.EnableNetwork D-Bus interface exposes the set_dhcp_handler function which uses user input in a call to eval, without sanitization, resulting in arbitrary code execution as root. This module has been tested successfully with blueman […]

Microsoft Windows Net-NTLMv2 Reflection DCOM/RPC Privilege Escalation

Posted by deepcore under exploit (No Respond)

This Metasploit module utilizes the Net-NTLMv2 reflection between DCOM/RPC to achieve a SYSTEM handle for elevation of privilege. It requires a CLSID string.

Coship Wireless Router Unauthenticated Admin Password Reset

Posted by deepcore under exploit (No Respond)

Coship Wireless Router versions 4.0.0.48, 4.0.0.40, 5.0.0.54, 5.0.0.55, and 10.0.0.49 suffer from an unauthenticated admin password reset vulnerability.

FortiGate FortiOS LDAP Credential Disclosure

Posted by deepcore under exploit (No Respond)

FortiGate FortiOS versions prior to 6.0.3 suffer from an LDAP credential disclosure vulnerability.

Roxy Fileman 1.4.5 Arbitrary File Download

Posted by deepcore under exploit (No Respond)

Roxy Fileman version 1.4.5 suffers from an arbitrary file download vulnerability.

GL-AR300M-Lite 2.2.7 Command Injection / Directory Traversal

Posted by deepcore under exploit (No Respond)

GL-AR300M-Lite version 2.27 suffers from command injection, file download, and directory traversal vulnerabilities.