Kaspersky AntiVirus - Yoda's Protector Unpacking Memory Corruption

Source: https://code.google.com/p/google-security-research/issues/detail?id=528 The attached testcase was found by fuzzing packed PE files, I suspect it was packed using "Yoda's protector". This vulnerability is obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM on all systems...

Symantec Endpoint Protection Manager - Authentication Bypass / Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Symantec Endpoint Protection Manager Authentication Bypass and Code Execution', 'Description' = %q This module exploits three separa...

Symantec Endpoint Protection Manager Authentication Bypass / Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Symantec Endpoint Protection Manager Authentication Bypass and Code Execution', 'Description' = %q This module exploits three separa...

curl: re-using authenticated connection when unauthenticated

It was discovered that libcurl could incorrectly reuse NTLM-authenticated connections for subsequent unauthenticated requests to the same host. If an application using libcurl established an NTLM-authenticated connection to a server, and sent subsequent unauthenticated requests to the same server...

Microsoft Windows NT 4.0 DHCP Server Request Buffer Overflow attack - Ver2 (CVE-2004-0900)

A buffer overflow vulnerability has been reported in Microsoft Windows NT. An attacker could exploit this vulnerability via a malformed DHCP message. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application...

cURL and libcurl Unauthorized Operation Vulnerability

CURL is a set of file transfer tools that utilize URL syntax to work at the command line.Libcurl is a free, open source client-side URL transfer library. A security vulnerability exists in cURL and libcurl versions 7.10.6 through 7.41.0 that stems from the program failing to properly reuse NTLM...

Microsoft Winhlp32 Compressed Phrase Buffer Overflow attack - Ver2 (CVE-2004-1306)

A buffer overflow vulnerability has been reported in Microsoft Windows XP, Microsoft Windows 2000, Microsoft Windows NT and Microsoft Windows Server 2003. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause...

IT-Grundschutz M4.052: Geräteschutz unter NT-basierten Windows-Systemen

IT-Grundschutz M4.052: Geräteschutz unter NT-basierten Windows-Systemen. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM4052.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 4.052 Authors: Thomas Rotter Copyright: Copyright c 2015 Greenbone...

ManageEngine Desktop Central statusUpdate Arbitrary File Upload RCE (intrusive check)

The version of ManageEngine Desktop Central running on the remote host is affected by a remote code execution vulnerability due to a failure by the statusUpdate script to properly sanitize user-supplied input to the 'fileName' parameter when performing an 'LFU' action to statusUpdate. A remote,...

IT-Grundschutz M4.052: Gerteschutz unter NT-basierten Windows-Systemen

IT-Grundschutz M4.052: Gerteschutz unter NT-basierten Windows-Systemen. Stand: 14. Ergnzungslieferung 14. EL. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier...

Microsoft WINS Service Memory Overwrite Buffer Overflow - Ver2 (CVE-2004-0567)

A buffer overflow vulnerability has been reported in Microsoft Windows Server 2003, Microsoft Windows 2000 and Microsoft Windows NT. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

iBackup 10.0.0.32 - Local Privilege Escalation

No description provided by source. Exploit Title: iBackup = 10.0.0.32 Local Privilege Escalation Date: 23/01/2014 Author: Glafkos Charalambous glafkos.charalambousatunithreat.com Version: 10.0.0.32 Vendor: IBackup Vendor URL: https://www.ibackup.com/ CVE-2014-5507 Vulnerability Details There are...

Did the “Man With No Name” Feel Insecure?

Posted by James Forshaw, Taker of Names Sometimes when I'm doing security research I'll come across a bug which surprises me. I discovered just such a bug in the Windows version of Chrome which exposed a little-known security detail in the OS. The bug, CVE-2014-3196 was fixed in M38, so it seemed...

Provide the right artifact: Windows NT EPATHOBJ Local Ring0 Exploit-vulnerability warning-the black bar safety net

This is a 2 0 1 3 year 6 month released the windows nt kernel local mention of the right to 0day Vulnerability CVE-2 0 1 3-3 6 6 0, but soon Microsoft will in the 2 0 1 3 year 7 month The Update Patch fixes this vulnerability; this vulnerability relates to the version of windows there is XP, Vist...

Hewlett-Packard Application Lifecycle Manager DLL Planting Elevation of Privilege Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard's Application Lifecycle Management. This vulnerability requires the attacker to have an unprivileged account on the Application Lifecycle Management System. The specific flaw exists...

SysExporter - Grab data from list-view, tree-view, combo box, WebBrowser control, and text-box

SysExporter utility allows you to grab the data stored in standard list-views, tree-views, list boxes, combo boxes, text-boxes, and WebBrowser/HTML controls from almost any application running on your system, and export it to text, HTML or XML file. Here's some examples for data that you can expo...

SmartDesk WebSuite 2.1 - Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/278/info A buffer overflow vulnerability in SmartDesk WebSuite 2.1 allows malicious remote users to crash the server, and may at worst allow them to execute arbitrary code. WebSuite 2.1 will crash when the filename...

Microsoft Windows XP/95/98/2000/NT 4 Riched20.dll Attribute Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6874/info The riched20.dll is vulnerable to a buffer overflow that results in the application calling the library to fail. By creating a Rich Text Format RTF file with more than 65536 bytes of data in an attribute, the...

Microsoft Windows 2000/NT 4 TCP Stack DoS Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/3967/info An issue exists in Windows which could cause the TCP stack to consume all available system memory. This is achieved if a user sends numerous empty TCP packets to a host on port 139. Successful exploitation of th...

MS Windows NT Crash with an Extra Long Username DoS Exploit

No description provided by source. You can crash an NT box possibly W95 too by sending a very long username in a Winpopup message. This is easy to do from UNIX with 'smbclient -U LOTSandLOTSofcrap -M host'. milw0rm.com 1997-04-01...