OpenLitespeed 1.3.9 - Use-After-Free (Denial of Service)

OpenLitespeed 1.3.9 - Use-After-Free Denial of Service / Openlitespeed 1.3.9 Use After Free denial of service exploit. This exploit triggers a denial of service condition within the Openlitespeed web server. This is achieved by sending a tampered request contain a large number 91 of 'a: a' header...

CVE-2014-3689

The vmware-vga driver hw/display/vmwarevga.c in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling...

CVE-2013-6282

The CVE-2013-6282 issue affects the Linux kernel on ARM v6k/v7 where get_user and put_user do not validate certain addresses, enabling an unprivileged user to read/write arbitrary kernel memory. Exploitation was reported in the wild on Android devices in late 2013. Affected kernel versions includ...

VMware Virtual Machine Communication Interface (VMCI) - vmci.sys

VMware Virtual Machine Communication Interface VMCI - vmci.sys / CVE-2013-1406 exploitation PoC by Artem Shishkin, Positive Research, Positive Technologies, 02-2013 / void stdcall FireShellDWORD dwSomeParam EscalatePrivilegeshProcessToElevate; // Equate the stack and quit the cycle ifndef AMD64 a...

Design/Logic Flaw

The NVIDIA UNIX driver before 295.40 allows local users to access arbitrary memory locations by leveraging GPU device-node read/write privileges...

USN-1105-1: Linux kernel vulnerabilities

Dan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. CVE-2010-4075 Dan Rosenberg discovered that the socket filters did not correctly...

MS Internet Explorer 6 - 8 Content-Encoding Memory Corruption

No description provided by source. MSIE Content-Encoding: deflate memory corruption vulnerability a.k.a. MSRC 8769, MS09-054, CVE-2009-1547, “Data Stream Header Corruption Vulnerability” Microsoft fixed a bug in Internet Explorer’s “Content-Encoding:deflate” implementation. Here are two...

USN-455-1: PHP vulnerabilities

Stefan Esser discovered multiple vulnerabilities in the "Month of PHP bugs". The substrcompare function did not sufficiently verify its length argument. This might be exploited to read otherwise unaccessible memory, which might lead to information disclosure. CVE-2007-1375 The shared memory shmop...

HP Instant Support - ActiveX Control Driver Check Buffer Overflow

HP Instant Support - ActiveX Control Driver Check Buffer Overflow source: https://www.securityfocus.com/bid/24730/info HP Instant Support ActiveX control is prone to a remote buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input before copying it to an...

CVE-2006-6143

The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon kadmind and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service crash and possibl...

iDefense Security Advisory 06.13.06: Microsoft Internet Explorer ART File Heap Corruption Vulnerability

Microsoft Internet Explorer ART File Heap Corruption Vulnerability iDefense Security Advisory 06.13.06 http://www.idefense.com/application/poi/display?type=vulnerabilities June 13, 2006 I. BACKGROUND Internet Explorer is the web browser included in Microsoft Corp.'s Windows products. II...

4D WebStar Tomcat Plugin Remote Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits ======================================================= 4D WebStar Tomcat Plugin Remote Buffer Overflow Exploit ======================================================= / 4d buffer overflow Braden Thomas the buffer is copied byte by byte...

Missing Install object instance checks — Mozilla

The native implementations of InstallTrigger and other XPInstall-related javascript objects did not properly validate that they were called on instances of the correct type. By passing other objects, even raw numbers, the javascript interpreter would jump to the wrong place in memory. Although no...

CVE-2004-1093

Midnight commander mc 4.5.55 and earlier allows remote attackers to cause a denial of service via "use of already freed memory."...

Adobe Acrobat Acrobat Reader 6.0 - .ETD File Parser Format String

Adobe Acrobat Acrobat Reader 6.0 - .ETD File Parser Format String source: https://www.securityfocus.com/bid/11934/info Adobe Acrobat/Acrobat Reader is reported prone to a remote format string vulnerability. The vulnerability is present in the ETD file parser when processing tag values. Reports...

Microsoft Internet Explorer vulnerable to buffer overflow via FRAME and IFRAME elements

Overview Microsoft Internet Explorer IE contains a buffer overflow vulnerability that can be exploited to execute arbitrary code with the privileges of the user running IE. Description A heap buffer overflow vulnerability exists in the way IE handles the SRC and NAME attributes of HTML elements...

Microsoft Windows NT 4.0/2000 - Local Descriptor Table Privilege Escalation (MS04-011)

// source: https://www.securityfocus.com/bid/10122/info Microsoft Windows Local Descriptor Table programming interface is prone to a privilege-escalation vulnerability. A local attacker may be able to create a malicious entry in the Local Descriptor Table. This entry may point into protected...

SX Design sipd 0.1.2/0.1.4 - Remote Format String

source: https://www.securityfocus.com/bid/9236/info sipd has been reported prone to a format string vulnerability that may be triggered remotely. It has been reported that sip URI arguments passed to the affected server are not sufficiently handled. An attacker may place format specifiers in the...

CVE-2003-0854

ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd...

eMule 0.2x - AttachToAlreadyKnown Double-Free

eMule 0.2x - AttachToAlreadyKnown Double-Free // source: https://www.securityfocus.com/bid/8444/info eMule client has been reported prone to a double free vulnerability. It has been reported that when the eMule client receives a specific sequence of packets from a malicious server, a memory objec...