Microsoft Internet Explorer 张贴编码信息泄露漏洞（MS10-018）

BUGTRAQ ID: 39028 CVE ID: CVE-2010-0488 Internet Explorer是Windows操作系统中默认捆绑的web浏览器。 在提交数据时Internet Explorer处理使用特制编码字符串的内容的方式存在信息泄露漏洞。攻击者可以通过创建特制的网页来利用这个漏洞，如果用户查看了该网页就会导致信息泄露。成功利用这个漏洞的攻击者可以查看本地计算机或其他域或Internet Explorer区中的其他浏览器窗口的内容。 Microsoft Internet Explorer 7.0 Microsoft Internet Explorer 6.0 SP...

Internet Explorer onreadystatechange释放后使用漏洞（MS10-018）

BUGTRAQ ID: 39027 CVE ID: CVE-2010-0491 Internet Explorer是Windows操作系统中默认捆绑的web浏览器。 Internet Explorer在处理带onreadystatechange事件处理器的HTML对象时存在释放后使用错误。这个事件用于在某些HTML对象的状态发生变化时执行操作。具体来讲，当对象的某些属性发生变化时，会释放事件处理器功能对象，当仍保留了对其的引用。之后在访问对象时，会将这个无效的内存处理为对象指针，其中的一个成员用于执行间接的函数调用，这会导致执行任意代码。 Microsoft Internet...

SAP GUI 7.00 - BExGlobal Active-X unsecure method

SAP GUI 7.00 - BExGlobal Active-X unsecure method Security vulnerability found in SAP GUI 7.10 and BI 7.0 that allows operating system functions to be called remotely. Application: SAP GUI Versions Affected: SAP GUI SAP GUI 7.1 Vendor URL: http://SAP.com Bugs: Insecure method. Code Execution...

SAP GUI SAPBExCommonResources ActiveX控件不安全方式调用漏洞

SAPgui是SAP软件的图形用户界面客户端。 SAP GUI所安装的SAPBExCommonResources activeX控件没有正确地过滤传送给Execute调用方式的参数，用户受骗访问了恶意网页并向该方式传送了恶意参数就会导致执行任意代码。 SAP Sapgui 7.1 临时解决方法： 为clsid: A009C90D-814B-11D3-BA3E-080009D22344设置kill bit。 厂商补丁： SAP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Microsoft Data Access Components ActiveX Data Objects Memory Corruption Vulnerability

Description Microsoft Data Access Components are prone to a remote memory-corruption vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow the attacker to execute arbitrary code within the context of the...

[DSECRG-09-064] SAP GUI - Insecure method, code execution

Digital Security Research Group DSecRG Advisory DSECRG-09-064 Application: SAP GUI Versions Affected: SAP GUI SAP GUI 7.1 Vendor URL: http://SAP.com Bugs: Insecure method. Code Execution. Exploits: YES Reported: 16.10.2009 Vendor response: 27.10.2009 Date of Public Advisory: 23.03.2010 Author:...

RealNetworks RealPlayer rmoc3260.dll ActiveX Control Memory Corruption (CVE-2008-1309)

RealPlayer is a media player application developed by RealNetworks, Inc. The application is capable of playing back numerous multimedia file formats and various streaming protocols. A memory corruption vulnerability exists in RealNetworks RealPlayer ActiveX controls implemented in rmoc3260.dll. T...

Oracle Document Capture Actbar2.ocx — Insecure Method

Application: Oracle Document Capture Versions Affected: Release 10gR3 Vendor URL: www.oracle.com Bugs: Insecure method, File overwriting Exploits: YES Reported: 22.03.2010 Vendor response: 31.03.2010 Date of Public Advisory: 24.01.2011 Author: Evdokimov Dmitriy Description ActiveX components...

Oracle Document Capture empop3.dll — insecure method

Application: Oracle Document Capture Versions Affected: 6.4 — 7.2 Vendor URL: http://www.oracle.com Bugs: Insecure method, File overwriting, File deleting Exploits: YES Reported: 22.03.2010 Vendor response: 31.03.2010 Date of Public Advisory: 24.01.2011 CVE-number:CVE-2010-3591 Author: Evdokimov...

