TorrentFlux User-Agent XSS Vulnerability

http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/ Name: TorrentFlux User-Agent XSS Vulnerability Published: 2006-10-06 Critical Level: Moderate Type: Cross-Site Scripting Where: Remote Status: 0-Day Software: Torrentflux 2.1 Discoverer: Steven Roddis...

Microsoft Windows / Internet Explorer 0-day vulnerability

Microsoft Vector Graphics Rendering Library vulnerability is used for hidden malware installation...

Apple AirPort wireless drivers fails to properly handle scan cache updates

Overview An heap buffer overflow exists in the Apple AirPort wireless driver. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code, or cause a denial-of-service condition. Description Apple AirPort drivers contain a heap buffer overflow in the code that...

Microsoft PowerPoint 0-day vulnerability

No description provided...

[SA21552] Ichitaro Document Viewer Buffer Overflow Vulnerability

TITLE: Ichitaro Document Viewer Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA21552 VERIFY ADVISORY: http://secunia.com/advisories/21552/ CRITICAL: Extremely critical IMPACT: System access WHERE: From remote SOFTWARE: Ichitaro for Linux http://secunia.com/product/11596/ Ichitaro 9.x...

[Full-disclosure] 0-day XP SP2 wmf exploit

Description: yet another 'windows meta file' WMF denial of service exploit. System affected: + Windows XP SP2, + Windows 2003 SP1, + Windows XP SP1, + Windows XP + Windows 2003 Tech info: page fault in gdi32!CreateBrushIndirect because invalid pointer access. Incorrect short to void sign extensio...

gdiplus.pl.txt

!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...

Gdiplus.dll division by 0

!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...

CVE-2006-3929

Cross-site scripting XSS vulnerability in the Forms/rpSysAdmin script on the Zyxel Prestige 660H-61 ADSL Router running firmware 3.40PT.0b32 allows remote attackers to inject arbitrary web script or HTML via hex-encoded values in the a parameter...

CVE-2006-3929

Affected product: Zyxel Prestige 660H-61 ADSL Router, firmware 3.40(PT.0)b32. Vulnerable component: Forms/rpSysAdmin script. Root cause: XSS via hex-encoded values in parameter a due to improper sanitization. Impact: remote attacker can execute arbitrary script in the victim’s browser (cross-site...

[Full-disclosure] Microsoft PowerPoint 0-day Vulnerability FAQ document written

I have written FAQ document including 33 items about the recently reported 0-day vulnerability in PowerPoint. This vulnerability is being exploited by Trojan horse including keylogger features. The document entitled as Microsoft PowerPoint 0-day Vulnerability FAQ is located at my SecuriTeam Blogs...

CVE-2006-3547

EMC VMware Player is affected by a user‑assisted denial of service vulnerability triggered by a long value assigned to ide1:0.fileName in the VM’s .vmx file. The issue leads to unrecoverable application failure when parsing the VMX, with third parties noting that write access to the .vmx file cou...

msword-hlink-ohday.txt

Hi people, the same problem concerning hlink.dll already exploited in excel is present even in Microsoft Word, but Word 2003 seems, luckily, not vulnerable. this one is the public 0-day I made for Microsoft Word. the author is "SYS 49152" obviusly it's a local sploit .. best regards. SYS 49152...

Microsoft Word 20002003 - Hlink Local Buffer Overflow

Microsoft Word 20002003 - Hlink Local Buffer Overflow !/bin/perl Microsoft Word hlink 0-day by SYS 49152 this POC works only with: win 2ksp4 ENG + word 2000/XP all versions. win XP ENG sp1/sp2 + word XP 2002 SP3. Word 2003 is not vulnerable. bindshell on port 49152 hey kids.. I hope you know how ...

Targeted attack: experience from the trenches

Targeted attack: experience from the trenches Published: 2006-05-19, Last Updated: 2006-05-19 17:36:01 UTC by Chris Carboni Version: 2click to highlight changes Learning lessons from incidents is a very important part of incident handling. Yet with targeted attacks it is very hard as you need to...

Design/Logic Flaw

Unspecified vulnerability in CA Resource Initialization Manager CAIRIM 1.x before 20060502, as used in z/OS Common Services and the LMP component in multiple products, allows attackers to violate integrity via a certain "problem state program" that uses SVC to gain access to supervisor state, key...

linux/x86 setuid(0) + execve("/bin/sh", ["/bin/sh", NULL]) 31 bytes

Exploit for linux/x86 platform in category shellcode =================================================================== linux/x86 setuid0 + execve"/bin/sh", "/bin/sh", NULL 31 bytes =================================================================== / Linux/x86 setuid0 + execve"/bin/sh",...

[SA19095] Oreka RTP Handling Denial of Service Vulnerability

TITLE: Oreka RTP Handling Denial of Service Vulnerability SECUNIA ADVISORY ID: SA19095 VERIFY ADVISORY: http://secunia.com/advisories/19095/ CRITICAL: Less critical IMPACT: DoS WHERE: From local network SOFTWARE: Oreka 0.x http://secunia.com/product/8523/ DESCRIPTION: A vulnerability has been...

CVE-2006-0967

NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to cause a denial of service memory usage and cpu utilization via a flood of arbitrary UDP datagrams to ports 0 to 65000. NOTE: this issue was reported as a buffer overflow, but that term usual...

The Windows in the DLL Files the basic principle and modified method-vulnerability warning-the black bar safety net

A DLL file is common sense DLL is a Dynamic Link Library acronym meaning Dynamic Link Library. In Windows, many applications are not a complete executable file, which is divided into a number of relatively independent Dynamic Link Library that DLL file, placed in the system. When we execute a...