Windows Object Packager Insecure Execution

Added: 01/24/2012 CVE: CVE-2012-0009 BID: 51297 OSVDB: 78212 Background Windows Object Packager is a tool that can be used to create a package that can be inserted into a file. Problem A vulnerability exists in the way the Windows Object Packager registers and implements packages stored on networ...

Joomla! Component com_xball - 'team_id' SQL Injection

source: https://www.securityfocus.com/bid/51618/info The 'comxball' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

vBSEO proc_deutf() Remote PHP Code Injection

This module exploits a vulnerability in the 'procdeutf' function defined in /includes/functionsvbseocpabstract.php for vBSEO versions 3.6.0 and earlier. User input passed through 'charrepl' POST parameter isn't properly sanitized before being used in a call to pregreplace function which uses the...

HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'HEAD', :uri =...

HP OpenView Network Node Manager - 'ov.dll' _OVBuildPath Buffer Overflow (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'HEAD', :uri =...

PostNuke pnAddressbook Module - id SQL Injection

PostNuke pnAddressbook Module - id SQL Injection source: https://www.securityfocus.com/bid/51566/info The pnAddressbook module for PostNuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issu...

Microsoft Office ClickOnce Unsafe Execution

Added: 01/16/2012 CVE: CVE-2012-0013 BID: 51284 OSVDB: 78207 Background ClickOnce is a deployment technology that allows developers to create self-updating Windows-based applications that can be installed and run with minimal user interaction. A ClickOnce application is any Windows Presentation...

Splunk Search Jobs Remote Code Execution

Added: 01/13/2012 CVE: CVE-2011-4642 BID: 51061 OSVDB: 77695 Background Splunk collects, indexes and harnesses the massive volumes of valuable machine data generated by your complex IT infrastructure, whether physical, virtual or in the cloud. Problem Splunk allows users to perform search actions...

Plone Zope SAXutils Command Execution

Added: 01/13/2012 CVE: CVE-2011-3587 BID: 49857 OSVDB: 76105 Background Plone is a free and open source content management system built on top of the Zope application server. Plone can be used for any kind of website, including blogs, internet sites, webshops and internal websites. Problem Plone...

Microsoft PowerPoint Floating Point Techno-color Time Bandit vulnerability

Added: 01/12/2012 CVE: CVE-2011-0655 BID: 47252 OSVDB: 71771 Background Microsoft PowerPoint is presentation software included in the Microsoft Office desktop suite. Problem The vulnerability is caused when PowerPoint reads an invalid record in a specially crafted PowerPoint file. A remote attack...

NTR ActiveX Control StopModule() Remote Code Execution

This module exploits a vulnerability found in the NTR ActiveX 1.1.8. The vulnerability exists in the StopModule method, where the lModule parameter is used to dereference memory to get a function pointer, which leads to code execution under the context of the user visiting a malicious web page...

CoCSoft Stream Down Stack Overflow

Added: 01/10/2012 CVE: CVE-2011-5052 BID: 51190 OSVDB: 78043 Background CoCSoft Stream Down is a streaming media download tool. Problem The CoCSoft Stream Down HTTP client implementation in version 6.8 and prior does not properly validate HTTP responses. This vulnerability may allow an attacker t...

MS12-005 Microsoft Office ClickOnce Unsafe Object Package Handling Vulnerability

This module exploits a vulnerability found in Microsoft Office's ClickOnce feature. When handling a Macro document, the application fails to recognize certain file extensions as dangerous executables, which can be used to bypass the warning message. This can allow attackers to trick victims into...

ImpressPages CMS 'actions.php' Remote Code Execution Vulnerability

ImpressPages CMS is prone to a remote-code execution vulnerability. Exploiting this issue will allow attackers to execute arbitrary code within the context of the affected application. ImpressPages CMS 1.0.12 is vulnerable; other versions may also be affected. OpenVAS Vulnerability Test $Id:...

under windows ie_iepeers. dll after the release of the heavy interest with vulnerability-vulnerability warning-the black bar safety net

Vulnerability details please view: ms10018, the http://technet.microsoft.com/en-us/security/bulletin/MS10-018 The key, if metasploit was not this exploit, where you can download: http://www.rec-sec.com/index.php Here also posted about it: this ruby code is saved directly to the...

Novell iPrint Client ActiveX Control GetDriverSettings Stack Overflow

Added: 12/23/2011 CVE: CVE-2011-3173 BID: 50367 OSVDB: 76631 Background Novell iPrint is an application which allows users to install and manage printers. Novell iPrint installs the Novell iPrint Client ActiveX control named ienipp.ocx. Problem A buffer overflow vulnerability in the ActiveX contr...

FreeBSD Telnet Service Encryption Key ID Buffer Overflow

This module exploits a buffer overflow in the encryption option handler of the FreeBSD telnet service. Module Options msf use exploit/freebsd/telnet/telnet/encryptkeyid msf undefinedencryptkeyid show actions ...actions... msf undefinedencryptkeyid set ACTION msf undefinedencryptkeyid show options...

Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow

This module exploits a buffer overflow in the encryption option handler of the Linux BSD-derived telnet service inetutils or krb5-telnet. Most Linux distributions use NetKit-derived telnet daemons, so this flaw only applies to a small subset of Linux systems running telnetd. Module Options msf us...

Enterasys NetSight nssyslogd.exe Buffer Overflow

This module exploits a stack buffer overflow in Enterasys NetSight. The vulnerability exists in the Syslog service nssylogd.exe when parsing a specially crafted PRIO from a syslog message. The module has been tested successfully on Enterasys NetSight 4.0.1.34 over Windows XP SP3 and Windows 2003...

novell sentinel log manager 1.2.0.1 - Directory Traversal

novell sentinel log manager 1.2.0.1 - Directory Traversal Exploit Title: Novell Sentinel Log Manager directory traversal Date: 2011-12-18 Exploit Author: Andrea Fabrizi Vendor Homepage: http://www.novell.com/ Version: = 1.2.0.1 Tested on: Sentinel Log Manager Appliance 1.2.0.1 CVE: 2011-5028 The...