CVE-2006-3444

CVE-2006-3444 is a Windows 2000 SP4 kernel elevation-of-privilege vulnerability caused by improper validation of an input buffer (an unchecked buffer). A local attacker who can log on could exploit this to gain full control of the system, including installing programs, altering data, or creating ...

CVE-2006-3441: Undefined Security Weakness

Buffer overflow in the DNS Client service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted record response. NOTE: while MS06-041 implies that there is a single issue, there are multiple vectors, and likely multiple...

CVE-2006-3444: Undefined Security Weakness

Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, probably a buffer overflow, allows local users to obtain privileges via unspecified vectors involving an "unchecked buffer."...

CVE-2006-3648: Undefined Security Weakness

Unspecified vulnerability in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 and 2003 SP1, allows remote attackers to execute arbitrary code via unspecified vectors involving unhandled exceptions, memory resident applications, and incorrectly "unloading chained exception."...

CVE-2006-3451

Microsoft Internet Explorer 5 SP4 and 6 do not properly garbage collect when "multiple imports are used on a styleSheets collection" to construct a chain of Cascading Style Sheets CSS, which allows remote attackers to execute arbitrary code via unspecified vectors...

BrightStor ARCserve Universal Agent buffer overflow

Added: 08/07/2006 CVE: CVE-2005-1018 BID: 13102 OSVDB: 15471 Background The BrightStor ARCserve Backup family of products includes a Universal Agent which listens for connections on port 6050/TCP. Problem A buffer overflow in the Universal Agent allows remote attackers to execute arbitrary comman...

eIQNetworks ESA License Manager LICMGR_ADDLICENSE Overflow

This module exploits a stack buffer overflow in eIQnetworks Enterprise Security Analyzer. During the processing of long arguments to the LICMGRADDLICENSE command, a stack-based buffer overflow occurs. This module has only been tested against ESA v2.1.13. Module Options msf use...

FileCOPA FTP Server 1.01 - LIST Remote Buffer Overflow (1)

FileCOPA FTP Server 1.01 - LIST Remote Buffer Overflow 1 !/usr/bin/perl -w bad char 0x00 0x0a tested on win00 SP4 English on filecopa ftp server 6/4/2006 version use Net::FTP; $target = $ARGV0 || die "usage:$0 "; my $user = "test"; my $pass = "test"; $shellcode =...

FileCOPA FTP Server 1.01 - 'LIST' Remote Buffer Overflow (1)

!/usr/bin/perl -w bad char 0x00 0x0a tested on win00 SP4 English on filecopa ftp server 6/4/2006 version use Net::FTP; $target = $ARGV0 || die "usage:$0 "; my $user = "test"; my $pass = "test"; $shellcode = "\xd9\xee\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x5e\x81\x73\x17\xe0\x66"...

CVE-2006-1300: Undefined Security Weakness

Microsoft .NET framework 2.0 ASP.NET in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to bypass access restrictions via unspecified "URL paths" that can access Application Folder objects "explicitly by name."...

Microsoft Word 2000/2003 - Hlink Local Buffer Overflow

!/bin/perl Microsoft Word hlink 0-day by SYS 49152 this POC works only with: win 2ksp4 ENG + word 2000/XP all versions. win XP ENG sp1/sp2 + word XP 2002 SP3. Word 2003 is not vulnerable. bindshell on port 49152 hey kids.. I hope you know how to use winzip :- to get in contact with me...

MERCUR < 2005 SP4 Multiple Remote DoS

Binary data 3655.prm...

CVE-2006-2380

CVE-2006-2380 corresponds to a spoofing vulnerability in RPC mutual authentication on Microsoft Windows 2000 SP4. The issue arises from the RPC service not correctly validating the identity of the RPC server during mutual authentication over SSL, potentially allowing an attacker to impersonate a ...

CVE-2006-2379: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing...

CVE-2006-1313: Undefined Security Weakness

Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which results in memory corruption and allows remote attackers to execute arbitrary code...

CVE-2006-2373: Undefined Security Weakness

The Server Message Block SMB driver MRXSMB.SYS in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHODNEITHER method flag and an arbitrary address, possibly f...

CVE-2006-2370: Undefined Security Weakness

Buffer overflow in the Routing and Remote Access service RRAS in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the "RRAS Memory Corrupti...

CVE-2006-2371: Undefined Security Weakness

Buffer overflow in the Remote Access Connection Manager service RASMAN service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to...

CVE-2006-2380: Improper Authentication

Microsoft Windows 2000 SP4 does not properly validate an RPC server during mutual authentication over SSL, which allows remote attackers to spoof an RPC server, aka the "RPC Mutual Authentication Vulnerability."...

wingatex.pl.txt

Proof of concept not for "in the wild" kiddies QBik Wingate version 6.1.1.1077 remote exploit for Win2k SP4 german by kcope in 2006 use IO::Socket; if $ARGV0 eq "" print "param1 = remote host"; exit; win32bind - EXITFUNC=seh LPORT=4444 Size=709 Encoder=PexAlphaNum http://metasploit.com my...