HTTP Methods Allowed (per directory)

By calling the OPTIONS method, it is possible to determine which HTTP methods are allowed on each directory. The following HTTP methods are considered insecure: PUT, DELETE, CONNECT, TRACE, HEAD Many frameworks and languages treat 'HEAD' as a 'GET' request, albeit one without any body in the...

Design/Logic Flaw

Multiple insecure method vulnerabilities in Idefense Labs COMRaider allow remote attackers to create or overwrite arbitrary files via the 1 CreateFolder and 2 Copy methods. NOTE: this might only be a vulnerability in certain insecure configurations of Internet Explorer...

iDefense COMRaider ActiveX控件多个不安全方法漏洞

Bugraq ID: 35725 CNCAN ID：CNCAN-2009071804 iDefense COMRaider是一款设计用于Fuzz COM对象接口的程序。 iDefense COMRaider ActiveX控件不正确调用方法，远程攻击者可以利用漏洞建立任意目录并拷贝任意本地文件。 问题存在于CreateFolder和Copy方法处理过程中，构建恶意WEB页，诱使用户打开，可建立任意目录并拷贝任意本地文件。造成拒绝服务等其他攻击。 iDefense COMraider 目前没有详细解决方案提供：...

CVE-2009-1212

Multiple insecure method vulnerabilities in PRECIS2.DLL in the PrecisionID Datamatrix ActiveX control DMATRIXLib.Datamatrix allow remote attackers to overwrite arbitrary files via the 1 SaveBarCode and 2 SaveEnhWMF methods...

SupportSoft DNA Editor Module (dnaedit.dll v6.9.2205) remote code execution exploit (IE6/7)

!-- SupportSoft DNA Editor Module dnaedit.dll v6.9.2205 remote code execution exploit IE6/7 by Nine:Situations:Group::bruiser vendor url: http://www.supportsoft.com/ our site: http://retrogod.altervista.org/ details: CLSID: 01110800-3E00-11D2-8470-0060089874ED Progid: Tioga.Editor.1 Binary Path:...

SAP GUI 7.1 WebViewer2D ActiveX — Insecure Methods

Application: EAI WebViewer2D EnjoySAP, SAP GUI for Windows 6.4 and 7.1 Versions Affected:Tested on 7100.2.7.1038 PL 7 Vendor URL: Bugs: Insecure method, File owervriting Exploits: YES Reported: 02.07.2009 Vendor response: 02.07.2009 Date of Public Advisory: 28.09.2009 Author: Alexandr Polyakov...

SAP GUI 7.1 WebViewer3D ActiveX — Insecure Methods

Application: EnjoySAP, SAP GUI for Windows 6.4 and 7.1 Versions Affected: Tested on 7100.2.7.1038 PL 7 Vendor URL: Bugs: Insecure method, File owervriting Exploits: YES Reported: 02.07.2009 Vendor response: 02.07.2009 Date of Public Advisory: 28.09.2009 Author: Alexandr Polyakov Description SAP G...

Office Viewer ActiveX Control 3.0.1 Remote File Execution Exploit

No description provided by source. =======================================================================================br Author: Houssamix br =======================================================================================br Office Viewer ActiveX Control v 3.0.1 Remote File execution...

Office Viewer ActiveX Control 3.0.1 - Remote Command Execution

Office Viewer ActiveX Control 3.0.1 - Remote Command Execution ======================================================================================= Author: Houssamix ======================================================================================= Office Viewer ActiveX Control v 3.0.1...

Office Viewer ActiveX Control 3.0.1 Remote File Execution Exploit

Exploit for unknown platform in category remote exploits ================================================================= Office Viewer ActiveX Control 3.0.1 Remote File Execution Exploit =================================================================...

Google Chrome Insecure Methods

Google Chrome Inesecure Methods&XSS By: e.wiZz! [email protected] najjaci.net Thanks: shinnaifor being so cool and lot of other friends In the wild... Chrome suffers from insecure methods thru "view-source" URI schemeit is just scheme,not protocol. file disclosure chrome-resource://thumb/C:/ XSS:...

CVE-2008-4924

Multiple insecure method vulnerabilities in MW6 Technologies 1D Barcode ActiveX control BARCODELib.MW6Barcode, Barcode.dll 3.0.0.1 allow remote attackers to overwrite arbitrary files via a full pathname argument to the 1 SaveAsBMP and 2 SaveAsWMF methods...

MW6 Barcode ActiveX (Barcode.dll) Insecure Method Exploit

No description provided by source. !-- By Dr.Pantagon DeltaSecurityCenter www.DeltaSecurity.ir Description : 1D Barcode ActiveX ver : 3.0.0.1 CopyRight : MW6 Technologies, Inc. Download Link : http://www.mw6tech.com/barcode/try/MW6Barcode.zip This was written for educational purpose. Use it at...

ruby: multiple insufficient safe mode restrictions

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via 1 untracevar, 2...

ruby: multiple insufficient safe mode restrictions

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via 1 untracevar, 2...

ruby: multiple insufficient safe mode restrictions

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via 1 untracevar, 2...

Autodesk DWF Viewer ActiveX multiple security vulnerabilities

Insecure methods allow to save and execute files...

Ruby multiple insufficient safe mode restrictions

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via 1 untracevar, 2...

ruby -- multiple vulnerabilities in safe level

The official ruby site reports: Several vulnerabilities in safe level have been discovereds:. untracevar is permitted at safe level 4; $PROGRAMNAME may be modified at safe level 4; insecure methods may be called at safe level 1-3; syslog operations are permitted at safe level 4; dl doesn't check...

hpu-insecure.txt

&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& Insecure Methods in HP Update Software. Remote: Yes Execute code remotely is possible using methods ExecuteAsync and Execute :- If a user visits the malicious page the attacker can execute code...