6210 matches found
Dart ZipLite Compression 1.8.5.3 - DartZipLite.dll ActiveX Control Buffer Overflow
Dart ZipLite Compression 1.8.5.3 - DartZipLite.dll ActiveX Control Buffer Overflow source: https://www.securityfocus.com/bid/24099/info The Dart ZipLite Compression ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before...
CVE-2007-2814: Undefined Security Weakness
Multiple stack-based buffer overflows in the Pegasus ImagN' ActiveX control IMW32O40.OCX 4.00.041 allow remote attackers to execute arbitrary code via 1 a long FileName parameter, or unspecified vectors involving the 2 BeginReport, 3 CreatePictureExA, 4 DefineImage, 5 DefineImageEx, 6...
KSign KSignSWAT 2.0.3.3 - ActiveX Control Remote Buffer Overflow
KSign KSignSWAT 2.0.3.3 - ActiveX Control Remote Buffer Overflow www.ksign.com - KSignSWAT SWATLogin PoC code function GetHeapPadHeapJam, SizeofHeapPad whileHeapJam.length2 SizeofHeapPad HeapJam +=HeapJam; HeapJam = HeapJam.substring0, SizeofHeapPad/2; return HeapJam; // buffer 671 bytes write,...
CVE-2007-2827: Improper Restriction of Operations within the Bounds of a Memory Buffer
Heap-based buffer overflow in LEAD Technologies LEADTOOLS ISIS ActiveX Control ltisi14E.ocx 14.5.0.44 and earlier allows remote attackers to execute arbitrary code via a long DriverName property...
CVE-2007-2820: Undefined Security Weakness
Multiple stack-based buffer overflows in the KSign KSignSWAT ActiveX Control AxKSignSWAT.dll 2.0.3.3 allow remote attackers to execute arbitrary code via long arguments to the 1 SWATInit, 2 SWATInitEx, 3 SWATInitEx2, 4 SWATInitEx3, and 5 SWATLogin functions...
KSign KSignSWAT 2.0.3.3 - ActiveX Control Remote Buffer Overflow
www.ksign.com - KSignSWAT SWATLogin PoC code function GetHeapPadHeapJam, SizeofHeapPad whileHeapJam.length2 SizeofHeapPad HeapJam +=HeapJam; HeapJam = HeapJam.substring0, SizeofHeapPad/2; return HeapJam; // buffer 671 bytes write, then EIP overwrite. var O5pad=unescape...
Dart ZipLite Compression 1.8.5.3 - 'DartZipLite.dll' ActiveX Control Buffer Overflow
source: https://www.securityfocus.com/bid/24099/info The Dart ZipLite Compression ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. Successfully exploiting this issue...
Stack overflow
Stack-based buffer overflow in the BrowseDir function in the 1 lttmb14E.ocx or 2 LTRTM14e.DLL ActiveX control in LeadTools Raster Thumbnail Object Library 14.5.0.44 allows remote attackers to execute arbitrary code via a long argument...
CVE-2007-2787
Stack-based buffer overflow in the BrowseDir function in the 1 lttmb14E.ocx or 2 LTRTM14e.DLL ActiveX control in LeadTools Raster Thumbnail Object Library 14.5.0.44 allows remote attackers to execute arbitrary code via a long argument...
Stack overflow
Stack-based buffer overflow in the LEAD Technologies LeadTools JPEG 2000 LEADJ2K.LEADJ2K.140 ActiveX control LTJ2K14.ocx 14.5.0.35 allows remote attackers to execute arbitrary code via a long BitmapDataPath property...
CVE-2007-2771
Stack-based buffer overflow in the LEAD Technologies LeadTools JPEG 2000 LEADJ2K.LEADJ2K.140 ActiveX control LTJ2K14.ocx 14.5.0.35 allows remote attackers to execute arbitrary code via a long BitmapDataPath property...
Pegasus ImagN ActiveX Control Remote Buffer Overflow Exploit
Exploit for unknown platform in category remote exploits ============================================================ Pegasus ImagN ActiveX Control Remote Buffer Overflow Exploit ============================================================ ?php / win32adduser - PASS=tzu EXITFUNC=seh USER=sun...
Pegasus ImagN - ActiveX Control Remote Buffer Overflow
Pegasus ImagN - ActiveX Control Remote Buffer Overflow ?php / win32adduser - PASS=tzu EXITFUNC=seh USER=sun Size=483 Encoder=PexAlphaNum http://metasploit.com / $shellcode = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"...
Pegasus ImagN - ActiveX Control Remote Buffer Overflow
?php / win32adduser - PASS=tzu EXITFUNC=seh USER=sun Size=483 Encoder=PexAlphaNum http://metasploit.com / $shellcode = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49". "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"...
Buffer overflow
Buffer overflow in the UnlockSupport function in the LockModules subsystem in a certain ActiveX control in ltmm15.dll in Sienzo Digital Music Mentor DMM 2.6.0.4 allows remote attackers to execute arbitrary code via a long string in the second argument, a different issue than CVE-2007-2564...
CVE-2007-2763
Buffer overflow in the UnlockSupport function in the LockModules subsystem in a certain ActiveX control in ltmm15.dll in Sienzo Digital Music Mentor DMM 2.6.0.4 allows remote attackers to execute arbitrary code via a long string in the second argument, a different issue than CVE-2007-2564...
LEAD Technologies JPEG 2000 ActiveX control buffer overflow
Overview The LEAD Technologies JPEG 2000 ActiveX control contains a buffer overflow, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description LEAD Technologies provides imaging software for Windows. The LEAD JPEG 2000 ActiveX control, which ...
CVE-2007-2755
The PrecisionID Barcode 1.9 ActiveX control in PrecisionIDBarcode.dll, when Internet Explorer 6 is used, allows remote attackers to overwrite arbitrary files via a full pathname to the SaveToFile function, a different vulnerability than CVE-2007-2744...
Code injection
The PrecisionID Barcode 1.9 ActiveX control in PrecisionIDBarcode.dll, when Internet Explorer 6 is used, allows remote attackers to overwrite arbitrary files via a full pathname to the SaveToFile function, a different vulnerability than CVE-2007-2744...
CVE-2007-2755
CVE-2007-2755 : The PrecisionID Barcode 1.9 ActiveX control (PrecisionID_Barcode.dll) is vulnerable when used with Internet Explorer 6. An attacker can overwrite arbitrary files by passing a full pathname to the SaveToFile function, representing a file-write condition that is separate from CVE-20...