Technical Documentation: ycdxsb/PocOrExp_in_Github

ℹ️ Provenance: Multi-Tier Ingestion · CodeWiki Reference

Overview (`README.md`) Copy Section

PocOrExp in Github

Aggregating existing Poc or Exp on Github, CVE information comes from the official CVE website.

Note: Aggregation is only done through general CVE numbers, so for vulnerabilities with Windows-specific numbers like MS17-010 and famous vulnerabilities with nicknames, it's better to search for them yourself.

Usage Copy Chapter

python3 exp.py -h
usage: exp.py [-h]
[-y {1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021,all}]
[-i {y,n}] [-w {y,n}]

CVE Details and Collect PocOrExp in Github

optional arguments:
-h, --help show this help message and exit
-y {1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021,all}, --year {1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021,all}
get Poc or CVE of certain year or all years
-i {y,n}, --init {y,n}
init or not
-w {y,n}, --watch {y,n}
keep an eye on them or not

Parameter description:

• -y specifies the year of CVEs to process
• -i indicates whether it is the first initialization, y means initial, and will not process already handled CVEs, n means no, and will process already handled CVEs
• -w monitors PoC changes: the current strategy is to update known CVEs with PoC from previous years, and all CVEs from the current year

Steps to use:

• STEP 1: Install dependencies

pip3 install -r requirements.txt

• STEP 2: Apply for a GitHub API token and write it into the TOKENS file in the project directory. The format is as follows, multiple tokens can be used:

token:your_token

• STEP 3: Process CVE information

python3 exp.py -y 2021 -i y
python3 exp.py -y all -i y

• If you want to speed up the process, you can use the asynchronous script exp_async.py

PocOrExps Copy Chapter

• PocOrExp All
• 2026
• 2025
• 2024
• 2023
• 2022
• 2021
• 2020
• 2019
• 2018
• 2017
• 2016
• 2015
• 2014
• 2013
• 2012
• 2011
• 2010
• 2009
• 2008
• 2007
• 2006
• 2005
• 2004
• 2003
• 2002
• 2001
• 2000
• 1999

Log Copy Chapter

• 2021-04-12: Fixed the issue of GitHub search returning results like CVE-2020-36184 when searching for CVE-2020-3618.
• 2021-04-13: Switched to CVE official data due to missing CVE numbers on the NVD website, released an asynchronous script.
• 2021-04-14: Completed the first round of PocOrExp crawling, now using 20 GitHub API tokens to poll all CVEs within 12 hours and update.
• 2021-04-16: Added -w parameter.
• 2021-04-17: Added a daily update script today.py. The update content can be seen in Today. You can modify it, for example, to send the get_today_update results to yourself through services like Dingding or wxpusher.
• 2021-04-20: Found some non-PoC repos, removed them by adding a blacklist, and updated the asynchronous script to v2.
• 2021-04-23: Discovered that some results in today's update are not recently updated repos due to the following reasons:
• 1. The repo changed from private to public.
• 2. When querying through the API, the script strategy is to take the top 30 results by star count, so when the number of other repos with the same CVE increases, they enter the top 30 list, appearing as newly added today. Found that only CVE-2019-0708 has more than 100 search results, so pagination was not used to crawl all. Changed to taking the top 100 results by star count each time.
• 2021-04-30: download to download all PoC/Exp to prevent repo deletion by publishers. Please update git to the latest version to prevent attacks when cloning on Windows CVE-2020-27955.
• 2021-05-19: Found some phishing attempts using CVE on GitHub, like JamesGee. No special handling, please be cautious.
• 2024-09-01: If you are unable to find the POC/EXP on GitHub, you can also check here: https://pocorexps.nsa.im/

Star History Copy Chapter

Reference Copy Chapter

• https://github.com/nomi-sec/PoC-in-GitHub

Overview (`1999/README.md`) Copy Section

CVE-1999-1053 Copy Chapter

guestbook.pl cleanses user-inserted SSI commands by removing text between "!--" and "--" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "--".

• https://github.com/siunam321/CVE-1999-1053-PoC :

CVE-1999-0678 Copy Chapter

A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server.

• https://github.com/lto7777777/CVE-1999-0678 :

CVE-1999-0532 Copy Chapter

A DNS server allows zone transfers.

• https://github.com/websecnl/Bulk_CVE-1999-0532_Scanner :

• https://github.com/Rodney-O-C-Melby/dns-zone-transfer-test :

• https://github.com/SleepTheGod/dns-zone-audit :

CVE-1999-0524 Copy Chapter

ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.

• https://github.com/noraj/ChronoLeak :

• https://github.com/threatlabindonesia/CVE-1999-0524-ICMP-Timestamp-and-Address-Mask-Request-Exploit :

• https://github.com/biontdv/CVE-1999-0524-POC :

• https://github.com/Ransc0rp1on/ICMP-Timestamp-POC :

CVE-1999-0517 Copy Chapter

An SNMP community name is the default (e.g. public), null, or missing.

• https://github.com/ialejandrozalles/InvestigacionAplicacionCVE-1999-0517 :

CVE-1999-0016 Copy Chapter

Land IP denial of service.

• https://github.com/pexmee/CVE-1999-0016-Land-DOS-tool :

• https://github.com/Pommaq/CVE-1999-0016-POC :

CVE-1999-0001 Copy Chapter

ip_input.c in BSD-derived TCP/IP implementations allows remote attackers to cause a denial of service (crash or hang) via crafted packets.

• https://github.com/MarcusGutierrez/complex-vulnerabilities :

Overview (`2000/README.md`) Copy Section

CVE-2000-0979 Copy Chapter

File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers to bypass share access controls by sending a 1-byte password that matches the first character of the real password, aka the "Share Level Password" vulnerability.

• https://github.com/Z6543/CVE-2000-0979 :

CVE-2000-0649 Copy Chapter

IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.

• https://github.com/rafaelh/CVE-2000-0649 :

• https://github.com/Downgraderz/PoC-CVE-2000-0649 :

• https://github.com/stevenvegar/cve-2000-0649 :

CVE-2000-0170 Copy Chapter

Buffer overflow in the man program in Linux allows local users to gain privileges via the MANPAGER environmental variable.

• https://github.com/mike182/exploit :

CVE-2000-0168 Copy Chapter

Microsoft Windows 9x operating systems allow an attacker to cause a denial of service via a pathname that includes file device names, aka the "DOS Device in Path Name" vulnerability.

• https://github.com/adk86/CVE-Vulnerability-Research-Exploit-Analysis :

CVE-2000-0114 Copy Chapter

Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.

• https://github.com/Cappricio-Securities/CVE-2000-0114 :

• https://github.com/adhamelhansye/CVE-2000-0114 :

• https://github.com/Josekutty-K/frontpage-server-extensions-vulnerability-scanner :

Overview (`2001/README.md`) Copy Section

CVE-2001-1442 Copy Chapter

Buffer overflow in innfeed for ISC InterNetNews (INN) before 2.3.0 allows local users in the "news" group to gain privileges via a long -c command line argument.

• https://github.com/alt3kx/CVE-2001-1442 :

CVE-2001-0934 Copy Chapter

Cooolsoft PowerFTP Server 2.03 allows remote attackers to obtain the physical path of the server root via the pwd command, which lists the full pathname.

• https://github.com/alt3kx/CVE-2001-0934 :

CVE-2001-0933 Copy Chapter

Cooolsoft PowerFTP Server 2.03 allows remote attackers to list the contents of arbitrary drives via a ls (LIST) command that includes the drive letter as an argument, e.g. "ls C:".

• https://github.com/alt3kx/CVE-2001-0933 :

CVE-2001-0932 Copy Chapter

Buffer overflow in Cooolsoft PowerFTP Server 2.03 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long command.

• https://github.com/alt3kx/CVE-2001-0932 :

CVE-2001-0931 Copy Chapter

Directory traversal vulnerability in Cooolsoft PowerFTP Server 2.03 allows attackers to list or read arbitrary files and directories via a .. (dot dot) in (1) LS or (2) GET.

• https://github.com/alt3kx/CVE-2001-0931 :

CVE-2001-0758 Copy Chapter

Directory traversal vulnerability in Shambala 4.5 allows remote attackers to escape the FTP root directory via "CWD ..." command.

• https://github.com/alt3kx/CVE-2001-0758 :

CVE-2001-0680 Copy Chapter

Directory traversal vulnerability in ftpd in QPC QVT/Net 4.0 and AVT/Term 5.0 allows a remote attacker to traverse directories on the web server via a "dot dot" attack in a LIST (ls) command.

• https://github.com/alt3kx/CVE-2001-0680 :

CVE-2001-0550 Copy Chapter

wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handled by the glob function (ftpglob).

• https://github.com/gilberto47831/Network-Filesystem-Forensics :

Overview (`2002/README.md`) Copy Section

CVE-2002-20001 Copy Chapter

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.

• https://github.com/c0r0n3r/dheater :

• https://github.com/itmaniac/dheat_dos_attack_poc :

CVE-2002-2154 Copy Chapter

Directory traversal vulnerability in Monkey HTTP Daemon 0.1.4 allows remote attackers to read arbitrary files via .. (dot dot) sequences.

• https://github.com/Hirainsingadia/CVE-2002-2154 :

CVE-2002-1614 Copy Chapter

Buffer overflow in HP Tru64 UNIX allows local users to execute arbitrary code via a long argument to /usr/bin/at.

• https://github.com/wlensinas/CVE-2002-1614 :

CVE-2002-1120 Copy Chapter

Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.

• https://github.com/TheMalwareGuardian/CVE-2002-1120 :

CVE-2002-0991 Copy Chapter

Buffer overflows in the cifslogin command for HP CIFS/9000 Client A.01.06 and earlier, based on the Sharity package, allows local users to gain root privileges via long (1) -U, (2) -D, (3) -P, (4) -S, (5) -N, or (6) -u parameters.

• https://github.com/alt3kx/CVE-2002-0991 :

CVE-2002-0936 Copy Chapter

The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).

• https://github.com/om4rsallam/Full-Attack-Lifecycle-Simulation-on-Metasploitable :

CVE-2002-0748 Copy Chapter

LabVIEW Web Server 5.1.1 through 6.1 allows remote attackers to cause a denial of service (crash) via an HTTP GET request that ends in two newline characters, instead of the expected carriage return/newline combinations.

• https://github.com/fauzanwijaya/CVE-2002-0748 :

CVE-2002-0740 Copy Chapter

Buffer overflow in slrnpull for the SLRN package, when installed setuid or setgid, allows local users to gain privileges via a long -d (SPOOLDIR) argument.

• https://github.com/alt3kx/CVE-2002-0740 :

CVE-2002-0448 Copy Chapter

Xerver Free Web Server 2.10 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request that contains many "C:/" sequences.

• https://github.com/alt3kx/CVE-2002-0448 :

CVE-2002-0348 Copy Chapter

service.cgi in Cobalt RAQ 4 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long service argument.

• https://github.com/alt3kx/CVE-2002-0348 :

CVE-2002-0347 Copy Chapter

Directory traversal vulnerability in Cobalt RAQ 4 allows remote attackers to read password-protected files, and possibly files outside the web root, via a .. (dot dot) in an HTTP request.

• https://github.com/alt3kx/CVE-2002-0347 :

CVE-2002-0346 Copy Chapter

Cross-site scripting vulnerability in Cobalt RAQ 4 allows remote attackers to execute arbitrary script as other Cobalt users via Javascript in a URL to (1) service.cgi or (2) alert.cgi.

• https://github.com/alt3kx/CVE-2002-0346 :

CVE-2002-0289 Copy Chapter

Buffer overflow in Phusion web server 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long HTTP request.

• https://github.com/alt3kx/CVE-2002-0289 :

CVE-2002-0288 Copy Chapter

Directory traversal vulnerability in Phusion web server 1.0 allows remote attackers to read arbitrary files via a ... (triple dot dot) in the HTTP request.

• https://github.com/alt3kx/CVE-2002-0288 :

CVE-2002-0201 Copy Chapter

Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request, possibly triggering a buffer overflow.

• https://github.com/alt3kx/CVE-2002-0201 :

CVE-2002-0200 Copy Chapter

Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name.

• https://github.com/alt3kx/CVE-2002-0200 :

CVE-2002-0082 Copy Chapter

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.

• https://github.com/anilkashyap01/Binary-Exploitation-and-Kernel-Escalation :

• https://github.com/ratiros01/CVE-2002-0082 :

• https://github.com/Nutsulejustine/pentest-kioptrix :

Overview (`2003/README.md`) Copy Section

CVE-2003-0358 Copy Chapter

Buffer overflow in (1) nethack 3.4.0 and earlier, and (2) falconseye 1.9.3 and earlier, which is based on nethack, allows local users to gain privileges via a long -s command line option.

• https://github.com/fengjixuchui/CVE-2003-0358 :

• https://github.com/gmh5225/CVE-2003-0358 :

CVE-2003-0282 Copy Chapter

Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.

• https://github.com/sionnx/cve-2003-0282 :

CVE-2003-0264 Copy Chapter

Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO argument to slmail.exe, (2) a long XTRN argument to slmail.exe, (3) a long string to POPPASSWD, or (4) a long password to the POP3 server.

• https://github.com/TheMalwareGuardian/CVE-2003-0264 :

• https://github.com/nobodyatall648/CVE-2003-0264 :

• https://github.com/fyoderxx/slmail-exploit :

• https://github.com/war4uthor/CVE-2003-0264 :

• https://github.com/adenkiewicz/CVE-2003-0264 :

• https://github.com/vrikodar/CVE-2003-0264_EXPLOIT :

• https://github.com/vaknin/SLMail5.5 :

• https://github.com/pwncone/CVE-2003-0264-SLmail-5.5 :

CVE-2003-0222 Copy Chapter

Stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a "CREATE DATABASE LINK" query containing a connect string with a long USING parameter.

• https://github.com/phamthanhsang280477/CVE-2003-0222 :

CVE-2003-0201 Copy Chapter

Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.

• https://github.com/KernelPan1k/trans2open-CVE-2003-0201 :

• https://github.com/americooo/pentest-writeups :

• https://github.com/deepakkcybersec-eng/Kioptrix-Level1-Vulnerability-Analysis :

CVE-2003-0172 Copy Chapter

Buffer overflow in openlog function for PHP 4.3.1 on Windows operating system, and possibly other OSes, allows remote attackers to cause a crash and possibly execute arbitrary code via a long filename argument.

• https://github.com/cyberdesu/Remote-Buffer-overflow-CVE-2003-0172 :

CVE-2003-0127 Copy Chapter

The kernel module loader in Linux kernel 2.2.x before 2.2.25, and 2.4.x before 2.4.21, allows local users to gain root privileges by using ptrace to attach to a child process that is spawned by the kernel.

• https://github.com/anilkashyap01/Binary-Exploitation-and-Kernel-Escalation :

CVE-2003-0001 Copy Chapter

Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.

• https://github.com/marb08/etherleak-checker :

Overview (`2004/README.md`) Copy Section

CVE-2004-2687 Copy Chapter

distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.

• https://github.com/h3x0v3rl0rd/distccd_rce_CVE-2004-2687 :

• https://github.com/k4miyo/CVE-2004-2687 :

• https://github.com/angelpimentell/distcc_cve_2004-2687_exploit :

• https://github.com/germarr93/CyberSecurity-Pentest-Lab :

• https://github.com/micheaol/distccd_rce_CVE-2004-2687 :

• https://github.com/nulltrace1336/Metasploitable-2-Distcc-Exploit-via-Kali-Linux-CVE-2004-2687 :

• https://github.com/ocfagb/hacktivity-vulns-exploits-lab :

• https://github.com/aish19siddiqua-commits/mtechweek_04 :

CVE-2004-2549 Copy Chapter

Nortel Wireless LAN (WLAN) Access Point (AP) 2220, 2221, and 2225 allow remote attackers to cause a denial of service (service crash) via a TCP request with a large string, followed by 8 newline characters, to (1) the Telnet service on TCP port 23 and (2) the HTTP service on TCP port 80, possibly due to a buffer overflow.

• https://github.com/alt3kx/CVE-2004-2549 :

CVE-2004-2449 Copy Chapter

Roger Wilco 1.4.1.6 and earlier or Roger Wilco Base Station 0.30a and earlier allows remote attackers to cause a denial of service (application crash) via a long, malformed UDP datagram.

• https://github.com/ParallelVisions/DoSTool :

CVE-2004-2271 Copy Chapter

Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.

• https://github.com/kkirsche/CVE-2004-2271 :

• https://github.com/war4uthor/CVE-2004-2271 :

• https://github.com/pwncone/CVE-2004-2271-MiniShare-1.4.1-BOF :

• https://github.com/PercussiveElbow/CVE-2004-2271-MiniShare-1.4.1-Buffer-Overflow :

CVE-2004-2167 Copy Chapter

Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary code via (1) the expandmacro function, and possibly (2) Environments and (3) TranslateCommand.

• https://github.com/uzzzval/cve-2004-2167 :

CVE-2004-1769 Copy Chapter

The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.

• https://github.com/sinkaroid/shiguresh :

• https://github.com/Redsplit/shiguresh :

CVE-2004-1561 Copy Chapter

Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a large number of headers.

• https://github.com/ivanitlearning/CVE-2004-1561 :

• https://github.com/thel1nus/CVE-2004-1561-Notes :

• https://github.com/darrynb89/CVE-2004-1561 :

• https://github.com/ratiros01/CVE-2004-1561 :

• https://github.com/Danyw24/CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32- :

• https://github.com/MonseigneurPatas/thm-ice-icecast-rce-privesc :

CVE-2004-1235 Copy Chapter

Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.

• https://github.com/0b0111100/2004 :

CVE-2004-1151 Copy Chapter

Multiple buffer overflows in the (1) sys32_ni_syscall and (2) sys32_vm86_warning functions in sys_ia32.c for Linux 2.6.x may allow local attackers to modify kernel memory and gain privileges.

• https://github.com/lulugelian/CVE_2004_1151 :

• https://github.com/lulugelian/CVE_TEST :

CVE-2004-0789 Copy Chapter

Multiple implementations of the DNS protocol, including (1) Poslib 1.0.2-1 and earlier as used by Posadis, (2) Axis Network products before firmware 3.13, and (3) Men & Mice Suite 2.2x before 2.2.3 and 3.5.x before 3.5.2, allow remote attackers to cause a denial of service (CPU and network bandwidth consumption) by triggering a communications loop via (a) DNS query packets with localhost as a spoofed source address, or (b) a response packet that triggers a response packet.

• https://github.com/HimmeL-Byte/CVE-2004-0789-DDOS :

CVE-2004-0558 Copy Chapter

The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service (service hang) via a certain UDP packet to the IPP port.

• https://github.com/fibonascii/CVE-2004-0558 :

CVE-2004-0077 Copy Chapter

The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.

• https://github.com/0b0111100/2004 :

Overview (`2005/README.md`) Copy Section

CVE-2005-3299 Copy Chapter

PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter, possibly involving the subform array.

• https://github.com/RizeKishimaro/CVE-2005-3299 :

• https://github.com/Cr0w-ui/-CVE-2005-3299- :

CVE-2005-2428 Copy Chapter

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.

• https://github.com/schwankner/CVE-2005-2428-IBM-Lotus-Domino-R8-Password-Hash-Extraction-Exploit :

CVE-2005-1794 Copy Chapter

Microsoft Terminal Server using Remote Desktop Protocol (RDP) 5.2 stores an RSA private key in mstlsapi.dll and uses it to sign a certificate, which allows remote attackers to spoof public keys of legitimate servers and conduct man-in-the-middle attacks.

• https://github.com/InitRoot/CVE-2005-1794Scanner :

CVE-2005-1263 Copy Chapter

The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.

• https://github.com/0b0111100/2005 :

CVE-2005-1125 Copy Chapter

Race condition in libsafe 2.0.16 and earlier, when running in multi-threaded applications, allows attackers to bypass libsafe protection and exploit other vulnerabilities before the _libsafe_die function call is completed.

• https://github.com/tagatac/libsafe-CVE-2005-1125 :

CVE-2005-0859 Copy Chapter

PHP remote file inclusion vulnerability in CzarNews 1.13b allows remote attackers to execute arbitrary PHP code via the tpath parameter to (1) headlines.php or (2) news.php. NOTE: some sources have reported the "dir" parameter as being affected; however, this is likely a cut-and-paste error from the wrong section of the original vulnerability report. Also, the news.php version was later reported to be in 1.12 through 1.14.

• https://github.com/rubo77/czarnews :

CVE-2005-0736 Copy Chapter

Integer overflow in sys_epoll_wait in eventpoll.c for Linux kernel 2.6 to 2.6.11 allows local users to overwrite kernel memory via a large number of events.

• https://github.com/0b0111100/2005 :

CVE-2005-0603 Copy Chapter

viewtopic.php in phpBB 2.0.12 and earlier allows remote attackers to obtain sensitive information via a highlight parameter containing invalid regular expression syntax, which reveals the path in a PHP error message.

• https://github.com/Parcer0/CVE-2005-0603-phpBB-2.0.12-Full-path-disclosure :

CVE-2005-0575 Copy Chapter

Buffer overflow in Stormy Studios Knet 1.04c and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP GET request.

• https://github.com/bluedragonsecurity/CVE-2005-0575-knet-exploit :

• https://github.com/MayaOfVeil/CVE-2005-0575 :

CVE-2005-0452 Copy Chapter

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including "" and "".

• https://github.com/AndreyRusyaev/secreports :

Overview (`2006/README.md`) Copy Section

CVE-2006-20001 Copy Chapter

A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.

This issue affects Apache HTTP Server 2.4.54 and earlier.

