Novell NetWare LSASS CIFS.NLM Driver Stack Buffer Overflow

This module exploits a stack buffer overflow in the NetWare CIFS.NLM driver. Since the driver runs in the kernel space, a failed exploit attempt can cause the OS to reboot. Module Options msf use exploit/netware/smb/lsass/cifs msf undefinedcifs show actions ...actions... msf undefinedcifs set...

Novell NetWare 6.5 SP2-SP7 - LSASS CIFS.NLM Overflow (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Novell NetWare...

CVE-2007-0108

nwgina.dll in Novell Client 4.91 SP3 for Windows 2000/XP/2003 does not delete user profiles during a Terminal Service or Citrix session, which allows remote authenticated users to invoke alternate user profiles...

Novell Client NWGINA.DLL User档案文件安全绕过漏洞

Novell Client是一款Novell系统客户端。 Novell Client存在安全绕过问题，远程攻击者可以利用漏洞在Citrix环境中调用其他用户的档案文件，导致提权等攻击。 目前没有详细漏洞细节提供。 Novell Client 4.91 SP3 可联系供应商获得解决方案： http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974970.htm...

BrightStor ARCserve Message Engine RPC server buffer overflow

Added: 11/09/2006 CVE: CVE-2006-5143 BID: 20365 OSVDB: 29535 Background The BrightStor ARCserve Backup family of products includes a Message Engine which listens for connections on port 6503/TCP. Problem A buffer overflow in the ASCORE.dll library allows remote attackers to execute arbitrary...

Mercur MailServer 5.0 SP3 - IMAP Remote Buffer Overflow (2)

Mercur MailServer 5.0 SP3 - IMAP Remote Buffer Overflow 2 !/usr/bin/perl Tested on Windows 2k Sp4 Italian and English version and Win XP Pro SP2 Italian and English version Perl script based on Sami FTP server remote exploit by Critical Security https://www.securityfocus.com/bid/17138 acaro at...

CVE-2006-3649: Undefined Security Weakness

Buffer overflow in Microsoft Visual Basic for Applications VBA SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute...

msword-hlink-ohday.txt

Hi people, the same problem concerning hlink.dll already exploited in excel is present even in Microsoft Word, but Word 2003 seems, luckily, not vulnerable. this one is the public 0-day I made for Microsoft Word. the author is "SYS 49152" obviusly it's a local sploit .. best regards. SYS 49152...

CVE-2006-1316: Improper Control of Generation of Code

Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via an Office file with malformed string that triggers memory corruption related to record lengths, aka "Microsoft Office...

CVE-2006-2389: Improper Control of Generation of Code

Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via an Office file with a malformed property that triggers memory corruption related to record lengths, aka "Microsoft Offic...

CVE-2006-0033: Undefined Security Weakness

Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via a crafted PNG image that triggers memory corruption when it is parsed...

Microsoft Word 20002003 - Hlink Local Buffer Overflow

Microsoft Word 20002003 - Hlink Local Buffer Overflow !/bin/perl Microsoft Word hlink 0-day by SYS 49152 this POC works only with: win 2ksp4 ENG + word 2000/XP all versions. win XP ENG sp1/sp2 + word XP 2002 SP3. Word 2003 is not vulnerable. bindshell on port 49152 hey kids.. I hope you know how ...

CVE-2006-0022: Undefined Security Weakness

Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac, and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed record, which triggers memory corruptio...

CVE-2006-1193: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access OWA, allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."...

CVE-2006-2492: Buffer Copy without Checking Size of Input

Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack...

[EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap Overflow

Microsoft Distributed Transaction Coordinator Heap Overflow http://www.eeye.com/html/research/advisories/AD20060509a.html Release Date: May 9, 2006 Date Reported: October 11, 2005 Patch Development Time In Days: 210 Severity: High Remote Code Execution Systems Affected: Windows NT 4.0 Windows 200...

CVE-2006-0034

Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator MSDTC for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or...

ASP-Nuke-community-v1.4SP3.txt

I MurderSkillz from g00ns.net have found xss vulnerabilities in ASP-Nuke community v1.4 SP3 and possibly other versions. Shouts go to all the g00ns. Once again..g00ns.net fucking owns j00! Found in XSS /aspnuke/default.asp?poll='alertdocument.cookie;&results=1 ----------...

Mercur MailServer 5.0 SP3 - 'IMAP' Remote Buffer Overflow (1)

/ mercur.cpp Atrium Mercur IMAP 5.0 SP3 Messaging Multiple IMAP Commands Remote Exploit Copyright C 2006 Javaphile Group http://www.javaphile.org Exploits code by : pll Ellison.Tangatgmaildotcom Bug Reference: http://www.frsirt.com/bulletins/4332 / include include include include pragma commentli...

Mercur MailServer 5.0 SP3 - 'IMAP' Denial of Service

/ Exploit for : IMAP 5.0 SP3 DoS Exploit Advisory : http://secunia.com/advisories/19267/ Coder : Omnipresent Email : [email protected] Description : Tim Taylor has discovered a vulnerability in Mercur Messaging 2005, which can be exploited by malicious people and by malicious users to cause a...