Twenty Year Anniversary
Showing 76 - 100 of 5,346 RSS Feed

Operating System: Windows

Windows Global Reparse Point Security Feature Bypass / Privilege Escalation
Posted Feb 20, 2018
Authored by James Forshaw, Google Security Research

Windows suffer from Global Reparse Point security feature bypass and privilege escalation vulnerabilities.

tags | exploit, vulnerability
systems | windows
advisories | CVE-2018-0822
MD5 | 84a050a0c09ac8b610c64807057eb756
Windows Kernel nt!RtlpCopyLegacyContextX86 Stack Memory Disclosure
Posted Feb 20, 2018
Authored by Google Security Research, mjurczyk

The Windows kernel suffers from a nt!RtlpCopyLegacyContextX86 stack memory disclosure vulnerability.

tags | exploit, kernel
systems | windows
advisories | CVE-2018-0832
MD5 | 377dfc9711b87f3d2d74deede52a59ef
Mozilla Executable Installer DLL Hijacking
Posted Feb 20, 2018
Authored by Stefan Kanthak

Mozilla's executable installers are vulnerable to dll hijacking.

tags | advisory
systems | windows
MD5 | 8915a3fa0d07a20bdf3b322c2c1e4179
Zero Day Zen Garden: Windows Exploits Development - Part 5
Posted Feb 16, 2018
Authored by Steve Patterson

Whitepaper called Zero Day Zen Garden: Windows Exploit Development Part 5 [Return Oriented Programming Chains].

tags | paper
systems | windows
MD5 | 3e997bff18215da9f06ce4af9ce36ef1
Advantech WebAccess Node 8.3.0 DLL Hijacking
Posted Feb 12, 2018
Authored by Nassim Asrir

Advantech WebAccess Node version 8.3.0 suffers from an AspVBObj.dll code execution dll hijacking vulnerability.

tags | exploit, code execution
systems | windows
advisories | CVE-2018-6911
MD5 | d399329ffa7fecc776e24fe1316f6ea9
Microsoft Skype DLL Hijacking
Posted Feb 9, 2018
Authored by Stefan Kanthak

Microsoft's Skype home-grown updater suffers from a dll hijacking vulnerability.

tags | exploit
systems | windows
MD5 | e378e1abd2417b24f1e060626ed42449
Microsoft Windows Subsystem For Linux Local Privilege Escalation
Posted Feb 2, 2018
Authored by Saar Amar

Microsoft Windows Subsystem for Linux execve() local privilege escalation exploit.

tags | exploit, local
systems | linux, windows
advisories | CVE-2018-0743
MD5 | 0903b2d21e77a9343b434798a05ca282
SourceTree Remote Command Injection
Posted Feb 1, 2018
Authored by Atlassian

Sourcetree for macOS versions 1.0b2 up to 2.7.0 and Sourcetree for Windows versions 0.5.1.0 up to 2.4.7.0 suffers from multiple command injection vulnerabilities.

tags | advisory, vulnerability
systems | windows
advisories | CVE-2017-14592, CVE-2017-14593, CVE-2017-17458, CVE-2017-17831
MD5 | b6f6d427c28112f1184e24193c496c12
BMC Server Automation RSCD Agent NSH Remote Command Execution
Posted Jan 31, 2018
Authored by Nicky Bloor, Olga Yanushkevich | Site metasploit.com

This Metasploit module exploits a weak access control check in the BMC Server Automation RSCD agent that allows arbitrary operating system commands to be executed without authentication. Note: Under Windows, non-powershell commands may need to be prefixed with 'cmd /c'.

tags | exploit, arbitrary
systems | windows
advisories | CVE-2016-1542, CVE-2016-1543
MD5 | 21c820bdd8fcc8d4555e107c87aa2da7
BMC BladeLogic RSCD Agent 8.3.00.64 Windows Users Disclosure
Posted Jan 30, 2018
Authored by Paul Taylor

BMC BladeLogic RSCD Agent version 8.3.00.64 suffers from a windows users disclosure vulnerability.

tags | exploit
systems | windows
advisories | CVE-2016-5063
MD5 | 9a5bc055f019f7c0dbca70e7a76dd801
Apple Security Advisory 2018-1-23-7
Posted Jan 25, 2018
Authored by Apple | Site apple.com