• https://github.com/r1az4r/CVE-2006-20001 :

CVE-2006-6184 Copy Chapter

Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long filename in a (1) GET or (2) PUT command.

• https://github.com/shauntdergrigorian/cve-2006-6184 :

• https://github.com/b03902043/CVE-2006-6184 :

CVE-2006-5051 Copy Chapter

Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.

• https://github.com/bigb0x/CVE-2024-6387 :

• https://github.com/anhvutuan/CVE-2024-6387-poc-1 :

• https://github.com/sardine-web/CVE-2024-6387_Check :

CVE-2006-4814 Copy Chapter

The mincore function in the Linux kernel before 2.4.33.6 does not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock.

• https://github.com/tagatac/linux-CVE-2006-4814 :

CVE-2006-4777 Copy Chapter

Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1, on Chinese and possibly other Windows distributions, allows remote attackers to execute arbitrary code via unknown manipulations in arguments to the KeyFrame method, possibly related to an integer overflow, as demonstrated by daxctle2, and a different vulnerability than CVE-2006-4446.

• https://github.com/Mario1234/js-driveby-download-CVE-2006-4777 :

CVE-2006-3747 Copy Chapter

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

• https://github.com/defensahacker/CVE-2006-3747 :

CVE-2006-3685 Copy Chapter

PHP remote file inclusion vulnerability in CzarNews 1.12 through 1.14 allows remote attackers to execute arbitrary PHP code via a URL in the tpath parameter to cn_config.php. NOTE: the news.php vector is already covered by CVE-2005-0859.

• https://github.com/rubo77/czarnews :

CVE-2006-3626 Copy Chapter

Race condition in Linux kernel 2.6.17.4 and earlier allows local users to gain root privileges by using prctl with PR_SET_DUMPABLE in a way that causes /proc/self/environ to become setuid root.

• https://github.com/0b0111100/2006 :

CVE-2006-3592 Copy Chapter

Unspecified vulnerability in the command line interface (CLI) in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows local users to execute arbitrary commands with elevated privileges via unspecified vectors, involving "certain CLI commands," aka bug CSCse11005.

• https://github.com/adenkiewicz/CVE-2006-3592 :

CVE-2006-3392 Copy Chapter

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.

• https://github.com/IvanGlinkin/CVE-2006-3392 :

• https://github.com/brosck/CVE-2006-3392 :

• https://github.com/g1vi/CVE-2006-3392 :

• https://github.com/0xtz/CVE-2006-3392 :

• https://github.com/Adel-hx0d/CVE-2006-3392 :

• https://github.com/kernel-cyber/CVE-2006-3392 :

• https://github.com/gb21oc/ExploitWebmin :

• https://github.com/oxasploits/oxasploits :

CVE-2006-2842 Copy Chapter

PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable

• https://github.com/karthi-the-hacker/CVE-2006-2842 :

CVE-2006-2451 Copy Chapter

The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a local user to cause a denial of service (disk consumption) and possibly gain privileges via the PR_SET_DUMPABLE argument of the prctl function and a program that causes a core dump file to be created in a directory for which the user does not have permissions.

• https://github.com/0b0111100/2006 :

CVE-2006-1641 Copy Chapter

Multiple SQL injection vulnerabilities in CzarNews 1.14 allow remote attackers to execute arbitrary SQL commands via the (1) usern or (2) passw parameters to (a) cn_auth.php, (3) s parameter to (b) news.php, or (4) a parameter to (c) dpost.php.

• https://github.com/rubo77/czarnews :

CVE-2006-1640 Copy Chapter

Cross-site scripting (XSS) vulnerability in news.php in CzarNews 1.14 allows remote attackers to inject arbitrary web script or HTML via the email parameter.

• https://github.com/rubo77/czarnews :

CVE-2006-1236 Copy Chapter

Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010.

• https://github.com/Axua/CVE-2006-1236 :

CVE-2006-0987 Copy Chapter

The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.

• https://github.com/pcastagnaro/dns_amplification_scanner :

CVE-2006-0450 Copy Chapter

phpBB 2.0.19 and earlier allows remote attackers to cause a denial of service (application crash) by (1) registering many users through profile.php or (2) using search.php to search in a certain way that confuses the database.

• https://github.com/Parcer0/CVE-2006-0450-phpBB-2.0.15-Multiple-DoS-Vulnerabilities :

Overview (`2007/README.md`) Copy Section

CVE-2007-6750 Copy Chapter

The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.

• https://github.com/michou79/noc21220-cybersecurity-assessment :

• https://github.com/RoflSecurity/nodeloris :

• https://github.com/sarjanpatel22/siem-threat-detection-lab :

CVE-2007-6638 Copy Chapter

March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, passwords, device names, and IP addresses via a direct request for scripts/logfiles.tar.gz.

• https://github.com/alt3kx/CVE-2007-6638 :

CVE-2007-6377 Copy Chapter

Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remote attackers to execute arbitrary code via a long query string.

• https://github.com/Nicoslo/Windows-exploitation-BadBlue-2.7-CVE-2007-6377 :

CVE-2007-5962 Copy Chapter

Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 through 8, and on Foresight Linux and rPath appliances, allows remote attackers to cause a denial of service (memory consumption) via a large number of CWD commands, as demonstrated by an attack on a daemon with the deny_file configuration option.

• https://github.com/antogit-sys/CVE-2007-5962 :

CVE-2007-5036 Copy Chapter

Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated users to cause a denial of service (HTTPS service outage) via a crafted query string in an HTTPS request to (1) adLog.cgi, (2) post.cgi, or (3) ad.cgi, related to the "files filter."

• https://github.com/alt3kx/CVE-2007-5036 :

CVE-2007-4607 Copy Chapter

Buffer overflow in the EasyMailSMTPObj ActiveX control in emsmtp.dll 6.0.1 in the Quiksoft EasyMail SMTP Object, as used in Postcast Server Pro 3.0.61 and other products, allows remote attackers to execute arbitrary code via a long argument to the SubmitToExpress method, a different vulnerability than CVE-2007-1029. NOTE: this may have been fixed in version 6.0.3.15.

• https://github.com/joeyrideout/CVE-2007-4607 :

CVE-2007-4560 Copy Chapter

clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail."

• https://github.com/Strikoder-Premium/sendmail-clamav-exploit-CVE-2007-4560 :

• https://github.com/0x1sac/ClamAV-Milter-Sendmail-0.91.2-Remote-Code-Execution :

CVE-2007-4559 Copy Chapter

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

• https://github.com/advanced-threat-research/Creosote :

• https://github.com/depers-rus/CVE-2007-4559 :

• https://github.com/Ooscaar/MALW :

• https://github.com/davidholiday/CVE-2007-4559 :

• https://github.com/luigigubello/trellix-tarslip-patch-bypass :

• https://github.com/jithinodattu/CVE-2007-4559-lab :

• https://github.com/m0d0ri205/wargame-tarpioka :

CVE-2007-3831 Copy Chapter

PHP remote file inclusion in main.php in ISS Proventia Network IPS GX5108 1.3 and GX5008 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

• https://github.com/alt3kx/CVE-2007-3831 :

CVE-2007-3830 Copy Chapter

Cross-site scripting (XSS) vulnerability in alert.php in ISS Proventia Network IPS GX5108 1.3 and GX5008 1.5 allows remote attackers to inject arbitrary web script or HTML via the reminder parameter.

• https://github.com/alt3kx/CVE-2007-3830 :

CVE-2007-3280 Copy Chapter

The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system function in libc.so.6 to gain shell access.

• https://github.com/denuwanjayasekara/CVE-Exploitation-Reports :

CVE-2007-2447 Copy Chapter

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

• https://github.com/amriunix/CVE-2007-2447 :

• https://github.com/h3x0v3rl0rd/CVE-2007-2447 :

• https://github.com/Unix13/metasploitable2 :

• https://github.com/Ziemni/CVE-2007-2447-in-Python :

• https://github.com/Alien0ne/CVE-2007-2447 :

• https://github.com/xbufu/CVE-2007-2447 :

• https://github.com/ozuma/CVE-2007-2447 :

• https://github.com/Nosferatuvjr/Samba-Usermap-exploit :

• https://github.com/Aviksaikat/CVE-2007-2447 :

• https://github.com/3x1t1um/CVE-2007-2447 :

• https://github.com/JoseBarrios/CVE-2007-2447 :

• https://github.com/abdulsaabir/CVE-2007-2447 :

• https://github.com/SeifEldienAhmad/Penetration-Testing-on-Metasploitable2 :

• https://github.com/Daviddoctor/Samba-CVE-2007-2447-Exploit-Username-Map-Script :

• https://github.com/b33m0x00/CVE-2007-2447 :

• https://github.com/b1fair/smb_usermap :

• https://github.com/xlcc4096/exploit-CVE-2007-2447 :

• https://github.com/G01d3nW01f/CVE-2007-2447 :

• https://github.com/foudadev/CVE-2007-2447 :

• https://github.com/Juantos/cve-2007-2447 :

• https://github.com/r3vpwnx/CVE-2007-2447 :

• https://github.com/rushikesh-a-bhujbal/CVE-2007-2447 :

• https://github.com/nika0x38/CVE-2007-2447 :

• https://github.com/0xKn/CVE-2007-2447 :

• https://github.com/testaross4/CVE-2007-2447 :

• https://github.com/IamLucif3r/CVE-2007-2447-Exploit :

• https://github.com/elphon/CVE-2007-2447-Exploit :

• https://github.com/DesmondHinds94/S22_The_Verification_Protocol :

• https://github.com/MikeRega7/CVE-2007-2447-RCE :

• https://github.com/bdunlap9/CVE-2007-2447_python :

• https://github.com/MrRoma577/exploit_cve-2007-2447_again :

• https://github.com/nulltrace1336/Samba-Exploit-CVE-2007-2447 :

• https://github.com/ShivamDey/Samba-CVE-2007-2447-Exploit :

• https://github.com/HerculesRD/PyUsernameMapScriptRCE :

• https://github.com/harshiys/CVE-2007-2447-Exploitation-SIEM-Detection-Lab :

• https://github.com/3t4n/samba-3.0.24-CVE-2007-2447-vunerable- :

• https://github.com/WildfootW/CVE-2007-2447_Samba_3.0.25rc3 :

• https://github.com/DevinLiggins14/SMB-PenTest-Exploiting-CVE-2007-2447-on-Metasploitable-2 :

• https://github.com/malredfan/metasploitable2-pentest :

• https://github.com/Mboatella25/metasploitable-pentest-lab :

• https://github.com/EthicalHackingLabs/metasploitable2-exploitation-metasploit :

• https://github.com/Youneskc/SMB-Penetration-Testing-NTLM-Relay-Version-2- :

• https://github.com/ronankongala/metasploit-pentest-report :

• https://github.com/ddiazcr/home-soc-lab :

• https://github.com/jaden-mas1010/Metasploitable2-Vulnerability-Assessment :

• https://github.com/Nyabayo/flatiron-pentest-nmap-enum4linux-smb-ftp-samba-metasploitable2-kali-healthcare-report :

• https://github.com/vig9610/Exploiting-Samba-on-Metasploitable-2 :

• https://github.com/sagarjain0456/Metasploit-Project-using-KaliLinux-plus-Metasploitable2-VMs :

CVE-2007-1858 Copy Chapter

The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts.

• https://github.com/anthophilee/A2SV--SSL-VUL-Scan :

CVE-2007-1567 Copy Chapter

Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors, as demonstrated by warftp_165.tar by Immunity. NOTE: this might be the same issue as CVE-1999-0256, CVE-2000-0131, or CVE-2006-2171, but due to Immunity's lack of details, this cannot be certain.

• https://github.com/TheMalwareGuardian/CVE-2007-1567 :

• https://github.com/war4uthor/CVE-2007-1567 :

CVE-2007-1260 Copy Chapter

Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via a long string in the Content-Length HTTP header.

• https://github.com/thecybermind/w48crash :

CVE-2007-0843 Copy Chapter

The ReadDirectoryChangesW API function on Microsoft Windows 2000, XP, Server 2003, and Vista does not check permissions for child objects, which allows local users to bypass permissions by opening a directory with LIST (READ) access and using ReadDirectoryChangesW to monitor changes of files that do not have LIST permissions, which can be leveraged to determine filenames, access times, and other sensitive information.

• https://github.com/z3APA3A/spydir :

CVE-2007-0038 Copy Chapter

Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.

• https://github.com/Axua/CVE-2007-0038 :

• https://github.com/Cheesse/cve2007-0038x64 :

Overview (`2008/README.md`) Copy Section

CVE-2008-7220 Copy Chapter

Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.

• https://github.com/followboy1999/CVE-2008-7220 :

CVE-2008-6970 Copy Chapter

SQL injection vulnerability in dosearch.inc.php in UBB.threads 7.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the Forum[] array parameter.

• https://github.com/KyomaHooin/CVE-2008-6970 :

CVE-2008-6827 Copy Chapter

The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function.

• https://github.com/alt3kx/CVE-2008-6827 :

CVE-2008-6806 Copy Chapter

Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/artikel/.

• https://github.com/threatcode/CVE-2008-6806 :

CVE-2008-5416 Copy Chapter

Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka "SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability."

• https://github.com/SECFORCE/CVE-2008-5416 :

CVE-2008-5161 Copy Chapter

Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.

• https://github.com/talha3117/OpenSSH-4.7p1-CVE-2008-5161-Exploit :

CVE-2008-4687 Copy Chapter

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.

• https://github.com/nmurilo/CVE-2008-4687-exploit :

• https://github.com/twisted007/mantis_rce :

CVE-2008-4654 Copy Chapter

Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.

• https://github.com/KernelErr/VLC-CVE-2008-4654-Exploit :

• https://github.com/bongbongco/CVE-2008-4654 :

• https://github.com/rnnsz/CVE-2008-4654 :

• https://github.com/Hexastrike/CVE-2008-4654 :

CVE-2008-4609 Copy Chapter

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

• https://github.com/mrclki/sockstress :

CVE-2008-4250 Copy Chapter

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."

• https://github.com/BinRacer/ms08-067.py :

• https://github.com/NoTrustedx/Exploit_MS08-067 :

• https://github.com/thunderstrike9090/Conflicker_analysis_scripts :

• https://github.com/BinRacer/ms08-067 :

CVE-2008-4210 Copy Chapter

fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

• https://github.com/0b0111100/2008 :

CVE-2008-4109 Copy Chapter

A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts, which allows remote attackers to cause a denial of service (connection slot exhaustion) via multiple login attempts. NOTE: this issue exists because of an incorrect fix for CVE-2006-5051.

• https://github.com/bigb0x/CVE-2024-6387 :

CVE-2008-3531 Copy Chapter

Stack-based buffer overflow in sys/kern/vfs_mount.c in the kernel in FreeBSD 7.0 and 7.1, when vfs.usermount is enabled, allows local users to gain privileges via a crafted (1) mount or (2) nmount system call, related to copying of "user defined data" in "certain error conditions."

• https://github.com/test-one9/ps4-11.50.github.io :

CVE-2008-2992 Copy Chapter

Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.

• https://github.com/Jonas-Holmberg/CVE-2008-2992 :

CVE-2008-2019 Copy Chapter

Simple Machines Forum (SMF), probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file (aka audio) CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated attack that considers Hamming distances. NOTE: this issue reportedly exists because of an insufficient fix for CVE-2007-3308.

• https://github.com/TheRook/AudioCaptchaBypass-CVE-2008-2019 :

CVE-2008-1930 Copy Chapter

The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allows remote attackers to forge cookies by registering a username that results in the same concatenated string, as demonstrated by registering usernames beginning with "admin" to obtain administrator privileges, aka a "cryptographic splicing" issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-6013.

• https://github.com/HeisenbergH4X/CVE-2008-1930 :

CVE-2008-1657 Copy Chapter

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.

• https://github.com/FaizanAli8232/CVE-Exploit-Research-Development :

• https://github.com/QasimShahbaz21/CVE-Exploit-Research-Development :

CVE-2008-1613 Copy Chapter

SQL injection vulnerability in ioRD.asp in RedDot CMS 7.5 Build 7.5.0.48, and possibly other versions including 6.5 and 7.0, allows remote attackers to execute arbitrary SQL commands via the LngId parameter.

• https://github.com/SECFORCE/CVE-2008-1613 :

CVE-2008-1611 Copy Chapter

Stack-based buffer overflow in TFTP Server SP 1.4 for Windows allows remote attackers to cause a denial of service or execute arbitrary code via a long filename in a read or write request.

• https://github.com/Axua/CVE-2008-1611 :

CVE-2008-1447 Copy Chapter

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."

• https://github.com/hamlasiraj/metasploit-bailiwicked_domain-fix :

• https://github.com/hackingyseguridad/dnspoison :

CVE-2008-0900 Copy Chapter

Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.

• https://github.com/0b0111100/2008 :

CVE-2008-0600 Copy Chapter

The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer before dereference, which allows local users to gain root privileges via crafted arguments in a vmsplice system call, a different vulnerability than CVE-2008-0009 and CVE-2008-0010.

• https://github.com/hackingyseguridad/root :

• https://github.com/0b0111100/2008 :

CVE-2008-0244 Copy Chapter

SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe.

• https://github.com/gregkcarson/sapmdbret :

CVE-2008-0228 Copy Chapter

Cross-site request forgery (CSRF) vulnerability in apply.cgi in the Linksys WRT54GL Wireless-G Broadband Router with firmware 4.30.9 allows remote attackers to perform actions as administrators.

• https://github.com/SpiderLabs/TWSL2011-007_iOS_code_workaround :

CVE-2008-0166 Copy Chapter

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.

• https://github.com/g0tmi1k/debian-ssh :

• https://github.com/demining/Vulnerable-to-Debian-OpenSSL-bug-CVE-2008-0166 :

• https://github.com/badkeys/debianopenssl :

• https://github.com/avarx/vulnkeys :

• https://github.com/AhegaoPsyops/sslWeakness :

• https://github.com/FaizanAli8232/CVE-Exploit-Research-Development :

• https://github.com/QasimShahbaz21/CVE-Exploit-Research-Development :

CVE-2008-0128 Copy Chapter

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

• https://github.com/ngyanch/4062-1 :

Overview (`2009/README.md`) Copy Section

CVE-2009-5147 Copy Chapter

DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.

• https://github.com/vpereira/CVE-2009-5147 :

• https://github.com/zhangyongbo100/-Ruby-dl-handle.c-CVE-2009-5147- :

CVE-2009-4660 Copy Chapter

Stack-based buffer overflow in the AntServer Module (AntServer.exe) in BigAnt IM Server 2.50 allows remote attackers to execute arbitrary code via a long GET request to TCP port 6660.

• https://github.com/war4uthor/CVE-2009-4660 :

CVE-2009-4623 Copy Chapter

Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACS_path parameter to (1) index.php and (2) admin.php in advanced_comment_system/. NOTE: this might only be a vulnerability when the administrator has not followed installation instructions in install.php. NOTE: this might be the same as CVE-2020-35598.

• https://github.com/kernel-cyber/CVE-2009-4623 :

• https://github.com/sammonsempes/CVE-2009-4623 :

• https://github.com/hupe1980/CVE-2009-4623 :

CVE-2009-4496 Copy Chapter

Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

• https://github.com/enriquenegri-cyberlaw/boa-cve-2009-4496-analysis :

CVE-2009-4140 Copy Chapter

Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.

• https://github.com/Alexeyan/CVE-2009-4137 :

CVE-2009-4137 Copy Chapter

The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the __destruct function in the Piwik_Config class; php://filter URIs; the __destruct functions in Zend Framework, as demonstrated by the Zend_Log destructor; the shutdown functions in Zend Framework, as demonstrated by the Zend_Log_Writer_Mail class; the render function in the Piwik_View class; Smarty templates; and the _eval function in Smarty.

• https://github.com/Alexeyan/CVE-2009-4137 :

CVE-2009-4118 Copy Chapter

The StartServiceCtrlDispatcher function in the cvpnd service (cvpnd.exe) in Cisco VPN client for Windows before 5.0.06.0100 does not properly handle an ERROR_FAILED_SERVICE_CONTROLLER_CONNECT error, which allows local users to cause a denial of service (service crash and VPN connection loss) via a manual start of cvpnd.exe while the cvpnd service is running.

• https://github.com/alt3kx/CVE-2009-4118 :

CVE-2009-4049 Copy Chapter

Heap-based buffer overflow in aswRdr.sys (aka the TDI RDR driver) in avast! Home and Professional 4.8.1356.0 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted arguments to IOCTL 0x80002024.

• https://github.com/fengjixuchui/CVE-2009-4049 :

CVE-2009-3999 Copy Chapter

Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to execute arbitrary code via a long fileName parameter.

• https://github.com/AC8999/CVE-2009-3999-HP-Power-Manager-4.2-Build-7-Buffer-Overflow :

• https://github.com/afifudinmtop/CVE-2009-3999 :

CVE-2009-3548 Copy Chapter

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

• https://github.com/cocomelonc/vulnexipy :

CVE-2009-3547 Copy Chapter

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.

• https://github.com/0b0111100/2009 :

CVE-2009-3103 Copy Chapter

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.

• https://github.com/Sic4rio/CVE-2009-3103---srv2.sys-SMB-Code-Execution-Python-MS09-050- :

• https://github.com/Neved4/exploits :

• https://github.com/sooklalad/ms09050 :

• https://github.com/sec13b/ms09-050_CVE-2009-3103 :

• https://github.com/afifudinmtop/CVE-2009-3103 :

• https://github.com/nicolasdamians/ms09-050-CVE-2009-3103-exploit :

• https://github.com/bytejmp/MS09-050 :

CVE-2009-3036 Copy Chapter

Cross-site scripting (XSS) vulnerability in the console in Symantec IM Manager 8.3 and 8.4 before 8.4.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

• https://github.com/brinhosa/CVE-2009-3036 :

CVE-2009-2698 Copy Chapter

The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.

