I-Mall Commerce (i-mall.cgi) Remote Command Execution Exploit

Exploit for cgi platform in category web applications ============================================================= I-Mall Commerce i-mall.cgi Remote Command Execution Exploit ============================================================= I-Mall explo Spawn bash style Shell with webserver uid Gree...

[Full-disclosure] NIC Chile CGI Script Zone Transfers

NIC Chile CGI Script Zone Transfers. Autor: Rodrigo Gutierrez rodrigo at intellicomp.cl Affected: All ".cl" domains which use NIC's Chile Secondary NS. Vendor url: http://www.nic.cl Rate: Critical Background. NIC Chile is a part of the University of Chile and is in charge of handling all the...

I-Mall Commerce - i-mall.cgi Remote Command Execution

I-Mall Commerce - i-mall.cgi Remote Command Execution I-Mall explo Spawn bash style Shell with webserver uid Greetz z, spax, foxtwo, Zone-H This Script is currently under development use strict; use IO::Socket; my $host; my $port; my $command; my $url; my $shiz; my @results; my $probe; my @U; $U1...

CVE-2005-0054

Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decodin...

Microsoft Internet Explorer Content Advisor contains a buffer overflow

Overview A buffer overflow in Microsoft Internet Explorer Content Advisor may allow a remote attacker to execute arbitrary code on a vulnerable system. Description The Content Advisor is used to control what content is viewable in Internet Explorer. A buffer overflow exists in the routines that...

CVE-2002-1591

AOL Instant Messenger AIM 4.7.2480 adds free.aol.com to the Trusted Sites Zone in Internet Explorer without user approval, which could allow code from free.aol.com to bypass intended access restrictions...

CVE-2002-1591

AOL Instant Messenger (AIM) 4.7.2480 adds free.aol.com to Internet Explorer’s Trusted Sites Zone without user approval, potentially allowing code from that domain to bypass access restrictions. The connected documents provide AIM as the affected product and indicate the root cause is improper Tru...

CVE-2004-1517

Zone Labs IMsecure and IMsecure Pro before 1.5 allow remote attackers to bypass Active Link Filtering via an instant message containing a URL with hex encoded file extensions...

CVE-2004-1517

Zone Labs IMsecure and IMsecure Pro before version 1.5 are affected by a vulnerability that allows remote attackers to bypass Active Link Filtering by sending an instant message containing a URL with hex-encoded file extensions. The issue is described across multiple sources as a bypass of link f...

CVE-2005-0054

Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decodin...

CVE-2005-0054

CVE-2005-0054 is a remote-code-execution vulnerability in Internet Explorer 5.01/5.5/6 where specially crafted HTML/URLs cause IE to interpret a page in the wrong security zone, potentially executing code in the Local Machine zone. The issue stems from how encoded hostnames are parsed for URLs, e...

Microsoft Internet Explorer URI Decoding Vulnerability

Description Microsoft Internet Explorer is prone to a vulnerability related to URI decoding. A bug in how the browser parses encoded URI data may allow zone bypass. As a result, it is possible to force the browser to interpret Web content in the Local Zone. This could be exploited to execute...

Microsoft Internet Explorer contains URL decoding cross-domain vulnerability

Overview A URL decoding vulnerability in Microsoft Internet Explorer may allow remote attackers to bypass zone security restrictions and execute arbitrary code on affected systems. Description IE uses a cross-domain security model to maintain separation between browser frames from different...

Microsoft Internet Explorer contains a Channel Definition Format (CDF) cross-domain vulnerability

Overview Microsoft Internet Explorer contains a vulnerability that may allow unintended information disclosure or remote code execution due to a flaw in handling Channel Definition Format CDF files. Description From the Microsoft Channel Definition Format description:Channel Definition Format CDF...

Multiple Internet Explorer bugs

CSS buffer overflow, local zone scripting, buffer overflow in Install Engine, writing file to any location with drag and drop or scripting in img tag, address bar spoofing, SSL crossite scripting...

Microsoft Windows HTML Help ActiveX control does not adequately validate window source

Overview The Microsoft Windows HTML Help ActiveX control contains a cross-domain vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands or code with the privileges of the user running the control. The HTML Help control can be instantiated by an HTML...

CVE-2004-2713

Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\Internet Logs\ to the EVERYONE group, which allows local users to cause a denial of service by modifying the folder contents or permissions. NOTE: this issue has been disputed by the vendor, who claims that it does not affect product...

CVE-2004-1517

Zone Labs IMsecure and IMsecure Pro before 1.5 allow remote attackers to bypass Active Link Filtering via an instant message containing a URL with hex encoded file extensions...

PT-2004-3603 · Zonealarm · Zonealarm Pro

Name of the Vulnerable Software and Affected Versions: Zone Alarm Pro versions 1.0 through 5.1 Description: The issue allows local users to cause a denial of service by modifying the folder contents or permissions of the %windir%Internet Logs directory, which is accessible to the EVERYONE group...

Microsoft Internet Explorer (Windows XP SP2) - HTML Help Control Local Zone Bypass

Microsoft Internet Explorer Windows XP SP2 - HTML Help Control Local Zone Bypass // sp2rc.htm // localpage.HHClick; setTimeout"inject.HHClick",100; // writehta.txt // Dim Conn, rs Set Conn = CreateObject"ADODB.Connection" Conn.Open "Driver=Microsoft Text Driver .txt; .csv;" & "Dbq=http://server;"...