Microsoft Security Bulletin MS07-035 — Critical Vulnerability in Win 32 API Could Allow Remote Code Execution (935839)

Microsoft Security Bulletin MS07-035 — Critical Vulnerability in Win 32 API Could Allow Remote Code Execution 935839 Published: June 12, 2007 Version: 1.0 General Information Executive Summary This critical security update resolves a privately reported vulnerability in a Win32 API. This...

MS07-035: Vulnerability in Win 32 API Could Allow Remote Code Execution (935839)

The remote host contains a version of the Win32 API that is vulnerable to a security flaw that could allow a local user to gain elevated privileges, and might allow a remote attacker to execute arbitrary code on the host. To exploit the flaw, an attacker would need to find a way to misuse the Win...

GLSA-200705-25 : file: Integer overflow

The remote host is affected by the vulnerability described in GLSA-200705-25 file: Integer overflow Colin Percival from FreeBSD reported that the previous fix for the fileprintf buffer overflow introduced a new integer overflow. Impact : A remote attacker could entice a user to run the file progr...

Linker index.php - Cross-Site Scripting Vulnerability

Linker index.php - Cross-Site Scripting Vulnerability Vulnerability: http://www.target.com/index.php?cat=3E223E3CScRiPt200a0d3Ealertdocument.cookie3B3C/script3E Vulnerable: All Versions Script : http://enproject.codelib.co.kr ----------------------------------------------- Credits : Vagrant Conta...

file: Integer overflow

Background file is a utility that guesses a file format by scanning binary data for patterns. Description Colin Percival from FreeBSD reported that the previous fix for the fileprintf buffer overflow introduced a new integer overflow. Impact A remote attacker could entice a user to run the file...

CVE-2007-2799

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert statement. NOTE: this issue is due to an...

Integer overflow

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert statement. NOTE: this issue is due to an...

CVE-2007-2799

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert statement. NOTE: this issue is due to an...

CVE-2007-2799

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert statement. NOTE: this issue is due to an...

CVE-2007-2799: Undefined Security Weakness

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert statement. NOTE: this issue is due to an...

CVE-2007-1819

CVE-2007-1819 describes a stack-based buffer overflow in the SPIDERLib.Loader ActiveX control (Spider90.ocx) version 9.1.0.4353 used by TestDirector (TD) for Mercury Quality Center, with patches: 9.0 before Patch 12.1 and 8.2 SP1 before Patch 32. The overflow is triggered by a long ProgColor prop...

Linux Kernel DCCP多个本地信息泄露漏洞

Linux是一款开放源代码的操作系统。 Linux针对DCCP支持存在多个问题，本地攻击者可以利用漏洞访问敏感信息。 问题存在于net/dccp/proto.c文件中的dodccpgetsockopt函数： ----------------------- static int dodccpgetsockoptstruct sock sk, int level, int optname, char user optval, int user optlen ... if getuserlen, optlen return -EFAULT; if len sizeofint return...

Stack overflow

Stack-based buffer overflow in Mercury/32 aka Mercury Mail Transport System 4.01b and earlier allows remote attackers to execute arbitrary code via a long LOGIN command. NOTE: this might be the same issue as CVE-2006-5961...

CVE-2007-1373

Stack-based buffer overflow in Mercury/32 aka Mercury Mail Transport System 4.01b and earlier allows remote attackers to execute arbitrary code via a long LOGIN command. NOTE: this might be the same issue as CVE-2006-5961...

CVE-2007-1373: Undefined Security Weakness

Stack-based buffer overflow in Mercury/32 aka Mercury Mail Transport System 4.01b and earlier allows remote attackers to execute arbitrary code via a long LOGIN command. NOTE: this might be the same issue as CVE-2006-5961...

mercurypown-v1.pl.txt

!/usr/bin/perl mercurypown-v1.pl Mercury/32 Connected\n"; $buf = "1 LOGIN"." "x$LEN-$BUFLEN."\255\n"; sendSOCKET, $buf, 0; sleep$senddelay; print"- Sending payload\n"; $buf = $NOP x 255; sendSOCKET, $buf, 0; sleep$senddelay; print"- Sending payload 2\n"; $buf = $NOP x $BUFLEN; sendSOCKET, $buf, 0...

Mercury/32 4.01 IMAP LOGIN SEH Buffer Overflow

This module exploits a stack buffer overflow in Mercury/32 use exploit/windows/imap/mercury/login msf undefinedlogin show actions ...actions... msf undefinedlogin set ACTION msf undefinedlogin show options ...show and set options... msf undefinedlogin run This module requires Metasploit:...

[Full-disclosure] Mercury/32 4.01b

Attached is a remote exploit disarmed PoC for Mercury/32 4.01b IMAPD. The vulnerability is located in the call:- 034646AE call sub346ECD9 which is passes as third argument the number of bytes remaining in a stack buffer in order to construct the complete command from the continuation data. Howeve...

Mercury/32 IMAP server buffer overflow

Buffer overflow in LOGIN command...

Mercury/32 Mail Server <= 4.01b (check) Buffer Overflow Exploit PoC

Exploit for unknown platform in category dos / poc =================================================================== Mercury/32 Mail Server Connected\n"; $buf = "1 LOGIN"." "x$LEN-$BUFLEN."\255\n"; sendSOCKET, $buf, 0; sleep$senddelay; print"- Sending payload\n"; $buf = $NOP x 255;...