exploit the possibilities
Showing 1 - 16 of 16 RSS Feed

Files Date: 2015-09-18

Windows Task Scheduler DeleteExpiredTaskAfter File Deletion Privilege Escalation
Posted Sep 18, 2015
Authored by Google Security Research, forshaw

The Task Scheduler can be made to delete a task after it's trigger has expired. No check is made to ensure the task file is not a junction which allows arbitrary files to be deleted by the system user leading to EoP.

tags | exploit, arbitrary
systems | linux
advisories | CVE-2015-2525
MD5 | a777204c6fa50a944acbc705b4737586
Windows NtUserGetClipboardAccessToken Token Leak Redux
Posted Sep 18, 2015
Authored by Google Security Research, forshaw

The NtUserGetClipboardAccessToken win32k system call exposes the access token of the last user to lower-privileged users. It can also be used to open an anonymous impersonation thread token which normally OpenThreadToken shouldn't be able to do. This is a bypass of the fix for CVE-2015-0078.

tags | exploit
systems | linux
advisories | CVE-2015-2527
MD5 | 8ff198d17ce6a786cede5d61cda7a201
Microsoft Office 2007 OGL.dll ValidateBitmapInfo Bounds Check Failure
Posted Sep 18, 2015
Authored by Google Security Research, scvitti

A bounds check crash was observed in Microsoft Office 2007 Excel with Microsoft Office File Validation Add-In disabled and Application Verifier enabled for testing and reproduction. This bug did not reproduce in Office 2010 or 2013.

tags | exploit
systems | linux
advisories | CVE-2015-2510
MD5 | 3637c6772cb52201052db352c3a6aa25
Microsoft Office Excel 2007, 2010, 2013 Use-After-Free With BIFFRecord
Posted Sep 18, 2015
Authored by Google Security Research, scvitti

Microsoft Excel 2007 running on Windows 2003 suffers from a use-after-free vulnerability.

tags | exploit
systems | linux, windows
advisories | CVE-2015-2523
MD5 | 120d58ef0a347673009fceed3230c4ee
Windows User Mode Font Driver Thread Permissions EoP
Posted Sep 18, 2015
Authored by Google Security Research, forshaw

The host process for the UMFD runs as a normal user but with a heavily restrictive process DACL. It's possible execute arbitrary code within the context of the process because it's possible to access the processes threads leading to local EoP.

tags | exploit, arbitrary, local
systems | linux
advisories | CVE-2015-2508
MD5 | 4c222da843b5708c2d819ecd2d4bbf86
Microsoft Office 2007 BIFFRecord Length Use-After-Free
Posted Sep 18, 2015
Authored by Google Security Research, scvitti

A use-after-free crash was observed in Microsoft Office 2007 with Microsoft Office File Validation Add-In disabled and Application Verifier enabled for testing and reproduction. This bug did not reproduce in Office 2010 or 2013.

tags | exploit
systems | linux
advisories | CVE-2015-2520
MD5 | 3c68c9f8d219101d5cc0116069a92447
Microsoft Office 2007 OLESSDirectyEntry.CreateTime Type Confusion
Posted Sep 18, 2015
Authored by Google Security Research, scvitti

A type confusion crash was observed in Microsoft Office 2007 with Microsoft Office File Validation Add-In disabled and Application Verifier enabled for testing and reproduction. This bug did not reproduce in Office 2010 or 2013.

tags | exploit
systems | linux
advisories | CVE-2015-2521
MD5 | 09e415bea707f7d612248c4a96108843
Farol SQL Injection
Posted Sep 18, 2015
Authored by Thierry Fernandes Faria

Farol suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
advisories | CVE-2015-6962
MD5 | 02b3c76dfeaeae8e7902843363be361a
Microsoft Security Bulletin Revision Increment For September, 2015
Posted Sep 18, 2015
Site microsoft.com

This bulletin summary lists one bulletin that has undergone a major revision increment for September, 2015.

