The Latest Infosec News, Tools, and Exploits – Got Root?
# Exploit Title: Windows 10 UAC Bypass by computerDefault # Date: 2018-10-18 # Exploit Author: Fabien DROMAS – Security consultant @ Synetis # Twitter: st0rnpentest # # Vendor Homepage: www.microsoft.com # Version: Version 10.0.17134.285 # […]
libSSH – Authentication Bypass [su_quote] #!/usr/bin/env python3 import paramiko import socket import argparse from sys import argv, exit parser = argparse.ArgumentParser(description=”libSSH Authentication Bypass”) parser.add_argument(‘–host’, help=’Host’) parser.add_argument(‘-p’, ‘–port’, help=’libSSH port’, default=22) parser.add_argument(‘-log’, ‘–logfile’, help=’Logfile to write […]
# Exploit Title: Time and Expense Management System 3.0 – Cross-Site Request Forgery (Add Admin) # Dork: N/A # Date: 2018-10-17 # Exploit Author: Ihsan Sencan # Vendor Homepage: http://www.initechs.com/ # Software Link: http://sourceforge.net/projects/tems/files/latest # […]
# Exploit Title: LayerBB Forum 1.1.1 – ‘search_query’ SQL Injection # Exploit Author: Ihsan Sencan # Dork: N/A # Date: 2018-10-04 # Vendor Homepage: https://layerbb.com/ # Software Link: https://demo.layerbb.com/ # Version: 1.1.1 # Category: Webapps […]
# Title: NICO-FTP 3.0.1.19 – Buffer Overflow (SEH)(ASLR) # Date: 2018-10-04 # Platforms: Windows # Author: Miguel Mendez Z # Vendor: Nico-FTP # Version: 3.0.1.19 # Tested on: Windows XP_sp3 [es]/ Windows 7_x86 [eng] [su_quote] […]
1. Content process -> Privileged content process (first_stage.js) When spawning a new Edge content process, its privilege is determined by its URL. This URL check is performed by the LCIEUrlPolicy::GetPICForPrivilegedInternalPage method in eModel.dll. The method […]
# Exploit Title: LG SuperSign EZ CMS 2.5 – Local File Inclusion # Date: 2018-09-13 # Exploit Author: Alejandro Fanjul # Vendor Homepage: https://www.lg.com/ar/software-lg-supersign # Version: SuperSign EZ (CMS) # Tested on: Web OS 4.0 […]
# Exploit Title: Ubisoft Uplay Desktop Client 63.0.5699.0 – Remote Code Execution # Date: 2018-09-01 # Exploit Author: Che-Chun Kuo # Vulnerability Type: URI Parsing Command Injection # Vendor Homepage: https://www.ubisoft.com/en-us/ # Software Link: https://uplay.ubi.com/ […]
# Exploit Title: LG Smart IP Camera 1508190 – Backup File Download # Exploit Author: Ege Balci # Vendor Homepage: https://www.lg.com # Software version: 1310250 <= 1508190 # Model: LNB*/LND*/LNU*/LNV* # CVE: CVE-2018-16946 # Description: […]
# Title: Joomla Component JCK Editor 6.4.4 – ‘parent’ SQL Injection # Date: 2018-09-14 # Exploit Author: Hamza Megahed # Vendor Homepage:https://www.joomla.org/ # Download: https://arkextensions.com/products/jck-editor # Version: 6.4.4 # Tested on: Ubuntu, FireFox, # CVE: […]