• https://github.com/xiaoxiaoleo/CVE-2009-2698 :

• https://github.com/0b0111100/2009 :

CVE-2009-2692 Copy Chapter

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

• https://github.com/jdvalentini/CVE-2009-2692 :

• https://github.com/0b0111100/2009 :

CVE-2009-2585 Copy Chapter

SQL injection vulnerability in index.php in Mlffat 2.2 allows remote attackers to execute arbitrary SQL commands via a member cookie in an account editprofile action, a different vector than CVE-2009-1731.

• https://github.com/n4xh4ck5/CVE2009-2585_HP_Power_Manager_BoF :

• https://github.com/securityforge/CVE2009-2585_HP_Power_Manager_BoF :

CVE-2009-2265 Copy Chapter

Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.

• https://github.com/zaphoxx/zaphoxx-coldfusion :

• https://github.com/p1ckzi/CVE-2009-2265 :

• https://github.com/h3x0v3rl0rd/CVE-2009-2265 :

• https://github.com/0xDTC/Adobe-ColdFusion-8-RCE-CVE-2009-2265 :

• https://github.com/brunorhis/CVE2009-2265 :

• https://github.com/nika0x38/CVE-2009-2265 :

• https://github.com/matesz44/CVE-2009-2265 :

• https://github.com/hd-exe/CVE-2009-2265-fix :

CVE-2009-1904 Copy Chapter

The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.

• https://github.com/NZKoz/bigdecimal-segfault-fix :

CVE-2009-1437 Copy Chapter

Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.6 and earlier allows remote attackers to execute arbitrary code via a long string in a malformed playlist (.m3u) file. NOTE: this may overlap CVE-2008-3408.

• https://github.com/HanseSecure/CVE-2009-1437 :

CVE-2009-1337 Copy Chapter

The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.

• https://github.com/0b0111100/2009 :

CVE-2009-1330 Copy Chapter

Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long filename in a playlist (.pls) file.

• https://github.com/adenkiewicz/CVE-2009-1330 :

• https://github.com/war4uthor/CVE-2009-1330 :

• https://github.com/exploitwritter/CVE-2009-1330_EasyRMToMp3Converter :

CVE-2009-1324 Copy Chapter

Stack-based buffer overflow in Mini-stream ASX to MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.

• https://github.com/war4uthor/CVE-2009-1324 :

CVE-2009-1244 Copy Chapter

Unspecified vulnerability in the virtual machine display function in VMware Workstation 6.5.1 and earlier; VMware Player 2.5.1 and earlier; VMware ACE 2.5.1 and earlier; VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745; VMware Fusion before 2.0.4 build 159196; VMware ESXi 3.5; and VMware ESX 3.0.2, 3.0.3, and 3.5 allows guest OS users to execute arbitrary code on the host OS via unknown vectors, a different vulnerability than CVE-2008-4916.

• https://github.com/piotrbania/vmware_exploit_pack_CVE-2009-1244 :

CVE-2009-1185 Copy Chapter

udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.

• https://github.com/0b0111100/2009 :

• https://github.com/aish19siddiqua-commits/mtechweek_04 :

CVE-2009-1151 Copy Chapter

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

• https://github.com/pagvac/pocs :

• https://github.com/e-Thug/PhpMyAdmin :

• https://github.com/tpdlshdmlrkfmcla/ZmEu :

CVE-2009-0689 Copy Chapter

Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.

• https://github.com/Fullmetal5/str2hax :

CVE-2009-0658 Copy Chapter

Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.

• https://github.com/kyaw-tun/blue-team-capstone :

CVE-2009-0473 Copy Chapter

Open redirect vulnerability in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

• https://github.com/akbarq/CVE-2009-0473-check :

CVE-2009-0347 Copy Chapter

Open redirect vulnerability in cs.html in the Autonomy (formerly Verity) Ultraseek search engine allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter.

• https://github.com/Cappricio-Securities/CVE-2009-0347 :

CVE-2009-0229 Copy Chapter

The Windows Printing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allows local users to read arbitrary files via a crafted separator page, aka "Print Spooler Read File Vulnerability."

• https://github.com/zveriu/CVE-2009-0229-PoC :

CVE-2009-0182 Copy Chapter

Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in a File line in a .pls file, as demonstrated by an http URL on a File1 line.

• https://github.com/nobodyatall648/CVE-2009-0182 :

Overview (`2010/README.md`) Copy Section

CVE-2010-5301 Copy Chapter

Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a HEAD request.

• https://github.com/lem0nSec/CVE-2010-5301 :

CVE-2010-5230 Copy Chapter

Multiple untrusted search path vulnerabilities in MicroStation 7.1 allow local users to gain privileges via a Trojan horse (1) mptools.dll, (2) baseman.dll, (3) wintab32.dll, or (4) wintab.dll file in the current working directory, as demonstrated by a directory that contains a .hln or .rdl file. NOTE: some of these details are obtained from third party information.

• https://github.com/otofoto/CVE-2010-5230 :

CVE-2010-5195 Copy Chapter

Untrusted search path vulnerability in Roxio MyDVD 9 allows local users to gain privileges via a Trojan horse HomeUtils9.dll file in the current working directory, as demonstrated by a directory that contains a .dmsd or .dmsm file. NOTE: some of these details are obtained from third party information.

• https://github.com/CristinaPravata/dirtycaw-projet :

CVE-2010-4804 Copy Chapter

The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// URIs, related to (1) BrowserActivity.java and (2) BrowserSettings.java in com/android/browser/.

• https://github.com/thomascannon/android-cve-2010-4804 :

CVE-2010-4669 Copy Chapter

The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Microsoft Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, and Windows 7 allows remote attackers to cause a denial of service (CPU consumption and system hang) by sending many Router Advertisement (RA) messages with different source addresses, as demonstrated by the flood_router6 program in the thc-ipv6 package.

• https://github.com/wrong-commit/CVE-2010-4669 :

CVE-2010-4476 Copy Chapter

The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.

• https://github.com/grzegorzblaszczyk/CVE-2010-4476-check :

CVE-2010-4221 Copy Chapter

Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.

• https://github.com/M41doror/cve-2010-4221 :

• https://github.com/diegslva/cve-2010-4221-lab :

• https://github.com/Mafiosohack/Offensive-lab-2 :

CVE-2010-3971 Copy Chapter

Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used in Microsoft Internet Explorer 6 through 8 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a self-referential @import rule in a stylesheet, aka "CSS Memory Corruption Vulnerability."

• https://github.com/nektra/CVE-2010-3971-hotpatch :

CVE-2010-3904 Copy Chapter

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

• https://github.com/redhatkaty/-cve-2010-3904-report :

CVE-2010-3863 Copy Chapter

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.

• https://github.com/sh1inroot-alt/shiro-cve-2010-3863 :

CVE-2010-3847 Copy Chapter

elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO) located in an arbitrary directory.

• https://github.com/magisterquis/cve-2010-3847 :

CVE-2010-3600 Copy Chapter

Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager Grid Control 10.2.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that this issue involves an exposed JSP script that accepts XML uploads in conjunction with NULL bytes in an unspecified parameter that allow execution of arbitrary code.

• https://github.com/LAITRUNGMINHDUC/CVE-2010-3600-PythonHackOracle11gR2 :

CVE-2010-3490 Copy Chapter

Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. (dot dot) in the usersnum parameter to admin/config.php, as demonstrated by creating a .php file under the web root.

• https://github.com/moayadalmalat/CVE-2010-3490 :

CVE-2010-3333 Copy Chapter

Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."

• https://github.com/Sunqiz/CVE-2010-3333-reproduction :

• https://github.com/whiteHat001/cve-2010-3333 :

• https://github.com/gousseine-systems/vuln-rabilit-windows7 :

CVE-2010-3332 Copy Chapter

Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."

• https://github.com/bongbongco/MS10-070 :

CVE-2010-3301 Copy Chapter

The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register. NOTE: this vulnerability exists because of a CVE-2007-4573 regression.

• https://github.com/n0lann/CVE2010-3301_compiled :

CVE-2010-3124 Copy Chapter

Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .mp3 file.

• https://github.com/KOBUKOVUI/DLL_Injection_On_VLC :

• https://github.com/Nhom6KTLT/CVE-2010-3124 :

CVE-2010-2883 Copy Chapter

Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.

• https://github.com/avielzecharia/CVE-2010-2883 :

CVE-2010-2861 Copy Chapter

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

• https://github.com/CyberCTF/vulhub-coldfusion-cve-2010-2861 :

• https://github.com/greysneakthief/14641-v2 :

CVE-2010-2626 Copy Chapter

index.pl in Miyabi CGI Tools SEO Links 1.02 allows remote attackers to execute arbitrary commands via shell metacharacters in the fn command. NOTE: some of these details are obtained from third party information.

• https://github.com/oxasploits/oxasploits :

CVE-2010-2553 Copy Chapter

The Cinepak codec in Microsoft Windows XP SP2 and SP3, Windows Vista SP1 and SP2, and Windows 7 does not properly decompress media files, which allows remote attackers to execute arbitrary code via a crafted file, aka "Cinepak Codec Decompression Vulnerability."

• https://github.com/Sunqiz/cve-2010-2553-reproduction :

CVE-2010-2387 Copy Chapter

vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs.

• https://github.com/LogSec/CVE-2010-2387 :

CVE-2010-2333 Copy Chapter

LiteSpeed Technologies LiteSpeed Web Server 4.0.x before 4.0.15 allows remote attackers to read the source code of scripts via an HTTP request with a null byte followed by a .txt file extension.

• https://github.com/jmonge12/Home-Network-Vulnerability-Assessment :

CVE-2010-2075 Copy Chapter

UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification (Trojan Horse) in the DEBUG3_DOLOG_SYSTEM macro, which allows remote attackers to execute arbitrary commands.

• https://github.com/MFernstrom/OffensivePascal-CVE-2010-2075 :

• https://github.com/chancej715/UnrealIRCd-3.2.8.1-Backdoor-Command-Execution :

• https://github.com/Tc-XoNoR/CVE-2010-2075 :

• https://github.com/FredBrave/CVE-2010-2075-UnrealIRCd-3.2.8.1 :

• https://github.com/earthbendergara/unrealircd3.2.8.1-local-exploit :

• https://github.com/rushikesh-a-bhujbal/CVE-2010-2075 :

• https://github.com/mishaqdev/cve-2010-2075-analysis :

• https://github.com/JoseLRC97/UnrealIRCd-3.2.8.1-Backdoor-Command-Execution :

• https://github.com/rhimavanth32-max/Metasploitable2-Reconnaissance-and-UnrealIRCd-Backdoor-Exploitation :

• https://github.com/Elazab2005/unrealircd-backdoor-pentest-report :

• https://github.com/zales2004/sunset-noontide-pentesting :

• https://github.com/Nyabayo/flatiron-pentest-nmap-enum4linux-smb-ftp-samba-metasploitable2-kali-healthcare-report :

CVE-2010-2039 Copy Chapter

Cross-site request forgery (CSRF) vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an Admin_Users action to index.php. NOTE: some of these details are obtained from third party information.

• https://github.com/RajeshTiwiva/CVE-2010-2039 :

CVE-2010-1938 Copy Chapter

Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long username, as demonstrated by a long USER command to the FreeBSD 8.0 ftpd.

• https://github.com/Nexxus67/cve-2010-1938 :

CVE-2010-1872 Copy Chapter

Cross-site scripting (XSS) vulnerability in cPlayer.php in FlashCard 2.6.5 and 3.0.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: some of these details are obtained from third party information.

• https://github.com/LipeOzyy/CVE-2010-1872-BlazeDVD-SEH-Exploit :

CVE-2010-1622 Copy Chapter

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

• https://github.com/DDuarte/springshell-rce-poc :

• https://github.com/E-bounce/cve-2010-1622_learning_environment :

• https://github.com/HandsomeCat00/Spring-CVE-2010-1622 :

• https://github.com/strainerart/Spring4Shell :

CVE-2010-1598 Copy Chapter

phpThumb.php in phpThumb() 1.7.9 and possibly other versions, when ImageMagick is installed, allows remote attackers to execute arbitrary commands via the fltr[] parameter, as discovered in the wild in April 2010. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

• https://github.com/connar/vulnerable_phpThumb :

CVE-2010-1411 Copy Chapter

Multiple integer overflows in the Fax3SetupState function in tif_fax3.c in the FAX3 decoder in LibTIFF before 3.9.3, as used in ImageIO in Apple Mac OS X 10.5.8 and Mac OS X 10.6 before 10.6.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF file that triggers a heap-based buffer overflow.

• https://github.com/MAVProxyUser/httpfuzz-robomiller :

CVE-2010-1240 Copy Chapter

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an arbitrary local program that was specified in a PDF document, as demonstrated by a text field that claims that the Open button will enable the user to read an encrypted message.

• https://github.com/Jasmoon99/Embedded-PDF :

• https://github.com/omarothmann/Embedded-Backdoor-Connection :

• https://github.com/asepsaepdin/CVE-2010-1240 :

• https://github.com/12345qwert123456/CVE-2010-1240 :

• https://github.com/ocfagb/hacktivity-vulns-exploits-lab :

CVE-2010-1205 Copy Chapter

Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.

• https://github.com/mk219533/CVE-2010-1205 :

CVE-2010-0832 Copy Chapter

pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to "user file stamps" and the motd.legal-notice file.

• https://github.com/R3fr4kt/Popcorn-TJNULL-OSCP- :

CVE-2010-0738 Copy Chapter

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

• https://github.com/gitcollect/jboss-autopwn :

• https://github.com/1872892142/jboss-autopwn-1 :

CVE-2010-0426 Copy Chapter

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.

• https://github.com/t0kx/privesc-CVE-2010-0426 :

• https://github.com/g1vi/CVE-2010-0426 :

• https://github.com/cved-sources/cve-2010-0426 :

CVE-2010-0232 Copy Chapter

The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges by crafting a VDM_TIB data structure in the Thread Environment Block (TEB), and then calling the NtVdmControl function to start the Windows Virtual DOS Machine (aka NTVDM) subsystem, leading to improperly handled exceptions involving the #GP trap handler (nt!KiTrap0D), aka "Windows Kernel Exception Handler Vulnerability."

• https://github.com/azorfus/CVE-2010-0232 :

CVE-2010-0219 Copy Chapter

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.

• https://github.com/vvts-alpha/CVE-2010-0219 :

Overview (`2011/README.md`) Copy Section

CVE-2011-5331 Copy Chapter

Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval.

• https://github.com/tomquinn8/CVE-2011-5331 :

CVE-2011-4919 Copy Chapter

mpack 1.6 has information disclosure via eavesdropping on mails sent by other users

• https://github.com/hartwork/mpacktrafficripper :

CVE-2011-4862 Copy Chapter

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.

• https://github.com/hdbreaker/GO-CVE-2011-4862 :

• https://github.com/appsecrani/CVE-2011-4862 :

• https://github.com/lol-fi/cve-2011-4862 :

CVE-2011-4825 Copy Chapter

Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.

• https://github.com/XavLimSG/Zenphoto-1.4.1.4-CVE-2011-4825-RCE :

CVE-2011-4367 Copy Chapter

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

• https://github.com/shoucheng3/apache__myfaces_CVE-2011-4367_2-0-11 :

CVE-2011-4107 Copy Chapter

The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

• https://github.com/SECFORCE/CVE-2011-4107 :

CVE-2011-3872 Copy Chapter

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."

• https://github.com/puppetlabs-toy-chest/puppetlabs-cve20113872 :

CVE-2011-3556 Copy Chapter

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.

• https://github.com/sk4la/cve_2011_3556 :

CVE-2011-3368 Copy Chapter

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

• https://github.com/SECFORCE/CVE-2011-3368 :

• https://github.com/colorblindpentester/CVE-2011-3368 :

CVE-2011-3192 Copy Chapter

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

• https://github.com/tkisason/KillApachePy :

• https://github.com/bluedragonsecurity/CVE-2011-3192-apache-exploit :

• https://github.com/futurezayka/CVE-2011-3192 :

• https://github.com/stcmjp/cve-2011-3192 :

• https://github.com/Xinjis/Apache_ByteRange_DoS_cve_2011_3192 :

• https://github.com/warmilk/http-Dos-Attack-Detection :

CVE-2011-3026 Copy Chapter

Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation.

• https://github.com/argp/cve-2011-3026-firefox :

CVE-2011-2894 Copy Chapter

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

• https://github.com/pwntester/SpringBreaker :

CVE-2011-2732 Copy Chapter

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

• https://github.com/shoucheng3/spring-projects__spring-security_CVE-2011-2732_2-0-6-RELEASE :

CVE-2011-2523 Copy Chapter

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

• https://github.com/padsalatushal/CVE-2011-2523 :

• https://github.com/Lynk4/CVE-2011-2523 :

• https://github.com/Maalfer/CVE-2011-2523-vsftpd-2.3.4-exploit :

• https://github.com/BolivarJ/CVE-2011-2523 :

• https://github.com/4m3rr0r/CVE-2011-2523-poc :

• https://github.com/nobodyatall648/CVE-2011-2523 :

• https://github.com/cowsecurity/CVE-2011-2523 :

• https://github.com/MFernstrom/OffensivePascal-CVE-2011-2523 :

• https://github.com/vedpakhare/vsftpd-234-vuln-report :

• https://github.com/Gill-Singh-A/vsFTP-2.3.4-Remote-Root-Shell-Exploit :

• https://github.com/ByteForgeFr/CVE-2011-2523 :

• https://github.com/cybermads/CVE-2011-2523 :

• https://github.com/krill-x7/CVE-2011-2523 :

• https://github.com/secwitness/CVE-2011-2523-vsftpd-backdoor-analysis :

• https://github.com/solomonhenry-afk/vsftpd-cve-2011-2523-detection-signature :

• https://github.com/JUN41DS2709/vsFTPd-2.3.4-Exploit :

• https://github.com/Efehamzaa/Metasploit-Red-Pentest-Lab :

• https://github.com/diceverick/vulnerability-assessment-lab :

• https://github.com/0xB0y426/CVE-2011-2523-PoC :

• https://github.com/lghost256/vsftpd234-exploit :

• https://github.com/0xSojalSec/-CVE-2011-2523 :

• https://github.com/sug4r-wr41th/CVE-2011-2523 :

• https://github.com/Gr4ykt/CVE-2011-2523 :

• https://github.com/hklabCR/CVE-2011-2523 :

• https://github.com/0xSojalSec/CVE-2011-2523 :

• https://github.com/Gvln-S/CVE-2011-2523 :

• https://github.com/vaishnavucv/CVE-2011-2523 :

• https://github.com/rushikesh-a-bhujbal/CVE-2011-2523 :

• https://github.com/Dahalsamir/CVE-2011-2523-exploit :

• https://github.com/Tenor-Z/SmileySploit :

• https://github.com/XiangSi-Howard/CTF---CVE-2011-2523 :

• https://github.com/Shubham-2k1/Exploit-CVE-2011-2523 :

• https://github.com/IndiQuarks/vsftpd-cve-2011-2523-lab :

• https://github.com/Chathura123git/ethical-hacking-CVE-2011-2523 :

• https://github.com/brettsm/vsftpd2.3.4-backdoor-exploit :

• https://github.com/Vijishanmugavel/metasploitable2-vsftpd-cve-2011-2523 :

• https://github.com/alexojocyber/cve-2011-2523-vsftpd-validation-lab :

• https://github.com/AnugiArrawwala/CVE-Research :

• https://github.com/sonalisarkar-2003/FTP-vsFTPD-CVE-2011-2523-VAPT-Report :

• https://github.com/yagnikkrish/metasploitable-penetration-testing-lab :

• https://github.com/Lychi3/vsftpd-backdoor :

• https://github.com/davidlares/vsftpd-exploitation :

• https://github.com/kn9annihilator/CVE-2011-2523-vsFTPd-2.3.4-Writeup :

• https://github.com/RinAliyeva/metasploitable2-vsftpd-exploitation :

• https://github.com/H4R335HR/vsftpd-234-backdoor :

• https://github.com/KlyneZyro/Metasploitable2-VAPT-Report :

• https://github.com/HerculesRD/vsftpd2.3.4PyExploit :

• https://github.com/aboubacar70/LAB1-metasploitable :

• https://github.com/Amirmuhammadmarvi/network-security-lab :

• https://github.com/delmag138/NovaShyld_Task_3 :

• https://github.com/Mithileshan/soc-investigation-lab :

• https://github.com/IrsaAttiqueCyber/SystemVulnerabilityChecklist_Project4_Decodelabs :

• https://github.com/rsakthikumar-cmd/metasploitable2-vsftpd-writeup :

• https://github.com/IvoAlbacete/Kali-Metasploitable :

• https://github.com/Prafullya-Shandilya/metasploitable-pentest-report :

• https://github.com/DanReis20/pentest-lab-metasploitable2 :

• https://github.com/Orevic21/wazuh-home-soc :

• https://github.com/Nutsulejustine/pentest-metasploitable :

• https://github.com/Tr00jan99/PwnTillDawn-Portal-Walkthrough :

• https://github.com/NitinSukthe-G/OpenVAS-Vulnerability-Assessment-Incident-Response :

• https://github.com/Spidey1919/vsftpd-2.3.4-rce-assessment :

• https://github.com/Mirza-22144/Vulnerability-Assessment-Exploitation-Lab :

• https://github.com/ronankongala/metasploit-pentest-report :

• https://github.com/Taisa456/network-security-snort :

• https://github.com/khalilu020/offensive-security-adversary-emulation :

• https://github.com/samirchapagain/metasploit-lab-report :

• https://github.com/tshaq17/vsftpd-2.3.4---Backdoor-Command-Execution :

• https://github.com/Nyabayo/flatiron-pentest-nmap-enum4linux-smb-ftp-samba-metasploitable2-kali-healthcare-report :

• https://github.com/Jhatchi/NexaCorp-DFIR-INC-2026-001 :

• https://github.com/aish19siddiqua-commits/mtechweek_04 :

• https://github.com/JohanMV/explotacion-vsftpd-nmap_Laboratorio_1 :

• https://github.com/hajisthabegum/Exploiting-vsFTPd-2.3.4-Backdoor-Vulnerability-Ethical-Hacking-Lab-with-Metasploitable-2-Metasploit :

• https://github.com/emilebarnard242/pentest-metasploitable2 :

• https://github.com/victorborrero01/pentesting-lab-metasploitable2 :

• https://github.com/sagarjain0456/Metasploit-Project-using-KaliLinux-plus-Metasploitable2-VMs :

CVE-2011-2461 Copy Chapter

Cross-site scripting (XSS) vulnerability in the Adobe Flex SDK 3.x and 4.x before 4.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to the loading of modules from different domains.

