PT-2011-1303

Name of the Vulnerable Software and Affected Versions Symantec Altiris Deployment Solution versions 6.9.x Symantec Notification Server versions 6.0.x Symantec Management Platform versions 7.0.x Description The issue concerns an unsafe method exposed by the Altiris eXpress NS SC Download ActiveX...

Design/Logic Flaw

Insecure method vulnerability in Sina Inc. DLoader Class ActiveX Control allows remote attackers to overwrite arbitrary files via a URL in the first parameter to the DonwloadAndInstall method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Sina DLoader类ActiveX控件'DonwloadAndInstall'方法任意文件下载漏洞

BUGTRAQ ID: 30223 CNCAN ID：CNCAN-2008071507 Sina UC是一款新浪网开发的基于P2P的即时通讯和娱乐平台。 Sina DLoader类ActiveX控件'DonwloadAndInstall'方法存在输入验证问题，远程攻击者可以利用漏洞下载任意文件到目标系统，并以登录进程权限执行。 问题是'DonwloadAndInstall'方法对参数缺少充分检查，可直接提交远程服务器的任意文件作为参数，程序不经过验证即可下载，导致以登录进程权限执行。 Sina Inc. DLoader 目前没有解决方案提供： http://www.51uc.com/...