tags | advisory
MD5 | 7b5d7b546bb19add013dd3bfce5f96a2
Windows CreateObjectTask TileUserBroker Privlege Escalation
Posted Sep 18, 2015
Authored by Google Security Research, forshaw

The Microsoft\Windows\Shell\CreateObjectTask initializes a shell32 based ICreateObject COM server as local system. This is marked as being accessible from a normal user account so once created we can attach to it. The server only has one method, CreateObject which checks the CLSID against a list of known safe classes before allowing it to be instantiated. One of these classes is allows a user to set their account picture for the logon screen.

tags | exploit, shell, local
systems | linux, windows
advisories | CVE-2015-2528
MD5 | a9407076d7299abeadaf4df08afdfc35
Windows CreateObjectTask SettingsSyncDiagnostics Privilege Escalation
Posted Sep 18, 2015
Authored by Google Security Research, forshaw

The Microsoft\Windows\Shell\CreateObjectTask initializes a shell32 based ICreateObject COM server as local system. This is marked as being accessible from a normal user account so once created we can attach to it. The server only has one method, CreateObject which checks the CLSID against a list of known safe classes before allowing it to be instantiated. One of these classes is a diagnostic class for setting synchronization implemented in SettingSync.dll.

tags | exploit, shell, local
systems | linux, windows
advisories | CVE-2015-2524
MD5 | 2c2e85e3f2fa214ea13a5ff9c5bce62b
Microsoft Exchange Outlook Web 2013 Information Disclosure
Posted Sep 18, 2015
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Outlook Web Access (OWA) does not properly handle web requests. A remote user can send a specially crafted request to the target web application to view potentially sensitive stack trace information on the target system.

tags | advisory, remote, web
advisories | CVE-2015-2505
MD5 | 2bf7a469dfe02b5584686466c475ab4a
OS X IOKit Kernel Memory Corruption
Posted Sep 18, 2015
Authored by Google Security Research, ianbeer

An OS X IOKit kernel memory corruption issue occurs due to a bad bzero in IOBluetoothDevice.

tags | exploit, kernel
systems | linux, apple, osx
advisories | CVE-2014-8836
MD5 | be89e142f6fbb107f137d490b98a4d33
iBooking CMS SQL Injection
Posted Sep 18, 2015
Authored by Cleiton Pinheiro

iBooking CMS suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | ac814e5b406e145f1cb8a981817baec0
Pentaho 5.2.x BA Suite / PDI Information Disclosure
Posted Sep 18, 2015
Authored by Gregory Draperi

Pentaho version 5.2.x GA BA Suite and PDI allow unauthenticated access to configuration files. The GetResource servlet, a vestige of the old platform UI, allows unauthenticated access to resources in the pentaho-solutions/system folder. Specifically vulnerable are properties files that may reveal passwords.

tags | exploit, info disclosure
advisories | CVE-2015-6940
MD5 | 2e7fcb0e7b18e3ae22f2cafb031e9c8b
Adobe Reader X And XI For Windows Out-of-bounds Write In CoolType.dll
Posted Sep 18, 2015
Authored by Google Security Research, mjurczyk

Adobe Reader X and XI for windows suffers from an out-of-bounds write in CoolType.dll.

tags | exploit
systems | linux, windows
advisories | CVE-2014-9160
MD5 | dd8f139d822407d292c9785b3fda336e
Page 1 of 1
Back1Next

File Archive:

October 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    24 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    7 Files
  • 4
    Oct 4th
    4 Files
  • 5
    Oct 5th
    10 Files
  • 6
    Oct 6th
    1 Files
  • 7
    Oct 7th
    21 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    5 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    17 Files
  • 12
    Oct 12th
    4 Files
  • 13
    Oct 13th
    4 Files
  • 14
    Oct 14th
    15 Files
  • 15
    Oct 15th
    19 Files
  • 16
    Oct 16th
    19 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close