Design/Logic Flaw

DLMFDISK.sys 1.2.0.27 in DESlock+ 3.2.6 and earlier allows local users to gain privileges via a certain DLKFDISKIOCTL request to \.\DLKFDiskControl that overwrites a data structure associated with a mounted pseudo-filesystem, aka the "ring0 SYSTEM" vulnerability...

CVE-2008-1141

Memory leak in DLMFENC.sys 1.0.0.26 in DESlock+ 3.2.6 and earlier allows local users to cause a denial of service kernel memory consumption via a series of DLMFENCIOCTL requests to \.\DLKPFSDDevice that allocate "link list structures."...

CVE-2008-1139

DESlock+ 3.2.6 and earlier are affected when DLMFENC.sys 1.0.0.26 and DLMFDISK.sys 1.2.0.27 are present. A DLMFENC_IOCTL request to the device .\DLKPFSD_Device can overwrite a pointer, enabling local privilege escalation to SYSTEM (the “ring0 link list zero SYSTEM” issue). Affected components are...

CVE-2008-1138

DLMFENC.sys 1.0.0.26 in DESlock+ 3.2.6 and earlier allows local users to cause a denial of service system crash via a certain ZEROMEM DLMFENCIOCTL request to \.\DLKPFSDDevice, aka the "ring0 link list zero" vulnerability...

DESlock+ <= 3.2.6 DLMFDISK.sys local kernel ring0 SYSTEM Exploit

No description provided by source. / deslock-pown-v2.c Copyright c 2008 by [email protected] DESlock+ = 3.2.6 local kernel ring0 SYSTEM exploit by mu-b - Wed 26 Dec 2007 - Tested on: DLMFDISK.sys 1.2.0.27 - Microsoft Windows 2003 SP2 - Microsoft Windows XP SP2 Note: create a mountable filesyste...

DESlock+ 3.2.6 - DLMFENC.sys Local Kernel Ring0 link list zero (PoC)

DESlock+ 3.2.6 - DLMFENC.sys Local Kernel Ring0 link list zero PoC / deslock-list-zero.c Copyright c 2008 by DESlock+ include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xDEADBEEF define ZEROMEM 0xDEADBEEF define ARGSIZEa a-sizeof int2/sizeof void struct ioctlreq int flag; int...

DESlock+ 3.2.6 - Local Kernel Ring0 link list zero SYSTEM

DESlock+ 3.2.6 - Local Kernel Ring0 link list zero SYSTEM / deslock-list-zero-v2.c Copyright c 2008 by DESlock+ include include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xC001D00D define DLKFDISKRIOCTL 0x80002008 define DLKFDISKSLOT 0x00000C5C define ARGSIZEa a/sizeof void static...

DESlock+ < 3.2.6 - 'LIST' Local Kernel Memory Leak

/ deslock-list-leak.c Copyright c 2008 by DESlock+ include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xC001D00D define ARGSIZEa a-sizeof int2/sizeof void struct ioctlreq int flag; int reqnum; void argARGSIZE0x20; ; static void xormaskreq struct ioctlreq req DWORD i, pid; PCHAR ptr...

WebAdmin < 3.2.6 MDaemon Account Hijacking

The remote host is running WebAdmin, a web-based remote administration tool for Alt-N MDaemon. According to its banner, the installed version of WebAdmin enables a domain administrator within the default domain to hijack the 'MDaemon' account used by MDaemon when processing remote server and...

[SECURITY] [DSA 1130-1] New sitebar packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 1130-1 [email protected] http://www.debian.org/security/ Martin Schulze July 30th, 2006 http://www.debian.org/security/faq -...

Horde IMP HTML MIME Viewer XSS Vulnerabilities

The target is running at least one instance of Horde IMP whose version number is between 3.0 and 3.2.5 inclusive. SPDX-FileCopyrightText: 2003-2004 George A. Theall Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

[SA17089] Paros hsqldb Exposure of Database Content

TITLE: Paros hsqldb Exposure of Database Content SECUNIA ADVISORY ID: SA17089 VERIFY ADVISORY: http://secunia.com/advisories/17089/ CRITICAL: Less critical IMPACT: Security Bypass, Exposure of sensitive information WHERE: From local network SOFTWARE: Paros 3.x http://secunia.com/product/2043/...

CVE-1999-1559

Xylan OmniSwitch vulnerable before 3.2.6: remote attacker can bypass the login prompt by sending a CTRL-D, effectively causing a login bypass and locking other users out since the device supports only a single session. Affected component: OmniSwitch web/console login flow on affected firmware; ro...

Security problems with Phorum php message board

Author: Brian Moon Homepage: www.phorum.org Version: 3.2.6 Problem: Any user can parse a choosed php script file using the Phorum sustem. It is also possibel, under certain circunstances, to execute arbitrary commands on the server as the httpd user. Status: Fixed in version 3.2.7 released...