• https://github.com/ikkisoft/ParrotNG :

• https://github.com/edmondscommerce/CVE-2011-2461_Magento_Patch :

• https://github.com/u-maxx/magento-swf-patched-CVE-2011-2461 :

CVE-2011-1974 Copy Chapter

NDISTAPI.sys in the NDISTAPI driver in Remote Access Service (RAS) in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP2 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "NDISTAPI Elevation of Privilege Vulnerability."

• https://github.com/hittlle/CVE-2011-1974-PoC :

CVE-2011-1575 Copy Chapter

The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

• https://github.com/masamoon/cve-2011-1575-poc :

CVE-2011-1571 Copy Chapter

Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.

• https://github.com/yazgx97/CVE-2011-1571 :

CVE-2011-1485 Copy Chapter

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

• https://github.com/bluedragonsecurity/CVE-2011-1485-pkexec-exploit :

• https://github.com/Pashkela/CVE-2011-1485 :

CVE-2011-1475 Copy Chapter

The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."

• https://github.com/samaujs/CVE-2011-1475 :

CVE-2011-1473 Copy Chapter

OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094. NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment

• https://github.com/XDLDCG/bash-tls-reneg-attack :

• https://github.com/khaledibnalwalid/CVE-2011-1473-POC :

• https://github.com/zjt674449039/cve-2011-1473 :

CVE-2011-1249 Copy Chapter

The Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

• https://github.com/h3x0v3rl0rd/CVE-2011-1249 :

• https://github.com/Madusanka99/OHTS :

• https://github.com/appl3b0y/edb-40564-mingw-fix :

CVE-2011-1237 Copy Chapter

Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other "Vulnerability Type 1" CVEs listed in MS11-034, aka "Win32k Use After Free Vulnerability."

• https://github.com/BrunoPujos/CVE-2011-1237 :

CVE-2011-0762 Copy Chapter

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.

• https://github.com/s3mPr1linux/CVE-2011-0762 :

CVE-2011-0228 Copy Chapter

The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an arbitrary domain.

• https://github.com/jan0/isslfix :

• https://github.com/amil-ptl-test/ptl_cve_2011_0228 :

CVE-2011-0104 Copy Chapter

Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HLink record in an Excel file, aka "Excel Buffer Overwrite Vulnerability."

• https://github.com/Sunqiz/CVE-2011-0104-reproduction :

Overview (`2012/README.md`) Copy Section

CVE-2012-6636 Copy Chapter

The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.

• https://github.com/xckevin/AndroidWebviewInjectDemo :

• https://github.com/Snip3R69/CVE-2013-4710-WebView-RCE-Vulnerability :

CVE-2012-6422 Copy Chapter

The kernel in Samsung Galaxy S2, Galaxy Note 2, MEIZU MX, and possibly other Android devices, when running an Exynos 4210 or 4412 processor, uses weak permissions (0666) for /dev/exynos-mem, which allows attackers to read or write arbitrary physical memory and gain privileges via a crafted application, as demonstrated by ExynosAbuse.

• https://github.com/wired0ut/CVE-2012-6422 :

CVE-2012-6066 Copy Chapter

freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.

• https://github.com/bongbongco/CVE-2012-6066 :

CVE-2012-5960 Copy Chapter

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a long UDN (aka upnp:rootdevice) field in a UDP packet.

• https://github.com/finn79426/CVE-2012-5960-PoC :

CVE-2012-5959 Copy Chapter

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a long UDN (aka uuid) field within a string that contains a :: (colon colon) in a UDP packet.

• https://github.com/lochiiconnectivity/vulnupnp :

• https://github.com/finn79426/CVE-2012-5960-PoC :

CVE-2012-5958 Copy Chapter

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a UDP packet with a crafted string that is not properly handled after a certain pointer subtraction.

• https://github.com/lochiiconnectivity/vulnupnp :

• https://github.com/hmrumman777-beep/NetAudit-IoT :

CVE-2012-5664 Copy Chapter

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6496, CVE-2012-6497. Reason: this candidate was intended for one issue, but the candidate was publicly used to label concerns about multiple products. Notes: All CVE users should consult CVE-2012-6496 and CVE-2012-6497 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.

• https://github.com/phusion/rails-cve-2012-5664-test :

CVE-2012-5613 Copy Chapter

MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.

• https://github.com/Hood3dRob1n/MySQL-Fu.rb :

• https://github.com/w4fz5uck5/UDFPwn-CVE-2012-5613 :

CVE-2012-5575 Copy Chapter

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."

• https://github.com/tafamace/CVE-2012-5575 :

CVE-2012-5519 Copy Chapter

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.

• https://github.com/p1ckzi/CVE-2012-5519 :

CVE-2012-5321 Copy Chapter

tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection."

• https://github.com/Cappricio-Securities/CVE-2012-5321 :

CVE-2012-5221 Copy Chapter

Directory traversal vulnerability in the PostScript Interpreter, as used on the HP LaserJet 4xxx, 5200, 90xx, M30xx, M4345, M50xx, M90xx, P3005, and P4xxx; LaserJet Enterprise P3015; Color LaserJet 3xxx, 47xx, 5550, 9500, CM60xx, CP35xx, CP4005, and CP6015; Color LaserJet Enterprise CP4xxx; and 9250c Digital Sender with model-dependent firmware through 52.x allows remote attackers to read arbitrary files via unknown vectors.

• https://github.com/aredspy/HPCredDumper :

CVE-2012-5106 Copy Chapter

Stack-based buffer overflow in FreeFloat FTP Server 1.0 allows remote authenticated users to execute arbitrary code via a long string in a PUT command.

• https://github.com/war4uthor/CVE-2012-5106 :

CVE-2012-4960 Copy Chapter

The Huawei NE5000E, MA5200G, NE40E, NE80E, ATN, NE40, NE80, NE20E-X6, NE20, ME60, CX600, CX200, CX300, ACU, WLAN AC 6605, S9300, S7700, S2300, S3300, S5300, S3300HI, S5300HI, S5306, S6300, S2700, S3700, S5700, S6700, AR G3, H3C AR(OEM IN), AR 19, AR 29, AR 49, Eudemon100E, Eudemon200, Eudemon300, Eudemon500, Eudemon1000, Eudemon1000E-U/USG5300, Eudemon1000E-X/USG5500, Eudemon8080E/USG9300, Eudemon8160E/USG9300, Eudemon8000E-X/USG9500, E200E-C/USG2200, E200E-X3/USG2200, E200E-X5/USG2200, E200E-X7/USG2200, E200E-C/USG5100, E200E-X3/USG5100, E200E-X5/USG5100, E200E-X7/USG5100, E200E-B/USG2100, E200E-X1/USG2100, E200E-X2/USG2100, SVN5300, SVN2000, SVN5000, SVN3000, NIP100, NIP200, NIP1000, NIP2100, NIP2200, and NIP5100 use the DES algorithm for stored passwords, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.

• https://github.com/ghcohu/Decrypt-passwords-for-Huawei-routers-and-switches-CVE-2012-4960 :

CVE-2012-4929 Copy Chapter

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

• https://github.com/mpgn/CRIME-poc :

• https://github.com/anthophilee/A2SV--SSL-VUL-Scan :

CVE-2012-4869 Copy Chapter

The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action.

• https://github.com/AndyCyberSec/OSCP :

• https://github.com/cyberdesu/Elastix-2.2.0-CVE-2012-4869 :

CVE-2012-4792 Copy Chapter

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.

• https://github.com/WizardVan/CVE-2012-4792 :

CVE-2012-4681 Copy Chapter

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

• https://github.com/benjholla/CVE-2012-4681-Armoring :

• https://github.com/ZH3FENG/PoCs-CVE_2012_4681 :

CVE-2012-4431 Copy Chapter

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

• https://github.com/imjdl/CVE-2012-4431 :

CVE-2012-4220 Copy Chapter

diagchar_core.c in the Qualcomm Innovation Center (QuIC) Diagnostics (aka DIAG) kernel-mode driver for Android 2.3 through 4.2 allows attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via an application that uses crafted arguments in a local diagchar_ioctl call.

• https://github.com/poliva/root-zte-open :

• https://github.com/hiikezoe/diaggetroot :

CVE-2012-3716 Copy Chapter

CoreText in Apple Mac OS X 10.7.x before 10.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write or read) via a crafted text glyph.

• https://github.com/d4rkcat/killosx :

CVE-2012-3576 Copy Chapter

Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/wpstorecart.

• https://github.com/Ydvmtzv/wpstorecart-exploit :

CVE-2012-3452 Copy Chapter

gnome-screensaver 3.4.x before 3.4.4 and 3.5.x before 3.5.4, when multiple screens are used, only locks the screen with the active focus, which allows physically proximate attackers to bypass screen locking and access an unattended workstation.

• https://github.com/sh7alward/CVE-20121-34527-nightmare :

CVE-2012-3153 Copy Chapter

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.

• https://github.com/Mekanismen/pwnacle-fusion :

• https://github.com/abq0/rwsploit :

CVE-2012-3152 Copy Chapter

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.

• https://github.com/Mekanismen/pwnacle-fusion :

• https://github.com/abq0/rwsploit :

CVE-2012-3137 Copy Chapter

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."

• https://github.com/r1-/cve-2012-3137 :

• https://github.com/hantwister/o5logon-fetch :

CVE-2012-2982 Copy Chapter

file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | (pipe) character.

• https://github.com/JohnHammond/CVE-2012-2982 :

• https://github.com/cd6629/CVE-2012-2982-Python-PoC :

• https://github.com/0xTas/CVE-2012-2982 :

• https://github.com/OstojaOfficial/CVE-2012-2982 :

• https://github.com/Gvmyz/CVE-2012-2982_Python :

• https://github.com/JRrooot/CVE-2012-2982-Webmin-RCE :

• https://github.com/Ari-Weinberg/CVE-2012-2982 :

• https://github.com/lpuv/CVE-2012-2982 :

• https://github.com/blu3ming/CVE-2012-2982 :

• https://github.com/0xF331-D3AD/CVE-2012-2982 :

• https://github.com/CpyRe/CVE-2012-2982 :

• https://github.com/elliotosama/CVE-2012-2982 :

• https://github.com/varppi/CVE-2012-2982 :

• https://github.com/boriitoo/CVE-2012-2982 :

• https://github.com/Shadow-Spinner/CVE-2012-2982_python :

• https://github.com/SieGer05/CVE-2012-2982-Webmin-Exploit :

• https://github.com/SincIDK/CVE-2012-2982-Exploit-Script :

• https://github.com/marinovharisan/Webmin-1.580---file-show.cgi-Manual-Remote-Command-Execution-Non-Metasploit- :

• https://github.com/danielvilaca/PoC_Webmin :

CVE-2012-2688 Copy Chapter

Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."

• https://github.com/shelld3v/CVE-2012-2688 :

CVE-2012-2661 Copy Chapter

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.

• https://github.com/r4x0r1337/-CVE-2012-2661-ActiveRecord-SQL-injection- :

CVE-2012-2593 Copy Chapter

Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email.

• https://github.com/AndrewTrube/CVE-2012-2593 :

CVE-2012-2459 Copy Chapter

Unspecified vulnerability in bitcoind and Bitcoin-Qt before 0.4.6, 0.5.x before 0.5.5, 0.6.0.x before 0.6.0.7, and 0.6.x before 0.6.2 allows remote attackers to cause a denial of service (block-processing outage and incorrect block count) via unknown behavior on a Bitcoin network.

• https://github.com/condeDeveloper/arvore-merkle :

• https://github.com/systemslibrarian/crypto-lab-merkle-proofs :

• https://github.com/GJ504b123/merkle-lab :

CVE-2012-2122 Copy Chapter

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

• https://github.com/Avinza/CVE-2012-2122-scanner :

• https://github.com/cyberharsh/Oracle-mysql-CVE-2012-2122 :

• https://github.com/CyberCTF/vulhub-mysql-cve-2012-2122 :

• https://github.com/zhangkaibin0921/CVE-2012-2122 :

• https://github.com/subinyy/docker_CVE_2012_2122 :

• https://github.com/netw0rk7/CVE-2012-2122-Home-Lab :

CVE-2012-1889 Copy Chapter

Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

• https://github.com/whu-enjoy/CVE-2012-1889 :

• https://github.com/l-iberty/cve-2012-1889 :

CVE-2012-1876 Copy Chapter

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.

• https://github.com/WizardVan/CVE-2012-1876 :

• https://github.com/ExploitCN/CVE-2012-1876-win7_x86_and_win7x64 :

CVE-2012-1870 Copy Chapter

The CBC mode in the TLS protocol, as used in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and other products, allows remote web servers to obtain plaintext data by triggering multiple requests to a third-party HTTPS server and sniffing the network during the resulting HTTPS session, aka "TLS Protocol Vulnerability."

• https://github.com/dja2TaqkGEEfA45/CVE-2012-1870 :

CVE-2012-1831 Copy Chapter

Heap-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.

• https://github.com/Astrowmist/POC-CVE-2012-1831 :

CVE-2012-1823 Copy Chapter

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

• https://github.com/0xl0k1/CVE-2012-1823 :

• https://github.com/Unix13/metasploitable2 :

• https://github.com/tardummy01/oscp_scripts-1 :

• https://github.com/mujtaba815/metasploitable2-php-cgi-exploit :

• https://github.com/drone789/CVE-2012-1823 :

• https://github.com/cyberharsh/PHP_CVE-2012-1823 :

• https://github.com/Dmitri131313/CVE-2012-1823-exploit-for-https-user-password-web :

• https://github.com/hackherMind-Pixel/Vulnerable-Lab-Exploitation :

• https://github.com/CyberCTF/vulhub-php-cve-2012-1823 :

• https://github.com/Jimmy01240397/CVE-2012-1823-Analyze :

• https://github.com/tryj/CVE-2012-1823---PHP-CGI---RCE :

• https://github.com/tanasescualexandrugabriel/Vulnerability-Assessment-and-OSINT-CVE-2012-1823 :

• https://github.com/yilmaz8596/metasploitable-vulnerability-assessment :

• https://github.com/nulltrace1336/PHP-CGI-Argument-Injection-Exploit :

• https://github.com/mehedi-hasan-sami98/DVWA-ZAP-PENTEST :

• https://github.com/waburig/Open-Worldwide-Application-Security-Project-OWASP- :

CVE-2012-1803 Copy Chapter

RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) TELNET, (2) remote shell (aka rsh), or (3) serial-console session.

• https://github.com/x3roxismygood/CVE-2012-1803 :

CVE-2012-1723 Copy Chapter

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

• https://github.com/EthanNJC/CVE-2012-1723 :

CVE-2012-1675 Copy Chapter

The TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.0.5, as used in Oracle Fusion Middleware, Enterprise Manager, E-Business Suite, and possibly other products, allows remote attackers to execute arbitrary database commands by performing a remote registration of a database (1) instance or (2) service name that already exists, then conducting a man-in-the-middle (MITM) attack to hijack database connections, aka "TNS Poison."

• https://github.com/bongbongco/CVE-2012-1675 :

CVE-2012-1495 Copy Chapter

install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.

• https://github.com/axelbankole/CVE-2012-1495-Webcalendar- :

CVE-2012-0754 Copy Chapter

Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

• https://github.com/mbeweoo/flash-exploit-defense-system :

CVE-2012-0507 Copy Chapter

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.

• https://github.com/frg316/cve2012-0507 :

CVE-2012-0158 Copy Chapter

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."

• https://github.com/Sunqiz/CVE-2012-0158-reproduction :

• https://github.com/RobertoLeonFR-ES/Exploit-Win32.CVE-2012-0158.F.doc :

CVE-2012-0152 Copy Chapter

The Remote Desktop Protocol (RDP) service in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to cause a denial of service (application hang) via a series of crafted packets, aka "Terminal Server Denial of Service Vulnerability."

• https://github.com/anmolksachan/MS12-020 :

• https://github.com/rutvijjethwa/RDP_jammer :

CVE-2012-0056 Copy Chapter

The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/pid/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.

• https://github.com/pythonone/CVE-2012-0056 :

• https://github.com/srclib/CVE-2012-0056 :

CVE-2012-0003 Copy Chapter

Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to execute arbitrary code via a crafted MIDI file, aka "MIDI Remote Code Execution Vulnerability."

• https://github.com/k0keoyo/CVE-2012-0003_eXP :

• https://github.com/gousseine-systems/vuln-rabilit-windows7 :

CVE-2012-0002 Copy Chapter

The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to an object that (1) was not properly initialized or (2) is deleted, aka "Remote Desktop Protocol Vulnerability."

• https://github.com/zhangkaibin0921/MS12-020-CVE-2012-0002 :

Overview (`2013/README.md`) Copy Section

CVE-2013-7285 Copy Chapter

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

• https://github.com/shoucheng3/x-stream__xstream_CVE-2013-7285_1-4-6 :

CVE-2013-6987 Copy Chapter

Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. (dot dot) in the (1) path parameter to file_delete.cgi or (2) folder_path parameter to file_share.cgi in webapi/FileStation/; (3) dlink parameter to fbdownload/; or unspecified parameters to (4) html5_upload.cgi, (5) file_download.cgi, (6) file_sharing.cgi, (7) file_MVCP.cgi, or (8) file_rename.cgi in webapi/FileStation/.

• https://github.com/stoicboomer/CVE-2013-6987 :

CVE-2013-6919 Copy Chapter

The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.

• https://github.com/connar/vulnerable_phpThumb :

CVE-2013-6668 Copy Chapter

Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Google Chrome before 33.0.1750.146, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

• https://github.com/sdneon/CveTest :

CVE-2013-6490 Copy Chapter

The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer overflow.

• https://github.com/Everdoh/CVE-2013-6490 :

CVE-2013-6375 Copy Chapter

Xen 4.2.x and 4.3.x, when using Intel VT-d for PCI passthrough, does not properly flush the TLB after clearing a present translation table entry, which allows local guest administrators to cause a denial of service or gain privileges via unspecified vectors related to an "inverted boolean parameter."

• https://github.com/bl4ck5un/cve-2013-6375 :

CVE-2013-6282 Copy Chapter

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.

• https://github.com/fi01/libput_user_exploit :

• https://github.com/timwr/CVE-2013-6282 :

• https://github.com/jeboo/bypasslkm :

• https://github.com/fi01/libget_user_exploit :

CVE-2013-6117 Copy Chapter

Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

• https://github.com/milo2012/CVE-2013-6117 :

• https://github.com/fsn4k3/dahua-dvr-metasploit :

CVE-2013-5842 Copy Chapter

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-5850.

• https://github.com/guhe120/CVE-2013-5842 :

CVE-2013-5664 Copy Chapter

Cross-site scripting (XSS) vulnerability in the web-based device-management API browser in Palo Alto Networks PAN-OS before 4.1.13 and 5.0.x before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via crafted data, aka Ref ID 50908.

• https://github.com/phusion/rails-cve-2012-5664-test :

CVE-2013-5211 Copy Chapter

The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.

• https://github.com/dani87/ntpscanner :

• https://github.com/sepehrdaddev/ntpdos :

• https://github.com/0xhav0c/CVE-2013-5211 :

• https://github.com/suedadam/ntpscanner :

• https://github.com/requiempentest/NTP_CVE-2013-5211 :

• https://github.com/requiempentest/-exploit-check-CVE-2013-5211 :

CVE-2013-5065 Copy Chapter

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.

• https://github.com/Friarfukd/RobbinHood :

CVE-2013-4786 Copy Chapter

The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.

• https://github.com/fin3ss3g0d/CosmicRakp :

CVE-2013-4784 Copy Chapter

The HP Integrated Lights-Out (iLO) BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.

• https://github.com/alexoslabs/ipmitest :

CVE-2013-4730 Copy Chapter

Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.

• https://github.com/t0rt3ll1n0/PCmanBoF :

CVE-2013-4710 Copy Chapter

Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.

• https://github.com/Snip3R69/CVE-2013-4710-WebView-RCE-Vulnerability :

CVE-2013-4547 Copy Chapter

nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.

• https://github.com/cyberharsh/Nginx-CVE-2013-4547 :

• https://github.com/CyberCTF/vulhub-nginx-cve-2013-4547 :

• https://github.com/rsp243/fix_nginx_CVE-2013-4547_IB :

CVE-2013-4434 Copy Chapter

Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames.

