applesmb-overflow.txt

/ Copyright C 2007-2008 Subreption LLC. All rights reserved. Visit http://blog.subreption.com for exploit development notes. References: CVE-2007-3876 http://docs.info.apple.com/article.html?artnum=307179 http://seclists.org/fulldisclosure/2007/Dec/0445.html...

[Full-disclosure] SF-Shoutbox 1.2.1 <= 1.4 HTML/JS Injection Vulnerability

----------------------------- || WWW.SMASH-THE-STACK.NET || ----------------------------- || ADVISORY: SF-Shoutbox 1.2.1 = 1.4 HTML/JS Injection Vulnerability || 0x00: ABOUT ME || 0x01: DATELINE || 0x02: INFORMATION || 0x03: EXPLOITATION || 0x04: GOOGLE DORK || 0x05: RISK LEVEL || 0x00: ABOUT ME...

[Full-disclosure] OSNews

http://distrowatch.com/weekly.php?issue=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd00 Someone forget their chroot soup this morning...

Apache Tomcat fails to properly handle cookies containing single quotes

Overview Apache Tomcat fails to properly handle cookies that contain a single quote, which may allow session hijacking. Description Apache Tomcat is an implementation of the Java Servlet and JavaServer Page JSP technologies. Apache Tomcat incorrectly treats a single quote as a cookie delimiter...

[Full-disclosure] Java fullscreen PWNage

Just POC http://evil.hackademix.net/fullscreen/js.html Tonu unrelated to this web or exploit Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/...

liberoit-xss.txt

The Italian ISP Libero.it not check the HTTP POST Parameter "pQuery" on search query and displays the content of this variable without modification within the html form area. Security problems on Libero's 155.it allows attackers to conduct XSS attacks for the following URL:...

Alphanumeric Shellcode Encoder Decoder

Exploit for generator platform in category shellcode ====================================== Alphanumeric Shellcode Encoder Decoder ====================================== / //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////...

borland-overflow.txt

/ http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064882.html Groetjes aan mijn sletjes: Doopie, Sjaakhans, PS en Sleepwalker :P All your base are belong to FD2K2! / include include include include include pragma commentlib,"ws232" define IBPORT "3050" // 0xFF - 0x8, jmp 8 bytes back...

Sun Java WebStart - JNLP Stack Buffer Overflow (PoC)

Sun Java WebStart - JNLP Stack Buffer Overflow PoC '----------------------------------------------------------------------------------------------- ' Java Web Start Buffer Overflow POC Exploit ' ' FileName: JavaWebStartPOC.VBS ' Contact: ZhenHan.Liuph4nt0m.org ' Date: 2007-07-10 ' Team:...

fusetalkautherror-xss.txt

Hello everyone, After trying to report a SQL bug autherror.cfm to FuseTalk, and seeing them providing patches to customers dropping new fixed .cfm files in a private place reserved to customers without giving proper credits and without reporting them publicly we were following the Full Disclosure...

Re: [Full-disclosure] screen 4.0.3 local Authentication Bypass

-----Original Message----- Subject: Re: Full-disclosure screen 4.0.3 local Authentication Bypass Verified on OpenBSD I'm not seeing a 'Getpass error' message on 4.1-STABLE current, but there does seem to be a problem with locking and reattaching: $ screen space $ echo "This is the locked screen"...

[Full-disclosure] Full Path Disclosure eqDKP 1.3.2c and prior

eqDKP 1.3.2c and prior 'compare' variable reveals the full path because eqdkp fails to properly sanitize user-supplied input Example: /path-to-eqdkp/listmembers.php?compare=00 Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored b...

[Full-disclosure] KSign KSignSWAT ActiveX Control Multiple Buffer Overflows Vulnerability

Title : KSign KSignSWAT ActiveX Control Multiple Buffer Overflows Vulnerability Version : AxKSignSWAT.dll KSignSWAT ActiveX Control ver. 2.0.3.3 Discoverer : KIM, KEE HONG [email protected] Critical : High Critical Test system : Windows XP SP2 Korean All patched : Windows XP SP2 English All...

[Full-disclosure] SQL-Injection in IP-TRACKING Mod for phpBB2.0.x

Information: The IP-Tracking Mod is a Extension for phpBB2.0.x which logs all Page hits the user of the Boards do including Referer, IP and Username. It contains a SQL-Injection on Admin-Level. You can get it from: http://www.phpbb.de/viewtopic.php?t=63690&postdays=0&postorder=asc&start=0 Steps t...

[Full-disclosure] PsychoStats 3.0.6b and prior

newtheme variable only expects "sane" behaivor, no arguement or an arguement with any special character, etc.. will cause it to error and display the full path to $pathtohlstats/includes/smarty/Smarty.class.php $pathtohlstats/server.php?newcss=styles.css&newtheme=00 Ex: Warning: Smarty error:...

asterisk-inject.txt

I've found a code injection in the music-on-hold module at freePBX's portal. There are Inssuficient filters in the delete functions. Only " ' and ; are being filtered. Vulnerable Lines: 300: $rmcmd="rm -f "".$pathtodir."/". $del."""; 301: exec$rmcmd; Example code:...

[Full-disclosure] freePBX 2.2.x's Music-on-hold Remote Code Execution Injection

I've found a code injection in the music-on-hold module at freePBX's portal. There are Inssuficient filters in the delete functions. Only " ' and ; are being filtered. Vulnerable Lines: 300: $rmcmd="rm -f "".$pathtodir."/". $del."""; 301: exec$rmcmd; Example code:...

Re: [Full-disclosure] [Amsn-devel] aMSN <= 0.96 remote DoS vulnerability

On Sun, Apr 22, 2007 at 05:41:25PM +0200, Sebastian Rother wrote: On Sun, 22 Apr 2007 01:32:35 -0400 [email protected] Youness Alaoui wrote: Hi, I'm a developer and admin of the aMSN project, someone just sent me this link...

[Full-disclosure] Asterisk SDP DOS vulnerability

MADYNES Security Advisory http://madynes.loria.fr/ http://madynes.loria.fr Title: Asterisk SIP INVITE remote DOS Release Date: 08/03/2007 Severity: High - Denial of Service Advisory ID:KIPH1 Software: Asterisk http://www.asterisk.org/ http://www.asterisk.org/ AsteriskR is a complete IP PBX in...

[Full-disclosure] PHP import_request_variables() vs extract()

Please note that also extract will override any variable exluded $GLOBALS but the main difference is that on http://it2.php.net/extract you are advised to do not use "extract against untrusted data, like user-input $GET, ...." quote if you want to run old code that relies on registerglobals...