Novell ZENworks Desktop Management ActiveX Control Buffer Overflow (CVE-2008-5073)

Novel ZENworks Desktop Management is a resource management solution for workstations and laptops. The product include various software components that are installed on management and managed computers. One of these software components is an ActiveX control implemented in file AxNalServer.dll. A...

WebPlayer ActiveX控件拒绝服务漏洞

WebPlayer 2010是一款网络视频播放软件,它具有三个控件CVGPlayer55,CVGPlayer60,CVGPlayer70,当恶意网页中OBJECT标签的style属性：width=130或height=74时,实例化这三个控件将引起CPU占用率上升,IE崩溃. WebPlayer 20100226 设置下列CLSID的KillBit...

CSS Web Installer CSSWEBLib.Installer ActiveX InstallProduct1 Method Overflow

The CSS Web Installer ActiveX control, a component of the Authentium Command On Demand virus scanner, installed on the remote Windows host reportedly is affected by a buffer overflow involving the 'InstallProduct1' method, and possibly the 'InstallProduct' and 'InstallProduct2' methods as well. I...

Microsoft IE畸形对象操作内存破坏漏洞

BUGTRAQ ID: 38615 CVE ID: CVE-2010-0806 Internet Explorer是Windows操作系统中默认捆绑的web浏览器。 Internet Explorer通过使用iepeers.dll组件提供对Web文件夹和打印的支持，该组件中存在释放后使用错误。如果用户加载了特制的HTML文档或 Office文件，未经认证的远程攻击者就可以导致拒绝服务或执行任意代码。 Microsoft Internet Explorer 7.0 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer...

Norton Internet Security ActiveX Command Execution (CVE-2004-0364)

Norton Internet Security is a security solution produced by Symantec corporation. There exists a vulnerability within Norton Internet Security that allows a remote attacker to run arbitrary executables on the target system through a malicious call to a certain method of a vulnerable ActiveX...

Quiksoft EasyMail Objects AddAttachments() ActiveX Control BOF Vulnerability

QuikSoft EasyMail Objects ActiveX Control is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption

This module exploits a memory corruption vulnerability in the Internet Explorer Tabular Data ActiveX Control. Microsoft reports that version 5.01 and 6 of Internet Explorer are vulnerable. By specifying a long value as the "DataURL" parameter to this control, it is possible to write a NUL byte...

[ZDI-10-290] SAP NetWeaver Business Client SapThemeRepository ActiveX Control Remote Code Execution Vulnerability

Application: SAP NetWeaver, TippingPoint™ IPS Customer Protection Versions Affected: Vendor URL: Bugs: Reported: 03.09.2010 Vendor response: Date of Public Advisory: 14.12.2010 Author: Alexandr Polyakov, Alexey Sintsov Description This vulnerability allows remote attackers to execute arbitrary co...

Lenovo Hotkey Driver <= v5.33 Privilege Escalation

No description provided by source. Author: Chilik Tamir - Amdocs Power Security Testing Group Website: http://invalid-packet.blogspot.com/2010/03/full-disclosure-security-vulnerability.html Subject: Security vulnerability Privilege escalation in Lenovo Hotkey Driver and Access Connections version...

Lenovo Hotkey Driver <= v5.33 Privilege Escalation Exploit

Exploit for unknown platform in category local exploits ========================================================== Lenovo Hotkey Driver in Lenovo Hotkey Driver and Access Connections version =v5.33 Impact: A privilege escalation attack can be used as a backdoor to bypass login and run arbitrary...

Lenovo Hotkey Driver 5.33 - Local Privilege Escalation

Author: Chilik Tamir - Amdocs Power Security Testing Group Website: http://invalid-packet.blogspot.com/2010/03/full-disclosure-security-vulnerability.html Subject: Security vulnerability in Lenovo Hotkey Driver and Access Connections version =v5.33 Impact: A privilege escalation attack can be use...