Latest PoC news

Google shares Spectre PoC targeting browser JavaScript engines

Google has published JavaScript proof-of-concept (PoC) code to demonstrate the practicality of using Spectre exploits targeting web browsers to gain access to information from a browser's memory.
- Sergiu Gatlan
- March 12, 2021
- 02:30 PM
- 0
Windows DNS SIGRed bug gets first public RCE PoC exploit

A working proof-of-concept (PoC) exploit is now publicly available for the critical SIGRed Windows DNS Server remote code execution (RCE) vulnerability.
- Sergiu Gatlan
- March 04, 2021
- 09:44 AM
- 0
Google shares PoC exploit for critical Windows 10 Graphics RCE bug

Project Zero, Google's 0day bug-hunting team, shared technical details and proof-of-concept (PoC) exploit code for a critical remote code execution (RCE) bug affecting a Windows graphics component.
- Sergiu Gatlan
- February 27, 2021
- 09:12 AM
- 0
Attackers scan for vulnerable VMware servers after PoC exploit release

After security researchers have developed and published proof-of-concept (PoC) exploit code targeting a critical vCenter remote code execution (RCE) vulnerability, attackers are now actively scanning for vulnerable Internet-exposed VMware servers.
- Sergiu Gatlan
- February 25, 2021
- 07:56 AM
- 0
Windows Kerberos Bronze Bit attack gets public exploit, patch now

Proof-of-concept exploit code and full details on a Windows Kerberos security bypass vulnerability have been published earlier this week by Jake Karnes, the NetSPI security consultant and penetration tester who reported the security bug to Microsoft.
- Sergiu Gatlan
- December 10, 2020
- 12:08 PM
- 1
US Cyber Command: Patch Windows 'Bad Neighbor' TCP/IP bug now

US Cyber Command warns Microsoft customers to patch their systems immediately against the critical and remotely exploitable CVE-2020-16898 vulnerability addressed during this month's Patch Tuesday.
- Sergiu Gatlan
- October 14, 2020
- 10:42 AM
- 2
PoC exploits released for SAP Recon vulnerabilities, patch now!

Just two days after SAP released patches for a critical NetWeaver AS JAVA remote code execution vulnerability, proof-of-concept (PoC) exploits have been released, and active scans are underway to exploit devices.
- Lawrence Abrams
- July 15, 2020
- 05:28 PM
- 0
PoC exploits released for F5 BIG-IP vulnerabilities, patch now!

Two days after patches for critical F5 BIG-IP vulnerability were released, security researchers have started publicly posting proof-of-concept (PoC) exploits show how easy it is to exploit these devices.
- Lawrence Abrams
- July 05, 2020
- 04:44 PM
- 2
Windows 10 SMBGhost bug gets public proof-of-concept RCE exploit

Working exploit code that achieves remote code execution on Windows 10 machines is now publicly available for CVE-2020-0796, a critical vulnerability in Microsoft Server Message Block (SMB 3.1.1).
- Ionut Ilascu
- June 05, 2020
- 01:47 PM
- 0
Hackers exploit Salt RCE bugs in widespread attacks, PoCs public

Hackers kept busy this weekend exploiting vulnerable Salt instances used in various infrastructures for server management and automation.
- Ionut Ilascu
- May 04, 2020
- 01:19 PM
- 0
Windows 10 SMBGhost RCE exploit demoed by researchers

A proof-of-concept remote code execution (RCE) exploit for the Windows 10 CVE-2020-0796 'wormable' pre-auth remote code execution vulnerability was developed and demoed today by researchers at Ricerca Security.
- Sergiu Gatlan
- April 20, 2020
- 02:04 PM
- 1
48K Windows Hosts Vulnerable to SMBGhost CVE-2020-0796 RCE Attacks

After an Internet-wide scan, researchers at cybersecurity firm Kryptos Logic discovered roughly 48,000 Windows 10 hosts vulnerable to attacks targeting the pre-auth remote code execution CVE-2020-0796 vulnerability found in Microsoft Server Message Block 3.1.1 (SMBv3).
- Sergiu Gatlan
- March 12, 2020
- 09:41 AM
- 0
DoS Exploit PoC Released for Critical Windows RDP Gateway Bugs

A proof-of-concept (PoC) denial of service exploit has been published by Danish security researcher Ollypwn for the CVE-2020-0609 and CVE-2020-0610 flaws affecting the Remote Desktop Gateway (RD Gateway) component on Windows Server (2012, 2012 R2, 2016, and 2019) devices.
- Sergiu Gatlan
- January 24, 2020
- 02:10 PM
- 0
PoCs for Windows CryptoAPI Bug Are Out, Show Real-Life Exploit Risks

Proof-of-concept exploit code is now available for the Windows CryptoAPI spoofing vulnerability tracked as CVE-2020-0601 and reported by the National Security Agency (NSA), just two days after Microsoft released a patch.
- Sergiu Gatlan
- January 16, 2020
- 12:59 PM
- 0
Demo Exploit Code Available for Privilege Escalation Bug in Windows

Proof-of-concept exploit code for a privilege escalation vulnerability affecting Windows operating system has been published today, soon after Microsoft rolled out its monthly batch of security patches.
- Ionut Ilascu
- April 10, 2019
- 03:35 AM
- 0
Microsoft Provides Mitigations, Workarounds for PrivExchange Vulnerability

Microsoft released a security advisory with mitigation measures and workarounds for an elevation of privilege vulnerability affecting Microsoft Exchange 2013 and newer which was made public by security researcher Dirk-jan Mollema, together with a proof-of-concept tool named PrivExchange.
- Sergiu Gatlan
- February 07, 2019
- 04:00 PM
- 0
jQuery File Upload Plugin Vulnerable for 8 Years and Only Hackers Knew

Of the thousands of plugins for the jQuery framework, one of the most popular of them harbored for at least three years an oversight in code that eluded the security community, despite public availability of tutorials that explained how it could be exploited.
- Ionut Ilascu
- October 19, 2018
- 10:43 AM
- 1
Exploit Published for Unpatched Flaw in Windows Task Scheduler

A security researcher has published on Twitter details about a vulnerability in the Windows OS. The vulnerability is a "local privilege escalation" issue that allows an attacker to elevate the access of malicious code from a limited USER role to an all-access SYSTEM account.
- Catalin Cimpanu
- August 28, 2018
- 04:57 AM
- 2
Cisco ASA Flaw Exploited in the Wild After Publication of Two PoCs

Hackers are exploiting a vulnerability in Cisco software to crash and/or retrieve information from affected devices. Cisco is aware of the issue and has warned customers last week, Friday, June 22.
- Catalin Cimpanu
- June 27, 2018
- 11:57 AM
- 0
PoC Developed for CoinHive Mining In Excel Using Custom JavaScript Functions

Within days of Microsoft announcing that they are introducing custom JavaScript equations in Excel, a security researcher has developed a way to use this method to load the CoinHive in-browser JavaScript miner within Excel.
- Lawrence Abrams
- May 08, 2018
- 10:13 PM
- 0