IBM Rational ClearQuest CQOle - Remote Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 HttpClients::IE,...

IBM Rational ClearQuest 'cqole.dll' ActiveX 控件堆缓冲区溢出漏洞(CVE-2012-0708)

BUGTRAQ ID: 53170 CVE ID: CVE-2012-0708 IBM Rational ClearQuest是全面的软件变更、追踪管理解决方案。 IBM Rational ClearQuest 版本8.0, 8.0.0.1和7.1.1至7.1.2.5中的cqole.dll内CQOle ActiveX控件中的Ole API存在堆缓冲区溢出漏洞，通过RegisterSchemaRepoFromFileByDbSet函数原型错配恶意制作的网页可导致攻击者利用此漏洞执行任意代码。 0 IBM Rational ClearQuest 8.0.0.1 IBM Rational...

IBM Rational ClearQuest CQOle Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 HttpClients::IE,...

Cisco AnyConnect Secure Mobility Client VPN Downloader RCE (cisco-sa-20120620-ac)

The remote host has a version of Cisco AnyConnect 2.5 MR6. Such versions are potentially affected by an arbitrary code execution vulnerability. The WebLaunch VPN downloader implementation does not properly validate binaries that are received, which can allow remote attackers to execute arbitrary...

IBM Rational ClearQuest CQOle ActiveX Code Execution (CVE-2012-0708)

A remote code execution vulnerability has been reported in IBM Rational ClearQuest...

MacOSX Cisco AnyConnect Secure Mobility Client Multiple Vulnerabilities

The remote host has a version of Cisco AnyConnect 2.5 MR6 / 3.0 MR8. Such versions are potentially affected by multiple vulnerabilities : - The WebLaunch VPN downloader implementation does not properly validate binaries that are received, which can allow remote attackers to execute arbitrary code...

IBM Rational ClearQuest CQOle ActiveX Control Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Rational ClearQuest. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the CQOl...

IBM Lotus iNotes Upload模块ActiveX控件缓冲区溢出漏洞

BUGTRAQ ID: 53879 CVE ID: CVE-2012-2175 Lotus iNotes之前被称为Lotus Domino Web Access，是Lotus Domino服务器基于web的消息和协作界面。 IBM Lotus iNotes 8.5.3 FP2之前版本dwa85W.dll内的某些ActiveX控件中的AttachmentTimes方法在实现上存在缓冲区溢出漏洞，通过较长的参数可允许远程攻击者执行任意代码。 0 IBM Lotus iNotes 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability

This module exploits a code execution vulnerability in the KeyScript ActiveX control from keyhelp.ocx. It is packaged in several products or GE, such as Proficy Historian 4.5, 4.0, 3.5, and 3.1, Proficy HMI/SCADA 5.1 and 5.0, Proficy Pulse 1.0, Proficy Batch Execution 5.6, and SI7 I/O Driver...

AOL桌面工具栏未初始化指针远程代码执行漏洞

Bugtraq ID: 54146 AOL Deskbar是一款桌面工具栏软件。 AOL dnUpdater ActiveX控件存在安全漏洞，允许攻击者以应用程序上下文执行任意代码。 AOL dnUpdater ActiveX控件把部分参数传递给"Init"方法并作为函数指针使用，可被利用在任意内存位置执行任意指令。 0 AOL Deskbar AOL dnUpdater ActiveX Control 厂商解决方案 用户可参考如下供应商提供的升级程序：...

Oracle WebCenter Forms Recognition ActiveX Control Arbitrary File Creation (CVE-2012-1709)

A directory traversal vulnerability has been reported in Oracle WebCenter Forms Recognition. The vulnerability is due to insufficient validation of parameters used in certain methods in the CroProj.dll ActiveX control. A remote attacker can exploit this vulnerability by enticing a target user to...

ZDI-12-098 : AOL Products dnUpdater ActiveX Uninitialized Pointer Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-098 : AOL Products dnUpdater ActiveX Uninitialized Pointer Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-098 June 21, 2012 - -- CVE ID: - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors:...

AOL Products dnUpdater ActiveX Uninitialized Pointer Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of America Online's Toolbar, Desktop, IM, and winamp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific...

CVE-2012-2493

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux, does not properly validate binaries that are received by the downloader process, which allows...

CVE-2012-2494

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 and 3.x before 3.0 MR8 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by...

Code injection

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux, does not properly validate binaries that are received by the downloader process, which allows...

Code injection

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 and 3.x before 3.0 MR8 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by...

CVE-2012-2493

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux, does not properly validate binaries that are received by the downloader process, which allows...

CVE-2012-2494

CVE-2012-2494 affects Cisco AnyConnect Secure Mobility Client: the VPN WebLaunch downloader does not compare the timestamp of the offered vpndownloader.exe with the installed version, enabling a downgrade to older releases. Affected product/version ranges include Cisco AnyConnect Secure Mobility ...

CVE-2012-2495

The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by...