Novell Client for Windows 2000/XP - ActiveX Remote Denial of Service

Application: Novell Client for Windows 2000 and XP Platforms: Windows XP Professional French SP2 crash: IE 6.0.2900.2180 Exploitation: remote DoS Date: 2009-08-24 Author: Francis Provencher Protek Research Lab's 1 Introduction 2 Technical details 3 The Code =============== 1 Introduction...

Novell Client For Windows 2000/XP Denial Of Service

Application: Novell Client for Windows 2000 and XP Platforms: Windows XP Professional French SP2 crash: IE 6.0.2900.2180 Exploitation: remote DoS Date: 2009-08-24 Author: Francis Provencher Protek Research Lab's 1 Introduction 2 Technical details 3 The Code =============== 1 Introduction...

Acer AcerCtrls.APlunch ActiveX Arbitrary Command Execution

The remote host contains an ActiveX control from Acer called 'AcerCtrls.APlunch'. If this control is distributed with the appropriate 'Implemented Categories' registry key, it may be marked as safe for scripting. This would allow a web page in Internet Explorer to call the control's 'Run' method....

AwingSoft Web3D Player (WindsPly.ocx) Remote BOF PoC

No description provided by source. ----------------------------------------------------------------------------- AwingSoft Web3D Player WindsPly.ocx "SceneURL" Remote Buffer Overflow url: http://www.awingsoft.com/ Author: shinnai mail: shinnaiatautisticidotorg site: http://www.shinnai.net/...

AwingSoft Web3D Player - WindsPly.ocx Remote Buffer Overflow (PoC)

AwingSoft Web3D Player - WindsPly.ocx Remote Buffer Overflow PoC ----------------------------------------------------------------------------- AwingSoft Web3D Player WindsPly.ocx "SceneURL" Remote Buffer Overflow url: http://www.awingsoft.com/ Author: shinnai mail: shinnaiatautisticidotorg site:...

Winds3D Viewer GetURL()函数远程代码执行漏洞

BUGTRAQ ID: 35595 CVECAN ID: CVE-2009-2386 Awakening是一个功能强大的实时3D解决方案，Winds3D Viewer是Awakening的浏览器插件。 Winds3D Viewer以不安全的方式实现了GetURL函数： /----------- GetURLstring URL Description: Open browser to visit assigned URL returns: None - -----------/ 调用GetURL最终会执行相当于“ShellExecuteNULL, "open", URL, 0, 0,...

McAfee 3.6.0.608 Active-X Data Write

GOODFELLAS Security Research TEAM http://goodfellas.shellcode.com.ar Greetings to str0ke McAfee, Inc. 3.6.0.608 Policy Manager naPolicyManager.dll Arbitrary Data Write ============================================================================== Internal ID: VULWAR20090616. -----------...

Roxio CinePlayer 3.2 (IAManager.dll) Remote BOF Exploit (heap spray)

No description provided by source. html head titleBoom!/title brRoxio CinePlayer 3.2 IAManager.dll Remote BOF Exploit heap spray/br brAdvisory from secunia 22251/br brBy : His0k4/br brGreetings: All friends dz, snakespc.com/br brTested on Windows Xp Sp3 en,with IE7/br object...

BaoFeng - 'config.dll' ActiveX Remote Code Execution

BaoFeng config.dll ActiveX Remote Code Execution Exploit Exploit made by etirah Download: www.baofeng.com Problem DLL : config.dll Problem Func : SetAttributeValueparam1,param2,param3 Problem Param : param1 References: 1. http://forum.eviloctal.com/viewthread.php?tid=35051 2...

AOL IWinAmpActiveX Class - ConvertFile() Remote Buffer Overflow

AOL IWinAmpActiveX Class - ConvertFile Remote Buffer Overflow //add user one, user "sun" pass "tzu" shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" +...

