CVE-2007-6189

A certain ActiveX control in 1 OScan8.ocx and 2 Oscan81.ocx in BitDefender Online Anti-Virus Scanner 8.0 allows remote attackers to execute arbitrary code via a long argument to the InitX method that begins with a "%%" sequence, which is misinterpreted as a Unicode string and decoded twice, leadi...

CVE-2007-6189

A certain ActiveX control in 1 OScan8.ocx and 2 Oscan81.ocx in BitDefender Online Anti-Virus Scanner 8.0 allows remote attackers to execute arbitrary code via a long argument to the InitX method that begins with a "%%" sequence, which is misinterpreted as a Unicode string and decoded twice, leadi...

RichFX Basic Player ActiveX控件多个缓冲区溢出漏洞

RichFX Basic Player是一款基于浏览器的媒体播放插件。 RichFX Basic Player包含的控件不正确过滤参数数据，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 问题是控件对DoInstall，QueryComponents方法的参数缺少充分边界检查，构建恶意WEB页，诱使用户打开，可导致以应用程序进程权限执行任意指令。 RichFX RichFX Basic Player 1.1 + Real Networks RealPlayer 11 + Real Networks RealPlayer 11 Beta 6.0.14 550 目前没有解决方案提供：...

RealMedia RealPlayer Ierpplug.DLL PlayerProperty ActiveX Control Buffer Overflow Vulnerability

No description provided by source. !-- written by e.b. -- html head script language="JavaScript" DEFER function Check var s = "AAAA"; while s.length 999999 s=s+s; var obj = new ActiveXObject"IERPCTL.IERPCTL"; //FDC7A535-4070-4B92-A0EA-D9994BCC0DC5...

RichFX Basic Player ActiveX Control Multiple Buffer Overflow Vulnerabilities

No description provided by source. html head script language="JavaScript" DEFER function Check var s = "AAAA"; while s.length 999999 s=s+s; var obj = new ActiveXObject"RFXInstMgr.RFXInstMgr"; //47F59200-8783-11D2-8343-00A0C945A819 obj.DoInstalls; obj.QueryComponentss; /script /head body...

SonicWall SSL-VPN NeLaunchCtrl ActiveX Control Remote Exploit

No description provided by source. !-- SonicWall SSL-VPN NeLaunchCtrl ActiveX Control exploit. by krafty greets to SK, muts, halvar, grugq, and all the ethnical hackers sux to exploit traders - ZDI, WabiSabiLabi, and all you h0arders. Bring back the days of technotronic and r00tshell! Freedom...

Yahoo! Toolbar 1.4.1 Helper - Class ActiveX Control Remote Buffer Overflow (Denial of Service) (PoC)

Yahoo! Toolbar 1.4.1 Helper - Class ActiveX Control Remote Buffer Overflow Denial of Service PoC source: https://www.securityfocus.com/bid/26656/info Yahoo! Toolbar ActiveX Control is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to trigger denial-of-service...

Yahoo! Toolbar 1.4.1 Helper - Class ActiveX Control Remote Buffer Overflow (Denial of Service) (PoC)

source: https://www.securityfocus.com/bid/26656/info Yahoo! Toolbar ActiveX Control is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to trigger denial-of-service conditions in Internet Explorer or other applications that use the vulnerable ActiveX control. Reports...

Heap overflow

Heap-based buffer overflow in the PPlayer.XPPlayer.1 ActiveX control in pplayer.dll1work in Xunlei Thunder 5.7.4.401 allows remote attackers to execute arbitrary code via a long string in a FlvPlayerUrl property value. NOTE: some of these details are obtained from third party information...

CVE-2007-6144

Heap-based buffer overflow in the PPlayer.XPPlayer.1 ActiveX control in pplayer.dll1work in Xunlei Thunder 5.7.4.401 allows remote attackers to execute arbitrary code via a long string in a FlvPlayerUrl property value. NOTE: some of these details are obtained from third party information...

CVE-2007-6144

Heap-based buffer overflow in the PPlayer.XPPlayer.1 ActiveX control in pplayer.dll1work in Xunlei Thunder 5.7.4.401 allows remote attackers to execute arbitrary code via a long string in a FlvPlayerUrl property value. NOTE: some of these details are obtained from third party information...

CVE-2007-6144

CVE-2007-6144 describes a heap-based buffer overflow in the PPlayer.XPPlayer.1 ActiveX control (pplayer.dll_1_work) used by Xunlei Thunder 5.7.4.401. An attacker can trigger arbitrary code execution by supplying a long string to the FlvPlayerUrl property. The vulnerability is tied to a heap overf...

real-overflow.txt

There are multiple stack overflows in the ierpplug.dll ActiveX Control. These issues were originally discovered by shinnai, http://www.securityfocus.com/bid/22811 and http://www.securityfocus.com/bid/21802. I am adding the Import and PlayerProperty functions to the list. This was tested on Window...

Tencent QQ 2006 LaunchP2PShare - Multiple Stack Buffer Overflow Vulnerabilities

Tencent QQ 2006 LaunchP2PShare - Multiple Stack Buffer Overflow Vulnerabilities / source: https://www.securityfocus.com/bid/26613/info Tencent QQ is prone to multiple stack-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied dat...

richfx-overflow.txt

There are multiple stack overflows in the RichFX nprfxins.dll ActiveX Control. I almost positive that this control was installed with RealNetworks RealPlayer. This was tested on Windows XP SP2 fully patched and IE6. This control is marked safe for scripting. I have not tested code execution. PoC ...

BitDefender Online Anti-Virus Scanner ActiveX OScan8.ocx / OScan8.ocx InitX Method Arbitrary Code Execution

The remote host contains the 'BDSCANONLINE' ActiveX control, used by the BitDefender Online Scanner, a web-based virus scanner. The version of this control installed on the remote host fails to properly validate Unicode values passed to the 'InitX' function as a domain key. If a remote attacker c...

Tencent QQ 2006 LaunchP2PShare - Multiple Stack Buffer Overflow Vulnerabilities

/ source: https://www.securityfocus.com/bid/26613/info Tencent QQ is prone to multiple stack-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting these issues allows remote attackers to execute...

RealMedia RealPlayer 10.511 - ierpplug.dll PlayerProperty ActiveX Control Buffer Overflow

RealMedia RealPlayer 10.511 - ierpplug.dll PlayerProperty ActiveX Control Buffer Overflow source: https://www.securityfocus.com/bid/26586/info The RealPlayer ActiveX control is prone to a buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied data before...

RealMedia RealPlayer 10.5/11 - 'ierpplug.dll' PlayerProperty ActiveX Control Buffer Overflow

source: https://www.securityfocus.com/bid/26586/info The RealPlayer ActiveX control is prone to a buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer. A remote attacker may exploit this...

RichFX Basic Player 1.1 - ActiveX Control Multiple Buffer Overflow Vulnerabilities

source: https://www.securityfocus.com/bid/26573/info RichFX Basic Player ActiveX Control is prone a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting these issues allows remote attackers to execute...