1186 matches found
Microsoft Internet Explorer - 'javaprxy.dll' COM Object Remote Overflow
Bindshell on port 28876 - Based on Berend-Jan Wever's IE exploit 01 July 2005 Description - http://www.frsirt.com/english/advisories/2005/0935 Workarounds - http://www.microsoft.com/technet/security/advisory/903144.mspx sec-consult - http://www.sec-consult.com/184.html Solution : Set Internet and...
CVE-2002-1940
CVE-2002-1940 affects the LCC-Win32 3.2 compiler running on Windows 95/98/ME, where memory after the import table can leak previously used data, potentially exposing sensitive information. Root cause involves memory handling in that environment; Red Hat/Red Hat-like advisories and other sources c...
CVE-2002-1940
LCC-Win32 3.2 compiler, when running on Windows 95, 98, or ME, writes portions of previously used memory after the import table, which could allow attackers to gain sensitive information. NOTE: it has been reported that this problem is due to the OS and not the application...
CVE-2002-1940: Undefined Security Weakness
LCC-Win32 3.2 compiler, when running on Windows 95, 98, or ME, writes portions of previously used memory after the import table, which could allow attackers to gain sensitive information. NOTE: it has been reported that this problem is due to the OS and not the application...
CVE-2004-1077
CVE-2004-1077 affects Citrix Program Neighborhood Agent for Win32 (v8.00.24737 and earlier) and MetaFrame Presentation Server client for WinCE before 8.33. The root cause is a design/implementation flaw in the AppInStartmenu directive that lets a remote server supply a full UNC path, enabling arb...
CVE-2004-1077: Undefined Security Weakness
Citrix Program Neighborhood Agent for Win32 8.00.24737 and earlier and MetaFrame Presentation Server client for WinCE before 8.33 allows remote servers to create arbitrary shortcuts on the client via a full UNC path in the AppInStartmenu directive...
CVE-2004-1078: Undefined Security Weakness
Stack-based buffer overflow in the client for Citrix Program Neighborhood Agent for Win32 8.00.24737 and earlier and Citrix MetaFrame Presentation Server client for WinCE before 8.33 allows remote attackers to execute arbitrary code via a long cached icon filename in the InName XML element...
Windows 2000/XP/2003 kernel multiple vulnerabilities
Buffer overflow during font files parsing, buffer overflow in CSRSS Win32 execution subsystem, privilege escalation...
Microsoft Client Server Runtime System Vulnerability
Overview The Microsoft Client Server Runtime System CSRSS incorrectly validates certain messages potentially resulting in privilege elevation. Description CSRSS is the user-mode part of the Win32 subsystem. Win32.sys is the kernel-mode portion of the Win32 subsystem. The Win32 subsystem must be...
SHOUTcast DNAS/win32 1.9.4 File Request Format String Overflow
This module exploits a format string vulnerability in the Nullsoft SHOUTcast server for Windows. The vulnerability is triggered by requesting a file path that contains format string specifiers. This vulnerability was discovered by Tomasz Trojanowski and Damian Put. Module Options msf use...
MS Internet Explorer (IFRAME Tag) Buffer Overflow Exploit
Exploit for unknown platform in category remote exploits ========================================================= MS Internet Explorer IFRAME Tag Buffer Overflow Exploit ========================================================= BoF PoC exploit iS' ,SS" Copyright C 2003, 2004 by Berend-Jan Wever...
MS Internet Explorer (IFRAME Tag) Buffer Overflow Exploit
No description provided by source. HTML!-- ,sSSSs, Ss, Internet Exploiter v0.1 SS" YS' 'Ss. MSIE IFRAME src=... name="..." BoF PoC exploit iS' ,SS" Copyright C 2003, 2004 by Berend-Jan Wever. YS, .ss ,sY" http://www.edup.tudelft.nl/bjwever "YSSP" sSS [email protected] This program is free...
Microsoft Internet Explorer 6 - IFRAME Tag Buffer Overflow
BoF PoC exploit iS' ,SS" Copyright C 2003, 2004 by Berend-Jan Wever. YS, .ss ,sY" http://www.edup.tudelft.nl/bjwever "YSSP" sSS This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2, 1991 as published by the Free Softwa...
Icecast <= 2.0.1 Win32 Remote Code Execution Exploit (modded)
Exploit for unknown platform in category remote exploits ============================================================= Icecast include include ifdef WIN32 include include "winerr.h" define close closesocket else include include include include include include endif define VER "0.1" define PORT 80...
Icecast 2.0.1 (Win32) - Remote Code Execution (2)
/ ICECAST 2.0.1 WiN32 REMOTE EXPLOiT by Luigi Auriemma Modded by: LORDKAOZ OF IMPERATORI TEAM Greetz to marc0z, m3nTe, DarKBad, OuT, FaX Anche se non se lo merita, MeSSiA e eXpLoIt! This exploit will add an Administrator account with USER: X AND PASSWORD: X / include include include ifdef WIN32...
Icecast <= 2.0.1 Win32 Remote Code Execution Exploit
No description provided by source. / by Luigi Auriemma Shellcode add-on by Delikon www.Delikon.de Because of all the forbidden bytes in a http get request i had to use a very small shellcode, which was blown up by Msf::Encoder::PexAlphaNum. Great encoder...
Code execution in Icecast 2.0.1
Luigi Auriemma Application: Icecast http://www.icecast.org Versions: = 2.0.1 Platforms: only Win32 seems vulnerable but other platforms could be affected in some conditions Bug: array overflow Risk: critical Exploitation: remote Date: 28 September 2004 Author: Luigi Auriemma e-mail:...
Icecast Header Overwrite
This module exploits a buffer overflow in the header parsing of icecast versions 2.0.1 and earlier, discovered by Luigi Auriemma. Sending 32 HTTP headers will cause a write one past the end of a pointer array. On win32 this happens to overwrite the saved instruction pointer, and on linux dependin...
CVE-2002-0969
CVE-2002-0969 : A buffer overflow in the MySQL daemon (mysqld) on Win32 allows local code execution via a long datadir parameter in my.ini, when ACLs grant Full Control to Everyone. Affected: MySQL 3.23.x before 3.23.50 and 4.0 beta before 4.0.2. Root cause: overflow in handling the datadir value...
CVE-2002-0969: Buffer Copy without Checking Size of Input
Buffer overflow in MySQL daemon mysqld before 3.23.50, and 4.0 beta before 4.02, on the Win32 platform, allows local users to execute arbitrary code via a long "datadir" parameter in the my.ini initialization file, whose permissions on Windows allow Full Control to the Everyone group...