Sandro Gauci

9 exploits Active since Jan 2001
CVE-2020-26262 WRITEUP HIGH WRITEUP
coturn < 4.5.2 - Unintended Proxy Access via Loopback Address Bypass
Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.
CVSS 7.2
CVE-2000-1112 EXPLOITDB text WORKING POC
Microsoft Windows Media Player 7 - Privilege Escalation
Microsoft Windows Media Player 7 executes scripts in custom skin (.WMS) files, which could allow remote attackers to gain privileges via a skin that contains a malicious script, aka the ".WMS Script Execution" vulnerability.
EIP-2026-104169 EXPLOITDB text WRITEUP
Applicure dotDefender 4.01-3 - Persistent Cross-Site Scripting
EIP-2026-102562 EXPLOITDB python WORKING POC
Asterisk chan_pjsip 15.2.0 - 'SDP' Denial of Service
EIP-2026-102623 EXPLOITDB python WORKING POC
Kamailio 5.1.1 / 5.1.0 / 5.0.0 - Off-by-One Heap Overflow
CVE-2018-7284 EXPLOITDB HIGH python WORKING POC
Asterisk Buffer Overflow via SUBSCRIBE Request Accept Headers
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.
CVSS 7.5
CVE-2018-7286 EXPLOITDB MEDIUM python WORKING POC
Asterisk 13.x-13.19.1, 14.x<14.7.5, 15.x-15.2.1, Certified Asterisk <13.18 - DoS via SIP INVITE
An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection.
CVSS 6.5
EIP-2026-102561 EXPLOITDB python WORKING POC
Asterisk chan_pjsip 15.2.0 - 'SDP fmtp' Denial of Service
CVE-2011-3315 EXPLOITDB text WORKING POC
Cisco Unified Communications Manager 5.x-8.x Path Traversal via Crafted URL
Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response (Unified IP-IVR) before 6.0(1)SR1ES8, 7.0(x) before 7.0(2)ES1, 8.0(x) through 8.0(2)SU3, and 8.5(x) before 8.5(1)SU2, allows remote attackers to read arbitrary files via a crafted URL, aka Bug IDs CSCth09343 and CSCts44049.