Watchfire AppScan QA 5.0.x Remote Code Execution Exploit PoC

Exploit for unknown platform in category remote exploits ============================================================ Watchfire AppScan QA 5.0.x Remote Code Execution Exploit PoC ============================================================ Watchfire AppScan QA PoC - Coded by Mariano Nu?ez Di Croc...

CVE-2005-2827

The thread termination routine in the kernel for Windows NT 4.0 and 2000 NTOSKRNL.EXE allows local users to modify kernel memory and execution flow via steps in which a terminating thread causes Asynchronous Procedure Call APC entries to free the wrong data, aka the "Windows Kernel Vulnerability....

CVE-2005-2827

The thread termination routine in the kernel for Windows NT 4.0 and 2000 NTOSKRNL.EXE allows local users to modify kernel memory and execution flow via steps in which a terminating thread causes Asynchronous Procedure Call APC entries to free the wrong data, aka the "Windows Kernel Vulnerability....

CVE-2005-2827

The CVE-2005-2827 window kernel vulnerability affects Windows NT 4.0 and Windows 2000 (NTOSKRNL.EXE) where a terminating thread’s APC handling can lead to memory corruption and control of kernel execution. Root cause: during thread exit, the APC free loop in PspExitThread and related KiMoveApcSta...

Computer Associates License Service GETCONFIG buffer overflow

Added: 12/14/2005 CVE: CVE-2005-0581 BID: 12705 OSVDB: 14389 Background The License service comes with most Computer Associates products and exchanges license information over ports 10202/tcp and 10203/tcp. Problem A buffer overflow vulnerability exists in the processing of GETCONFIG messages...

[EEYEB-20050523] Windows Kernel APC Data-Free Local Privilege Escalation Vulnerability

Windows Kernel APC Data-Free Local Privilege Escalation Vulnerability Release Date: December 13, 2005 Date Reported: May 23, 2005 External Refferences: eEye ID EEYEB-20050523 OSVDB ID 18823 CVE CAN-2005-2827 Microsoft MS05-055 Severity: Medium Local Privilege Escalation to Kernel Systems Affected...

Computer Associates License Service GETCONFIG buffer overflow

Added: 12/14/2005 CVE: CVE-2005-0581 BID: 12705 OSVDB: 14389 Background The License service comes with most Computer Associates products and exchanges license information over ports 10202/tcp and 10203/tcp. Problem A buffer overflow vulnerability exists in the processing of GETCONFIG messages...

Computer Associates License Service GETCONFIG buffer overflow

Added: 12/14/2005 CVE: CVE-2005-0581 BID: 12705 OSVDB: 14389 Background The License service comes with most Computer Associates products and exchanges license information over ports 10202/tcp and 10203/tcp. Problem A buffer overflow vulnerability exists in the processing of GETCONFIG messages...

Microsoft Windows 2000 kernel Asynchronous Procedure Call privilege escalation

Double removal of structure from linked list allows memory manipulation...

CVE-2005-4131

Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed range, which could lead to memory corruption involving an argument to the msvcrt.memmove...

FreeFTPd user name buffer overflow

Added: 12/08/2005 CVE: CVE-2005-3683 BID: 15457 OSVDB: 20909 Background FreeFTPd is a free FTP/FTPS/SFTP server for Windows platforms. Problem An unauthenticated remote attacker could execute arbitrary commands by sending a long, specially crafted argument to the USER command. Resolution Upgrade ...

CVE-2005-3981

Microsoft Windows XP, 2000, and 2003 are affected by a local-privilege issue where a user can kill a writable process by calling CreateRemoteThread on a process opened via OpenProcess, using certain arguments and potentially an invalid start routine address. The underlying cause involves manipula...

MailEnable IMAP W3C Logging Buffer Overflow

Added: 12/03/2005 CVE: CVE-2005-3155 BID: 15006 OSVDB: 19842 Background MailEnable is a mail server for Windows platforms. The standard edition supports the SMTP and POP3 protocols. MailEnable Professional and MailEnable Enterprise also support IMAP and HTTPMail. Problem MailEnable's IMAP service...

Windows 2000 VPN Detection

Binary data 3314.prm...

winCreateExp.txt

Microsoft Windows CreateRemoteThread Exploit name : nima Salehi email : [email protected] web site : www.Ashiyane.com www.Ashiyane.net Copyright c 2002-2005 Ashiyane Digital Securty Team --------------------------------------------------------------------- Systems Affected: - Windows XP all SP -...

ieDoS.pm.txt

/ Author: Winny Thomas Pune, INDIA The crafted metafile from this code when viewed in internet explorer raises the CPU utilization to 100%. The code was tested on Windows 2000 server SP4. The issue does not occur with the hotfix for GDI MS05-053 installed Disclaimer: This code is for...

MS Windows Metafile (mtNoObjects) Denial of Service Exploit (MS05-053)

Exploit for unknown platform in category dos / poc ====================================================================== MS Windows Metafile mtNoObjects Denial of Service Exploit MS05-053 ====================================================================== / Author: Winny Thomas Pune, INDIA Th...

RSA SecurID Web Agent for IIS redirect buffer overflow

Added: 11/30/2005 CVE: CVE-2005-4734 BID: 26424 OSVDB: 20151 Background RSA SecurID Web Agent for IIS provides access control for IIS web servers using one-time authentication tokens. Problem A buffer overflow in IISWebAgentIF.dll could allow a remote attacker to execute arbitrary commands using ...

RSA SecurID Web Agent for IIS redirect buffer overflow

Added: 11/30/2005 CVE: CVE-2005-4734 BID: 26424 OSVDB: 20151 Background RSA SecurID Web Agent for IIS provides access control for IIS web servers using one-time authentication tokens. Problem A buffer overflow in IISWebAgentIF.dll could allow a remote attacker to execute arbitrary commands using ...

Oracle Enterprise Manager Agent buffer overflow

Added: 11/30/2005 CVE: CVE-2005-3460 BID: 15146 OSVDB: 20664 Background Oracle Application Server 10g includes the emagent.exe program which listens for connections on port 1830/TCP by default. Problem A buffer overflow vulnerability in emagent.exe could allow a remote attacker to execute arbitra...