Sync Breeze Enterprise 9.5.16 - Import Command Buffer Overflow

This module exploits a buffer overflow in Sync Breeze Enterprise 9.5.16 by using the import command option to import a specially crafted xml file. Module Options msf use exploit/windows/fileformat/syncbreeze/xml msf undefinedxml show actions ...actions... msf undefinedxml set ACTION msf...

Sync Breeze Enterprise 9.5.16 Buffer Overflow

!/usr/bin/env python Exploit Title: Sync Breeze Enterprise 9.5.16 - 'Import Command' Buffer Overflow SEH Date: 2017-03-29 Exploit Author: Daniel Teixeira Author Homepage: www.danielteixeira.com Vendor Homepage: http://www.syncbreeze.com Software Link:...

Code injection

NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPIDLLS environment variable...

CVE-2017-6455

CVE-2017-6455 affects NTP versions prior to 4.2.8p10 and 4.3.x prior to 4.3.94 when using PPSAPI. Local users can gain privileges by placing a DLL in the PPSAPI_DLLS environment variable, enabling a local privilege escalation. Public references in the connected documents confirm the vulnerability...

CVE-2017-6455

NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPIDLLS environment variable...

Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p10 Multiple Vulnerabilities

The version of the remote NTP server is 4.x prior to 4.2.8p10. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists in the receive function within file ntpd/ntpproto.c due to the expected origin timestamp being cleared when a packet with a zero...

VMware Host Guest Client Redirector - DLL Side Loading Exploit

Exploit for windows platform in category local exploits require 'msf/core' class MetasploitModule 'DLL Side Loading Vulnerability in VMware Host Guest Client Redirector', 'Description' = %q A DLL side loading vulnerability was found in the VMware Host Guest Client Redirector, a component of VMwar...

PhishWall Client DLL Loading Remote Code Execution Vulnerability

PhishWall Client is a client program developed by SecureBrain Japan. PhishWall Client suffers from a DLL loading remote code execution vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

Design/Logic Flaw

Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded by Skype. It allows an attacker to load a .dll of the attacker's choosing that...

CVE-2017-6517

Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded by Skype. It allows an attacker to load a .dll of the attacker's choosing that...

CVE-2017-6517

Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded by Skype. It allows an attacker to load a .dll of the attacker's choosing that...

CVE-2017-6517

CVE-2017-6517 affects Microsoft Skype 7.16.0.102, due to insecure library loading in Skype.exe that handles (api-ms-win-core-winrt-string-l1-1-0.dll). An unauthenticated attacker could leverage DLL hijacking to execute arbitrary code on the target system. Public sources describe this as a DLL loa...

CVE-2017-6517

Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded by Skype. It allows an attacker to load a .dll of the attacker's choosing that...

Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-04

Exploit for windows platform in category local exploits require 'zip' require 'base64' require 'msf/core' require 'rex/ole' class MetasploitModule 'Office OLE Multiple DLL Side Loading Vulnerabilities', 'Description' = %q Multiple DLL side loading vulnerabilities were found in various COM...

McAfee Security Scan Plus Privilege Escalation Vulnerability - Windows

McAfee Security Scan Plus is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Unpatchable 'DoubleAgent' Attack Can Hijack All Windows Versions — Even Your Antivirus!

A team of security researchers from Cybellum, an Israeli zero-day prevention firm, has discovered a new Windows vulnerability that could allow hackers to take full control of your computer. Dubbed DoubleAgent, the new injecting code technique works on all versions of Microsoft Windows operating...

Microsoft Color Management Module icm32.dll - icm32!LHCalc3toX_Di16_Do16_Lut8_G32 Out-of-Bounds Read (MS17-013)

Microsoft Color Management Module icm32.dll - icm32!LHCalc3toXDi16Do16Lut8G32 Out-of-Bounds Read MS17-013 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1054 We have encountered a crash in the Windows Color Management library icm32.dll, in the icm32!LHCalc3toXDi16Do16Lut8G32...

Adobe Shockwave Player <= 12.2.7.197 DLL Hijacking (APSB17-08)

The remote Windows host contains a version of Adobe Shockwave Player that is prior or equal to 12.2.7.197. It is, therefore, affected by a DLL hijacking vulnerability when loading certain dynamic link library DLL files due to searching an insecure path that may not be trusted or under user contro...

Microsoft Color Management Module 'icm32.dll' - 'icm32!Fill_ushort_ELUTs_from_lut16Tag' Out-of-Bounds Read (MS17-013)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1052 We have encountered a crash in the Windows Color Management library icm32.dll, in the icm32!FillushortELUTsfromlut16Tag function, while trying to display a TIFF image with a malformed embedded color profile: --- 7c1c.93b0:...

Microsoft Color Management Module 'icm32.dll' - 'icm32!LHCalc3toX_Di16_Do16_Lut8_G32' Out-of-Bounds Read (MS17-013)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1054 We have encountered a crash in the Windows Color Management library icm32.dll, in the icm32!LHCalc3toXDi16Do16Lut8G32 function, while trying to translate colors based on a malformed color profile file: --- 61e4.8620: Access...