Ada Image Server 0.6.7 - imgsrv.exe Remote Buffer Overflow

Ada Image Server 0.6.7 - imgsrv.exe Remote Buffer Overflow !/usr/bin/python Only usable module with safeseh disabled on XP SP2 and XP SP3 is imgsrv.exe. However, it contains a null character in the address ex: XP SP3 = 00689aff. Versions above 0.6.7 do not seem to be vulnerable. $ ./imgsrv.py...

Ada Image Server <= 0.6.7 imgsrv.exe Buffer Overflow

Exploit for unknown platform in category remote exploits ==================================================== Ada Image Server 00689aff. Versions above 0.6.7 do not seem to be vulnerable. $ ./imgsrv.py 192.168.1.146 Ada Image Server v0.6.6 SEH Overwrite Discovered/Exploited by Blake Tested on XP...

BigAnt Server 2.50 SP1 (ZIP File) Local Buffer Overflow PoC

Exploit for unknown platform in category dos / poc =========================================================== BigAnt Server 2.50 SP1 ZIP File Local Buffer Overflow PoC =========================================================== !/usr/bin/env python BigAnt Server 2.50 SP1 Local Buffer Overflow Po...

BigAnt Server 2.50 SP1 - '.zip' Local Buffer Overflow (PoC)

!/usr/bin/env python BigAnt Server 2.50 SP1 Local Buffer Overflow PoC Found By: DrIDE Tested: XPSP3 Usage: Open BigAnt Console, Go to Update, Browse to zip, Boom. buff = "\x41" 10000 f1 = open"BigAntUpdate.zip","w" f1.writebuff f1.close milw0rm.com 2009-09-16...

Microsoft Excel BIFF format Qsir record memory corruption

Added: 09/11/2009 CVE: CVE-2009-1134 BID: 35246 OSVDB: 54958 Background Microsoft Excel, part of the Microsoft Office product suite, is a spreadsheet application for Windows and Macintosh platforms. Problem A memory corruption vulnerability allows command execution when a user closes a spreadshee...

Kolibri+ Web Server 2 - GET Remote Overwrite (SEH)

Kolibri+ Web Server 2 - GET Remote Overwrite SEH !/usr/bin/python Could not get this to work on XP SP3. php5ts.dll is the only module with safe seh off but could not get the pop pop ret to work correctly despite the large number of usable addresses that were tested. $ ./kolibri.py 192.168.1.146...

CVE-2008-6974

Multiple cross-site request forgery CSRF vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary commands via the pingip parameter; 2 change the administrative credentials via the...

CVE-2009-2766

httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests...

CVE-2009-2766

CVE-2009-2766 affects httpd.c in the httpd management GUI of DD-WRT 24 sp1; CGI programs under /cgi-bin/ can be accessed without administrative authentication, enabling remote changes via HTTP requests. CBSS: Network vector, low complexity, no authentication, with partial impact on confidentialit...

CVE-2009-1534

Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office We...

Integer overflow

Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute arbitrary code on a Windows 2000 SP4 system via a crafted AVI file, or cause a denial of service on a Windows XP SP2 or SP3, Server 2003 SP2, Vista Gold, SP1, ...

Microsoft .NET Framework请求调度远程拒绝服务漏洞（MS09-036）

BUGTRAQ ID: 35985 CVECAN ID: CVE-2009-1536 Microsoft .NET Framework是一个流行的软件开发工具包。 ASP.NET管理请求调度的方式存在拒绝服务漏洞。攻击者可以创建特制的匿名HTTP请求导致受影响的Web服务器变得没有响应，直到重启相关的应用池。 仅可通过IIS 7.0暴露Microsoft .NET Framework中的漏洞代码。对于没有运行IIS 7.0的系统，无法利用这个漏洞。 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 3.5 Microsof...

Microsoft Visual Studio ATL 'VariantClear()'远程代码执行漏洞

Bugraq ID: 35832 CVE ID：CVE-2009-0901 CNCVE ID：CNCVE-20090901 Microsoft Visual Studio是一款微软公司的开发工具套件系列产品。 Microsoft活动模版库ATL处理ATL头字段存在问题，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 ATL头字段存在的一个错误允许攻击者对未正确初始化的VARIANT进行VariantClear调用，基于此攻击者可以提供破坏的流触发错误处理过程中来调用VariantClear而控制整个流程。此漏洞只影响安装了使用Visual Studio...

Acoustica MP3 Audio Mixer 2.471 - .m3u Local Heap Overflow (PoC)

Acoustica MP3 Audio Mixer 2.471 - .m3u Local Heap Overflow PoC !/usr/perl/bin -w Foundr By : D3V!L FucK3r MY Email: [email protected] Download : http://www.acoustica.com Tested on : Windos vista sp1 Version : mp3 audio mixer v.2.471 Demo if you Click ×××××× and select file then ...... : perl For a...

Acoustica MP3 Audio Mixer 2.471 - '.m3u' Local Heap Overflow (PoC)

!/usr/perl/bin -w Foundr By : D3V!L FucK3r MY Email: [email protected] Download : http://www.acoustica.com Tested on : Windos vista sp1 Version : mp3 audio mixer v.2.471 Demo if you Click ×××××× and select file then ...... : perl For a men : Gretz to : Sa^Devl , THEINJECTOR , anti-trust EAX 03D7AD...

CVE-2009-0566

CVE-2009-0566 affects Microsoft Office Publisher 2007 SP1. The issue is an uninitialized/arbitrary pointer dereference in the PUBCONV.DLL module used to convert legacy Publisher files, leading to memory corruption and remote code execution when a crafted file is opened. Exploitation requires a us...

Microsoft ISA Server Privilege Escalation Vulnerability (970953)

This host is missing a critical security update according to Microsoft Bulletin MS09-031. OpenVAS Vulnerability Test $Id: secpodms09-031.nasl 5363 2017-02-20 13:07:22Z cfi $ Microsoft ISA Server Privilege Escalation Vulnerability 970953 Authors: Nikita MR Copyright Copyright c 2009 SecPod,...

HP Data Protector 4.00-sp1 43064 Denial Of Service

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'HP Data Protector...

HP Data Protector 4.00-SP1b43064 - Remote Memory Leak/Denial of Service (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'HP Data Protector...

DESlock+ 4.0.2 - 'dlpcrypt.sys' Local Kernel Ring0 Code Execution

/ deslock-dlpcrypt.c Copyright c 2009 by DESlock+ 4.0.2 local kernel SYSTEM exploit by mu-b - Thu 18 Jun 2009 - Tested on: dlpcrypt.sys 0.1.1.27 .text:0001BB2E: 'what do ya want for nothing?' - hmmm, something that doesn't pass kernel mode pointers between kernel and userland? Compile: MinGW +...