Vulnerability in Microsoft IIS Allows Malicious File Uploads

A vulnerability has been identified in Microsoft Internet Information Services IIS that causes the server to incorrectly handle files with multiple extensions separated by the “;” character. For instance, a file named “malicious.asp;.jpg” is treated as an ASP file. This flaw allows attackers to...

OpenX - 'banner-edit.php' Arbitrary File Upload / PHP Code Execution (Metasploit)

$Id: openxbanneredit.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Adobe Photoshop CS2 - 'Wintab32.dll' DLL Hijacking

/ Exploit Title: Adobe Photoshop CS2 DLL Hijacking Exploit Wintab32.dll Date: August 25, 2010 Author: storm [email protected] Version: CS2 9.0 - Other versions are very possibly exploitable too Tested on: Windows Vista SP2 http://www.gonullyourself.org/ gcc -shared -o Wintab32.dll...

Roxio Creator DE - 'HomeUtils9.dll' DLL Hijacking

/ Exploit Title: Roxio Creator DE DLL Hijacking Exploit HomeUtils9.dll Date: August 25, 2010 Author: storm [email protected] Version: 9.0.116 - Other versions are very possibly exploitable too Tested on: Windows Vista SP2 http://www.gonullyourself.org/ gcc -shared -o HomeUtils9.dll...

InterVideo WinDVD 5 DLL Hijacking Exploit

Exploit for windows platform in category local exploits ========================================= InterVideo WinDVD 5 DLL Hijacking Exploit ========================================= / Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles, Dinesh Arora , Ganesha Site :...

Adobe Dreamweaver CS4 - ibfs32.dll DLL Hijacking

Adobe Dreamweaver CS4 - ibfs32.dll DLL Hijacking / Exploit Title: Adobe Dreamweaver CS4 DLL Hijacking Exploit ibfs32.dll Date: August 25, 2010 Author: Glafkos Charalambous glafkos@astalavistadotcom Version: 10.0 Build 4117 Tested on: Windows 7 Ultimate x86 Vulnerable extensions: .asp .asa. aspx...

Easy RM To MP3 2.7.3.7000 Buffer Overflow

Exploit Title: Easy RM to MP3 2.7.3.700 Local Buffer Overflow .m3u , .pls , .smi , .wpl , .wax , .wvx , .ram Date: 4 / 8 / 2010 Author: Oh Yaw Theng Software Link: http://www.exploit-db.com/application/10642/ Version: 2.7.3.700 Tested on: Windows XP SP 1 CVE : N / A !/usr/bin/python This exploit...

Microsoft Outlook AttachMethods Remote Code Execution (MS10-045; CVE-2010-0266)

Microsoft Outlook is an e-mail application and a personal information manager. A remote code execution vulnerability has been reported in the way that Microsoft Office Outlook tries to verify attachments in a specially crafted e-mail message. The vulnerability is due to an error in Microsoft Offi...

iscripts Socialware 2.2.x - Multiple Vulnerabilities

iscripts Socialware 2.2.x - Multiple Vulnerabilities /iScripts SocialWare 2.2.x Multiple Remote Vulnerability Name iScripts SocialWare Vendor http://www.iscripts.com Versions Affected 2.2.x Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at...

CVE-2010-2079

DataTrack System 3.5 allows remote attackers to bypass intended restrictions on file extensions, and read arbitrary files, via a trailing backslash in a URI, as demonstrated by 1 web.config\ and 2 .ascx\ files...

CVE-2010-2079

CVE-2010-2079 affects Magnoware DataTrack System (v3.5). The vulnerability arises from a flaw in URI handling that permits a trailing backslash to bypass extension restrictions and read protected files, exemplified by access to (1) web.config and (2) .ascx files. The documented impact is an infor...

phpcms2008sp4网站管理系统下载任意文件漏洞

comment\down.php ifpregmatch'/.php$/',$f || strpos$f, ":\" showmessage'地址有误'; //12行 只判断文件后辍 PHP，但没有考虑到在win系统中，文件名为：“xx.php ” 后面多了一个空格。也会被认为是 xx.php文件，因此，利用这个原理，当phpcms运行在win系统下，我们可以下载任意文件。 phpcms2008sp4UTF8100510 厂商补丁： PHPCMS ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

hustoj - 'FCKeditor' Arbitrary File Upload

check this out bro = http://www.hack0wn.com/view.php?xroot=1267.0&cat=exploits details..: works with an Apache server with the modmime module installed if specific - vulnerable code in path/web/fckeditor/editor/filemanager/connectors/php/config.php // SECURITY: You must explicitly enable this...

CVE-2010-2004

Stack-based buffer overflow in BS.Global BS.Player 2.51 Build 1022 Free, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via the Skin parameter in the Options section of a skins file .bsi, a different vulnerability than CVE-2009-1068...

In-portal 5.0.3 Remote Arbitrary File Upload Exploit

Exploit for php platform in category web applications ==================================================== In-portal 5.0.3 Remote Arbitrary File Upload Exploit ==================================================== Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

In-portal 5.0.3 - Arbitrary File Upload

Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : Inj3ct0r.com 0 1 + Support e-mail : submitatinj3ct0r.com 1 0 0 1 1 0 I'm eidelweiss member from Inj3ct0r Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-...

PHP 4.4.x < 4.4.9, 5.2.x < 5.2.8 DoS Vulnerability

PHP is prone to a denial of service DoS vulnerability because the application fails to handle certain file requests. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Camiro-CMS_beta-0.1 - FCKeditor Arbitrary File Upload

Camiro-CMSbeta-0.1 - FCKeditor Arbitrary File Upload ?php / ----------------------------------------------------------------- Camiro-CMSbeta-0.1 fckeditor Remote Arbitrary File Upload Exploit ----------------------------------------------------------------- Download :...

OSSIM repository_attachment.php页面任意文件上传漏洞

BUGTRAQ ID: 37377 OSSIM即开源安全信息管理（Open Source Security Information Management），是一个非常流行和完整的开源安全管理系统。 OSSIM的ossiminstall/repository/repositoryattachment.php脚本没有正确地执行安全检查，用户可以向Webroot中的文件夹上传带有任意扩展名的文件。如果用户上传了包含有某些Web Shell的PHP脚本，就会导致执行任意PHP代码。 AlienVault OSSIM 2.2 AlienVault OSSIM 2.1.5 厂商补丁：...

Firefox download filename spoofing with RTL override

Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override aka RLO or U+202E Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displayin...