Microsoft Internet Explorer 10 - CMarkup Use-After-Free (MS14-012)

Microsoft Internet Explorer 10 - CMarkup Use-After-Free MS14-012 mxmlc.exe AsXploit.as -o AsXploit.swf Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/32851-AsXploit.as -- var garr = ; var arrLen = 0x250; function dword2datadword var d =...

Adobe Flash Player domainMemory ByteArray Use After Free

This module exploits a use-after-free vulnerability in Adobe Flash Player. The vulnerability occurs when the ByteArray assigned to the current ApplicationDomain is freed from an ActionScript worker, when forcing a reallocation by copying more contents than the original capacity, but Flash forgets...

CVE-2014-1760

CVE-2014-1760 concerns multiple memory-corruption vulnerabilities in Microsoft Internet Explorer 11. Reported as a remote-code-execution/denial-of-service class when visiting a crafted web site, with the root cause tied to memory handling in IE’s rendering/parsing paths (e.g., ZDI cites CFormatCa...

CVE-2014-1751

CVE-2014-1751 is a memory-corruption vulnerability in Microsoft Internet Explorer (IE) that can be triggered by visiting a crafted web site, enabling remote code execution or memory corruption leading to a denial of service. The IE family (versions 6–11) is affected; the underlying issue is a mem...

IE 12 to Support HSTS Encryption Protocol

Microsoft confirmed today it will support HTTPS Strict Transport Protocol HSTS in Internet Explorer 12, bringing its browser in line with other major vendors in its support of the protocol. Browsers supporting HSTS force any sessions sent over HTTP to be sent instead over HTTPS, encrypting...

destoon最新版某敏感功能xss指哪打哪

简要描述： 之前提交过，官方说补了 http://www.wooyun.org/bugs/wooyun-2014-053573 于是我看看修补以后的效果。 详细说明： 这是最新版的过滤富文本xss的函数： 已经解决了之前的问题。用expressi0n替换了expression。看似似乎没问题了。 其实还有各种问题。IE还有一个容错特性，那就是expression，其中加斜杠\，在IE6789上是可以触发的（当然我没测试更高版本）。所以，利用这个特性，可以绕过dsafe函数的过滤。 这时候，我们测试： 照弹无误：...

MS14-010 CVE-2014-0293 Technical Details and Code(I changed the web permanently)

Origin: Visit http://technet.microsoft.com/en-us/security/bulletin/ms14-010 Check "Acknowledgments" for "CVE-2014-0293". It says "Dieyu" and links to my website http://dieyu.org/ Technical Details: showModalDialog to keep script running, HTTP redirecting to target domain. Then script will run in...

ThinkSNS存储型XSS一枚

简要描述： 存储型XSS 详细说明： thinksns在微吧的应用中，允许用户发表帖子，而帖子是富文本。 所以，不可避免地涉及到富文本中xss的过滤。而问题就出来过滤的地方。 thinksns使用如下函数过滤传入的参数 function h$text, $type = 'html' // 无标签格式 $texttags = ''; //只保留链接 $linktags = ''; //只保留图片 $imagetags = ''; //只存在字体样式 $fonttags = ''; //标题摘要基本格式 $basetags = $fonttags.' '; //兼容Form格式...

IE 11 Stands Up to Pwn2Own Exploit Attempt

VANCOUVER – Successful exploits at the Pwn2Own contest get all the glitz, but the rarities are the exploits that fail. A group of four young South Korean hackers from ASRT, all of them well shy of their thirtieth birthdays, stood in proxy for Jung Hoon Lee. Lee was home fulfilling a military...

CVE-2014-0306

CVE-2014-0306 is described as a memory corruption vulnerability in Microsoft Internet Explorer 8 and 9 (remote code execution via a crafted web page). Connected sources add that this class of IE memory corruption issues is addressed by Microsoft MS14-012 (Cumulative Security Update for Internet E...

CVE-2014-0313

The CVE-2014-0313 entry corresponds to memory corruption in Microsoft Internet Explorer 10/11 triggered by a crafted web site. Connected sources confirm the affected product is Internet Explorer 10/11 and the vulnerability can allow remote code execution or memory corruption leading to denial of ...

CVE-2014-0298

The CVE-2014-0298 entry relates to memory corruption in Microsoft Internet Explorer (IE) 9–11 triggered by visiting a crafted website, per the NVD/NVD-derived description. Connected sources corroborate that this is a set of IE memory-corruption vulnerabilities resolved by Microsoft Security Bulle...

CVE-2014-0304

Microsoft Internet Explorer 11 is affected by CVE-2014-0304 (Memory Corruption). The vulnerability allows remote code execution or denial of service via a crafted web page due to memory object access. Mitigation provided by the vendor through MS14-012 (Cumulative Security Update for Internet Expl...

Microsoft Resolves IE Zero Day with Patch Tuesday Release

UPDATE: a previous version of this story mistakenly stated that Microsoft’s March patch Tuesday would be the last one providing support for Windows XP. Windows XP’s last patches will in fact be shipped with next month’s patch Tuesday release. Microsoft has finally pushed a fix for a stubborn and...

The browser cache is Vary broken

Jake, why are your blog posts always so depressing? -- Domenic Denicola @domenic Well, I wouldn't want to disappoint… TL;DR If you use "Vary" to negotiate content, the responses will fight for the same cache space. Additionally, IE ignores "max-age" and Safari is buggy. Content negotiation using...

[Responder] a LLMNR and NBT-NS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server

Responder is a LLMNR and NBT-NS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. This tool is first an LLMNR and NBT-NS responder, it will answer to specific NBT-NS NetBIOS Name...

Slack: Reflective XSS can be triggered in IE

https://slack.com/go/2-2190974613-d56827?77d50"alert9 The following URL is vulnerable to XSS and can be reproduce in IE...

CVE2014-0 3 2 2 0Day Exploit analysis-exploit warning-the black bar safety net

Recently there was an IE 0day CVE-2 0 1 4-0 3 2 2is used to hang horse。 Although the vulnerability itself exists in IE,but in order to achieve success use,this sample also borrow a flash as an auxiliary,to break through the various protection. IE+flash combination also gives the analysis poses so...

Microsoft Ships IE 10 Zero Day Fix-It Tool

Microsoft last night released a Fix-It tool as a temporary mitigation for a zero-day vulnerability in Internet Explorer 10 being exploited by two hacker groups against the Veterans of Foreign Wars in the U.S. as well as a French aerospace manufacturer. IE 9 also contains the same use-after free...

Microsoft Mitigation Bypass Bug Bounty Winner Yang Yu

Yang Yu is no stranger to writing mitigation bypasses for Microsoft Windows products. A year ago at the CanSecWest conference in Vancouver, the 35-year-old security researcher from Beijing did an extensive presentation on bypassing Address Space Layout Randomization ASLR and Data Execution...