Google Chrome任意文件下载漏洞

BUGTRAQ ID: 31000 CNCAN ID：CNCAN-2008090409 Google Chrome是一款Google公司开发的WEB浏览器。 Google Chrome默认下载任意文件无需确定，远程攻击者可以利用漏洞诱使用户下载恶意文件。 构建一个指向任意执行文件的URL，Google Chrome会自动下载到用户计算机并没有任何用户提示，可导致攻击者通过社会工程攻击，下载恶意文件并执行。 Google Chrome 0.2.149 27 目前没有解决方案提供： http://www.google.com/chrome script document.write'ifra...

Design/Logic Flaw

The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destinati...

Sina DLoader类ActiveX控件'DonwloadAndInstall'方法任意文件下载漏洞

BUGTRAQ ID: 30223 CNCAN ID：CNCAN-2008071507 Sina UC是一款新浪网开发的基于P2P的即时通讯和娱乐平台。 Sina DLoader类ActiveX控件'DonwloadAndInstall'方法存在输入验证问题，远程攻击者可以利用漏洞下载任意文件到目标系统，并以登录进程权限执行。 问题是'DonwloadAndInstall'方法对参数缺少充分检查，可直接提交远程服务器的任意文件作为参数，程序不经过验证即可下载，导致以登录进程权限执行。 Sina Inc. DLoader 目前没有解决方案提供： http://www.51uc.com/...

Sina DLoader Class - ActiveX Control DonwloadAndInstall Method Arbitrary File Download

Sina DLoader Class - ActiveX Control DonwloadAndInstall Method Arbitrary File Download source: https://www.securityfocus.com/bid/30223/info Sina DLoader is prone to a vulnerability that can cause malicious files to be downloaded and saved to arbitrary locations on an affected computer. Attackers...

Microsoft Access Snapshot Viewer ActiveX Control Arbitrary File Download (CVE-2008-2463)

Microsoft Snapshot Viewer is an application that allows viewing of snapshots created with any version of Microsoft Access. A remote code execution vulnerability has been discovered in the Snapshot Viewer for Microsoft Access. The vulnerability is due to an error in the Snapshot Viewer ActiveX...

Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download Vulnerability

Description Snapshot Viewer for Microsoft Access is prone to a vulnerability that can cause malicious files to be downloaded and saved to arbitrary locations on an affected computer. Attackers may exploit this issue to put malicious files in arbitrary locations on a victim's computer. This will...

dirlist-traverse.txt

@===========================================@ | Author = StAkeR [email protected] | @===========================================@ + @==============================================================@ | dirLIST = Arbitrary File Download Vulnerability |...

UUSee 2008 - UUUpgrade ActiveX Control Update Method Arbitrary File Download

UUSee 2008 - UUUpgrade ActiveX Control Update Method Arbitrary File Download source: https://www.securityfocus.com/bid/29963/info UUSee is prone to a vulnerability that can cause malicious files to be downloaded and saved to arbitrary locations on an affected computer. Attackers may exploit this...

UUSee 2008 - UUUpgrade ActiveX Control 'Update' Method Arbitrary File Download

source: https://www.securityfocus.com/bid/29963/info UUSee is prone to a vulnerability that can cause malicious files to be downloaded and saved to arbitrary locations on an affected computer. Attackers may exploit this issue to overwrite sensitive files with malicious data that will compromise t...

nweb2fax <= 0.2.7 Multiple Remote Vulnerabilities

No description provided by source. :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl nweb2fax = 0.2.7 Multiple Remote Vulnerabilities Script site:...

nweb2fax-multi.txt

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl nweb2fax $line"; ... Arbitrary File Download Vulnerability :...

nweb2fax <= 0.2.7 Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ================================================= nweb2fax $line"; ... Arbitrary File Download Vulnerability : /viewrq.php?format=ps&varfilename=../../../../../../../../../../etc/passwd Bug: ... $varfilename=$GET'varfilename';...

nweb2fax 0.2.7 - Multiple Vulnerabilities

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl nweb2fax $line"; ... Arbitrary File Download Vulnerability :...

nweb2fax 0.2.7 - Multiple Vulnerabilities

nweb2fax 0.2.7 - Multiple Vulnerabilities :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl nweb2fax $line"; ... Arbitrary File Download Vulnerability :...

HP Instant Support HPISDataManager.dll ActiveX控件任意文件下载漏洞

BUGTRAQ ID: 29530 CVECAN ID: CVE-2007-5608 HP Instant Support是是基于网络的故障诊断和排除工具套件，适用于桌面计算和打印产品。 HP Instant Support所安装的HPISDataManager.dll ActiveX控件没有正确地过滤对DownloadFile函数的输入参数。如果用户受骗访问了恶意网页并向该函数传送了超长参数的话，就可能导致向本地系统下载任意文件。 HP Instant Support 1.0.0.22 临时解决方法：...

Black Ice Software Inc Barcode SDK (BIDIB.ocx) Multiple Vulns

No description provided by source. ----------------------------------------------------------------------------- Black Ice Software Inc Barcode SDK BIDIB.ocx Arbitrary File Download and Memory Corruption url: http://www.blackice.com File : BIDIB.ocx Ver. : 10.9.3.0...

HP Online Support Services ActiveX DownloadFile() arbitrary file download

Overview The HP Online Support Services ActiveX control contains a method called DownloadFile. This may allow a remote, unauthenticated attacker to download files to the location of the ActiveX control. Description HP Services provides online product support services including HP Instant Support...

Black Ice Software Inc Barcode SDK (BIDIB.ocx) Multiple Vulns

Exploit for unknown platform in category remote exploits ============================================================= Black Ice Software Inc Barcode SDK BIDIB.ocx Multiple Vulns =============================================================...

Black Ice Software Inc Barcode SDK - 'BIDIB.ocx' Multiple Vulnerabilities

----------------------------------------------------------------------------- Black Ice Software Inc Barcode SDK BIDIB.ocx Arbitrary File Download and Memory Corruption url: http://www.blackice.com File : BIDIB.ocx Ver. : 10.9.3.0 CLSID: D2797899-BE27-4CDB-892F-4FDC26EA9BA9 Mark.: RegKey Safe for...

blackicebidib-download.txt

----------------------------------------------------------------------------- Black Ice Software Inc Barcode SDK BIDIB.ocx Arbitrary File Download and Memory Corruption url: http://www.blackice.com File : BIDIB.ocx Ver. : 10.9.3.0 CLSID: D2797899-BE27-4CDB-892F-4FDC26EA9BA9 Mark.: RegKey Safe for...