Input validation

The WinVerifyTrust function in Authenticode Signature Verification 5.1, 6.0, and 6.1 in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly use unspecified fields in a...

PT-2010-2247 · Microsoft · Windows Server 2003 +6

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, Server 2008 Gold, SP2, and R2, and Windows 7 Description: A remote code execution issue exists in the Windows Authenticode Signature Verification...

Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability

Description Microsoft Windows Authenticode Signature Verification is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting victim to run or install a specially modified signed Portable Executable PE or cabinet file. Successful exploits can...

Check accessrights of ps, finger, who, last and /var/log/?tmp*

This plugin uses ssh to Check accessrights of ps, finger, who, last and /var/log/?tmp. Check if ps, finger, who and last is not user executable, check perm 660 for /var/log/?tmp SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

CVE-2010-0993

Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified...

CVE-2010-1334

Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified directory, a different...

Foxit Reader 3.2 执行内嵌可执行程序漏洞

BUGTRAQ ID: 39109 Foxit Reader是一款小型的PDF文档查看器和打印程序。 出于安全考虑Foxit Reader、Adobe Reader等阅读器不允许执行PDF文档中内嵌的可执行程序（如二进制程序和脚本），但攻击者可以使用特殊技术绕过这种安全机制启动命令（/Launch /Action），最终执行内嵌的可执行程序。Adobe Reader在打开这种PDF文档时会弹出安全提示对话框，而Foxit Reader不会给出任何提示。 Foxit Reader 3.2 厂商补丁： Foxit ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Adobe, FoxIt Investigating Way to Mitigate PDF Hack

Security response teams at Adobe and FoxIt are investigating ways to mitigate a new PDF hack that allows the execution of an embedded executable without exploiting any security vulnerabilities. A demo of the PDF hack has been published to show how a hacker could employ social engineering techniqu...

Adobe Reader - Escape From '.PDF' Execute Embedded Executable

Title : Escape From PDF Author : Didier Stevens Date : 03/29/2010 Source : http://blog.didierstevens.com/2010/03/29/escape-from-pdf/ This is a special PDF hack: I managed to make a PoC PDF to execute an embedded executable without exploiting any vulnerability! I use a launch action triggered by t...

Hacker Finds a Way to Exploit PDF Files, Without Vulnerability

SEE: Updated report with response from Adobe and FoxIt Software A security researcher has managed to create a proof-of-concept PDF file that executes an embedded executable without exploiting any security vulnerabilities. The PDF hack, when combined with clever social engineering techniques, coul...

JITed egg-hunter stage-0 shellcode

No description provided by source. // JITed egg-hunter stage-0 shellcode // Permanent DEP bypass // // By Alexey Sintsov // [email protected] // [email protected] // // DSecRG - Digital Security Research Group dsecrg.com// // // TAG=3135330731353307 // its mean 0x07333531 twice! // // // This versi...

Mozilla Firefox and SeaMonkey Download Filename Spoofing Vulnerability

CVE:CVE-2009-3376 Mozilla Firefox and SeaMonkey are prone to a spoofing vulnerability. Attackers can exploit this issue to spoof the filenames displayed in the download dialog box and trick a user into downloading executable files. NOTE: This issue was previously covered in BID 36843 Mozilla...

Bournal Version Detection

This script finds the Bournal installed version. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2006-1 : sudo - several vulnerabilities

Several vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0426 It was discovered that sudo when a pseudo-command is enabled,...

[SECURITY] [DSA 2006-1] New sudo packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-2006-1 [email protected] http://www.debian.org/security/ Giuseppe Iuculano March 02, 2010 http://www.debian.org/security/faq -...

Mandriva Update for sudo MDVSA-2010:049 (sudo)

Check for the Version of sudo OpenVAS Vulnerability Test Mandriva Update for sudo MDVSA-2010:049 sudo Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

DSA-2006-1 sudo - several vulnerabilities

Bulletin has no description...

Portable Executable (PE) 16-bit File (CVE-2010-0232; CVE-2011-2003)

An elevation of privilege vulnerability exists in the Windows Kernel due to the way the kernel handles certain exceptions. The Windows Kernel is the core of the operating system. It provides system level services such as device management and memory management, allocates processor time to...

Mandriva Linux Security Advisory : sudo (MDVSA-2010:049)

A vulnerability has been found and corrected in sudo : sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain...

DEBIAN-CVE-2010-0426

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by...