Oracle Weblogic Apache Connector POST Request Buffer Overflow

Exploit for windows platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core'...

CVE-2011-5058

The CVE-2011-5058 entry affects 3S CoDeSys 3.4 SP4 Patch 2: the CmbWebserver.dll in the Control service allows remote attackers to create arbitrary directories under the web root by specifying a non-existent directory with backslash characters in an HTTP GET request. This is the concrete vulnerab...

CVE-2011-5007

Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080...

CVE-2011-5008

CVE-2011-5008 is an integer overflow in the GatewayService of 3S CoDeSys (versions affected: CoDeSys 2.3 and 3.4; patched in V3.5 and V2.3.9.32). A large size value in the packet header enables remote attackers to trigger a heap-based buffer overflow and potentially execute arbitrary code. Attack...

Codesys CmpWebServer Multiple Vulnerabilities

Codesys is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SCADA 3S CoDeSys CmpWebServer Stack Buffer Overflow

This module exploits a remote stack buffer overflow vulnerability in 3S-Smart Software Solutions product CoDeSys Scada Web Server Version 1.1.9.9. This vulnerability affects versions 3.4 SP4 Patch 2 and earlier. Module Options msf use exploit/windows/scada/codesys/webserver msf undefinedwebserver...

CVE-2011-2737

RSA enVision 3.x and 4.x prior to 4 SP4 P3 contain an arbitrary file retrieval vulnerability (CVE-2011-2737) that may allow unauthenticated remote attackers to read files via unspecified vectors. The issue is acknowledged in RSA ESA-2011-030, which recommends upgrading to RSA enVision 4 SP4 P3 as...

IBM Lotus Domino iCalendar - MAILTO Buffer Overflow (Metasploit)

$Id: dominoicalendarorganizer.rb 12236 2011-04-04 17:43:34Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

phpcms 2 0 0 8 sp4 explosive paths and arbitrary file deletion vulnerabilities and fixes-vulnerability warning-the black bar safety net

phpcms 2 0 0 8 sp4 explosive paths and arbitrary file deletion vulnerability and fix Affected versions: phpcms 2 0 0 8 sp4 Official address: www.phpcms.cn Vulnerability type: explosive paths and arbitrary file deletion Vulnerability Description: a certain page, not as fault-tolerant processing...

SuSE 11.1 Security Update : libvirt (SAT Patch Number 2957)

libvirt did not properly handle configured disk formats which potentially allowed users to read arbitrary files. CVE-2010-2237 / CVE-2010-2238 / CVE-2010-2239 Improperly mapped source privileged ports in guests may allow obtaining privileged resources on the host. CVE-2010-2242 In addition, fixes...

BACnet OPC Client Buffer Overflow

$Id: bacnetcsv.rb 10990 2010-11-11 20:09:15Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

SafeNet SoftRemote - GROUPNAME Buffer Overflow (Metasploit)

$Id: safenetsoftremotegroupname.rb 10998 2010-11-11 22:43:22Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

CA BrightStor ARCserve for Laptops and Desktops LGServer rxsSetDataGrowthScheduleAndFilter Buffer Overflow

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request rxsSetDataGrowthScheduleAndFilter, an attacker could overflow the buffer and execute arbitrary code. This module requires Metasploit:...

CA BrightStor ARCserve for Laptops & Desktops LGServer - Remote Buffer Overflow (Metasploit) (3)

$Id: lgserverrxrlogin.rb 10892 2010-11-03 22:09:44Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

IBM Lotus Domino iCalendar MAILTO Buffer Overflow

This module exploits a vulnerability found in IBM Lotus Domino iCalendar. By sending a long string of data as the "ORGANIZER;mailto" header, process "nRouter.exe" crashes due to a Cstrcpy routine in nnotes.dll, which allows remote attackers to gain arbitrary code execution. Note: In order to...

Microsoft Windows MFC库文档标题更新栈溢出漏洞

BUGTRAQ ID: 41333 Microsoft Windows是微软发布的非常流行的操作系统。 Windows mfc42.dll库中CFrameWnd类的UpdateFrameTitleForDocument函数在更新文档标题时存在栈溢出漏洞，用户受骗打开了恶意的档案文件并向该函数传送了超长的标题字符串参数就可以触发这个溢出，导致执行任意代码。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows 2000 SP4 厂商补丁： Microsoft ---------...

phpcms2008 sp4 网站内容管理系统多处跨站漏洞

Phpcms 是国内领先的网站内容管理系统，同时也是一个开源的PHP开发框架。Phpcms由内容模型、会员、问吧、专题、财务、订单、广告、邮件订阅、 短消息、自定义表单、全站搜索等20多个功能模块组成，内置新闻、图片、下载、信息、产品5大内容模型。Phpcms 采用模块化开发，支持自定义内容模型和会员模型，并且可以自定义字段。 对用户输入处理不严，存在多处跨站漏洞 phpcms2008 sp4 厂商补丁： PHPCMS ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.phpcms.cn/...

phpcms2008 sp4 /member/login.php 跨站漏洞

Phpcms 是国内领先的网站内容管理系统，同时也是一个开源的PHP开发框架。Phpcms由内容模型、会员、问吧、专题、财务、订单、广告、邮件订阅、 短消息、自定义表单、全站搜索等20多个功能模块组成，内置新闻、图片、下载、信息、产品5大内容模型。Phpcms 采用模块化开发，支持自定义内容模型和会员模型，并且可以自定义字段。 member/login.php对forward参数没有进行有效的处理，造成跨站漏洞 phpcms2008 sp4 厂商补丁： PHPCMS ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Microsoft Outlook Express - NNTP Response Parsing Buffer Overflow (MS05-030) (Metasploit)

$Id: ms05030nntp.rb 9262 2010-05-09 17:45:00Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

D-Link TFTP 1.0 - 'Filename' Remote Buffer Overflow (Metasploit)

$Id: dlinklongfilename.rb 9262 2010-05-09 17:45:00Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...