• https://github.com/styx00/Dropbear_CVE-2013-4434 :

CVE-2013-4378 Copy Chapter

Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.

• https://github.com/epicosy/VUL4J-50 :

• https://github.com/theratpack/grails-javamelody-sample-app :

CVE-2013-4362 Copy Chapter

WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.

• https://github.com/notclement/Automatic-davfs2-1.4.6-1.4.7-Local-Privilege-Escalation :

CVE-2013-4348 Copy Chapter

The skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel through 3.12 allows remote attackers to cause a denial of service (infinite loop) via a small value in the IHL field of a packet with IPIP encapsulation.

• https://github.com/bl4ck5un/cve-2013-4348 :

CVE-2013-4322 Copy Chapter

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

• https://github.com/LiviuPtr/CVE-2013-4322_PoC :

CVE-2013-4175 Copy Chapter

MySecureShell 1.31 has a Local Denial of Service Vulnerability

• https://github.com/hartwork/mysecureshell-issues :

CVE-2013-4002 Copy Chapter

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.

• https://github.com/tafamace/CVE-2013-4002 :

CVE-2013-3900 Copy Chapter

Why is Microsoft republishing a CVE from 2013?
We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the original text published on December 10, 2013,
Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows. This behavior remains available as an opt-in feature via reg key setting, and is available on supported editions of Windows released since December 10, 2013. This includes all currently supported versions of Windows 10 and Windows 11. The supporting code for this reg key was incorporated at the time of release for Windows 10 and Windows 11, so no security update is required; however, the reg key must be set. See the Security Updates table for the list of affected software.
Vulnerability Description
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable (PE) files. An anonymous attacker could exploit the vulnerability by modifying an existing signed executable file to leverage unverified portions of the file in such a way as to add malicious code to the file without invalidating the signature. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Exploitation of this vulnerability requires that a user or application run or install a specially crafted, signed PE file. An attacker could modify an... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900

• https://github.com/norvethil/CVE-2013-3900-PowerShell-PoC :

• https://github.com/CyberCondor/Fix-WinVerifyTrustSignatureValidationVuln :

• https://github.com/OtisSymbos/CVE-2013-3900-WinTrustVerify :

• https://github.com/pkblanks/Remediating-CVE-2013-3900-EnableCertPaddingCheck- :

• https://github.com/Sabecomoeh/CVE-2013-3900 :

• https://github.com/snoopopsec/vulnerability-CVE-2013-3900 :

• https://github.com/Securenetology/CVE-2013-3900 :

• https://github.com/DavidBr27/CVE-2013-3900-Remediation-Script :

• https://github.com/ksgassama-lab/vulnerability-remediation-cve-2013-3900 :

• https://github.com/malaya-m/cve-2013-3900-remediation-report :

• https://github.com/SDimitri05/cve-2013-3900-winverifytrust-mitigation :

• https://github.com/AdenilsonSantos/WinVerifyTrust :

• https://github.com/piranhap/CVE-2013-3900_Remediation_PowerShell :

• https://github.com/oukridrig772/-WinVerifyTrust-Signature-Validation-CVE-2013-3900-Mitigation :

• https://github.com/kingsrule50/nessus-vulnerability-scanning-lab :

CVE-2013-3893 Copy Chapter

Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.

• https://github.com/travelworld/cve_2013_3893_trigger.html :

CVE-2013-3827 Copy Chapter

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.

• https://github.com/thistehneisen/CVE-2013-3827 :

CVE-2013-3664 Copy Chapter

Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662. NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.

• https://github.com/defrancescojp/CVE-2013-3664_MAC :

• https://github.com/defrancescojp/CVE-2013-3664_BMP :

CVE-2013-3660 Copy Chapter

The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."

• https://github.com/ExploitCN/CVE-2013-3660-x64-WIN7 :

• https://github.com/kikozz/CVE-2013-3660-win32k.sys :

CVE-2013-3651 Copy Chapter

LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SC_CheckError.php and data/class/SC_FormParam.php.

• https://github.com/motikan2010/CVE-2013-3651 :

CVE-2013-3319 Copy Chapter

The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128.

• https://github.com/devoteam-cybertrust/cve-2013-3319 :

CVE-2013-3214 Copy Chapter

vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.

• https://github.com/shadofren/CVE-2013-3214 :

CVE-2013-2977 Copy Chapter

Integer overflow in IBM Notes 8.5.x before 8.5.3 FP4 Interim Fix 1 and 9.x before 9.0 Interim Fix 1 on Windows, and 8.5.x before 8.5.3 FP5 and 9.x before 9.0.1 on Linux, allows remote attackers to execute arbitrary code via a malformed PNG image in a previewed e-mail message, aka SPR NPEI96K82Q.

• https://github.com/defrancescojp/CVE-2013-2977 :

CVE-2013-2842 Copy Chapter

Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of widgets.

• https://github.com/173210/spider :

CVE-2013-2765 Copy Chapter

The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.

• https://github.com/yjaaidi/exploits :

CVE-2013-2730 Copy Chapter

Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2733.

• https://github.com/feliam/CVE-2013-2730 :

CVE-2013-2729 Copy Chapter

Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.

• https://github.com/feliam/CVE-2013-2729 :

CVE-2013-2597 Copy Chapter

Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that leverages /dev/msm_acdb access and provides a large size value in an ioctl argument.

• https://github.com/fi01/libmsm_acdb_exploit :

CVE-2013-2596 Copy Chapter

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.

• https://github.com/hiikezoe/libfb_mem_exploit :

CVE-2013-2595 Copy Chapter

The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which allows attackers to gain privileges via a crafted application.

• https://github.com/fi01/libmsm_cameraconfig_exploit :

CVE-2013-2251 Copy Chapter

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

• https://github.com/nth347/struts2-CVE-2013-2251 :

CVE-2013-2217 Copy Chapter

cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.

• https://github.com/Osirium/suds :

CVE-2013-2186 Copy Chapter

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.

• https://github.com/GrrrDog/ACEDcup :

• https://github.com/sa1g0n1337/CVE_2013_2186 :

• https://github.com/sa1g0n1337/Payload_CVE_2013_2186 :

CVE-2013-2171 Copy Chapter

The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not properly determine whether a task should have write access to a memory location, which allows local users to bypass filesystem write permissions and consequently gain privileges via a crafted application that leverages read permissions, and makes mmap and ptrace system calls.

• https://github.com/0xGabe/FreeBSD-9.0-9.1-Privilege-Escalation :

CVE-2013-2165 Copy Chapter

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

• https://github.com/Pastea/CVE-2013-2165 :

CVE-2013-2094 Copy Chapter

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.

• https://github.com/realtalk/cve-2013-2094 :

• https://github.com/hiikezoe/libperf_event_exploit :

• https://github.com/Pashkela/CVE-2013-2094 :

• https://github.com/timhsutw/cve-2013-2094 :

• https://github.com/vnik5287/CVE-2013-2094 :

• https://github.com/tarunyadav/fix-cve-2013-2094 :

• https://github.com/letsr00t/CVE-2013-2094 :

CVE-2013-2072 Copy Chapter

Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.

• https://github.com/bl4ck5un/cve-2013-2072 :

CVE-2013-2028 Copy Chapter

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.

• https://github.com/kitctf/nginxpwn :

• https://github.com/danghvu/nginx-1.4.0 :

• https://github.com/m4drat/CVE-2013-2028-Exploit :

• https://github.com/tachibana51/CVE-2013-2028-x64-bypass-ssp-and-pie-PoC :

• https://github.com/jptr218/nginxhack :

• https://github.com/Sunqiz/CVE-2013-2028-reproduction :

• https://github.com/xiw1ll/CVE-2013-2028_Checker :

• https://github.com/vanivamshi/CVE-2013-2028-Exploit :

CVE-2013-2010 Copy Chapter

WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability

• https://github.com/spyata123/w3-total-cache-cve-2013-2010 :

CVE-2013-2006 Copy Chapter

OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.

• https://github.com/LogSec/CVE-2013-2006 :

CVE-2013-1965 Copy Chapter

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

• https://github.com/cinno/CVE-2013-1965 :

CVE-2013-1814 Copy Chapter

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

• https://github.com/dannyEndorTest/java-vulnerable :

CVE-2013-1775 Copy Chapter

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch.

• https://github.com/bekhzod0725/perl-CVE-2013-1775 :

CVE-2013-1763 Copy Chapter

Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain privileges via a large family value in a Netlink message.

• https://github.com/qkrtjsrbs315/CVE-2013-1763 :

CVE-2013-1690 Copy Chapter

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

• https://github.com/vlad902/annotated-fbi-tbb-exploit :

CVE-2013-1491 Copy Chapter

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013.

• https://github.com/guhe120/CVE20131491-JIT :

CVE-2013-1488 Copy Chapter

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.

• https://github.com/v-p-b/buherablog-cve-2013-1488 :

CVE-2013-1300 Copy Chapter

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Win32k Memory Allocation Vulnerability."

• https://github.com/Meatballs1/cve-2013-1300 :

CVE-2013-1081 Copy Chapter

Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management (ZMM) 2.6.1 and 2.7.0 allows remote attackers to include and execute arbitrary local files via the language parameter.

• https://github.com/steponequit/CVE-2013-1081 :

CVE-2013-0333 Copy Chapter

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

• https://github.com/heroku/heroku-CVE-2013-0333 :

CVE-2013-0303 Copy Chapter

Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered by CVE-2013-7344.

• https://github.com/CiscoCXSecurity/ownCloud_RCE_CVE-2013-0303 :

CVE-2013-0269 Copy Chapter

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

• https://github.com/heroku/heroku-CVE-2013-0269 :

CVE-2013-0230 Copy Chapter

Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to execute arbitrary code via a long quoted method.

• https://github.com/lochiiconnectivity/vulnupnp :

CVE-2013-0229 Copy Chapter

The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read.

• https://github.com/lochiiconnectivity/vulnupnp :

CVE-2013-0212 Copy Chapter

store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.

• https://github.com/LogSec/CVE-2013-0212 :

CVE-2013-0169 Copy Chapter

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

• https://github.com/wearohat/lucky13 :

CVE-2013-0156 Copy Chapter

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

• https://github.com/bsodmike/rails-exploit-cve-2013-0156 :

• https://github.com/heroku/heroku-CVE-2013-0156 :

• https://github.com/Jjdt12/kuang_grade_mk11 :

• https://github.com/oxben10/CVE-2013-0156 :

• https://github.com/R3dKn33-zz/CVE-2013-0156 :

• https://github.com/7s26simon/CVE-2013-0156 :

• https://github.com/terracatta/name_reverser :

• https://github.com/mitaku/rails_cve_2013_0156_patch :

• https://github.com/josal/crack-0.1.8-fixed :

CVE-2013-0007 Copy Chapter

Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability."

• https://github.com/jyyjw/msxml4-remediation :

Overview (`2014/README.md`) Copy Section

CVE-2014-10069 Copy Chapter

Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain sensitive information by decrypting a backup configuration file, as demonstrated by a password hash in the um_auth_account_password field.

• https://github.com/aimoda/hitron-cfg-decrypter :

CVE-2014-9495 Copy Chapter

Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.

• https://github.com/Enessar/LibPNG_OSS-Fuzz :

CVE-2014-9390 Copy Chapter

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

• https://github.com/hakatashi/CVE-2014-9390 :

CVE-2014-9322 Copy Chapter

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.

• https://github.com/RKX1209/CVE-2014-9322 :

CVE-2014-9301 Copy Chapter

Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in the endpoint parameter.

• https://github.com/ottimo/burp-alfresco-referer-proxy-cve-2014-9301 :

CVE-2014-9295 Copy Chapter

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.

• https://github.com/MacMiniVault/NTPUpdateSnowLeopard :

CVE-2014-9222 Copy Chapter

AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to gain privileges via a crafted cookie that triggers memory corruption, aka the "Misfortune Cookie" vulnerability.

• https://github.com/donfanning/MIPS-CVE-2014-9222 :

• https://github.com/mercul1ninna/MIPS-CVE-2014-9222 :

• https://github.com/luel-4013/misfortune-cookie :

CVE-2014-9219 Copy Chapter

Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter.

• https://github.com/MohmadHafiz/CVE-2014-9219 :

CVE-2014-9173 Copy Chapter

SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter.

• https://github.com/ratiros01/CVE-2014-9173 :

CVE-2014-9137 Copy Chapter

Huawei USG9500 with software V200R001C01SPC800 and earlier versions, V300R001C00; USG2100 with software V300R001C00SPC900 and earlier versions; USG2200 with software V300R001C00SPC900; USG5100 with software V300R001C00SPC900 could allow an unauthenticated, remote attacker to conduct a CSRF attack against the user of the web interface.

• https://github.com/jamaal001/CVE-2014-91371-Wordpress- :

CVE-2014-9034 Copy Chapter

wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.

• https://github.com/c0r3dump3d/wp_drupal_timing_attack :

CVE-2014-9016 Copy Chapter

The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.

• https://github.com/c0r3dump3d/wp_drupal_timing_attack :

• https://github.com/Primus27/WordPress-Long-Password-Denial-of-Service :

CVE-2014-8731 Copy Chapter

PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last part of the concatenated filename," which creates a file in webroot.

• https://github.com/sbani/CVE-2014-8731-PoC :

CVE-2014-8729 Copy Chapter

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/inso-/TORQUE-Resource-Manager-2.5.x-2.5.13-stack-based-buffer-overflow-exploit-CVE-2014-8729-CVE-2014-878 :

CVE-2014-8682 Copy Chapter

Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.

• https://github.com/nihal1306/gogs :

CVE-2014-8610 Copy Chapter

AndroidManifest.xml in Android before 5.0.0 does not require the SEND_SMS permission for the SmsReceiver receiver, which allows attackers to send stored SMS messages, and consequently transmit arbitrary new draft SMS messages or trigger additional per-message charges from a network operator for old messages, via a crafted application that broadcasts an intent with the com.android.mms.transaction.MESSAGE_SENT action, aka Bug 17671795.

• https://github.com/eddieoz/dual-ec-drbg :

CVE-2014-8609 Copy Chapter

The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.

• https://github.com/MazX0p/CVE-2014-8609-POC :

• https://github.com/ratiros01/CVE-2014-8609-exploit :

• https://github.com/locisvv/Vulnerable-CVE-2014-8609 :

CVE-2014-8275 Copy Chapter

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

• https://github.com/uthrasri/CVE-2014-8275_openssl_g2.5 :

• https://github.com/uthrasri/Openssl_G2.5_CVE-2014-8275 :

CVE-2014-8244 Copy Chapter

Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote attackers to obtain sensitive information or modify data via a JNAP action in a JNAP/ HTTP request.

• https://github.com/JollyJumbuckk/LinksysLeaks :

CVE-2014-8142 Copy Chapter

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.

• https://github.com/3xp10it/php_cve-2014-8142_cve-2015-0231 :

CVE-2014-8110 Copy Chapter

Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

• https://github.com/tafamace/CVE-2014-8110 :

CVE-2014-7921 Copy Chapter

mediaserver in Android 4.0.3 through 5.x before 5.1 allows attackers to gain privileges. NOTE: This is a different vulnerability than CVE-2014-7920.

• https://github.com/laginimaineb/cve-2014-7920-7921 :

CVE-2014-7920 Copy Chapter

mediaserver in Android 2.2 through 5.x before 5.1 allows attackers to gain privileges. NOTE: This is a different vulnerability than CVE-2014-7921.

• https://github.com/laginimaineb/cve-2014-7920-7921 :

• https://github.com/Vinc3nt4H/cve-2014-7920-7921_update :

CVE-2014-7912 Copy Chapter

The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a large length value of an option in a DHCPACK message.

• https://github.com/vaginessa/cve-2014-7912 :

CVE-2014-7911 Copy Chapter

luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.

• https://github.com/retme7/CVE-2014-7911_poc :

• https://github.com/retme7/CVE-2014-4322_poc :

• https://github.com/GeneBlue/cve-2014-7911-exp :

• https://github.com/heeeeen/CVE-2014-7911poc :

• https://github.com/ele7enxxh/CVE-2014-7911 :

• https://github.com/koozxcv/CVE-2014-7911-CVE-2014-4322_get_root_privilege :

• https://github.com/koozxcv/CVE-2014-7911 :

• https://github.com/vaginessa/cve-2014-7912 :

CVE-2014-7816 Copy Chapter

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.

• https://github.com/shoucheng3/undertow-io__undertow_CVE-2014-7816_1-0-16-Final :

CVE-2014-7236 Copy Chapter

Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to do/view/Main/WebHome.

• https://github.com/m0nad/CVE-2014-7236_Exploit :

CVE-2014-7205 Copy Chapter

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.

• https://github.com/maximilianmarx/bassmaster-rce :

• https://github.com/AndrewTrube/CVE-2014-7205 :

CVE-2014-7169 Copy Chapter

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

• https://github.com/chef-boneyard/bash-shellshock :

• https://github.com/Gobinath-B/SHELL-SCHOCK :

• https://github.com/gina-alaska/bash-cve-2014-7169-cookbook :

• https://github.com/Kushiro45/shellshock-poc-cve-2014-7169 :

• https://github.com/renanvicente/puppet-shellshock :

• https://github.com/ajansha/shellshock :

CVE-2014-6721 Copy Chapter

The Pharmaguideline (aka com.pharmaguideline) application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

• https://github.com/sagisar1/CVE-2014-6721-exploit-Shellshock :

CVE-2014-6577 Copy Chapter

Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the original researcher's claim that this is an XML external entity (XXE) vulnerability in the XML parser, which allows attackers to conduct internal port scanning, perform SSRF attacks, or cause a denial of service via a crafted (1) http: or (2) ftp: URI.

• https://github.com/SecurityArtWork/oracle-xxe-sqli :

CVE-2014-6332 Copy Chapter

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."

• https://github.com/MarkoArmitage/metasploit-framework :

• https://github.com/mourr/CVE-2014-6332 :

• https://github.com/tjjh89017/cve-2014-6332 :

CVE-2014-6287 Copy Chapter

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

• https://github.com/VICXOR/HFSZap :

• https://github.com/randallbanner/Rejetto-HTTP-File-Server-HFS-2.3.x---Remote-Command-Execution :

• https://github.com/mrintern/thm_steelmountain_CVE-2014-6287 :

• https://github.com/Nicoslo/Windows-exploitation-Rejetto-HTTP-File-Server-HFS-2.3.x-CVE-2014-6287 :

• https://github.com/roughiz/cve-2014-6287.py :

• https://github.com/zhsh9/CVE-2014-6287 :

• https://github.com/10cks/CVE-2014-6287 :

• https://github.com/nika0x38/CVE-2014-6287 :

• https://github.com/jagg3rsec/CVE-2014-6287 :

• https://github.com/Z3R0space/CVE-2014-6287 :

• https://github.com/francescobrina/hfs-cve-2014-6287-exploit :

• https://github.com/JoaZ94/rejjeto_hfs-rce-exploit-cve-2014-6287 :

• https://github.com/rahisec/rejetto-http-file-server-2.3.x-RCE-exploit-CVE-2014-6287 :

• https://github.com/abanop22333/Steel-Mountain-TryHackMe-Walkthrough-Windows-Privilege-Escalation-HFS-RCE :

• https://github.com/R3fr4kt/Optimum :

CVE-2014-6271 Copy Chapter

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

• https://github.com/opsxcq/exploit-CVE-2014-6271 :

• https://github.com/capture0x/XSHOCK :

• https://github.com/scottjpack/shellshock_scanner :

• https://github.com/hmlio/vaas-cve-2014-6271 :

• https://github.com/b4keSn4ke/CVE-2014-6271 :

• https://github.com/cj1324/CGIShell :

• https://github.com/francisck/shellshock-cgi :

• https://github.com/indiandragon/Shellshock-Vulnerability-Scan :

• https://github.com/P0cL4bs/ShellShock-CGI-Scan :

• https://github.com/npm/ansible-bashpocalypse :

• https://github.com/J0hnTh3Kn1ght/CVE-2014-6271 :

• https://github.com/akr3ch/CVE-2014-6271 :

• https://github.com/zalalov/CVE-2014-6271 :

• https://github.com/ksang/shellshock :

• https://github.com/securusglobal/BadBash :

• https://github.com/0x00-0x00/CVE-2014-6271 :

• https://github.com/akiraaisha/shellshocker-python :

• https://github.com/RainMak3r/Rainstorm :

• https://github.com/sch3m4/RIS :

• https://github.com/r4z0r5/SwissArmyShellshocker :

• https://github.com/ramnes/pyshellshock :

• https://github.com/Anklebiter87/Cgi-bin_bash_Reverse :

• https://github.com/proclnas/ShellShock-CGI-Scan :

• https://github.com/0xN7y/CVE-2014-6271 :

• https://github.com/sunnyjiang/shellshocker-android :

• https://github.com/im2sinister/CVE-2014-6271 :

• https://github.com/Any3ite/CVE-2014-6271 :

• https://github.com/RadYio/CVE-2014-6271 :

• https://github.com/mochizuki875/CVE-2014-6271-Apache-Debian :

• https://github.com/APSL/salt-shellshock :

• https://github.com/ryeyao/CVE-2014-6271_Test :

• https://github.com/gabemarshall/shocknaww :

• https://github.com/Gurguii/cgi-bin-shellshock :

• https://github.com/TheRealCiscoo/shellshock-manual-exploitation :

• https://github.com/TheRealCiscoo/shellshock-poc :

• https://github.com/themson/shellshock :

