Memory corruption

The HxTocCtrl ActiveX control hxvz.dll, as used in Microsoft Internet Explorer 5.01 SP4 and 6 SP1, in Windows XP SP2, Server 2003 SP1 and SP2, Vista SP1, and Server 2008, allows remote attackers to execute arbitrary code via malformed arguments, which triggers memory corruption...

xnview1921-overflow.txt

!/usr/bin/perl ================================================================ XnView 1.92.1 Slideshow "FontName" Buffer Overflow ================================================================ Calc execution POC Exploit for WinXP SP1 pro English Found by : Stefan Cornelius, Secunia Research...

hpopenviewnnm-overflow.txt

!/usr/bin/python HP OpenView NNM 7.5.1 OVAS.EXE Pre Authentication SEH Overflow Tested on Windows 2003 Server SP1. Coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/hp-nnm-ov.py.txt shameless plug This vulnerability was found, analysed and exploited as...

XnView 1.92.1 - 'FontName' Slideshow Buffer Overflow

!/usr/bin/perl ================================================================ XnView 1.92.1 Slideshow "FontName" Buffer Overflow ================================================================ Calc execution POC Exploit for WinXP SP1 pro English Found by : Stefan Cornelius, Secunia Research...

HP OpenView Network Node Manager (OV NNM) 7.5.1 - 'OVAS.exe' Overflow (SEH)

!/usr/bin/python HP OpenView NNM 7.5.1 OVAS.EXE Pre Authentication SEH Overflow Tested on Windows 2003 Server SP1. Coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/hp-nnm-ov.py.txt shameless plug This vulnerability was found, analysed and exploited as...

DESlock+ <= 3.2.6 local kernel ring0 link list zero SYSTEM Exploit

No description provided by source. / deslock-list-zero-v2.c Copyright c 2008 by [email protected] DESlock+ = 3.2.6 local kernel ring0 link list zero SYSTEM exploit by mu-b - Fri 28 Dec 2007 - Tested on: DLMFENC.sys 1.0.0.26, DLMFDISK.sys 1.2.0.27 - Microsoft Windows 2003 SP2 - Microsoft Windows...

Microsoft Windows Active Directory LDAP Request Validation Remote Denial Of Service Vulnerability

Description Microsoft Windows is prone to a remote denial-of-service vulnerability because Microsoft Active Directory and ADAM Active Directory Application Mode fail to handle specially crafted Lightweight Directory Access Protocol LDAP requests. An attacker can exploit this issue to cause the...

Titan FTP Server 6.05 build 550 - 'DELE' Remote Buffer Overflow (PoC)

source: https://www.securityfocus.com/bid/27611/info Titan FTP Server is prone to a remote buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. An attacker may exploit this issue to execute arbitrary...

Microsoft Excel rtAFDesc record invalid pointer access

Added: 01/17/2008 CVE: CVE-2008-0081 BID: 27305 OSVDB: 40344 Background Microsoft Excel, part of the Microsoft Office product suite, is a spreadsheet application for Windows platforms. Problem Microsoft Excel references an uninitialized pointer if a spreadsheet contains an improperly placed...

Microsoft Excel rtAFDesc record invalid pointer access

Added: 01/17/2008 CVE: CVE-2008-0081 BID: 27305 OSVDB: 40344 Background Microsoft Excel, part of the Microsoft Office product suite, is a spreadsheet application for Windows platforms. Problem Microsoft Excel references an uninitialized pointer if a spreadsheet contains an improperly placed...

Microsoft Windows TCP/IP实现IGMP及MLD报文远程溢出漏洞（MS08-001）

BUGTRAQ ID: 27100 CVECAN ID: CVE-2007-0069 Microsoft Windows是微软发布的非常流行的操作系统。 Windows内核的TCP/IP实现（tcpip.sys）处理存储IGMPv3和MLDv2查询状态的TCP/IP结构的方式存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 匿名攻击者可以通过在网络上向计算机发送特制的IGMPv3和MLDv2报文来利用此漏洞。成功利用此漏洞的攻击者可以完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。 Microsoft Windows XP SP...

Microsoft Windows TCP/IP实现ICMP请求远程拒绝服务漏洞（MS08-001）

BUGTRAQ ID: 27139 CVECAN ID: CVE-2007-0066 Microsoft Windows是微软发布的非常流行的操作系统。 Windows内核的TCP/IP实现（tcpip.sys）中处理碎片路由器广播ICMP查询的方式实现上存在漏洞，远程攻击者可能利用此漏洞导致系统崩溃。 匿名攻击者可以通过在网络上向计算机特制的ICMP报文利用此漏洞，导致计算机停止响应和自动重新启动。但利用此漏洞所必须的ICMP路由发现协议（RDP）不是默认启用的。 Microsoft Windows XP SP2 Microsoft Windows Server 2003 SP2...

Trend Micro ServerProtect RPCFN_CMON_SetSvcImpersonateUser buffer overflow

Added: 12/28/2007 CVE: CVE-2007-4218 BID: 25395 OSVDB: 39752 Background Trend Micro ServerProtect is a virus scanner for servers. Problem A buffer overflow in the ServerProtect service allows remote attackers to execute arbitrary commands by sending a specially crafted RPC request which is...

Trend Micro ServerProtect RPCFN_CMON_SetSvcImpersonateUser buffer overflow

Added: 12/28/2007 CVE: CVE-2007-4218 BID: 25395 OSVDB: 39752 Background Trend Micro ServerProtect is a virus scanner for servers. Problem A buffer overflow in the ServerProtect service allows remote attackers to execute arbitrary commands by sending a specially crafted RPC request which is...

Trend Micro ServerProtect RPCFN_CMON_SetSvcImpersonateUser buffer overflow

Added: 12/28/2007 CVE: CVE-2007-4218 BID: 25395 OSVDB: 39752 Background Trend Micro ServerProtect is a virus scanner for servers. Problem A buffer overflow in the ServerProtect service allows remote attackers to execute arbitrary commands by sending a specially crafted RPC request which is...

windows/XP-sp1 portshell on port 58821 116 bytes

No description provided by source. / 116 bytes bindcode hardcoded for Windows XP SP1 / / but you can change the address if you want / / i made it pretty clear where they are / / the bindcode will bind to port 58821 / / by silicon / [email protected] / / greetz to dtors.net : include stdio.h inclu...

win32 Beep Shellcode (SP1/SP2) 35 bytes

No description provided by source. / Shellcode can be changed to work with any windows distribution by changing the address of Beep in kernel32.dll Addresses for SP1 and SP2 -xnull / include stdio.h unsigned char beepsp1 = "\x55\x89\xE5\x83\xEC\x18\xC7\x45\xFC"...

Appian Enterprise Business Suite 5.6 SP1 DoS

This module exploits a denial of service flaw in the Appian Enterprise Business Suite service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Appian Enterprise Business Suite 5.6 SP1 DoS',...

MS Windows RRAS RASMAN Registry Stack Overflow Exploit (MS06-025)

No description provided by source. This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artisti...

Microsoft Internet Explorer TIF/TIFF Code Execution (MS07-055)

Exploit for unknown platform in category remote exploits ============================================================== Microsoft Internet Explorer TIF/TIFF Code Execution MS07-055 ============================================================== !/usr/bin/perl Microsoft Internet Explorer TIF/TIFF...