CVE-2006-5967

Race condition in Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to cause memory corruption and execute arbitrary code via unknown vectors related to multiple invocations of the Analizar method in the ActiveScan.1 ActiveX control, which is not thread safe...

CVE-2006-5967

Race condition in Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to cause memory corruption and execute arbitrary code via unknown vectors related to multiple invocations of the Analizar method in the ActiveScan.1 ActiveX control, which is not thread safe...

WinZip FileView ActiveX控件远程栈溢出漏洞

WinZip是一款流行的文件压缩/解压工具。 WinZip的FileView ActiveX控件（WZFILEVIEW.FileViewCtrl.61，CLSID为A09AE68F-B14D-43ED-B713-BA413F034904）中存在栈溢出漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。 如果用户受骗访问了包含有恶意控件的站点的话，就会触发这个漏洞，导致执行任意代码。 WinZip WinZip 10.0 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.winzip.com/wz7245.htm / WinZip 10 =...

Microsoft IE HTML渲染内存破坏漏洞（MS06-067）

Internet Explorer是一款非常流行的WEB浏览器。 Internet Explorer在解析HTML CSS的float属性时存在漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。 如果处理了HTML页面中的特制div标签的话，就会触发内存破坏，导致执行任意代码。 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 将Internet和本地Intranet安全区域设置设为“高”，以便在这些区域中运行ActiveX控件和活动脚本之前进行提示。 将Internet...

Microsoft XMLHTTP ActiveX control setRequestHeader vulnerability

Added: 11/17/2006 CVE: CVE-2006-5745 BID: 20915 OSVDB: 30208 Background Microsoft XML Core Services includes the XMLHTTP ActiveX control, which allows web pages to send and receive XML data. Problem A memory corruption vulnerability in the XMLHTTP ActiveX control allows command execution when a...

Panda ActiveScan ActiveX控件多个远程安全漏洞

Panda ActiveScan是熊猫的免费在线病毒扫描工具。 Panda ActiveScan中存在多个远程安全漏洞，具体如下： 1 在调用ActiveScan.1 ActiveX控件的Reinicializar方法时会导致未经用户确认便重启系统。 2 PAVPZ.SOS.1 ActiveX控件的ObtenerTamano方式会返回指定本地文件名的文件大小，这可能允许恶意站点判断是否存在本地文件及相应的文件大小。 3 ActiveScan.1 ActiveX控件的Analizar方法线程不安全，恶意站点可能通过竞争条件破坏内存，执行任意代码。 Panda ActiveScan...

Microsoft XMLHTTP ActiveX control setRequestHeader vulnerability

Added: 11/17/2006 CVE: CVE-2006-5745 BID: 20915 OSVDB: 30208 Background Microsoft XML Core Services includes the XMLHTTP ActiveX control, which allows web pages to send and receive XML data. Problem A memory corruption vulnerability in the XMLHTTP ActiveX control allows command execution when a...

Microsoft XMLHTTP ActiveX control setRequestHeader vulnerability

Added: 11/17/2006 CVE: CVE-2006-5745 BID: 20915 OSVDB: 30208 Background Microsoft XML Core Services includes the XMLHTTP ActiveX control, which allows web pages to send and receive XML data. Problem A memory corruption vulnerability in the XMLHTTP ActiveX control allows command execution when a...

Adobe Flash Player多个远程代码执行漏洞（MS06-069）

Flash Player是一款设计用于增强WEB浏览和允许用户查看各种多媒体WEB内容的组件。 Flash Player处理Flash动画SWF文件的方式存在多个远程执行代码漏洞，成功利用这些漏洞的攻击者可以完全控制受影响的系统。 攻击者可以通过构建特制的Flash动画SWF文件来利用这些漏洞，如果用户访问包含特制的SWF文件的网站，则可能允许远程执行代码。可能作为电子邮件附件发送特制的SWF文件，只有当打开此电子邮件附件时，用户才会面临风险。 Microsoft Windows XP SP2 Adobe Flash Player = 8.0.24.0 临时解决方法：...

winzipFAC.txt

!-- Sub WZFILEVIEWOnAfterItemAddItem WZFILEVIEW.FilePattern = "STACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBAS...

Microsoft Agent Active控件缓冲区溢出漏洞（MS06-068）

Microsoft Windows是微软发布的非常流行的操作系统。 Windows的Microsoft Agent ActiveX控件在处理.ACF文件时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 攻击者可能通过构建特制网页来利用此漏洞，如果用户查看了该网页，则可能允许远程执行代码。 Microsoft Windows XP SP2 Microsoft Windows Server 2003 SP1 Microsoft Windows Server 2003 Microsoft Windows 2000SP4 临时解决方法：...

Microsoft XML核心服务XMLHTTP控件内存破坏漏洞（MS06-071）

Microsoft XML核心服务（MSXML）允许使用JScript、VBScript和Microsoft Visual Studio 6.0的用户构建可与其他符合XML 1.0标准的应用程序相互操作的XML应用。 在Microsoft XML Core Services的XMLHTTP 4.0...

WinZIP <= 10.0.7245 (FileView ActiveX Control) Stack Overflow PoC

No description provided by source. !-- WinZip FileView ActiveX Control Unsafe Method Exposure Vulnerability -- prdelka -- HTML HEAD TITLE/TITLE /HEAD BODY SCRIPT LANGUAGE="VBScript" !-- Sub WZFILEVIEWOnAfterItemAddItem WZFILEVIEW.FilePattern =...

Microsoft IE COM对象实例化daxctle.ocx堆破坏漏洞（MS06-067）

Internet Explorer是微软发布的非常流行的WEB浏览器。 Internet Explorer在处理某些COM对象的畸形参数时存在堆破坏漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。 当Internet Explorer在处理DirectAnimation.PathControl COM对象（daxctle.ocx）的Spline方式时，如果将第一个参数设置为0xffffffff的话就会触发堆溢出漏洞，导致拒绝服务或执行任意指令。 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0...

Microsoft Windows Agent ACF File Handling Memory Corruption (MS06-068; CVE-2006-3445)

A remote code execution vulnerability exists in Microsoft Agent. Microsoft Agent is a software technology that enables an enriched form of user interaction that can make using and learning to use a computer easier and more natural. The vulnerability is due to a memory corruption error in the...

Microsoft Visual Studio WMI Object Code Execution (MS06-073; CVE-2006-4704)

A remote code execution vulnerability exists in Microsoft Visual Studio 2005. Microsoft Visual Studio is a software development product for computer programmers. It centers on an integrated development environment which lets programmers create standalone applications, web sites, web applications,...

Microsoft XMLHTTP Control Open Method Code Execution (MS06-071; CVE-2006-5745)

XML HTTP, an ActiveX control that is included in Microsoft XML Core Services MSXML, is vulnerable to remote code execution. MSXML is an application for processing Extensible Stylesheet Language Transformation in an XML file that allows programmers to create high-performance XML-based applications...

Multiple Panda Antivirus ActiveScan ActiveX security vulnerabilities

Memory corruption, information leak, client PC rebooting...

[Full-disclosure] Secunia Research: Panda ActiveScan Multiple Vulnerabilities

====================================================================== Secunia Research 16/11/2006 - Panda ActiveScan Multiple Vulnerabilities - ====================================================================== Table of Contents Affected...

Integrity Clientless Security (ICS) Update 3.7.111.0

Check Point Integrity ™ Clientless Security ICS protects your Web site by detecting and disabling spyware processes and allowing you to enforce security policies before a user logs onto your network. Using ICS you can prevent users with potentially harmful software from accessing your Web site, a...