• https://github.com/FREEGUY-6/dmz-security-monitoring-hardening :

• https://github.com/V3nG4mxV1p3r/Mobile-Drop-Device-SOC-Detection :

• https://github.com/somhm-solutions/Shell-Shock :

• https://github.com/MuirlandOracle/CVE-2014-6271-IPFire :

• https://github.com/352926/shellshock_crawler :

• https://github.com/wenyu1999/bash-shellshock :

• https://github.com/cved-sources/cve-2014-6271 :

• https://github.com/0xBlackash/CVE-2014-6271 :

• https://github.com/villadora/CVE-2014-6271 :

• https://github.com/AlissonFaoli/Shellshock :

• https://github.com/knightc0de/Shellshock_vuln_Exploit :

• https://github.com/Industri4l-H3ll-Xpl0it3rs/CVE-2014-6271-Shellshock :

• https://github.com/moften/CVE-2014-6271 :

• https://github.com/Dilith006/CVE-2014-6271 :

• https://github.com/mritunjay-k/CVE-2014-6271 :

• https://github.com/rsherstnev/CVE-2014-6271 :

• https://github.com/kaleth4/-CVE-2014-6271 :

• https://github.com/Brandaoo/CVE-2014-6271 :

• https://github.com/Sindadziy/cve-2014-6271 :

• https://github.com/mattclegg/CVE-2014-6271 :

• https://github.com/kaleth4/CVE-2014-6271 :

• https://github.com/woltage/CVE-2014-6271 :

• https://github.com/Aruthw/CVE-2014-6271 :

• https://github.com/kowshik-sundararajan/CVE-2014-6271 :

• https://github.com/dlitz/bash-cve-2014-6271-fixes :

• https://github.com/Pilou-Pilou/docker_CVE-2014-6271. :

• https://github.com/DrHaitham/CVE-2014-6271-Shellshock- :

• https://github.com/shawntns/exploit-CVE-2014-6271 :

• https://github.com/hanmin0512/CVE-2014-6271_pwnable :

• https://github.com/rashmikadileeshara/CVE-2014-6271-Shellshock- :

• https://github.com/YunchoHang/CVE-2014-6271-SHELLSHOCK :

• https://github.com/caverm/Shellshock_CVE-2014-6271 :

• https://github.com/cyberharsh/Shellbash-CVE-2014-6271 :

• https://github.com/rrreeeyyy/cve-2014-6271-spec :

• https://github.com/andres101c/Shellshock-CVE-2014-6271 :

• https://github.com/w4fz5uck5/ShockZaum-CVE-2014-6271 :

• https://github.com/kelleykong/cve-2014-6271-mengjia-kong :

• https://github.com/jblaine/cookbook-bash-CVE-2014-6271 :

• https://github.com/alexgar207/Shellshock-Attack-CVE--2014-6271- :

• https://github.com/ilismal/Nessus_CVE-2014-6271_check :

• https://github.com/ryancnelson/patched-bash-4.3 :

• https://github.com/CyberCTF/vulhub-bash-cve-2014-6271 :

• https://github.com/huanlu/cve-2014-6271-huan-lu :

• https://github.com/Sindayifu/CVE-2019-14287-CVE-2014-6271 :

• https://github.com/anujbhan/shellshock-victim-host :

• https://github.com/renanvicente/puppet-shellshock :

• https://github.com/teedeedubya/bash-fix-exploit :

• https://github.com/FilipStudeny/-CVE-2014-6271-Shellshock-Remote-Command-Injection- :

• https://github.com/RAJMadhusankha/Shellshock-CVE-2014-6271-Exploitation-and-Analysis :

• https://github.com/justzx2011/bash-up :

• https://github.com/u20024804/bash-3.2-fixed-CVE-2014-6271 :

• https://github.com/u20024804/bash-4.2-fixed-CVE-2014-6271 :

• https://github.com/u20024804/bash-4.3-fixed-CVE-2014-6271 :

• https://github.com/ariarijp/vagrant-shellshock :

• https://github.com/internero/debian-lenny-bash_3.2.52-cve-2014-6271 :

• https://github.com/heikipikker/shellshock-shell :

• https://github.com/mgiftson0/linux-env-vars-shellshock-lab :

• https://github.com/FacundoMfernandez/pentesting-obioba :

• https://github.com/ajansha/shellshock :

• https://github.com/mtaha-sec/bash-apocalypse :

• https://github.com/R3fr4kt/Shocker-TJNULL-OSCP- :

• https://github.com/ambjlou/it355-lab4-enterprise-lan-security :

• https://github.com/HevenTafese/Penetration-Testing-Walkthrough-Hacksudo-Thor :

• https://github.com/JohnRyk/ICMPShock3 :

CVE-2014-5460 Copy Chapter

Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/.

• https://github.com/F-0x57/CVE-2014-5460 :

CVE-2014-5329 Copy Chapter

GIGAPOD file servers (Appliance model and Software model) provide two web interfaces, 80/tcp and 443/tcp for user operation, and 8001/tcp for administrative operation.
8001/tcp is served by a version of Apache HTTP server containing a flaw in handling HTTP requests (CVE-2011-3192), which may lead to a denial-of-service (DoS) condition.

• https://github.com/warmilk/http-Dos-Attack-Detection :

CVE-2014-5301 Copy Chapter

Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4.

• https://github.com/AndyCyberSec/OSCP :

CVE-2014-5284 Copy Chapter

host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before automatic IP blocking is performed.

• https://github.com/mbadanoiu/CVE-2014-5284 :

CVE-2014-5139 Copy Chapter

The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

• https://github.com/uthrasri/CVE-2014-5139 :

• https://github.com/uthrasri/G2.5_openssl_CVE-2014-5139 :

CVE-2014-4943 Copy Chapter

The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.

• https://github.com/redes-2015/l2tp-socket-bug :

CVE-2014-4936 Copy Chapter

The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.

• https://github.com/0x3a/CVE-2014-4936 :

CVE-2014-4725 Copy Chapter

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

• https://github.com/AnotherSec/CVE-2014-4725 :

CVE-2014-4699 Copy Chapter

The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.

• https://github.com/vnik5287/cve-2014-4699-ptrace :

CVE-2014-4688 Copy Chapter

pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_dns.php in a Create Alias action, (2) the smartmonemail value to diag_smart.php, or (3) the database value to status_rrd_graph_img.php.

• https://github.com/andyfeili/CVE-2014-4688 :

• https://github.com/jaydenblair/CVE-2014-4688-pfsense :

• https://github.com/note0577/CVE-2014-4688-NodeJs-Exploit :

CVE-2014-4671 Copy Chapter

Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.

• https://github.com/cph/rabl-old :

CVE-2014-4511 Copy Chapter

Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.

• https://github.com/michaelsss1/gitlist-RCE :

CVE-2014-4481 Copy Chapter

Integer overflow in CoreGraphics in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.

• https://github.com/feliam/CVE-2014-4481 :

CVE-2014-4378 Copy Chapter

CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted PDF document.

• https://github.com/feliam/CVE-2014-4378 :

CVE-2014-4377 Copy Chapter

Integer overflow in CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.

• https://github.com/feliam/CVE-2014-4377 :

• https://github.com/davidmurray/CVE-2014-4377 :

CVE-2014-4323 Copy Chapter

The mdp_lut_hw_update function in drivers/video/msm/mdp.c in the MDP display driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain start and length values within an ioctl call, which allows attackers to gain privileges via a crafted application.

• https://github.com/marcograss/cve-2014-4323 :

CVE-2014-4322 Copy Chapter

drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain offset, length, and base values within an ioctl call, which allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application.

• https://github.com/retme7/CVE-2014-4322_poc :

• https://github.com/laginimaineb/cve-2014-4322 :

• https://github.com/koozxcv/CVE-2014-7911-CVE-2014-4322_get_root_privilege :

• https://github.com/askk/CVE-2014-4322_adaptation :

• https://github.com/koozxcv/CVE-2014-4322 :

CVE-2014-4321 Copy Chapter

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/android-rooting-tools/libmsm_vfe_read_exploit :

CVE-2014-4210 Copy Chapter

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services.

• https://github.com/daybreak-kits/weblogicScanner :

• https://github.com/NoneNotNull/SSRFX :

• https://github.com/NHPT/WebLogic-SSRF_CVE-2014-4210 :

• https://github.com/unmanarc/CVE-2014-4210-SSRF-PORTSCANNER-POC :

• https://github.com/ZorvithonLeo/Exploit-CVE-2014-4210- :

CVE-2014-4140 Copy Chapter

Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."

• https://github.com/day6reak/CVE-2014-4140 :

CVE-2014-4114 Copy Chapter

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."

• https://github.com/gousseine-systems/vuln-rabilit-windows7 :

CVE-2014-4113 Copy Chapter

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."

• https://github.com/sam-b/CVE-2014-4113 :

• https://github.com/nsxz/Exploit-CVE-2014-4113 :

• https://github.com/johnjohnsp1/CVE-2014-4113 :

• https://github.com/wikiZ/cve-2014-4113 :

CVE-2014-4109 Copy Chapter

Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2799, CVE-2014-4059, CVE-2014-4065, CVE-2014-4079, CVE-2014-4081, CVE-2014-4083, CVE-2014-4085, CVE-2014-4088, CVE-2014-4090, CVE-2014-4094, CVE-2014-4097, CVE-2014-4100, CVE-2014-4103, CVE-2014-4104, CVE-2014-4105, CVE-2014-4106, CVE-2014-4107, CVE-2014-4108, CVE-2014-4110, and CVE-2014-4111.

• https://github.com/day6reak/CVE-2014-4109 :

CVE-2014-4076 Copy Chapter

Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka "TCP/IP Elevation of Privilege Vulnerability."

• https://github.com/fungoshacks/CVE-2014-4076 :

CVE-2014-4014 Copy Chapter

The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.

• https://github.com/vnik5287/cve-2014-4014-privesc :

CVE-2014-3704 Copy Chapter

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.

• https://github.com/Neldeborg/Drupalgeddon-Python3 :

• https://github.com/happynote3966/CVE-2014-3704 :

• https://github.com/joaomorenorf/CVE-2014-3704 :

• https://github.com/CyberCTF/vulhub-drupal-cve-2014-3704 :

• https://github.com/AleDiBen/Drupalgeddon :

• https://github.com/adfortunato/metasploitable3-pentest-writeup :

• https://github.com/fbm31/Audit-BlackBox-Web-to-Root :

CVE-2014-3656 Copy Chapter

JBoss KeyCloak: XSS in login-status-iframe.html

• https://github.com/shoucheng3/keycloak__keycloak_CVE-2014-3656_1-0-5-Final :

CVE-2014-3625 Copy Chapter

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

• https://github.com/ilmila/springcss-cve-2014-3625 :

• https://github.com/gforresu/SpringPathTraversal :

CVE-2014-3576 Copy Chapter

The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.

• https://github.com/shoucheng3/apache__activemq_CVE-2014-3576_5-10-1 :

CVE-2014-3570 Copy Chapter

The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.

• https://github.com/uthrasri/CVE-2014-3570 :

• https://github.com/uthrasri/openssl_G2.5_CVE-2014-3570 :

• https://github.com/uthrasri/Openssl_G2.5_CVE-2014-3570_01 :

• https://github.com/uthrasri/CVE-2014-3570_G2.5_openssl_no_patch :

CVE-2014-3566 Copy Chapter

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

• https://github.com/mpgn/poodle-PoC :

• https://github.com/anthophilee/A2SV--SSL-VUL-Scan :

• https://github.com/mikesplain/CVE-2014-3566-poodle-cookbook :

• https://github.com/GoRuGoo/poodle-attack-sandbox :

• https://github.com/josecl200/VC-PoodlePOC :

• https://github.com/uthrasri/openssl_g2.5_CVE-2014-3566 :

• https://github.com/cloudpassage/mangy-beast :

• https://github.com/jmonge12/Home-Network-Vulnerability-Assessment :

CVE-2014-3551 Copy Chapter

Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.

• https://github.com/JavaGarcia/CVE-2014-3551 :

CVE-2014-3507 Copy Chapter

Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.

• https://github.com/Satheesh575555/openSSL_1.0.1g_CVE-2014-3507 :

CVE-2014-3466 Copy Chapter

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.

• https://github.com/azet/CVE-2014-3466_PoC :

CVE-2014-3341 Copy Chapter

The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

• https://github.com/ehabhussein/snmpvlan :

CVE-2014-3206 Copy Chapter

Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.

• https://github.com/laccart/CVE-2014-3206 :

CVE-2014-3153 Copy Chapter

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

• https://github.com/timwr/CVE-2014-3153 :

• https://github.com/geekben/towelroot :

• https://github.com/dangtunguyen/TowelRoot :

• https://github.com/android-rooting-tools/libfutex_exploit :

• https://github.com/lieanu/CVE-2014-3153 :

• https://github.com/elongl/CVE-2014-3153 :

• https://github.com/zerodavinci/CVE-2014-3153-exploit :

• https://github.com/sin4ts/CVE2014-3153 :

• https://github.com/c3c/CVE-2014-3153 :

• https://github.com/c4mx/Linux-kernel-code-injection_CVE-2014-3153 :

CVE-2014-3120 Copy Chapter

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

• https://github.com/echohtp/ElasticSearch-CVE-2014-3120 :

• https://github.com/jeffgeiger/es_inject :

• https://github.com/CyberCTF/vulhub-elasticsearch-cve-2014-3120 :

• https://github.com/xpgdgit/CVE-2014-3120 :

• https://github.com/Dungsocool/CVE-2014-3120 :

CVE-2014-2815 Copy Chapter

Microsoft OneNote 2007 SP3 allows remote attackers to execute arbitrary code via a crafted OneNote file that triggers creation of an executable file in a startup folder, aka "OneNote Remote Code Execution Vulnerability."

• https://github.com/Edubr2020/CABTrap_OneNote2007 :

CVE-2014-2734 Copy Chapter

The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not appear to be related to a demonstration of the issue. As of 20140502, CVE is not aware of any public comment by the original researcher

• https://github.com/adrienthebo/cve-2014-2734 :

• https://github.com/gdisneyleugers/CVE-2014-2734 :

CVE-2014-2630 Copy Chapter

Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via unknown vectors.

• https://github.com/redtimmy/perf-exploiter :

CVE-2014-2383 Copy Chapter

dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.

• https://github.com/Relativ3Pa1n/CVE-2014-2383-LFI-to-RCE-Escalation :

CVE-2014-2324 Copy Chapter

Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.

• https://github.com/sp4c30x1/uc_httpd_exploit :

CVE-2014-2323 Copy Chapter

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

• https://github.com/cirocosta/lighty-sqlinj-demo :

CVE-2014-2321 Copy Chapter

web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials.

• https://github.com/injectionmethod/ZTE-Vuln-4-Skids :

• https://github.com/injectionmethod/Windows-ZTE-Loader :

CVE-2014-2064 Copy Chapter

The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.

• https://github.com/Naramsim/Offensive :

CVE-2014-2023 Copy Chapter

Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to (1) unsubscribe_forum.php or (2) unsubscribe_topic.php in mobiquo/functions/.

• https://github.com/tintinweb/pub :

CVE-2014-2022 Copy Chapter

SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request.

• https://github.com/tintinweb/pub :

CVE-2014-2021 Copy Chapter

Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.

• https://github.com/tintinweb/pub :

CVE-2014-1904 Copy Chapter

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.

• https://github.com/Naramsim/Offensive :

CVE-2014-1812 Copy Chapter

The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share, as exploited in the wild in May 2014, aka "Group Policy Preferences Password Elevation of Privilege Vulnerability."

• https://github.com/mauricelambert/gpp-encrypt :

CVE-2014-1773 Copy Chapter

Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1783, CVE-2014-1784, CVE-2014-1786, CVE-2014-1795, CVE-2014-1805, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.

• https://github.com/day6reak/CVE-2014-1773 :

CVE-2014-1767 Copy Chapter

Double free vulnerability in the Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

• https://github.com/ExploitCN/CVE-2014-1767-EXP-PAPER :

CVE-2014-1677 Copy Chapter

Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.

• https://github.com/tihmstar/freePW_tc7200Eploit :

CVE-2014-1447 Copy Chapter

Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (libvirtd crash) by closing a connection before a keepalive response is sent.

• https://github.com/tagatac/libvirt-CVE-2014-1447 :

CVE-2014-1322 Copy Chapter

The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it easier for local users to bypass the ASLR protection mechanism by reading an unspecified attribute of the object.

• https://github.com/raymondpittman/IPC-Memory-Mac-OSX-Exploit :

CVE-2014-1266 Copy Chapter

The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.

• https://github.com/gabrielg/CVE-2014-1266-poc :

• https://github.com/landonf/Testability-CVE-2014-1266 :

• https://github.com/macressler/SSLPatch :

• https://github.com/meetlight942/PentesterLab-Intercept-CVE-2014-1266 :

CVE-2014-0994 Copy Chapter

Heap-based buffer overflow in the ReadDIB function in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows context-dependent attackers to execute arbitrary code via the BITMAPINFOHEADER.biClrUsed field in a BMP file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0993.

• https://github.com/helpsystems/Embarcadero-Workaround :

CVE-2014-0993 Copy Chapter

Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

• https://github.com/helpsystems/Embarcadero-Workaround :

CVE-2014-0816 Copy Chapter

Unspecified vulnerability in Norman Security Suite 10.1 and earlier allows local users to gain privileges via unknown vectors.

• https://github.com/tandasat/CVE-2014-0816 :

CVE-2014-0521 Copy Chapter

Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X do not properly implement JavaScript APIs, which allows remote attackers to obtain sensitive information via a crafted PDF document.

• https://github.com/molnarg/cve-2014-0521 :

CVE-2014-0472 Copy Chapter

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."

• https://github.com/christasa/CVE-2014-0472 :

CVE-2014-0346 Copy Chapter

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0160. Reason: This candidate is a reservation duplicate of CVE-2014-0160. Notes: All CVE users should reference CVE-2014-0160 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

• https://github.com/Songul-Kizilay/CVE-2014-0346 :

CVE-2014-0291 Copy Chapter

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2014. Notes: none

• https://github.com/niccoX/patch-openssl-CVE-2014-0291_CVE-2015-0204 :

CVE-2014-0282 Copy Chapter

Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1775, CVE-2014-1779, CVE-2014-1799, CVE-2014-1803, and CVE-2014-2757.

• https://github.com/Charmve/PyStegosploit :

CVE-2014-0226 Copy Chapter

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.

• https://github.com/shreesh1/CVE-2014-0226-poc :

CVE-2014-0224 Copy Chapter

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

• https://github.com/Tripwire/OpenSSL-CCS-Inject-Test :

• https://github.com/ssllabs/openssl-ccs-cve-2014-0224 :

• https://github.com/secretnonempty/CVE-2014-0224 :

• https://github.com/anthophilee/A2SV--SSL-VUL-Scan :

• https://github.com/iph0n3/CVE-2014-0224 :

• https://github.com/droptables/ccs-eval :

CVE-2014-0221 Copy Chapter

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

• https://github.com/tpdlshdmlrkfmcla/OpenSSL_DTLS_CVE_2014_0221 :

CVE-2014-0196 Copy Chapter

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

• https://github.com/tempbottle/CVE-2014-0196 :

• https://github.com/SunRain/CVE-2014-0196 :

CVE-2014-0195 Copy Chapter

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

• https://github.com/ricedu/CVE-2014-0195 :

• https://github.com/PezwariNaan/CVE-2014-0195 :

CVE-2014-0166 Copy Chapter

The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.

