0day.today - أكبر قاعدة بيانات للثغرات في العالم.
We use one main domain DOMAIN_LINK
If you want to purchase the exploit or pay for service, you need to buy Gold. We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ أرسل ] rules
- Visit the [ الأسئلة الشائعة ] page
- [ Register ] profile
- Get [ الذهب ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ [email protected] ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
اتصل بنا
يمكنكم الاتصال بنا من خلال:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Safari Type Confusion / Sandbox Escape Exploit
[ 0Day-ID-34995 ]
العنوان الكامل
Safari Type Confusion / Sandbox Escape Exploit
[ Highlight ]
Highlight - is paid service, that can help to get more visitors to your material.
Price:
Price:
تاريخ الإضافة
الصنف
المنصة
تم التحقق
السعر
مجاني
الخطر
[Security Risk Critical
]Rel. releases
الوصف
This Metasploit module exploits an incorrect side-effect modeling of the 'in' operator. The DFG compiler assumes that the 'in' operator is side-effect free, however the embed element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850). The type confusion can be used as addrof and fakeobj primitives that then lead to arbitrary read/write of memory. These primitives allow us to write shellcode into a JIT region (RWX memory) containing the next stage of the exploit. The next stage uses CVE-2020-9856 to exploit a heap overflow in CVM Server, and extracts a macOS application containing our payload into /var/db/CVMS. The payload can then be opened with CVE-2020-9801, executing the payload as a user but without sandbox restrictions.
CVE
CVE-2020-9801
CVE-2020-9850
CVE-2020-9856
CVE-2020-9850
CVE-2020-9856
Other Information
Abuses
0
التعليقات
0
المشاهدات
13 820
We DO NOT use Telegram or any messengers / social networks! Please, beware of scammers!
مجاني
Open Exploit
You can open this source code for free
You can open this source code for free
Verified by
Verified by
This material is checked by Administration and absolutely workable.
This material is checked by Administration and absolutely workable.
[ التعليقات: 0 ]
Terms of use of comments:
- Users are forbidden to exchange personal contact details
- Haggle on other sites\projects is forbidden
- Reselling is forbidden
قم بالدخوال أو التسجيل لتكتب تعليق
قم بالدخوال أو التسجيل لتكتب تعليق