FarazPajohan

11 exploits Active since Feb 2017
CVE-2020-10364 EXPLOITDB HIGH text WORKING POC
Mikrotik Routeros < 6.44.3 - Resource Allocation Without Limits
The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write system calls, because of uncontrolled resource management.
CVSS 7.5
CVE-2020-20021 EXPLOITDB HIGH text WORKING POC
Mikrotik Routeros < 6.46.3 - Denial of Service
An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.
CVSS 7.5
CVE-2017-7938 EXPLOITDB MEDIUM text WORKING POC
Mor-pah.net Dmitry Deepmagic Informat... - Memory Corruption
Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname strings found in local log files.
CVSS 6.6
CVE-2017-9430 EXPLOITDB CRITICAL text WORKING POC
dnstracer <1.9 - DoS
Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a command line with a long name argument that is mishandled in a strcpy call for argv[0]. An example threat model is a web application that launches dnstracer with an untrusted name string.
CVSS 9.8
CVE-2017-7397 EXPLOITDB HIGH c WORKING POC
BackBox Linux 4.6 - DoS
BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addresses (as defined in RFC 1812 section 5.3.7). This product enables net.ipv4.conf.all.log_martians by default. NOTE: the vendor reports "It has been proved that this vulnerability has no foundation and it is totally fake and based on false assumptions.
CVSS 7.5
CVE-2017-5972 EXPLOITDB HIGH c WORKING POC
Linux Kernel < 3.19.8 - Denial of Service
The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets, as demonstrated by an attack against the kernel-3.10.0 package in CentOS Linux 7. NOTE: third parties have been unable to discern any relationship between the GitHub Engineering finding and the Trigemini.c attack code.
CVSS 7.5
CVE-2018-10070 EXPLOITDB HIGH text WORKING POC
MikroTik Version 6.41.4 - DoS
A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU and all available RAM by sending a crafted FTP request on port 21 that begins with many '\0' characters, preventing the affected router from accepting new FTP connections. The router will reboot after 10 minutes, logging a "router was rebooted without proper shutdown" message.
CVSS 7.5
CVE-2017-14266 EXPLOITDB HIGH text WORKING POC
Tcpreplay <3.4.4 - Buffer Overflow
tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file, a related issue to CVE-2016-6160.
CVSS 7.8
CVE-2017-17538 EXPLOITDB HIGH c WORKING POC
Mikrotik Router Firmware - Denial of Service
MikroTik v6.40.5 devices allow remote attackers to cause a denial of service via a flood of ICMP packets.
CVSS 7.5
CVE-2017-6444 EXPLOITDB HIGH c WORKING POC
Mikrotik Routeros - Denial of Service
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many ACK packets. After the attacker stops the exploit, the CPU usage is 100% and the router requires a reboot for normal operation.
CVSS 7.5
CVE-2017-7285 EXPLOITDB HIGH perl WORKING POC
MikroTik <6.38.5 - DoS
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of TCP RST packets, preventing the affected router from accepting new TCP connections.
CVSS 7.5