This exploit takes advantage of a buffer overflow vulnerability in Triologic Media Player 8. By creating a specially crafted '.m3l' file, an attacker can trigger a buffer overflow condition, potentially allowing them to execute arbitrary code on the target system.
This exploit creates a payload file 'POC.txt' that triggers a denial of service vulnerability in SpotAuditor 5.3.4. The exploit causes the application to crash when the payload is pasted into the 'Name' field during the registration process.
The vulnerability allows a local attacker to cause a denial of service (DoS) condition on the affected system. By providing a specially crafted input in the 'Key' field, the application crashes, resulting in the unavailability of the service.
Memu Play 7.1.3 suffers from Privilege Escalation due to insecure file permissions. By default, the Authenticated Users group has modify permission to ESM folders/files, allowing a low privilege account to rename the MemuService.exe file and replace it with a malicious file that can execute with system level privileges. Restarting the computer triggers the execution of the malicious file.
This exploit causes a denial of service (DoS) in DiskBoss version 7.7.14. By running a Python script that generates a large buffer and copying it to the clipboard, the exploit crashes the DiskBoss application when attempting to add the buffer as an input directory.
This module exploits a vulnerability within SharePoint and its .NET backend that allows an attacker to execute commands using specially crafted XOML data sent to SharePoint via the Workflows functionality.
Some DLINK Access Points are vulnerable to an authenticated OS command injection. Default credentials for the web interface are admin/admin.
This module exploits a vulnerability in IBM TM1 / Planning Analytics that allows an unauthenticated attacker to perform a configuration overwrite. It starts by querying the Admin server for the available applications, picks one, and then exploits it. You can also provide an application name to bypass this step, and exploit the application directly. The configuration overwrite is used to change an application server authentication method to "CAM", a proprietary IBM auth method, which is simulated by the exploit. The exploit then performs a fake authentication as admin, and finally abuses TM1 scripting to perform a command injection as root or SYSTEM. Testing was done on IBM PA 2.0.6 and IBM TM1 10.2.2 on Windows and Linux. Versions up to and including PA 2.0.8 are vulnerable. It is likely that versions earlier than TM1 10.2.2 are also vulnerable (10.2.2 was released in 2014).
This module can be used to leverage the extension functionality added since Redis 4.0.0 to execute arbitrary code. To transmit the given extension it makes use of the feature of Redis which called replication between master and slave.
The Grandstream UCM6200 Series WebSocket 1.0.20.20 is vulnerable to SQL Injection. An attacker can exploit this vulnerability to disclose the user_password via login (time based).
Services By CQR