TamiiLambrado

6 exploits Active since Mar 2017
CVE-2017-16939 GITHUB HIGH c WORKING POC
Linux kernel <4.13.11 - Privilege Escalation/DoS
The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.
3 stars
CVSS 7.8
CVE-2017-17712 GITHUB HIGH c WORKING POC
Linux Kernel 3.19-4.1.52 - Local Privilege Escalation via Race Condition in raw_sendmsg
The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges.
3 stars
CVSS 7.0
CVE-2017-8824 GITHUB HIGH c WORKING POC
Linux kernel through 4.14.3 - Use-After-Free in DCCP Disconnect Handler
The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state.
3 stars
CVSS 7.8
CVE-2018-5332 GITHUB HIGH c WORKING POC
Linux kernel <3.2 - Memory Corruption
In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).
3 stars
CVSS 7.8
CVE-2018-5333 GITHUB MEDIUM c WORKING POC
Linux kernel <4.14.13 - Memory Corruption
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.
3 stars
CVSS 5.5
CVE-2017-5638 NOMISEC CRITICAL
Apache Struts 2.3.x < 2.3.32 and 2.5.x < 2.5.10.1 - Remote Code Execution via Jakarta Multipart Parser
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVSS 9.8