• https://github.com/Ettack/POC-CVE-2014-0166 :

CVE-2014-0160 Copy Chapter

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

• https://github.com/FiloSottile/Heartbleed :

• https://github.com/musalbas/heartbleed-masstest :

• https://github.com/titanous/heartbleeder :

• https://github.com/Lekensteyn/pacemaker :

• https://github.com/sensepost/heartbleed-poc :

• https://github.com/einaros/heartbleed-tools :

• https://github.com/mpgn/heartbleed-PoC :

• https://github.com/isgroup/openmagic :

• https://github.com/jdauphant/patch-openssl-CVE-2014-0160 :

• https://github.com/DisK0nn3cT/MaltegoHeartbleed :

• https://github.com/OffensivePython/HeartLeak :

• https://github.com/hmlio/vaas-cve-2014-0160 :

• https://github.com/hybridus/heartbleedscanner :

• https://github.com/0x90/CVE-2014-0160 :

• https://github.com/DominikTo/bleed :

• https://github.com/0xinf0/bleeding_onions :

• https://github.com/hreese/heartbleed-dtls :

• https://github.com/undacmic/heartbleed-proof-of-concept :

• https://github.com/anthophilee/A2SV--SSL-VUL-Scan :

• https://github.com/yryz/heartbleed.js :

• https://github.com/mozilla-services/Heartbleed :

• https://github.com/ingochris/heartpatch.us :

• https://github.com/cheese-hub/heartbleed :

• https://github.com/zouguangxian/heartbleed :

• https://github.com/cyphar/heartthreader :

• https://github.com/pblittle/aws-suture :

• https://github.com/GuillermoEscobero/heartbleed :

• https://github.com/amerine/coronary :

• https://github.com/GardeniaWhite/fuzzing :

• https://github.com/waqasjamal-zz/HeartBleed-Vulnerability-Checker :

• https://github.com/indrajeetmp11/Heartbleed-PoC-Exploit-Script :

• https://github.com/PinkP4nther/Heartbleed_PoC :

• https://github.com/Saymeis/HeartBleed :

• https://github.com/vortextube/ssl_scanner :

• https://github.com/sammyfung/openssl-heartbleed-fix :

• https://github.com/Xyl2k/CVE-2014-0160-Chrome-Plugin :

• https://github.com/proactiveRISK/heartbleed-extention :

• https://github.com/xlucas/heartbleed :

• https://github.com/belmind/heartbleed :

• https://github.com/xanas/heartbleed.py :

• https://github.com/GeeksXtreme/ssl-heartbleed.nse :

• https://github.com/caiqiqi/OpenSSL-HeartBleed-CVE-2014-0160-PoC :

• https://github.com/cved-sources/cve-2014-0160 :

• https://github.com/0xBlackash/CVE-2014-0160 :

• https://github.com/a0726h77/heartbleed-test :

• https://github.com/cbk914/heartbleed-checker :

• https://github.com/22imer/CVE-2014-0160 :

• https://github.com/ice-security88/CVE-2014-0160 :

• https://github.com/fb1h2s/CVE-2014-0160 :

• https://github.com/tungduongNT/CVE-2014-0160. :

• https://github.com/obayesshelton/CVE-2014-0160-Scanner :

• https://github.com/h3x0v3rl0rd/CVE-2014-0160_Heartbleed :

• https://github.com/timsonner/cve-2014-0160-heartbleed :

• https://github.com/siddolo/knockbleed :

• https://github.com/MrE-Fog/CVE-2014-0160-Chrome-Plugin :

• https://github.com/CyberCTF/vulhub-openssl-cve-2014-0160 :

• https://github.com/marstornado/cve-2014-0160-Yunfeng-Jiang :

• https://github.com/yashfren/CVE-2014-0160-HeartBleed :

• https://github.com/iwaffles/heartbleed-test.crx :

• https://github.com/froyo75/Heartbleed_Dockerfile_with_Nginx :

• https://github.com/indiw0rm/-Heartbleed- :

• https://github.com/IhsSpotlight/HeartBleed-CVE-2014-0160--SCRIPTS-python3 :

• https://github.com/artofscripting-zz/cmty-ssl-heartbleed-CVE-2014-0160-HTTP-HTTPS :

• https://github.com/takeshixx/ssl-heartbleed.nse :

• https://github.com/L1LF1NG3R/heartbleed-vulnerability-exploitation :

• https://github.com/0xTaoZ/Heartbleed-CSP-project :

• https://github.com/WildfootW/CVE-2014-0160_OpenSSL_1.0.1f_Heartbleed :

• https://github.com/SimoesCTT/CTT-HEARTBLEED-Temporal-Resonance-Memory-Leak-Exploit-Heartbleed-CVE-2014-0160 :

• https://github.com/rouze-d/heartbleed :

• https://github.com/roganartu/heartbleedchecker-chrome :

• https://github.com/iSCInc/heartbleed :

• https://github.com/victoriacfigueiredo/heartbleed-lab :

• https://github.com/idkqh7/heatbleeding :

• https://github.com/Shayhha/HeartbleedAttack :

• https://github.com/tomdevman/heartbleed-bug :

• https://github.com/ThanHuuTuan/Heartexploit :

• https://github.com/Ayushsinha322/heartbleed-lab :

• https://github.com/Ryo-Soikutsu/Heartbleed :

• https://github.com/ArtemCyberLab/Project-Field-Analysis-and-Memory-Leak-Demonstration :

• https://github.com/pierceoneill/bleeding-heart :

CVE-2014-0130 Copy Chapter

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

• https://github.com/omarkurt/cve-2014-0130 :

CVE-2014-0114 Copy Chapter

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

• https://github.com/rgielen/struts1filter :

• https://github.com/aenlr/strutt-cve-2014-0114 :

• https://github.com/ricedu/struts1-patch :

CVE-2014-0094 Copy Chapter

The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.

• https://github.com/y0d3n/CVE-2014-0094 :

• https://github.com/HasegawaTadamitsu/CVE-2014-0094-test-program-for-struts1 :

CVE-2014-0075 Copy Chapter

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

• https://github.com/LiviuPtr/CVE-2014-0075_PoC :

CVE-2014-0050 Copy Chapter

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

• https://github.com/jrrdev/cve-2014-0050 :

CVE-2014-0043 Copy Chapter

In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in use.

• https://github.com/JJK96/JavaClasspathEnum :

CVE-2014-0038 Copy Chapter

The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.

• https://github.com/saelo/cve-2014-0038 :

• https://github.com/kiruthikan99/IT19115276 :

Overview (`2015/README.md`) Copy Section

CVE-2015-20107 Copy Chapter

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

• https://github.com/codeskipper/python-patrol :

CVE-2015-10141 Copy Chapter

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.

• https://github.com/D3Ext/CVE-2015-10141 :

• https://github.com/n0m4d22/PoC-CVE-2015-10141-Xdebug :

CVE-2015-10137 Copy Chapter

The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_file()' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

• https://github.com/Kai-One001/-CVE-2015-10137-WordPress-N-Media-Website-Contact-Form-with-File-Upload-1.3.4 :

CVE-2015-10034 Copy Chapter

A vulnerability has been found in j-nowak workout-organizer and classified as critical. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as 13cd6c3d1210640bfdb39872b2bb3597aa991279. It is recommended to apply a patch to fix this issue. VDB-217714 is the identifier assigned to this vulnerability.

• https://github.com/andrenasx/CVE-2015-10034 :

CVE-2015-9357 Copy Chapter

The akismet plugin before 3.1.5 for WordPress has XSS.

• https://github.com/saretawa/CVE-2015-9357-POC :

CVE-2015-9331 Copy Chapter

The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.

• https://github.com/Kairo-one/CVE-2015-9331 :

CVE-2015-9251 Copy Chapter

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

• https://github.com/halkichi0308/CVE-2015-9251 :

• https://github.com/hackgiver/CVE-2015-9251 :

• https://github.com/moften/CVE-2015-9251 :

• https://github.com/rox-11/xss :

CVE-2015-9238 Copy Chapter

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

• https://github.com/m0d0ri205/wargame-turkey_in_2 :

CVE-2015-9235 Copy Chapter

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

• https://github.com/z-bool/Venom-JWT :

• https://github.com/Nxvh1337/CVE-2015-9235_JWT_key_confusion :

• https://github.com/aalex954/jwt-key-confusion-poc :

• https://github.com/tierChampion/POC_CVE-2015-9235 :

• https://github.com/alisster00/blueHarbor :

CVE-2015-8710 Copy Chapter

The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.

• https://github.com/Karm/CVE-2015-8710 :

CVE-2015-8660 Copy Chapter

The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.

• https://github.com/whu-enjoy/CVE-2015-8660 :

• https://github.com/nhamle2/CVE-2015-8660 :

• https://github.com/carradolly/CVE-2015-8660 :

CVE-2015-8651 Copy Chapter

Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.

• https://github.com/Gitlabpro/The-analysis-of-the-cve-2015-8651 :

CVE-2015-8562 Copy Chapter

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.

• https://github.com/dmonst3r/JoomlaMassExploiter :

• https://github.com/VoidSec/Joomla_CVE-2015-8562 :

• https://github.com/ZaleHack/joomla_rce_CVE-2015-8562 :

• https://github.com/dmonst3r/CVE-2015-8562 :

• https://github.com/RobinHoutevelts/Joomla-CVE-2015-8562-PHP-POC :

• https://github.com/Caihuar/Joomla-cve-2015-8562 :

• https://github.com/atcasanova/cve-2015-8562-exploit :

• https://github.com/xnorkl/Joomla_Payload :

• https://github.com/guanjivip/CVE-2015-8562 :

• https://github.com/lorenzodegiorgi/setup-cve-2015-8562 :

• https://github.com/thejackerz/scanner-exploit-joomla-CVE-2015-8562 :

• https://github.com/drolley919/joomla-cve-2015-8562-exploit-and-linux-forensic-analysis :

CVE-2015-8550 Copy Chapter

Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.

• https://github.com/WhatsWrongAndWhy/CVE-2015-8550 :

CVE-2015-8543 Copy Chapter

The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application.

• https://github.com/bittorrent3389/CVE-2015-8543_for_SLE12SP1 :

CVE-2015-8522 Copy Chapter

Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8520, and CVE-2015-8521.

• https://github.com/damariion/CVE-2015-8522.RCE :

CVE-2015-8351 Copy Chapter

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.

• https://github.com/G4sp4rCS/exploit-CVE-2015-8351 :

• https://github.com/G01d3nW01f/CVE-2015-8351 :

• https://github.com/Philip-Otter/CVE-2015-8351_Otter_Remix :

CVE-2015-8299 Copy Chapter

Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a crafted KNXnet/IP UDP packet.

• https://github.com/kernoelpanic/CVE-2015-8299 :

CVE-2015-8277 Copy Chapter

Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode (a) 0x107 or (b) 0x10a.

• https://github.com/securifera/CVE-2015-8277-Exploit :

CVE-2015-8239 Copy Chapter

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

• https://github.com/justinsteven/sudo_digest_toctou_poc_CVE-2015-8239 :

CVE-2015-8103 Copy Chapter

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".

• https://github.com/r00t4dm/Jenkins-CVE-2015-8103 :

• https://github.com/cved-sources/cve-2015-8103 :

CVE-2015-8088 Copy Chapter

Heap-based buffer overflow in the HIFI driver in Huawei Mate 7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL10C00B354, MT7-TL00 before MT7-TL00C01B354, and MT7-CL00 before MT7-CL00C92B354 and P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01, GRA-CL00 before GRA-CL00C92B220, GRA-CL10 before GRA-CL10C92B220, GRA-UL00 before GRA-UL00C00B220, and GRA-UL10 before GRA-UL10C00B220 allows attackers to cause a denial of service (reboot) or execute arbitrary code via a crafted application.

• https://github.com/Pray3r/CVE-2015-8088 :

CVE-2015-7858 Copy Chapter

SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7297.

• https://github.com/CCrashBandicot/ContentHistory :

• https://github.com/areaventuno/exploit-joomla :

CVE-2015-7857 Copy Chapter

SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.

• https://github.com/CCrashBandicot/ContentHistory :

• https://github.com/areaventuno/exploit-joomla :

CVE-2015-7808 Copy Chapter

The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments.

• https://github.com/Prajithp/CVE-2015-7808 :

CVE-2015-7756 Copy Chapter

The encryption implementation in Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 makes it easier for remote attackers to discover the plaintext content of VPN sessions by sniffing the network for ciphertext data and conducting an unspecified decryption attack.

• https://github.com/hdm/juniper-cve-2015-7755 :

CVE-2015-7755 Copy Chapter

Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.

• https://github.com/hdm/juniper-cve-2015-7755 :

• https://github.com/cinno/CVE-2015-7755-POC :

CVE-2015-7576 Copy Chapter

The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.

• https://github.com/yield-c/CVE2015-7576 :

CVE-2015-7547 Copy Chapter

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.

• https://github.com/fjserna/CVE-2015-7547 :

• https://github.com/eSentire/cve-2015-7547-public :

• https://github.com/jgajek/cve-2015-7547 :

• https://github.com/cakuzo/CVE-2015-7547 :

• https://github.com/t0r0t0r0/CVE-2015-7547 :

• https://github.com/Stick-U235/CVE-2015-7547-Research :

• https://github.com/Amilaperera12/Glibc-Vulnerability-Exploit-CVE-2015-7547 :

• https://github.com/babykillerblack/CVE-2015-7547 :

• https://github.com/miracle03/CVE-2015-7547-master :

• https://github.com/bluebluelan/CVE-2015-7547-proj-master :

• https://github.com/rexifiles/rex-sec-glibc :

CVE-2015-7545 Copy Chapter

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

• https://github.com/avuserow/bug-free-chainsaw :

CVE-2015-7501 Copy Chapter

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

• https://github.com/ianxtianxt/CVE-2015-7501 :

CVE-2015-7297 Copy Chapter

SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858.

• https://github.com/Cappricio-Securities/CVE-2015-7297 :

• https://github.com/CCrashBandicot/ContentHistory :

• https://github.com/areaventuno/exploit-joomla :

CVE-2015-7214 Copy Chapter

Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs.

• https://github.com/llamakko/CVE-2015-7214 :

CVE-2015-6967 Copy Chapter

Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/my_image/image.php.

• https://github.com/dix0nym/CVE-2015-6967 :

• https://github.com/hadrian3689/nibbleblog_4.0.3 :

• https://github.com/innocentx0/CVE-2015-6967-EXPLOIT :

• https://github.com/cuerv0x/CVE-2015-6967 :

• https://github.com/FredBrave/CVE-2015-6967 :

• https://github.com/3mpir3Albert/HTB_Nibbles :

CVE-2015-6835 Copy Chapter

The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.

• https://github.com/ockeghem/CVE-2015-6835-checker :

CVE-2015-6748 Copy Chapter

Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.

• https://github.com/epicosy/VUL4J-59 :

CVE-2015-6668 Copy Chapter

The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.

• https://github.com/h3x0v3rl0rd/CVE-2015-6668 :

• https://github.com/G01d3nW01f/CVE-2015-6668 :

• https://github.com/jimdiroffii/CVE-2015-6668 :

• https://github.com/nika0x38/CVE-2015-6668 :

• https://github.com/NoTrustedx/Job-Manager-Disclosure :

CVE-2015-6640 Copy Chapter

The prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 does not ensure that only one vma is accessed in a certain update action, which allows attackers to gain privileges or cause a denial of service (vma list corruption) via a crafted application, aka internal bug 20017123.

• https://github.com/betalphafai/CVE-2015-6640 :

CVE-2015-6639 Copy Chapter

The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application that leverages QSEECOM access, aka internal bug 24446875.

• https://github.com/laginimaineb/ExtractKeyMaster :

• https://github.com/laginimaineb/cve-2015-6639 :

CVE-2015-6637 Copy Chapter

The MediaTek misc-sd driver in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 25307013.

• https://github.com/betalphafai/CVE-2015-6637 :

CVE-2015-6620 Copy Chapter

libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 24123723 and 24445127.

• https://github.com/flankerhqd/mediacodecoob :

• https://github.com/flankerhqd/CVE-2015-6620-POC :

CVE-2015-6606 Copy Chapter

The Secure Element Evaluation Kit (aka SEEK or SmartCard API) plugin in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 22301786.

• https://github.com/michaelroland/omapi-cve-2015-6606-exploit :

CVE-2015-6576 Copy Chapter

Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource.

• https://github.com/CallMeJonas/CVE-2015-6576 :

CVE-2015-6420 Copy Chapter

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

• https://github.com/Leeziao/CVE-2015-6420 :

CVE-2015-6357 Copy Chapter

The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.sourcefire.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide an invalid package, and consequently execute arbitrary code, via a crafted certificate, aka Bug ID CSCuw06444.

• https://github.com/mattimustang/firepwner :

CVE-2015-6132 Copy Chapter

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution Vulnerability."

• https://github.com/hexx0r/CVE-2015-6132 :

CVE-2015-6095 Copy Chapter

Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles password changes, which allows physically proximate attackers to bypass authentication, and conduct decryption attacks against certain BitLocker configurations, by connecting to an unintended Key Distribution Center (KDC), aka "Windows Kerberos Security Feature Bypass."

• https://github.com/JackOfMostTrades/bluebox :

CVE-2015-6086 Copy Chapter

Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

• https://github.com/payatu/CVE-2015-6086 :

CVE-2015-5995 Copy Chapter

Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative access via a certain admin substring in an HTTP Cookie header.

• https://github.com/shaheemirza/TendaSpill :

CVE-2015-5932 Copy Chapter

The kernel in Apple OS X before 10.11.1 allows local users to gain privileges by leveraging an unspecified "type confusion" during Mach task processing.

• https://github.com/jndok/tpwn-bis :

CVE-2015-5864 Copy Chapter

IOAudioFamily in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.

• https://github.com/jndok/tpwn-bis :

CVE-2015-5847 Copy Chapter

The Disk Images component in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.

• https://github.com/jndok/tpwn-bis :

CVE-2015-5736 Copy Chapter

The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in a (1) 0x220024 or (2) 0x220028 ioctl call.

• https://github.com/avielzecharia/CVE-2015-5736 :

• https://github.com/ApexPredator-InfoSec/forti_shield :

• https://github.com/RainbowDynamix/FortiLOL :

CVE-2015-5711 Copy Chapter

TIBCO Managed File Transfer Internet Server before 7.2.5, Managed File Transfer Command Center before 7.2.5, Slingshot before 1.9.4, and Vault before 2.0.1 allow remote authenticated users to obtain sensitive information via a crafted HTTP request.

• https://github.com/TrixSec/CVE-2015-57115 :

CVE-2015-5602 Copy Chapter

sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home///file.txt."

• https://github.com/t0kx/privesc-CVE-2015-5602 :

• https://github.com/cved-sources/cve-2015-5602 :

CVE-2015-5600 Copy Chapter

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.

• https://github.com/Abdirisaq-ali-aynab/vulnerability-assessment :

CVE-2015-5531 Copy Chapter

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

• https://github.com/MoCh3n/CVE-2015-5531-POC :

• https://github.com/xpgdgit/CVE-2015-5531 :

CVE-2015-5477 Copy Chapter

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

• https://github.com/tintinweb/pub :

• https://github.com/robertdavidgraham/cve-2015-5477 :

• https://github.com/elceef/tkeypoc :

• https://github.com/ilanyu/cve-2015-5477 :

• https://github.com/knqyf263/cve-2015-5477 :

• https://github.com/hmlio/vaas-cve-2015-5477 :

• https://github.com/xycloops123/TKEY-remote-DoS-vulnerability-exploit :

• https://github.com/likekabin/ShareDoc_cve-2015-5477 :

CVE-2015-5383 Copy Chapter

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.

• https://github.com/starnightcyber/Exploit-Database-For-Webmail :

CVE-2015-5381 Copy Chapter

Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.

• https://github.com/starnightcyber/Exploit-Database-For-Webmail :

CVE-2015-5377 Copy Chapter

Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability

• https://github.com/fi3ro/CVE-2015-5377 :

CVE-2015-5374 Copy Chapter

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions 1.02.02. Specially crafted packets sent to port 50000/UDP could cause a denial-of-service of the affected device. A manual reboot may be required to recover the service of the device.

• https://github.com/can/CVE-2015-5374-DoS-PoC :

CVE-2015-5347 Copy Chapter

Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 might allow remote attackers to inject arbitrary web script or HTML via a ModalWindow title.

• https://github.com/alexanderkjall/wicker-cve-2015-5347 :

CVE-2015-5287 Copy Chapter

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

• https://github.com/HORKimhab/CVE-2015-5287 :

CVE-2015-5254 Copy Chapter

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

• https://github.com/Catherines77/ActiveMQ-EXPtools :

• https://github.com/jas502n/CVE-2015-5254 :

• https://github.com/Ma1Dong/ActiveMQ_CVE-2015-5254 :

• https://github.com/guigui237/Exploitation-de-la-vuln-rabilit-CVE-2015-5254- :

• https://github.com/radsih/activemq-cve-lab :

CVE-2015-5195 Copy Chapter

ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.

• https://github.com/theglife214/CVE-2015-5195 :

CVE-2015-5122 Copy Chapter

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

• https://github.com/Xattam1/Adobe-Flash-Exploits_17-18 :

CVE-2015-5119 Copy Chapter

Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

• https://github.com/CiscoCXSecurity/CVE-2015-5119_walkthrough :

• https://github.com/jvazquez-r7/CVE-2015-5119 :

• https://github.com/dangokyo/CVE-2015-5119 :

• https://github.com/Xattam1/Adobe-Flash-Exploits_17-18 :

CVE-2015-4870 Copy Chapter

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser.

• https://github.com/OsandaMalith/CVE-2015-4870 :

CVE-2015-4852 Copy Chapter

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

• https://github.com/roo7break/serialator :

• https://github.com/zhzhdoai/Weblogic_Vuln :

• https://github.com/minhangxiaohui/Weblogic_direct_T3_Rces :

• https://github.com/AndersonSingh/serialization-vulnerability-scanner :

• https://github.com/nex1less/CVE-2015-4852 :

CVE-2015-4843 Copy Chapter

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

• https://github.com/Soteria-Research/cve-2015-4843-type-confusion-phrack :

CVE-2015-4495 Copy Chapter

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

• https://github.com/vincd/CVE-2015-4495 :

CVE-2015-4133 Copy Chapter

Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.

• https://github.com/D3Ext/CVE-2015-4133 :

• https://github.com/sug4r-wr41th/CVE-2015-4133 :

CVE-2015-4077 Copy Chapter

The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to read arbitrary kernel memory via a 0x22608C ioctl call.

• https://github.com/ApexPredator-InfoSec/forti_shield :

CVE-2015-4024 Copy Chapter

Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.

• https://github.com/typcn/php-load-test :

CVE-2015-4000 Copy Chapter

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

• https://github.com/fatlan/HAProxy-Keepalived-Sec-HighLoads :

• https://github.com/anthophilee/A2SV--SSL-VUL-Scan :

CVE-2015-3864 Copy Chapter

Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.

• https://github.com/eudemonics/scaredycat :

• https://github.com/pwnaccelerator/stagefright-cve-2015-3864 :

• https://github.com/HenryVHuang/CVE-2015-3864 :

• https://github.com/Cmadhushanka/CVE-2015-3864-Exploitation :

• https://github.com/Bhathiya404/Exploiting-Stagefright-Vulnerability-CVE-2015-3864 :

CVE-2015-3839 Copy Chapter

The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and process crash).

• https://github.com/Cecilia-newbie/cve-2015-3839_PoC :

CVE-2015-3837 Copy Chapter

The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute arbitrary code via an application that sends a crafted Intent, aka internal bug 21437603.

