Microsoft Internet Explorer 8 - Fixed Col Span ID (Full ASLR + DEP Bypass) (MS12-037)

function strtointstr return str.charCodeAt10x10000 + str.charCodeAt0; var free = "EEEE"; while free.length 500 free += free; var string1 = "AAAA"; while string1.length 500 string1 += string1; var st...

Internet Explorer CButton Use After Free Vulnerability

Added: 01/04/2013 CVE: CVE-2012-4792 BID: 57070 OSVDB: 88774 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Problem All references to DOM button objects are not properly removed when a DOM buttom object is deleted. If the stale reference...

Microsoft Responds to IE Zero Day Used in CFR Watering Hole Attack

UPDATE – Microsoft responded this weekend with temporary mitigations and workarounds for a zero-day vulnerability in Internet Explorer exploited in an attack on the Council on Foreign Relations website. IE 6, 7 and 8 are vulnerable to exploits that would enable a remote attacker to execute code o...

Nvidia显示驱动服务(nvvsvc.exe)权限提升漏洞

Nvidia 是全球图形技术和数字媒体处理器行业领导厂商。 Windows版Nvidia显示驱动服务中存在提权漏洞，允许能访问目标机器的攻击者创建有远程Root访问权限的超级用户，完全绕过DEP和ASLR保护。 该漏洞是由于没有检查memmove操作的拷贝数据而造成的栈溢出漏洞。一个绕过DEP + ASLR + /GS + CoE的利用公布在pastebin.com，目前已删除。 0 Nvidia Display Driver 厂商补丁： NVIDIA ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

BlazeDVD 6.1 - .PLF File (ASLR + DEP Bypass) (Metasploit)

BlazeDVD 6.1 - .PLF File ASLR + DEP Bypass Metasploit This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

BlazeDVD 6.1 PLF Exploit DEP/ASLR Bypass (MSF)

Exploit for windows platform in category local exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

BlazeDVD 6.1 - '.PLF' File (ASLR + DEP Bypass) (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'BlazeDVD 6.1 PLF...

BlazeDVD 6.1 PLF Exploit DEP/ASLR Bypass

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'BlazeDVD 6.1 PLF...

NVidia Display Driver Buffer Overflow

/ NVidia Display Driver Service Nsvr Exploit - Christmas 2012 - Bypass DEP + ASLR + /GS + CoE ============================================================= @peterwintrsmith Hey all! Here is an exploit for an interesting stack buffer overflow in the NVidia Display Driver Service. The service liste...

Adobe Shockwave player vulnerable to downgrading

Overview Adobe Shockwave Player may automatically install a legacy version of the runtime, which can increase the attack surface of systems that have Shockwave installed. Description Adobe Macromedia Shockwave Player is software that plays active web content developed in Macromedia and Adobe...

Adobe Shockwave player installs Xtras without prompting

Overview Adobe Shockwave Player installs Xtras that are signed by Adobe or Macromedia without prompting, which can allow an attacker to target vulnerabilities in older Xtras. Description Adobe Macromedia Shockwave Player is software that plays active web content developed in Macromedia and Adobe...

Adobe Shockwave player provides vulnerable Flash runtime

Overview Adobe Shockwave Player 12.1.1.151 and earlier versions on the Windows and Macintosh operating systems provide a vulnerable version of the Flash runtime. Description Adobe Macromedia Shockwave Player is software that plays active web content developed in Macromedia and Adobe Director...

VLC media player 2.0.4 buffer overflow PoC

buffer overflow during the handling of the swf file context-dependent Successful exploits can allow attackers to execute arbitrary code Title : VLC media player 2.0.4 buffer overflow POC Version : 2.0.4 Twoflower Date : 2012-12-06 Vendor : http://www.videolan.org/vlc/ Impact : Med/High Contact :...

Apple QuickTime 7.7.2 TeXML Style Element font-table Field Stack Buffer Overflow

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 OperatingSystems::WINDOWS, :javascript...

Autonomy Keyview IDOL contains multiple vulnerabilities in file parsers

Overview Autonomy Keyview IDOL contains multiple vulnerabilities in file parsers. These vulnerabilities could allow a remote attacker to execute arbitrary code on an affected system. Description Autonomy Keyview IDOL is a set of libraries that can decode over 1,000 different file formats. The...

BigAnt Server 2.52 Stack Overflow Vulnerability

BigAnt Server version 2.52 SP5 SEH stack overflow ROP-based exploit with ASLR and DEP bypass. Exploit Title: BigAnt Server 2.52 SP5 SEH Stack Overflow ROP-based exploit ASLR + DEP bypass Date: 03/11/2012 Exploit Author: Lorenzo Cantoni Vendor Homepage: http://www.bigantsoft.com/ Version: BigAnt...

EMC Networker Format String

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'EMC Networker Format String',...

BigAnt Server 2.52 Stack Overflow

Exploit Title: BigAnt Server 2.52 SP5 SEH Stack Overflow ROP-based exploit ASLR + DEP bypass Date: 03/11/2012 Exploit Author: Lorenzo Cantoni Vendor Homepage: http://www.bigantsoft.com/ Version: BigAnt Console 2.52 SP5 Tested on: Windows 7 SP0 x86 Italian - expsrv.dll 6.0.9589 Info: Vulnerability...

BigAnt Server 2.52 SP5 - Remote Stack Overflow ROP-Based (SEH) (ASLR + DEP Bypass)

BigAnt Server 2.52 SP5 - Remote Stack Overflow ROP-Based SEH ASLR + DEP Bypass Exploit Title: BigAnt Server 2.52 SP5 SEH Stack Overflow ROP-based exploit ASLR + DEP bypass Date: 03/11/2012 Exploit Author: Lorenzo Cantoni Vendor Homepage: http://www.bigantsoft.com/ Version: BigAnt Console 2.52 SP5...

BigAnt Server 2.52 SP5 SEH Stack Overflow ROP-based exploit (ASLR + DEP bypass)

Exploit for windows platform in category remote exploits Exploit Title: BigAnt Server 2.52 SP5 SEH Stack Overflow ROP-based exploit ASLR + DEP bypass Date: 03/11/2012 Exploit Author: Lorenzo Cantoni Vendor Homepage: http://www.bigantsoft.com/ Version: BigAnt Console 2.52 SP5 Tested on: Windows 7...