Apple Mac OSX 10.4.7 - Mach Exception Handling Privilege Escalation

/ excploit.c - 28 Nov 2005 - [email protected] Exploitable Mach Exception Handling Affected: Mac OS X 10.4.6 darwin 8.6.0 and older When a process executes a setuid executable, all existing rights to the task port are invalidated, to make sure unauthorized processes do not retain control o...

Solaris 9 (sparc) : 121316-02

SunOS 5.9: kernel/sys/doorfs Patch. Date this patch was last updated by Sun : Aug/10/06 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Oracle DBMS绕过登录访问控制漏洞

BUGTRAQ ID: 16287 CVECAN ID: CVE-2006-0256 Oracle Database是一款大型商业数据库系统。 Oracle Database的登录过程实现存在漏洞，远程攻击者可能在登录过程中对服务器进行SQL注入攻击。...

gdiplus.pl.txt

!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...

Gdiplus.dll division by 0

!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...

mspp-poc1.txt

/----------------------------------------------------------------------------------------- MS Power Point Unspecified vulnerability POC nice SYS 49152 what about rar ? sorry no more comments : figure it yourself some greetz goes to waqas : Tested against Power Point ' 03 -- naveed...

msword-hlink-ohday.txt

Hi people, the same problem concerning hlink.dll already exploited in excel is present even in Microsoft Word, but Word 2003 seems, luckily, not vulnerable. this one is the public 0-day I made for Microsoft Word. the author is "SYS 49152" obviusly it's a local sploit .. best regards. SYS 49152...

Microsoft Word 20002003 - Hlink Local Buffer Overflow

Microsoft Word 20002003 - Hlink Local Buffer Overflow !/bin/perl Microsoft Word hlink 0-day by SYS 49152 this POC works only with: win 2ksp4 ENG + word 2000/XP all versions. win XP ENG sp1/sp2 + word XP 2002 SP3. Word 2003 is not vulnerable. bindshell on port 49152 hey kids.. I hope you know how ...

Microsoft Excel Universal Hlink Local Buffer Overflow Exploit

No description provided by source. excel hlink overflow UNIVERSAL poc by SYS 49152 public version works with ANY of the following oses/office combinations: -windows 2k sp4/XP SP1/XP SP2 -office 2000/Xp/2003 bindshell on port 49152 thanks go to BuzzDee for some things.. credits to kcope for findin...

Microsoft Excel - Universal Hlink Local Buffer Overflow

excel hlink overflow UNIVERSAL poc by SYS 49152 public version works with ANY of the following oses/office combinations: -windows 2k sp4/XP SP1/XP SP2 -office 2000/Xp/2003 bindshell on port 49152 thanks go to BuzzDee for some things.. credits to kcope for finding the vuln.. I'm always ready to jo...

Microsoft Excel - Universal Hlink Local Buffer Overflow

Microsoft Excel - Universal Hlink Local Buffer Overflow excel hlink overflow UNIVERSAL poc by SYS 49152 public version works with ANY of the following oses/office combinations: -windows 2k sp4/XP SP1/XP SP2 -office 2000/Xp/2003 bindshell on port 49152 thanks go to BuzzDee for some things.. credit...

phpMyChat 0.15.0dev (SYS enter) Remote Code Execution Exploit

Exploit for unknown platform in category web applications ============================================================= phpMyChat 0.15.0dev SYS enter Remote Code Execution Exploit ============================================================= !/usr/bin/php -q -d shortopentag=on works with...

phpMyChat 0.14.5 - SYS enter Remote Code Execution

phpMyChat 0.14.5 - SYS enter Remote Code Execution !/usr/bin/php -q -d shortopentag=on query"INSERT INTO ".CMSGTBL." VALUES $T, '$R', 'SYS exit', '', ".time.", '', 'sprintfLEXITROM, "".specialchar$U,$Latin1,1.""'"; $kicked = 3; ... have a look to "T" argument, it is not sanitized before to be...

CVE-2006-0547

Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements in the context of the SYS user and bypass audit logging, including statements to create new privileged database accounts, via a modified AUTHALTERSESSION attribute in the authentication phase of t...

Buffer overflow

Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements in the context of the SYS user and bypass audit logging, including statements to create new privileged database accounts, via a modified AUTHALTERSESSION attribute in the authentication phase of t...

CVE-2006-0081

CVE-2006-0081 affects the Intel Graphics Accelerator Driver 6.14.10.4308 (ialmrnt5 display driver). The vulnerability is a denial of service caused by an overly long text field in a window title, leading to a crash or screen resolution change. The connected documents confirm the affected componen...

CVE-2006-0081

ialmnt5.sys in the ialmrnt5 display driver in Intel Graphics Accelerator Driver 6.14.10.4308 allows attackers to cause a denial of service crash or screen resolution change via a long text field, as demonstrated using a long window title...

Design/Logic Flaw

ialmnt5.sys in the ialmrnt5 display driver in Intel Graphics Accelerator Driver 6.14.10.4308 allows attackers to cause a denial of service crash or screen resolution change via a long text field, as demonstrated using a long window title...

NBD Tools: Buffer overflow in NBD server

Background The NBD Tools are the Network Block Device utilities allowing one to use remote block devices over a TCP/IP network. It includes a userland NBD server. Description Kurt Fitzner discovered that the NBD server allocates a request buffer that fails to take into account the size of the rep...

Fedora Core 4 : perl-5.8.6-22 (2005-1144)

o Updated upstream fix for sprintf integer overflow vulnerabilities CVE-2005-3962 and CVE-2005-3912, including new Sys::Syslog 0.08 o Updated fix for bug 136009 / MakeMaker LDRUNPATH issue: restore previous default Red Hat behavior of removing the MakeMaker generated LDRUNPATH setting from the li...