Video write-up about the Real World CTF challenge "flaglab" that involved exploiting a GitLab 1day. Actually two CVEs were combined to achieve full remote code execution...

Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi: from zero knowledge to zero-click RCE Introduction and motivation How wireless device works and starts up Interaction between Wi-Fi S…

Gwendal Le Coguic, web developer and security researcher

## Introduction In Steam and other valve games (CSGO, Half-Life, TF2) there is a functionality to find game servers called the server browser. In order to retrieve the information about these...

IntroductionWhile DNS rebinding was first described nearly two decades ago, it has recently gained a second youth with the proliferation of insecure IoT devices and a series of highly publicized vulne…

Blog

Microsoft Windows MSHTML Engine - "Edit" Remote Code Execution. CVE-2019-0541 . local exploit for Windows platform

Research by: Nadav Grossman Introduction In this article, we tell the story of how we found a logical bug using the WinAFL fuzzer and exploited it in WinRAR to gain full control over a victim’s comput…

Exploits and/or advisories. Contribute to kmkz/exploit development by creating an account on GitHub.

This blog post details how a combination of a Path Traversal and Local File Inclusion vulnerability lead to Remote Code Execution in the WordPress core. The vulnerability remained uncovered in the Wor…

In this post, we show how to reverse engineer the Magellan bug from the patch and exploit it on a 64bit desktop environment.

# 1. Background The Steam Chat client is a particularly interesting system to attack because it's built using a modern set of technologies with strong security characteristics. It's built on...

I want to believe that all of you know about ImageMagick and its Tragick. This issue was found in the end of the April, 2016 and due to many processing plugins depends on the ImageMagick library this …

A Fuzzing Drill Hits the Motherlode Research By: Yoav Alon, Netanel Ben-Simon Introduction The year 2017 was an inflection point in the vulnerability landscape. The number of new vulnerabilities repor…

This is the story of how I was able to get remote code execution on Hubspot 's servers by exploiting a vulnerability in HubL expression la...

[ WebAsm OOB ArrayBuffer ] WebAsm instance builder reads imports from an attacker-controlled object in v8/src/wasm/wasm-module.cc:1625 ProcessImports(). Imports can be getters, which run while the ins…

it works on iOS 12.1.1, meaning every iOS version since 12.0 is vulnerable

André Baptista - Reverse engineer, exploitation researcher and bug bounty hunter.

分享奇虎360公司的技术，与安全的互联网共同成长。

A new type of malicious MS Office document has appeared: a PowerPoint document that executes a PowerShell command by hovering over a link with the mouse cursor (this attack does not involve VBA macros…

Last week a new exploitation technique for PHP applications was announced at the BlackHat USA conference. Find out everything you need to know in this blog post.SummaryThe security researcher Sam Thom…

Hello Everyone,

We delve a bit deeper into WebExtension security featuring 5 bugs

A Pwn2Own exploit chain. Contribute to saelo/pwn2own2018 development by creating an account on GitHub.

Cymulate’s research team has discovered a way to abuse the Online Video feature on Microsoft Word to execute malicious code. Attackers could use this for malicious purposes such as phishing, as the do…

This past Patch Tuesday , Microsoft released an update for Internet Explorer (IE) to address CVE-2018-8460 . The vulnerability exists in IE 11 on all supported versions of Windows. It falls into the g…

(CVE-2018-8495) Chaining small bugs together to achieve RCE

1. Content process -> Privileged content process (first_stage.js) When spawning a new Edge content process, its privilege is determined by its URL. This URL check is performed by the LCIEUrlPolicy::Ge…

CVE-2018-15685 Electron WebPreferences Remote Code Execution Finding