暴风影音2009(Config.dll)ActiveX远程栈溢出漏洞

暴风影音是国内一款相当流行的万能播放器 http://www.baofeng.com/ clsid:BD103B2B-30FB-4F1E-8C17-D8F6AADBCC05 C:\Program Files\StormII\Config.dll Sub SetAttributeValue ByVal lpQueryStr As String , ByVal bstrAttributeName As String , ByVal lpValueStr As String 当参数lpQueryStr是一个超长字符串时，发生栈溢出，利用堆填充技术，攻击者可以很轻松的利用此漏洞执行任意代码 分析...

Symantec Fax Viewer Control v10 (DCCFAXVW.DLL) remote buffer overflow exploit

!-- Symantec Fax Viewer Control v10 DCCFAXVW.DLL remote buffer overflow exploit IE7 by Nine:Situations:Group::trotzkista site: http://retrogod.altervista.org/ tested against: Symantec WinFax Pro 10.03 Internet Explorer 7, XP SP3 some details: CLSID: C05A1FBC-1413-11D1-B05F-00805F4945F6 Progid:...

Versalsoft HTTP Image Uploader ActiveX Vulnerability

This host is installed with Versalsoft HTTP Image Uploader and is prone to ActiveX vulnerability. OpenVAS Vulnerability Test $Id: gbversalsofthttpimageupldractvxvuln.nasl 5369 2017-02-20 14:48:07Z cfi $ Versalsoft HTTP Image Uploader ActiveX Vulnerability Authors: Nikita MR Copyright: Copyright c...

Orbit Downloader File Deletion ActiveX Vulnerability

This host is installed with Orbit Downloader and is prone to File Deletion ActiveX Vulnerability. OpenVAS Vulnerability Test $Id: secpodorbitdownloaderactivexctrlvuln.nasl 5369 2017-02-20 14:48:07Z cfi $ Orbit Downloader File Deletion ActiveX Vulnerability Authors: Sujit Ghosal Copyright: Copyrig...

GeoVision LiveAudio - ActiveX Remote Freed-Memory Access

GeoVision LiveAudio - ActiveX Remote Freed-Memory Access // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" +...

SopCast SopCore ActiveX Control DoS Vulnerability - Windows

SopCast SopCore ActiveX is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SupportSoft DNA Editor Module (dnaedit.dll v6.9.2205) remote code execution exploit (IE6/7)

!-- SupportSoft DNA Editor Module dnaedit.dll v6.9.2205 remote code execution exploit IE6/7 by Nine:Situations:Group::bruiser vendor url: http://www.supportsoft.com/ our site: http://retrogod.altervista.org/ details: CLSID: 01110800-3E00-11D2-8470-0060089874ED Progid: Tioga.Editor.1 Binary Path:...

SupportSoft DNA Editor Module (dnaedit.dll) Code Execution Exploit

No description provided by source. !-- SupportSoft DNA Editor Module dnaedit.dll v6.9.2205 remote code execution exploit IE6/7 by Nine:Situations:Group::bruiser vendor url: http://www.supportsoft.com/ our site: http://retrogod.altervista.org/ details: CLSID: 01110800-3E00-11D2-8470-0060089874ED...

Imera ImeraIEPlugin ActiveX控件任意文件下载漏洞

Imera TeamLinks是桌面客户端软件，允许物理分不断组成员之间进行协作。 TeamLinks客户端的ImeraIEPlugin.dll库所提供的ImeraIEPlugin.Pilot.1 ActiveX控件没有正地的处理DownloadHost属性参数，如果用户受骗访问了恶意站点并向该属性传送了恶意参数的话，就可能导致向用户系统下载并执行任意文件。 Imera ImeraIEPlugin.dll 1.0.2.54 临时解决方法： 为CLSID 75CC8584-86D4-4A50-B976-AA72618322C6设置kill-bit。 厂商补丁： Imera -----...

Synactis All-In-The-Box ActiveX RCE Vulnerability

All-In-The-Box ActiveX is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...