Apple Security Advisory 2018-1-23-7 - iCloud for Windows 7.3 is now available and addresses code execution vulnerabilities.

tags | advisory, vulnerability, code execution
systems | windows, apple, 7
advisories | CVE-2018-4088, CVE-2018-4096
MD5 | 7f66fa9c1925323303df6c448d12a4cf
Apple Security Advisory 2018-1-23-6
Posted Jan 25, 2018
Authored by Apple | Site apple.com

Apple Security Advisory 2018-1-23-6 - iTunes 12.7.3 for Windows is now available and addresses code execution vulnerabilities.

tags | advisory, vulnerability, code execution
systems | windows, apple
advisories | CVE-2018-4088, CVE-2018-4096
MD5 | c0add0de73417e236e8ffa65303d38e2
Kaseya VSA R9.2 Arbitrary File Read
Posted Jan 15, 2018
Authored by Securify B.V., Kin Hung Cheng, Robert Hartshorn

A security vulnerability was found in Kaseya VSA file download file functionality. Using this vulnerability an authenticated user in a Kaseya VSA environment is able to download arbitrary files from the server (including source code of Kaseya, the database backups, configuration files, and even windows files). Version R9.2 was found affected.

tags | exploit, arbitrary
systems | windows
MD5 | 605ce3e61e7a1e700654afd0b394ab11
Windows Kernel Exploitation Tutorial Part 5: NULL Pointer Dereference
Posted Jan 12, 2018
Authored by rootkit

Whitepaper called Windows Kernel Exploitation Tutorial Part 5: NULL Pointer Dereference.

tags | paper, kernel
systems | windows
MD5 | 6d619680559450b20c39f2d197102acb
Wireshark Analyzer 2.4.4
Posted Jan 12, 2018
Authored by Gerald Combs | Site wireshark.org

Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers.

Changes: Multiple fixes including various security issues being addressed. Various other updates.
tags | tool, sniffer, protocol
systems | windows, unix
advisories | CVE-2018-5334, CVE-2018-5335, CVE-2018-5336
MD5 | 660db152b7d6974c0e2ff12aa8a4fce6
ALLMediaServer 0.95 Stack Buffer Overflow
Posted Jan 12, 2018
Authored by Mario Kartone Ciccarelli

ALLMediaServer version 0.95 stack buffer overflow exploit with DEP bypass on Windows 7 x64.

tags | exploit, overflow
systems | windows, 7
advisories | CVE-2017-17932
MD5 | 15321ab5b12699493b877fadfdf25da1
Microsoft Windows SMB Server Mount Point Privilege Escalation
Posted Jan 11, 2018
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the SMB server drivers (srv.sys and srv2.sys) do not check the destination of a NTFS mount point when manually handling a reparse operation leading to being able to locally open an arbitrary device via an SMB client which can result in privilege escalation.

tags | exploit, arbitrary
systems | windows
advisories | CVE-2018-0749
MD5 | 8bee2db391a04c548de7c3126b3c73a4
Microsoft Windows NtImpersonateAnonymousToken LPAC To Non-LPAC Privilege Escalation
Posted Jan 11, 2018
Authored by James Forshaw, Google Security Research

On Microsoft Windows, when impersonating the anonymous token in an LPAC the WIN://NOAPPALLPKG security attribute is ignored leading to impersonating a non-LPAC token leading to privilege escalation.

tags | exploit
systems | windows
advisories | CVE-2018-0752
MD5 | 8c8cfa8d06fb3178fe47edd96393a118
Microsoft Windows NtImpersonateAnonymousToken AC To Non-AC Privilege Escalation
Posted Jan 11, 2018
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the check for an AC token when impersonating the anonymous token does not check impersonation token's security level leading to impersonating a non-AC anonymous token leading to privilege escalation.

tags | exploit
systems | windows
advisories | CVE-2018-0751
MD5 | ec5a514309e694f43622f9260cc4f20a
HPE iMC dbman RestoreDBase Unauthenticated Remote Command Execution
Posted Jan 10, 2018
Authored by Chris Lyne, sztivi | Site metasploit.com

