Portable Executable (PE) 16-bit File (CVE-2010-0232; CVE-2011-2003)

An elevation of privilege vulnerability exists in the Windows Kernel due to the way the kernel handles certain exceptions. The Windows Kernel is the core of the operating system. It provides system level services such as device management and memory management, allocates processor time to...

Wireshark 1.2.5 - LWRES getaddrbyname Buffer Overflow

Wireshark 1.2.5 - LWRES getaddrbyname Buffer Overflow !/usr/bin/env python Wireshark 1.2.5 LWRES getaddrbyname stack-based buffer overflow Discovered by babi Reference: http://www.exploit-db.com/exploits/11288 Exploit Dev by Nullthreat & Pure|Hate import socket, sys try: host = sys.argv1 except:...

Microsoft Windows kernel privilege escalation

Invalid exception handling in GP trap handler allows ring0 privilege escalation...

Microsoft Windows GP Trap Handler Privilege Escalation Vulnerability

Microsoft Windows operating system is prone to a privilege escalation vulnerability. This VT has been deprecated and replaced by the VT with the OID: 1.3.6.1.4.1.25623.1.0.900740. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and ar...

HTMLDOC 1.9.x-r1629 (Windows x86) - '.html' Local Buffer Overflow

/HTMLDOC 1.9.x-r1629 local .html buffer overflowwin32 exploit download: http://www.htmldoc.org/software.php?VERSION=1.9.x-r1629&FILE=htmldoc/snapshots/htmldoc-1.9.x-r1629.tar.bz2 header 19 bytes junk 268 bytes EIP register 4 bytes NOP SLEED 15 bytes calc.exe shellcode 338 bytes PLEASE READ: 1.Run...

Special ActiveX repurposing attacks tips and techniques-vulnerability warning-the black bar safety net

Copyright c 2 0 0 9 Czy Invicta Hack01@Live! cn All rights reserved. == 0x00 Foreword In this article, I am not against ActiveX controls the basic attack scenarios will be discussed. I'm here to be discussed is the use of a lot of interesting tricks and techniques to the development and utilizati...

CVE-2009-2743

IBM WebSphere Application Server WAS 6.1 before 6.1.0.27, and 7.0 before 7.0.0.7, does not properly handle an exception occurring after use of wsadmin scripts and configuration of JAAS-J2C Authentication Data, which allows local users to obtain sensitive information by reading the First Failure...

WINMOD 1.4 (.lst) Local Stack Overflow Exploit XP SP3 (RET+SEH) #3

Exploit for unknown platform in category local exploits ================================================================== WINMOD 1.4 .lst Local Stack Overflow Exploit XP SP3 RET+SEH 3 ================================================================== Winmod 1.4 .lst Local Stack Overflow Exploit...

CVE-2009-1686

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle constant aka const declarations in a type-conversion operation during JavaScript exception handling, which allows remote attackers to execute arbitrary code or...

CVE-2009-1686

Removed by vendor...

32bit FTP (09.04.24) - Banner Remote Buffer Overflow (PoC)

32bit FTP 09.04.24 - Banner Remote Buffer Overflow PoC ! /usr/bin/perl A client side vulnerability in the product allows remote servers to cause the client to crash by sending it a large banner. By: Load 99% website: http://www.electrasoft.com/32ftp.htm Version:09.04.24 0:005 g ... 9b0.bac: Acces...

Talkative IRC 0.4.4.16 Remote Stack Overflow Exploit (SEH)

No description provided by source. !/usr/bin/perl Title: Talkative IRC 0.4.4.16 Remote Stack Overflow Exploit SEH Summary: The easiest and fastest way to meet people online. With Talkative IRC you can chat with thousands of people at the same time. Find people with the same interests as you. Join...

Forgot Password/Crowd Integration exception handling and regex improvements

If JIRA is integrated with Crowd, and Crowd has password restrictions e.g. regex, a user will receive a stack trace in JIRA if the new password does not meet Crowd's password requirements e.g. through the Forgot Password link in JIRA. noformat java.lang.IllegalArgumentException: Could not change...

Forgot Password/Crowd Integration exception handling and regex improvements

If JIRA is integrated with Crowd, and Crowd has password restrictions e.g. regex, a user will receive a stack trace in JIRA if the new password does not meet Crowd's password requirements e.g. through the Forgot Password link in JIRA. noformat java.lang.IllegalArgumentException: Could not change...

CVE-2008-4684

packet-frame in Wireshark 0.99.2 through 1.0.3 does not properly handle exceptions thrown by post dissectors, which allows remote attackers to cause a denial of service application crash via a certain series of packets, as demonstrated by enabling the 1 PRP or 2 MATE post dissector...

NoticeWare E-mail Server 5.1.2.2 (POP3) Pre-Auth DoS Exploit

No description provided by source. !/usr/bin/python Software: NoticeWare E-mail Sever POP3 5.1.2.2 Pre-Auth DoS Discovered and Coded by: Paul Hand aka rAWjAW Blog: http://rawjaw-security.blogspot.com E-mail: phand3754atgmaildotcom Description: NoticeWare E-mail Server has many odd querks about it...

kernel: [x86_64] The string instruction version didn't zero the output on exception.

arch/x8664/lib/copyuser.S in the Linux kernel before 2.6.19 on some AMD64 systems does not erase destination memory locations after an exception during kernel memory copy, which allows local users to obtain sensitive information...

kernel: [x86_64] The string instruction version didn't zero the output on exception.

arch/x8664/lib/copyuser.S in the Linux kernel before 2.6.19 on some AMD64 systems does not erase destination memory locations after an exception during kernel memory copy, which allows local users to obtain sensitive information...

Moderate: Red Hat Security Advisory: setroubleshoot security and bug fix update

Updated setroubleshoot packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The setroubleshoot packages provide tools to help diagnose SELinux...

LICQ 1.3.5 - File Descriptor Remote Denial of Service

LICQ 1.3.5 - File Descriptor Remote Denial of Service // source: https://www.securityfocus.com/bid/28679/info LICQ is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions. A remote attacker can exploit this issue to crash the affected...