New local NT attack - TOCTOU (Time-Of-Check-to-Time-Of-Use race conditions)

If service hooks are used for argument filtering, race conditions are possible between argument check and actual sytem call...

FutureSoft TFTP Server 2000 - Transfer-Mode Overflow (Metasploit)

$Id: futuresofttransfermode.rb 9262 2010-05-09 17:45:00Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Discuz!NT 3.1.0 多处持久性跨站漏洞

Discuz!NT，是康盛创想北京科技有限公司旗下的一款功能强大的基于 ASP.net 平台的社区软件，包括论坛、Space 个人空 间、相册、聚合等功能，后台自由选择开启。 1.论坛相册空间日志发表评论，插入跨站语句即可： demo:http://nt.discuz.net/showphoto.aspx?photoid=42 2. 在论坛板块版面出随意选择一种浏览方式，然后修改或添加加入跨站语句，获得地址：...

TABS MailCarrier 2.51 - SMTP EHLO Overflow (Metasploit)

$Id: mailcarriersmtpehlo.rb 9179 2010-04-30 08:40:19Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Microsoft IIS 4.0 - '.htr' Path Overflow (MS02-018) (Metasploit)

$Id: ms02018htr.rb 9179 2010-04-30 08:40:19Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Windows NT NNTP Component Buffer Overflow

The Network News Transfer Protocol NNTP component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an...

Windows NT NNTP Component Buffer Overflow

The Network News Transfer Protocol NNTP component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an...

Discuz! NT 3.0.0 background get WEBSHELL-vulnerability warning-the black bar safety net

http://test.com/admin/global/globaltemplatesedit.aspx?path=../&filename=index. aspx&templateid=1&templatename=Default Directly put your horse written in the forum index. aspx Or is the other file. path=../&filename=index. aspx But remember to get the SHELL to put the family file to restore it. Th...

Discuz!NT 3.1用户空间跨站漏洞

北洋贱队（http://bbs.seceye.org） Discuz!NT 是康盛创想北京科技有限公司旗下的一款功能强大的基于 ASP.net 平台的社区软件。基于先进的 .Net Framework，默认支持 SQLServer数据库，可扩展支持Access、MySQL等多种数据库，支持IIS5、IIS6、IIS7，安全高效、稳定易用，充分发挥 ASP.net 特性，支持自由选择切换皮肤，支持多种其它论坛的数据转换。 Discuz!NT 3.1 等待官方补丁 1.论坛用户空间日志发表评论，插入跨站语句即可：...

Lenovo Hotkey Driver 5.33 - Local Privilege Escalation

Lenovo Hotkey Driver 5.33 - Local Privilege Escalation Author: Chilik Tamir - Amdocs Power Security Testing Group Website: http://invalid-packet.blogspot.com/2010/03/full-disclosure-security-vulnerability.html Subject: Security vulnerability in Lenovo Hotkey Driver and Access Connections version...

Discuz! NT 3.1.0 more than the presence of cross-site vulnerability-vulnerability warning-the black bar safety net

1. In the Quick Search area of the“plates”of the search submitted to the cross site testing statement"iframe+Src=http://hi. baidu. com/5 4 2 7 5 1 8, The Get the address: http://localhost/bbs/forumsearch.aspx?q=%22%3E%3Ciframe%20src%3Dhttp%3A//hi.baidu.com/5427518%3E 2. In the forum sections...

Discuz!NT 3.1.0 多处存在跨站漏洞

北洋贱队（http://bbs.seceye.org）首发 1.在快速搜索区域的“板块”搜索提交跨站测试语句"iframe+Src=http://www.gohack.org， 获得地址：http://localhost/bbs/forumsearch.aspx?q=%22%3E%3Ciframe%20src%3Dhttp%3A//www.gohack.org%3E 2.在论坛板块版面出随意选择一种浏览方式，然后修改或添加加入跨站语句，获得地址：...

Fedora Update for ejabberd FEDORA-2010-1281

Check for the Version of ejabberd OpenVAS Vulnerability Test Fedora Update for ejabberd FEDORA-2010-1281 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Debian DSA-1942-1 : wireshark - several vulnerabilities

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2560 A NULL pointer dereference wa...

[SECURITY] Fedora 12 Update: ejabberd-2.1.2-2.fc12

ejabberd is a Free and Open Source distributed fault-tolerant Jabber/XMPP server. It is mostly written in Erlang, and runs on many platforms tested on Linux, FreeBSD, NetBSD, Solaris, Mac OS X and Windows NT/2000/XP...

Microsoft Windows NT #GP Trap Handler Allows Users to Switch Kernel Stack

Microsoft Windows NT GP Trap Handler Allows Users to Switch Kernel Stack ------------------------------------------------------------------------- CVE-2010-0232 In order to support BIOS service routines in legacy 16bit applications, the Windows NT Kernel supports the concept of BIOS calls in the...

Microsoft Confirms Unpatched Windows Kernel Flaw

One day after a Google security researcher releases code to expose a flaw that affects every release of the Windows NT kernel — from Windows NT 3.1 1993 up to and including Windows 7 2009 — Microsoft has released a security advisory to acknowledge the issue and warn of the risk of privilege...

CVE-2010-0232: Undefined Security Weakness

The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly...

17 Year-Old Windows Security Hole Found

A now published hole in Windows allows users with restricted access to escalate their privileges to system level – and this is believed to be possible on all 32-bit versions of Windows from Windows NT 3.1 up to, and including Windows 7. Read the full article. The H Security...

Microsoft Windows NT User Mode To Ring 0 Escalation

Microsoft Windows NT GP Trap Handler Allows Users to Switch Kernel Stack ------------------------------------------------------------------------- CVE-2010-0232 In order to support BIOS service routines in legacy 16bit applications, the Windows NT Kernel supports the concept of BIOS calls in the...