Microsoft Internet Explorer Document.Domain跨域同源覆盖漏洞

Microsoft Internet Explorer是一款流行的WEB浏览器。 Microsoft Internet Explorer存在绕过同源策略问题，远程攻击者可以利用漏洞访问其他目标域或者进行内容伪造攻击。 攻击者可以通过修改document.domain中的值，构建恶意WEB页，诱使用户访问来触发。 Microsoft Internet Explorer 6.0 SP2 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 - Citrix ICA Client for Windows 4.0...

HP Digital Imaging hpqxml.dll 2.0.0.133 - Arbitrary Data Write

HP Digital Imaging hpqxml.dll 2.0.0.133 - Arbitrary Data Write :. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: GoodFellas Security Research Team Technical Detail saveXMLAsFile method receives a filename as an argument, with this format "c:\path\file". Proof of...

[Full-disclosure] Windows Oday release

dear all SChannel Off-By-One Heap Corruption =================================== Discovery Date: 28th August 2006 Date reported to Microsoft: 19th March 2007 Summary: The Secure Channel SChannel library on WinXP-SP1/SP2 is vulnerable to a off-by-one heap buffer overwrite. The SChannel library...

CVE-2007-2219

Unspecified vulnerability in the Win32 API on Microsoft Windows 2000, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via certain parameters to an unspecified function...

CVE-2003-1330

Technical details about CVE-2003-1330 are not provided in the connected documents. The initial description summarizes the vulnerability as bypass of e-mail attachment filtering via an undetected attachment. Monitor for official advisories or patches.

CVE-2007-0947

Use-after-free vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, resulting in accessing deallocated memory of CMarkup objects, aka the second of two "HTML...

Design/Logic Flaw

Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control CAPICOM.dll in Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2 allows remote attackers to execute arbitrary code via unspecified vectors, aka the "CAPICOM.Certificates Vulnerability."...

CVE-2007-2475

Affected product: Novell SecureLogin (NSL) 6 SP1 prior to 6.0.106, specifically the ADSCHEMA utility. Issue: A vulnerability that permits a user to gain excessive permissions to their own attributes in an Active Directory (AD) environment. Impact/notes: The vulnerability is described in the conne...

CVE-2007-2476

CVE-2007-2476 is associated with Novell SecureLogin (NSL) versions prior to 6.0.106 (NSL 6 SP1 and earlier). The connected Nessus data confirms multiple issues, including a vulnerability that could grant users excessive permissions to their own AD attributes and an additional security issue relat...

RealPlayer 10 - '.ra' Remote Denial of Service

!/usr/bin/python Real player 10 Gold .Ra file remote Dos. Credits to n00b for finding this bug This bug is a nasty memory leak with in Real player 10 gold please remember if your guna test it out save all your info you need first..Coz your probly guna have to reboot also remember all other...

Novell Groupwise WebAccess GWINTER.EXE远程缓冲区溢出漏洞

Novell GroupWise是Novell基于WEB的应用服务程序。 Novell Groupwise WebAccess处理HTTP请求存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 问题存在于监听TCP 7205和7211的GWINTER.exe进程中，在处理HTTP BASIC验证请求时，拷贝用户提供的BASE64数据到固定大小的堆栈缓冲区，发送至少336字节会由于调用有漏洞的base64decode调用而造成基于堆栈的缓冲区溢出，可以应用程序权限执行任意指令。 Novell Groupwise 7.0 Novell Groupwise 7.0.0 SP1...

Foxit Reader 2.0 (PDF) Remote Denial of Service Exploit

No description provided by source. / Created Friday, April 20 2007 Moderator of http://igniteds.net Foxit Reader 2.0 for Windows Remote dos exploit created by n00b Foxit pdf viewer is prone to a dos exploit by opening a malformed pdf document it is possible...

CVE-2007-1946

Integer overflow in Windows Explorer in Microsoft Windows XP SP1 might allow user-assisted remote attackers to cause a denial of service crash and possibly execute arbitrary code via a large width dimension in a crafted BMP image, as demonstrated by w4intof.bmp...

CVE-2007-1946

Integer overflow in Windows Explorer in Microsoft Windows XP SP1 might allow user-assisted remote attackers to cause a denial of service crash and possibly execute arbitrary code via a large width dimension in a crafted BMP image, as demonstrated by w4intof.bmp...

[Full-disclosure] AOL Nullsoft Winamp LIBSNDFILE.DLL Remote Memory Corruption (Off By Zero)

AOL Nullsoft Winamp LIBSNDFILE.DLL Remote Memory Corruption Off By Zero by Piotr Bania [email protected] http://www.piotrbania.com Severity: Critical - Possible remote code execution. Software affected: Tested on AOL Nullsoft Winamp v5.33 x86 Feb 13 2007 on Windows XP SP1/SP2. There exist a...

Several Windows image viewers vulnerabilities

I made a small research covering security of several Windows offline image viewers. Although, when discussing security of image viewing software, web browsers are usually implied, since they will be on the 'front lines' in the unsafe environment such as the Internet, this research lists several...

Computer Associates BrightStor ARCserve Backup MediaSVR.EXE 191缓冲区溢出漏洞

Computer Associates BrightStor ARCserve Backup是一款企业级的备份解决方案。 Computer Associates BrightStor ARCserve Backup处理XDR过程的RPC数据存在设计错误，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 Mediasvr.exe导入的多个DLL在处理使用XDR过程的RPC数据时存在设计错误。4个来自RPC报文的字节作为特殊地址处理（xdrhandlet data会经过多次位移动和字节反转），最后装载到ECX中，在NULL字节后至少8字节NULL的191 0xbf过程成为可利用条件：...

CA BrightStor Backup 11.5.2.0 (Mediasvr.exe) Remote Code Exploit

Exploit for unknown platform in category remote exploits ================================================================ CA BrightStor Backup 11.5.2.0 Mediasvr.exe Remote Code Exploit ================================================================ !/usr/bin/python Computer Associates CA...

CVE-2007-1537

\Device\NdisTapi NDISTAPI.sys in Microsoft Windows XP SP2 and 2003 SP1 uses weak permissions, which allows local users to write to the device and cause a denial of service, as demonstrated by using an IRQL to acquire a spinlock on paged memory via the NdisTapiDispatch function...

Microsoft Windows OLE Dialog内存破坏漏洞（MS07-011）

Microsoft Windows是微软发布的非常流行的操作系统。 Microsoft Windows提供的OLE Dialog组件中存在一个远程执行代码漏洞。当用户与RTF文件中的畸形嵌入OLE对象进行交互时，就可能导致内存破坏，在用户系统上执行任意代码。 成功利用此漏洞的攻击者可以完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。那些帐户被配置为拥有较少系统用户权限的用户比具有管理用户权限的用户受到的影响要小。要利用此漏洞，需要进行用大量的户交互。 Microsoft Windows XP SP2 Microsoft Windows...