Design/Logic Flaw

The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname...

CVE-2015-0925

The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname...

Exif Pilot 4.7.2 - Buffer Overflow (SEH)

!/usr/bin/env ruby Exploit Title: Exif Pilot SEH Based Buffer Overflow Version: version 4.7.2 Download: http://www.colorpilot.com/load/exif.exe Tested on: Windows XP sp2 Exploit Author: Osanda M. Jayathissa E-Mail: osandacatunseen.is =begin Click Tools Options Customize 35mm tab Import and choose...

UBUNTU-CVE-2014-7940

The collator implementation in i18n/ucol.cpp in International Components for Unicode ICU 52 through SVN revision 293126, as used in Google Chrome before 40.0.2214.91, does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have...

Oracle Solaris Third-Party Patch Update : icu (multiple_vulnerabilities_in_international_components)

The remote Solaris system is missing necessary patches to address security updates : - The International Components for Unicode ICU functionality in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

Oracle Solaris Third-Party Patch Update : samba (multiple_vulnerabilities_in_samba1)

The remote Solaris system is missing necessary patches to address security updates : - The sysrecvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a malformed...

Triologic-Media-Player-8-(.m3u)

Exploit Title: Triologic Media Player 8 .m3u Local Universal Unicode Buffer Overflow SEH Date: August 17, 2010 Software Link: http://download.cnet.com/Triologic-Media-Player/3000-21394-10691520.html buffer = "\x41" 536 buffer buffer += "\x61\x41" popad + nop/align buffer += "\xF2\x41" pop,pop,ret...

Xion-Player-1.0.125

Script provided as is without any warranty. Use for educational purposes only. Do not use this code to do anything illegal ! Corelan does not want anyone to use this script outputfile="corelanc0d3r.m3u" offsettonseh=250 affected by the m3u path length ! junk = "A" offsettonseh nseh="\x41\x45"...

GOM-Player-2.1.33.5071-ASX-File-Unicode

Exploit Title: GOM Player Crafted ASX File Unicode Stack Buffer Overflow and Arbitrary Code Execution. Version: 2.1.33.5071 Date: 30-11-2011 Author: Debasish Mandal Peter Van Eeckhoutte corelanc0d3r rawinput" Press Enter to generate the crafted ASX..." size = 2046 Shellcode WinExec "Calc.exe"...

Blade-API-Monitor-Unicode-Bypass

This is a super strange exploit. First I would like to commend "FullMetalFouad" for the unicode work on the original exploit. Originally I wanted to see if I could simplify the process. While I was doing that I lost sight of the fact that the instructions had to be printable since we need to copy...

Malicious Git And Mercurial HTTP Server For CVE-2014-9390

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Malicious Git and Mercurial HTTP Server For CVE-2014-9390', 'Description' = %q This module exploits CVE-2014-9390, which affects Git...

CVE-2014-8147

The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode ICU before 55.1 uses an integer data type that is inconsistent with a header file, which allows remote attackers to cause a denial of service...

UBUNTU-CVE-2014-8146

The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode ICU before 55.1 does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service...

Achat Unicode SEH Buffer Overflow

This module exploits a Unicode SEH buffer overflow in Achat. By sending a crafted message to the default port 9256/UDP, it's possible to overwrite the SEH handler. Even when the exploit is reliable, it depends on timing since there are two threads overflowing the stack in the same time. This modu...

GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Malicious Git and Mercurial HTTP Server For CVE-2014-9390', 'Description' = %q This module exploits CVE-2014-9390, which affect...

Malicious Git and Mercurial HTTP Server For CVE-2014-9390

This module exploits CVE-2014-9390, which affects Git versions less than 1.8.5.6, 1.9.5, 2.0.5, 2.1.4 and 2.2.1 and Mercurial versions less than 3.2.3 and describes three vulnerabilities. On operating systems which have case-insensitive file systems, like Windows and OS X, Git clients can be...

KLA10616 Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities have been found in Microsoft Office products. Malicious users can exploit these vulnerabilities to run arbitrary code, cause denial of service, loss of integrity, security bypass, privilege escalation and obtain sensitive information. Below is a complete list of...

Crunch - Password Cracking Wordlist Generator

Crunch is a wordlist generator where you can specify a standard character set or a character set you specify. crunch can generate all possible combinations and permutations. Features crunch generates wordlists in both combination and permutation ways it can breakup output by number of lines or fi...

74cms(20141020)全局SQL注入过滤绕过

简要描述： 74cmsv3.5.120141020 绕过全局SQL注入过滤。 详细说明： WooYun: 74cms 最新版 注入8-9 报道过74cms转换编码导致的SQL注入的问题，是由于使用了iconv函数导致的，74cms做了修正，转而使用了自定义的函数utf8togbk来转换编码，代码如下： function utf8togbk$utfstr global $UC2GBTABLE; $okstr = ''; ifempty$UC2GBTABLE define'CODETABLEDIR',...

ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540)

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D...