• https://github.com/roeeh/conscryptchecker :

• https://github.com/itibs/IsildursBane :

CVE-2015-3825 Copy Chapter

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-3837. Reason: This candidate is a reservation duplicate of CVE-2015-3837. Notes: All CVE users should reference CVE-2015-3837 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

• https://github.com/roeeh/conscryptchecker :

CVE-2015-3636 Copy Chapter

The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.

• https://github.com/fi01/CVE-2015-3636 :

• https://github.com/idhyt/androotzf :

• https://github.com/android-rooting-tools/libpingpong_exploit :

• https://github.com/a7vinx/CVE-2015-3636 :

• https://github.com/betalphafai/cve-2015-3636_crash :

• https://github.com/askk/libping_unhash_exploit_POC :

• https://github.com/debugfan/rattle_root :

• https://github.com/ludongxu/cve-2015-3636 :

CVE-2015-3456 Copy Chapter

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

• https://github.com/vincentbernat/cve-2015-3456 :

• https://github.com/orf53975/poisonfrog :

CVE-2015-3337 Copy Chapter

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.

• https://github.com/jas502n/CVE-2015-3337 :

CVE-2015-3306 Copy Chapter

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

• https://github.com/t0kx/exploit-CVE-2015-3306 :

• https://github.com/nootropics/propane :

• https://github.com/xyk0x/cpx_proftpd :

• https://github.com/davidtavarez/CVE-2015-3306 :

• https://github.com/cd6629/CVE-2015-3306-Python-PoC :

• https://github.com/jptr218/proftpd_bypass :

• https://github.com/cybersensei-EH/hackviser_labs_CVE-2015-3306 :

• https://github.com/0xm4ud/ProFTPD_CVE-2015-3306 :

• https://github.com/bcononugbor-source/OpenVAS-Vulnerability-Analysis-Incident-Response-Report :

• https://github.com/cved-sources/cve-2015-3306 :

• https://github.com/hackarada/cve-2015-3306 :

• https://github.com/donmedfor/CVE-2015-3306 :

• https://github.com/Z3R0space/CVE-2015-3306 :

• https://github.com/diegslva/cve-2015-3306-lab :

• https://github.com/cdedmondson/Modified-CVE-2015-3306-Exploit :

• https://github.com/netw0rk7/CVE-2015-3306-Home-Lab :

• https://github.com/canpilayda/proftpd-mod_copy-cve-2015-3306 :

• https://github.com/JoseLRC97/ProFTPd-1.3.5-mod_copy-Remote-Command-Execution :

CVE-2015-3256 Copy Chapter

PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation."

• https://github.com/puglia-ryan/S-V-Project-Implementation-of-CVE-2015-3256 :

CVE-2015-3246 Copy Chapter

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

• https://github.com/HORKimhab/CVE-2015-3246 :

CVE-2015-3239 Copy Chapter

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.

• https://github.com/RenukaSelvar/libunwind_CVE-2015-3239 :

• https://github.com/RenukaSelvar/libunwind_CVE-2015-3239_After :

• https://github.com/RenukaSelvar/libunwind_CVE-2015-3239_AfterPatch :

CVE-2015-3224 Copy Chapter

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.

• https://github.com/0xEval/cve-2015-3224 :

• https://github.com/0x00-0x00/CVE-2015-3224 :

• https://github.com/SQU4NCH/CVE-2015-3224 :

• https://github.com/roriruri9370/Whitelist-bypass :

• https://github.com/n000xy/CVE-2015-3224- :

• https://github.com/Sic4rio/CVE-2015-3224 :

CVE-2015-3197 Copy Chapter

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.

• https://github.com/Trinadh465/OpenSSL-1_0_1g_CVE-2015-3197 :

CVE-2015-3195 Copy Chapter

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

• https://github.com/Trinadh465/OpenSSL-1_0_1g_CVE-2015-3195 :

CVE-2015-3194 Copy Chapter

crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.

• https://github.com/Trinadh465/OpenSSL-1_0_1g_CVE-2015-3194 :

CVE-2015-3152 Copy Chapter

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.

• https://github.com/duo-labs/mysslstrip :

CVE-2015-3105 Copy Chapter

Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

• https://github.com/Xattam1/Adobe-Flash-Exploits_17-18 :

CVE-2015-3090 Copy Chapter

Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3078, CVE-2015-3089, and CVE-2015-3093.

• https://github.com/Xattam1/Adobe-Flash-Exploits_17-18 :

CVE-2015-3073 Copy Chapter

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, and CVE-2015-3074.

• https://github.com/reigningshells/CVE-2015-3073 :

CVE-2015-3043 Copy Chapter

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.

• https://github.com/whitehairman/Exploit :

CVE-2015-2925 Copy Chapter

The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."

• https://github.com/Kagami/docker_cve-2015-2925 :

CVE-2015-2900 Copy Chapter

The AddUserFinding add_userfinding2 function in Medicomp MEDCIN Engine before 2.22.20153.226 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted packet on port 8190.

• https://github.com/securifera/CVE-2015-2900-Exploit :

CVE-2015-2797 Copy Chapter

Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with firmware 1.0.2.0 and earlier allows remote attackers to execute arbitrary code via a long string in the redirect parameter to cgi-bin/login.

• https://github.com/Bariskizilkaya/CVE-2015-2797-PoC :

CVE-2015-2794 Copy Chapter

The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.

• https://github.com/styx00/DNN_CVE-2015-2794 :

• https://github.com/wilsc0w/CVE-2015-2794-finder :

CVE-2015-2546 Copy Chapter

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2518.

• https://github.com/k0keoyo/CVE-2015-2546-Exploit :

CVE-2015-2315 Copy Chapter

Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminder_popup action to the default URI.

• https://github.com/weidongl74/cve-2015-2315-report :

CVE-2015-2291 Copy Chapter

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.

• https://github.com/Tare05/Intel-CVE-2015-2291 :

• https://github.com/gmh5225/CVE-2015-2291 :

• https://github.com/ethanedits/iqvw64e-privilege-escalation :

• https://github.com/antoniorauso/NalCaller :

CVE-2015-2231 Copy Chapter

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/rednaga/adups-get-super-serial :

CVE-2015-2208 Copy Chapter

The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter.

• https://github.com/ptantiku/cve-2015-2208 :

CVE-2015-2153 Copy Chapter

The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU).

• https://github.com/arntsonl/CVE-2015-2153 :

CVE-2015-1986 Copy Chapter

The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2015-1938.

• https://github.com/MayaOfVeil/CVE-2015-1986 :

CVE-2015-1925 Copy Chapter

Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.

• https://github.com/damariion/CVE-2015-1925.RCE :

CVE-2015-1855 Copy Chapter

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.

• https://github.com/vpereira/CVE-2015-1855 :

CVE-2015-1805 Copy Chapter

The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun."

• https://github.com/dosomder/iovyroot :

• https://github.com/idhyt/androotzf :

• https://github.com/panyu6325/CVE-2015-1805 :

• https://github.com/ireshchaminda1/Android-Privilege-Escalation-Remote-Access-Vulnerability-CVE-2015-1805 :

• https://github.com/FloatingGuy/cve-2015-1805 :

• https://github.com/valentineus/hp-slate7-root-kit :

• https://github.com/mobilelinux/iovy_root_research :

• https://github.com/cjn304/Root-My-Galaxy-S4 :

CVE-2015-1792 Copy Chapter

The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function.

• https://github.com/Trinadh465/OpenSSL-1_0_1g_CVE-2015-1792 :

CVE-2015-1791 Copy Chapter

Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.

• https://github.com/Trinadh465/OpenSSL-1_0_1g_CVE-2015-1791 :

CVE-2015-1790 Copy Chapter

The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.

• https://github.com/Trinadh465/OpenSSL-1_0_1g_CVE-2015-1790 :

CVE-2015-1788 Copy Chapter

The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication.

• https://github.com/pazhanivel07/OpenSSL_1_0_1g_CVE-2015-1788 :

CVE-2015-1769 Copy Chapter

Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles symlinks, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Mount Manager Elevation of Privilege Vulnerability."

• https://github.com/int0/CVE-2015-1769 :

CVE-2015-1701 Copy Chapter

Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."

• https://github.com/hfiref0x/CVE-2015-1701 :

CVE-2015-1641 Copy Chapter

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

• https://github.com/Cyberclues/rtf_exploit_extractor :

CVE-2015-1635 Copy Chapter

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

• https://github.com/technion/erlvulnscan :

• https://github.com/aedoo/CVE-2015-1635-POC :

• https://github.com/Zx7ffa4512-Python/Project-CVE-2015-1635 :

• https://github.com/h3x0v3rl0rd/CVE-2015-1635-POC :

• https://github.com/neu5ron/cve_2015-1635 :

• https://github.com/bongbongco/MS15-034 :

• https://github.com/Cappricio-Securities/CVE-2015-1635 :

• https://github.com/w01ke/CVE-2015-1635-POC :

• https://github.com/hedgecore/HTTPsys :

• https://github.com/u0pattern/Remove-IIS-RIIS :

• https://github.com/h3x0v3rl0rd/CVE-2015-1635 :

• https://github.com/moeinmiadi/CVE-2015-1635_PoC :

• https://github.com/SkinAir/ms15-034-Scan :

• https://github.com/wiredaem0n/chk-ms15-034 :

CVE-2015-1592 Copy Chapter

Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.

• https://github.com/lightsey/cve-2015-1592 :

CVE-2015-1579 Copy Chapter

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.

• https://github.com/dmonst3r/WordPressMassExploiter :

• https://github.com/dmonst3r/CVE-2015-1579 :

CVE-2015-1578 Copy Chapter

Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) pidvesa cookie to u5admin/pidvesa.php or (2) uri parameter to u5admin/meta2.php.

• https://github.com/Zeppperoni/CVE-2015-1578 :

• https://github.com/yaldobaoth/CVE-2015-1578-PoC :

• https://github.com/yaldobaoth/CVE-2015-1578-PoC-Metasploit :

CVE-2015-1561 Copy Chapter

The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon 19.10.0) uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ns_id parameter.

• https://github.com/Iansus/Centreon-CVE-2015-1560_1561 :

CVE-2015-1560 Copy Chapter

SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon web 2.7.0) allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.

• https://github.com/Iansus/Centreon-CVE-2015-1560_1561 :

CVE-2015-1538 Copy Chapter

Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.

• https://github.com/jduck/cve-2015-1538-1 :

• https://github.com/oguzhantopgul/cve-2015-1538-1 :

• https://github.com/Tharana/vulnerability-exploitation :

• https://github.com/renjithsasidharan/cve-2015-1538-1 :

• https://github.com/Tharana/Android-vulnerability-exploitation :

• https://github.com/niranjanshr13/Stagefright-cve-2015-1538-1 :

• https://github.com/xsleaksiki/cve :

CVE-2015-1528 Copy Chapter

Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application, aka internal bug 19334482.

• https://github.com/secmob/PoCForCVE-2015-1528 :

• https://github.com/kanpol/PoCForCVE-2015-1528 :

CVE-2015-1474 Copy Chapter

Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values.

• https://github.com/p1gl3t/CVE-2015-1474_poc :

CVE-2015-1427 Copy Chapter

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

• https://github.com/t0kx/exploit-CVE-2015-1427 :

• https://github.com/cved-sources/cve-2015-1427 :

• https://github.com/shavchen/cve2015_1427 :

• https://github.com/xpgdgit/CVE-2015-1427 :

• https://github.com/Sebikea/CVE-2015-1427-for-trixie :

• https://github.com/CyberCTF/vulhub-elasticsearch-cve-2015-1427 :

• https://github.com/cyberharsh/Groovy-scripting-engine-CVE-2015-1427 :

CVE-2015-1397 Copy Chapter

SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.

• https://github.com/WHOISshuvam/CVE-2015-1397 :

• https://github.com/47Cid/Magento-Shoplift-SQLI :

• https://github.com/tmatejicek/CVE-2015-1397 :

• https://github.com/Wytchwulf/CVE-2015-1397-Magento-Shoplift :

• https://github.com/0xDTC/Magento-eCommerce-RCE-CVE-2015-1397 :

CVE-2015-1328 Copy Chapter

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.

• https://github.com/elit3pwner/CVE-2015-1328-GoldenEye :

• https://github.com/0xf1d0/CVE-2015-1328 :

• https://github.com/notlikethis/CVE-2015-1328 :

• https://github.com/YastrebX/CVE-2015-1328 :

• https://github.com/FernandoCassioDev/CVE-2015-1328 :

• https://github.com/BlackFrog-hub/cve-2015-1328 :

• https://github.com/WhatsWrongAndWhy/CVE-2015-1328 :

• https://github.com/bansalkrish007-arch/cve-2015-1328 :

• https://github.com/SR7-HACKING/LINUX-VULNERABILITY-CVE-2015-1328 :

• https://github.com/saqibnet/blackbox-pentesting-infsecos :

• https://github.com/thieveshkar/RootQuest-CTF-Box-Multi-Stage-Exploitation-VM :

CVE-2015-1318 Copy Chapter

The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).

• https://github.com/ScottyBauer/CVE-2015-1318 :

CVE-2015-1187 Copy Chapter

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.

• https://github.com/christopher-leese/cve-2015-1187-dir820l-firmware-reverse-engineering :

CVE-2015-1157 Copy Chapter

CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.

• https://github.com/perillamint/CVE-2015-1157 :

CVE-2015-1140 Copy Chapter

Buffer overflow in IOHIDFamily in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors.

• https://github.com/kpwn/vpwn :

CVE-2015-1130 Copy Chapter

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors.

• https://github.com/sideeffect42/RootPipeTester :

• https://github.com/Shmoopi/RootPipe-Demo :

CVE-2015-0568 Copy Chapter

Use-after-free vulnerability in the msm_set_crop function in drivers/media/video/msm/msm_camera.c in the MSM-Camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call.

• https://github.com/betalphafai/CVE-2015-0568 :

CVE-2015-0345 Copy Chapter

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

• https://github.com/BishopFox/coldfusion-10-11-xss :

CVE-2015-0313 Copy Chapter

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.

• https://github.com/SecurityObscurity/cve-2015-0313 :

CVE-2015-0311 Copy Chapter

Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.

• https://github.com/jr64/CVE-2015-0311 :

CVE-2015-0235 Copy Chapter

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

• https://github.com/aaronfay/CVE-2015-0235-test :

• https://github.com/makelinux/CVE-2015-0235-workaround :

• https://github.com/fser/ghost-checker :

• https://github.com/gh-ost00/XMLRPC-Ghost :

• https://github.com/arm13/ghost_exploit :

• https://github.com/mikesplain/CVE-2015-0235-cookbook :

• https://github.com/furyutei/CVE-2015-0235_GHOST :

• https://github.com/nickanderson/cfengine-CVE_2015_0235 :

• https://github.com/adherzog/ansible-CVE-2015-0235-GHOST :

• https://github.com/sUbc0ol/CVE-2015-0235 :

• https://github.com/alanmeyer/CVE-glibc :

• https://github.com/tobyzxj/CVE-2015-0235 :

• https://github.com/chayim/GHOSTCHECK-cve-2015-0235 :

• https://github.com/koudaiii-archives/cookbook-update-glibc :

• https://github.com/1and1-serversupport/ghosttester :

• https://github.com/favoretti/lenny-libc6 :

• https://github.com/F88/ghostbusters15 :

CVE-2015-0231 Copy Chapter

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.

• https://github.com/3xp10it/php_cve-2014-8142_cve-2015-0231 :

CVE-2015-0205 Copy Chapter

The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.

• https://github.com/saurabh2088/OpenSSL_1_0_1g_CVE-2015-0205 :

CVE-2015-0204 Copy Chapter

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.

• https://github.com/AbhishekGhosh/FREAK-Attack-CVE-2015-0204-Testing-Script :

• https://github.com/anthophilee/A2SV--SSL-VUL-Scan :

• https://github.com/scottjpack/Freak-Scanner :

• https://github.com/felmoltor/FreakVulnChecker :

• https://github.com/niccoX/patch-openssl-CVE-2014-0291_CVE-2015-0204 :

CVE-2015-0072 Copy Chapter

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."

• https://github.com/dbellavista/uxss-poc :

CVE-2015-0057 Copy Chapter

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

• https://github.com/highandhigh/CVE-2015-0057 :

CVE-2015-0009 Copy Chapter

The Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows man-in-the-middle attackers to disable a signing requirement and trigger a revert-to-default action by spoofing domain-controller responses, aka "Group Policy Security Feature Bypass Vulnerability."

• https://github.com/PhoenixC46/ExploitPOC_MS15-014_CVE-2015-0009 :

CVE-2015-0006 Copy Chapter

The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not perform mutual authentication to determine a domain connection, which allows remote attackers to trigger an unintended permissive configuration by spoofing DNS and LDAP responses on a local network, aka "NLA Security Feature Bypass Vulnerability."

• https://github.com/bugch3ck/imposter :

Overview (`2016/README.md`) Copy Section

CVE-2016-1000229 Copy Chapter

swagger-ui has XSS in key names

• https://github.com/barteeees/SwaggerUI-CVE-2016-1000229 :

• https://github.com/ossf-cve-benchmark/CVE-2016-1000229 :

CVE-2016-1000027 Copy Chapter

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

• https://github.com/artem-smotrakov/cve-2016-1000027-poc :

• https://github.com/tina94happy/Spring-Web-5xx-Mitigated-version :

• https://github.com/Ragatzino/test-cve-2016-1000027 :

• https://github.com/yihtserns/spring-web-without-remoting :

CVE-2016-1000002 Copy Chapter

gdm3 3.14.2 and possibly later has an information leak before screen lock

• https://github.com/hdgokani/CVE2016-10000027 :

CVE-2016-20012 Copy Chapter

OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product

• https://github.com/arturo-b-cmu/cve-2016-20012 :

CVE-2016-15042 Copy Chapter

The Frontend File Manager (versions 4.0), N-Media Post Front-end Form (versions 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the nm_filemanager_upload_file and nm_postfront_upload_file AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

• https://github.com/ImBIOS/lab-cve-2016-15042 :

CVE-2016-15041 Copy Chapter

The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwp_setup_purchase_username’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• https://github.com/flame-11/CVE-2016-15041-mainwp-dashboard :

CVE-2016-10993 Copy Chapter

The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.

• https://github.com/0xc4t/CVE-2016-10993 :

CVE-2016-10961 Copy Chapter

The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.

• https://github.com/tuanhoma/CVE-2016-109618--TryHackMe- :

CVE-2016-10956 Copy Chapter

The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.

• https://github.com/p0dalirius/CVE-2016-10956-mail-masta :

• https://github.com/Hackhoven/wp-mail-masta-exploit :

CVE-2016-10924 Copy Chapter

The ebook-download plugin before 1.2 for WordPress has directory traversal.

• https://github.com/rvzsec/CVE-2016-10924 :

• https://github.com/alealeluyah/cve-2016-10924-POC :

• https://github.com/LGenAgul/Wordpress-ebook-CVE-2016-10924 :

CVE-2016-10761 Copy Chapter

Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack.

• https://github.com/ISSAPolska/CVE-2016-10761 :

CVE-2016-10735 Copy Chapter

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

• https://github.com/Yumeae/Bootstrap-with-XSS :

• https://github.com/ossf-cve-benchmark/CVE-2016-10735 :

CVE-2016-10726 Copy Chapter

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.

• https://github.com/shoucheng3/DSpace__DSpace_CVE-2016-10726_4-4 :

CVE-2016-10725 Copy Chapter

In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to override all other alerts) because operations occur in the wrong order. This behavior occurs in the remote network alert system (deprecated since Q1 2016). This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.

• https://github.com/JinBean/CVE-Extension :

CVE-2016-10724 Copy Chapter

Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (deprecated since Q1 2016) if an attacker can sign a message with a certain private key that had been known by unintended actors, because of an infinitely sized map. This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.

• https://github.com/JinBean/CVE-Extension :

CVE-2016-10709 Copy Chapter

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.

• https://github.com/wetw0rk/Exploit-Development :

CVE-2016-10708 Copy Chapter

sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.

• https://github.com/lggcs/CVE-2016-10708 :

CVE-2016-10555 Copy Chapter

Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.

• https://github.com/z-bool/Venom-JWT :

• https://github.com/CircuitSoul/poc-cve-2016-10555 :

• https://github.com/scent2d/PoC-CVE-2016-10555 :

CVE-2016-10401 Copy Chapter

ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known (or a non-root default account exists within an ISP's deployment of these devices).

• https://github.com/oxasploits/oxasploits :

CVE-2016-10277 Copy Chapter

An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute arbitrary code within the context of the bootloader. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33840490.

• https://github.com/alephsecurity/initroot :

• https://github.com/leosol/initroot :

CVE-2016-10204 Copy Chapter

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.

• https://github.com/0xNullComet/CVE-2016-10204_Webshell :

• https://github.com/akash0x00/zoneminder-1.29-1.30-rce-exploit :

CVE-2016-10191 Copy Chapter

Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.

• https://github.com/KaviDk/Heap-Over-Flow-with-CVE-2016-10191 :

CVE-2016-10190 Copy Chapter

Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response.

• https://github.com/muzalam/FFMPEG-exploit :

CVE-2016-10140 Copy Chapter

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.

• https://github.com/asaotomo/CVE-2016-10140-Zoneminder-Poc :

CVE-2016-10134 Copy Chapter

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

• https://github.com/CyberCTF/vulhub-zabbix-cve-2016-10134 :

CVE-2016-10045 Copy Chapter

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

• https://github.com/Zenexer/safeshell :

• https://github.com/pedro823/cve-2016-10033-45 :