This Metasploit module exploits a remote command execution vulnerability in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04. The dbman service allows unauthenticated remote users to restore a user-specified database (OpCode 10007), however the database connection username is not sanitized resulting in command injection, allowing execution of arbitrary operating system commands as SYSTEM. This service listens on TCP port 2810 by default. This Metasploit module has been tested successfully on iMC PLAT v7.2 (E0403) on Windows 7 SP1 (EN).

tags | exploit, remote, arbitrary, tcp
systems | windows, 7
advisories | CVE-2017-5817
MD5 | 252d40a332488ae10b75261fe5cefc7d
HPE iMC dbman RestartDB Unauthenticated Remote Command Execution
Posted Jan 10, 2018
Authored by Chris Lyne, sztivi | Site metasploit.com

This Metasploit module exploits a remote command execution vulnerability in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04. The dbman service allows unauthenticated remote users to restart a user-specified database instance (OpCode 10008), however the instance ID is not sanitized, allowing execution of arbitrary operating system commands as SYSTEM. This service listens on TCP port 2810 by default. This Metasploit module has been tested successfully on iMC PLAT v7.2 (E0403) on Windows 7 SP1 (EN).

tags | exploit, remote, arbitrary, tcp
systems | windows, 7
advisories | CVE-2017-5816
MD5 | 5919ea7fa37b5b123d15780fb9eca50b
Microsoft Windows Local XPS Print Spooler Sandbox Escape
Posted Jan 10, 2018
Authored by James Forshaw, Google Security Research

The Microsoft Windows local print spooler can be abused to create an arbitrary file from a low privilege application including one in an AC as well as a typical Edge LPAC CP leading to elevation of privilege.

tags | exploit, arbitrary, local
systems | windows
MD5 | f9c76875d1743262b2802cf76e9e7f56
Microsoft Windows Kernel ATMFD.DLL NamedEscape 0x250D Pool Corruption
Posted Jan 10, 2018
Authored by Google Security Research, mjurczyk

The Microsoft Windows OpenType ATMFD.DLL kernel-mode font driver has an undocumented "escape" interface, handled by the standard DrvEscape and DrvFontManagement functions implemented by the module. The interface is very similar to Buffered IOCTL in nature, and handles 13 different operation codes in the numerical range of 0x2502 to 0x2514. It is accessible to user-mode applications through an exported (but not documented) gdi32!NamedEscape function, which internally invokes the NtGdiExtEscape syscall.

tags | advisory, kernel
systems | windows
advisories | CVE-2018-0788
MD5 | 96b46447ba7a6c968d0db2900d57b8a3
Microsoft Windows Kernel ATMFD.DLL Out-Of-Bounds Read
Posted Jan 10, 2018
Authored by Google Security Research, mjurczyk

The Microsoft Windows OpenType ATMFD.DLL kernel-mode driver lacks any sort of sanitization of various 32-bit offsets found in .MMM files (Multiple Master Metrics), and instead uses them blindly while loading Type 1 Multiple-Master fonts in the system.

tags | advisory, kernel
systems | windows
advisories | CVE-2018-0754
MD5 | 870a4dbf54830a3b7fe3d330142d98ab
Microsoft Windows Kernel nt!PiUEventHandleGetEven Stack Memory Disclosure
Posted Jan 10, 2018
Authored by Google Security Research, mjurczyk

The Microsoft Windows kernel suffers from a stack memory disclosure from nt!RawMountVolume via nt!PiUEventHandleGetEvent (\Device\DeviceApi\CMNotify device).

tags | advisory, kernel
systems | windows
advisories | CVE-2018-0747
MD5 | 60cf9a8ec04755f71c4247b0446d8196
Page 4 of 214
Back23456Next

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

June 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    14 Files
  • 2
    Jun 2nd
    1 Files
  • 3
    Jun 3rd
    3 Files
  • 4
    Jun 4th
    18 Files
  • 5
    Jun 5th
    21 Files
  • 6
    Jun 6th
    8 Files
  • 7
    Jun 7th
    16 Files
  • 8
    Jun 8th
    18 Files
  • 9
    Jun 9th
    5 Files
  • 10
    Jun 10th
    2 Files
  • 11
    Jun 11th
    21 Files
  • 12
    Jun 12th
    32 Files
  • 13
    Jun 13th
    15 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    4 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    2 Files
  • 18
    Jun 18th
    15 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    15 Files
  • 21
    Jun 21st
    15 Files
  • 22
    Jun 22nd
    7 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close