BEA WebLogic Server fails to properly associate the user identity on subsequent client connections

Overview BEA WebLogic Server fails to properly associate a user's identity when a client attempts to connect multiple times using different client certificates. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating,...

Multiple XSS vulnerabilities in Microsoft SharePoint Portal Server 2001

-- Security Advisory -- Multiple XSS vulnerabilities in Microsoft SharePoint Portal Server 2001 -- Author: Ory Segal , Sanctum inc. http://www.SanctumInc.com -- Release Date: April 5th. 2004 -- Product: Microsoft SharePoint Portal Server 2001 -- Severity: High -- CVE: CAN-2004-0379 -- Description...

Microsoft Windows Messenger Service - Denial of Service (MS03-043)

/ DoS Proof of Concept for MS03-043 - exploitation shouldn't be too hard. Launching it one or two times against the target should make the machine reboot. Tested against a Win2K SP4. "The vulnerability results because the Messenger Service does not properly validate the length of a message before...

Microsoft IIS 404 Response Service Pack Signature

The Patch level Service Pack of the remote IIS server appears to be lower than the current IIS service pack level. As each service pack typically contains many security patches, the server may be at risk. Note that this test makes assumptions of the remote patch level based on static return value...

Microsoft Windows SQL Server - Remote Denial of Service (MS03-031)

Microsoft Windows SQL Server - Remote Denial of Service MS03-031 //////////////////////////////////////////////////////////////// // // Microsoft SQL Server DoS Remote Exploit MS03-031 // By refdom of xfocus // //////////////////////////////////////////////////////////////// include include inclu...

MS Windows SQL Server Denial of Service Remote Exploit (MS03-031)

Exploit for unknown platform in category dos / poc ================================================================= MS Windows SQL Server Denial of Service Remote Exploit MS03-031 =================================================================...

MS Windows SQL Server Denial of Service Remote Exploit (MS03-031)

No description provided by source. //////////////////////////////////////////////////////////////// // // Microsoft SQL Server DoS Remote Exploit MS03-031 // By refdom of xfocus // //////////////////////////////////////////////////////////////// include stdio.h include stdlib.h include windows.h...

Microsoft Windows SQL Server - Remote Denial of Service (MS03-031)

//////////////////////////////////////////////////////////////// // // Microsoft SQL Server DoS Remote Exploit MS03-031 // By refdom of xfocus // //////////////////////////////////////////////////////////////// include include include void Usage printf"\n"; printf"exp for Microsoft SQL Server...

List of Security Fixes in Windows 2000 Service Pack 4

List of Security Fixes in Windows 2000 Service Pack 4 The information in this article applies to: Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Server SP4 SUMMARY This article describes the following security-related bugs and update...

CORE-2003-0305-04: NetMeeting Directory Traversal Vulnerability

Core Security Technologies Advisory http://www.coresecurity.com NetMeeting Directory Traversal Vulnerability Date Published: 2003-07-02 Last Update: 2003-07-02 Advisory ID: CORE-2003-0305-04 Bugtraq ID: 7931 CVE Name: None currently assigned. Title: NetMeeting Directory Traversal Vulnerability...

[SNS Advisory No.65] Windows 2000 ShellExecute() API Let Applications to Cause Buffer Overflow

---------------------------------------------------------------------- SNS Advisory No.65 Windows 2000 ShellExecute API Let Applications to Cause Buffer Overflow Problem first discovered: Thu, 5 Dec 2002 Published: Thu, 03 Jul 2003 Reference:...

Active Directory Stack Overflow

Advisory ID Internal CORE-2003-0305-03 Date Published: 2003-07-02 Last Update: 2004-04-21 Advisory ID: CORE-2003-0305-03 Bugtraq ID: 7930 CVE Name: CAN-2003-0663 Title: Active Directory Stack Overflow Class: Boundary Error Condition, Denial of Service Remotely Exploitable: Yes Locally Exploitable...

Re[2]: EXPLOIT: Buffer overflow in Explorer.exe on Windows XP SP1

hello bugtraq, From MSDN: ---cut--- DWORD GetPrivateProfileSection LPCTSTR lpAppName, LPTSTR lpReturnedString, DWORD nSize, LPCTSTR lpFileName ; skip nSize in Size of the buffer pointed to by the lpReturnedString parameter, in TCHARs. Windows 95/98/Me: The maximum buffer size is 32,767 characters...

Kerio Personal Firewall 2.1.4 - Remote Code Execution

Kerio Personal Firewall 2.1.4 - Remote Code Execution / Kerio Personal Firewall v2.1.4 remote code execution exploit Tested on Windows XP with SP1 In order to exploit, for ease of mind, set the firewall to permit all traffic, or allow a connection to port 44334 from your testing unix shell ip. It...

MS02-040 / MS03-033: Unchecked buffer in MDAC Function (326573 / 823718)

The remote Microsoft Data Access Component MDAC server is vulnerable to a flaw that could allow an attacker to execute arbitrary code on this host, provided he can load and execute a database query on this server. C Tenable Network Security, Inc. MS03-033 supercedes MS02-040 Note: The fix for thi...

Unchecked buffer in PC-cillin

---------------------------------------------------------------------------- - Texonet Security Advisory 20021210 ---------------------------------------------------------------------------- - Advisory ID : TEXONET-20021210 Authors : Joel Soderberg and Christer Oberg [email protected] Issue...

Microsoft Windows 2000 SNMP service leaks memory when querying printer objects if spooler service is stopped

Overview A memory leak exists in the Windows 2000 SNMP service. Under a specific precondition, it can result in a remote denial-of-service vulnerability. Description If the SNMP service is running on a Windows 2000 server, and the 'Print Spooler' service is not running, repeatedly using SNMP...

Microsoft Windows SMB Registry : XP Service Pack Detection

Nessus was able to determine the Service Pack version of the Windows XP system by reading the following registry key : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDVersion This script was written by Georges Dagousset Modified by David Maciejak to add check for Service Pack 2 See the Nessu...

Microsoft Internet Explorer 6 - URI Handler Restriction Circumvention

Microsoft Internet Explorer 6 - URI Handler Restriction Circumvention source: https://www.securityfocus.com/bid/5730/info Microsoft Windows Internet Explorer 6.0 SP1 introduced restrictions for certain URI handlers such as file:// and res://. It has been demonstrated in the past that these URI...

Microsoft Internet Explorer 6 - URI Handler Restriction Circumvention

source: https://www.securityfocus.com/bid/5730/info Microsoft Windows Internet Explorer 6.0 SP1 introduced restrictions for certain URI handlers such as file:// and res://. It has been demonstrated in the past that these URI handlers could be abused and incorporated into different types of attack...