CVE-2007-1382

The CVE-2007-1382 entry concerns the PHP COM extensions for PHP on Windows. The vulnerability arises when a context-dependent attacker uses a WScript.Shell COM object’s Run method to execute cmd.exe, bypassing PHP’s Safe Mode and enabling arbitrary code execution. The affected component is the PH...

PHP COM extension safe_mode protection bypass

WScript.Shell COM object allows execution of any commands...

Unfixed XSS vulnerability at www.mobile88.com

Security researcher By Encore, has submitted on 03/09/2007 a cross-site-scripting XSS vulnerability affecting www.mobile88.com, which at the time of submission ranked 12405 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/09/2007. It is...

Unfixed XSS vulnerability at www.arsiv1.com

Security researcher St@rExT, has submitted on 03/08/2007 a cross-site-scripting XSS vulnerability affecting www.arsiv1.com, which at the time of submission ranked 1785925 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/08/2007. It is current...

PHP COM extensions (inconsistent Win32) safe_mode Bypass Exploit

No description provided by source. ?php //PHP COM extensions inconsistent Win32 safemode bypass //by rgod $suntzu = new COM"WScript.Shell"; $suntzu-Run'c:windowssystem32cmd.exe /c '.escapeshellarg$GETcmd.' '.dirname$SERVERSCRIPTFILENAME.'/suntzoi.txt';...

PHP COM Extensions - inconsistent Win32 safe_mode Bypass

PHP COM Extensions - inconsistent Win32 safemode Bypass Run'c:\windows\system32\cmd.exe /c '.escapeshellarg$GETcmd.' '.dirname$SERVERSCRIPTFILENAME.'/suntzoi.txt'; $suntzoi=file"suntzoi.txt"; for $i=0; $i milw0rm.com 2007-03-07...

PHP COM extensions (inconsistent Win32) safe_mode Bypass Exploit

Exploit for unknown platform in category local exploits ================================================================ PHP COM extensions inconsistent Win32 safemode Bypass Exploit ================================================================ Run'c:\windows\system32\cmd.exe /c...

PHP 'COM' Extensions - inconsistent Win32 'safe_mode' Bypass

Run'c:\windows\system32\cmd.exe /c '.escapeshellarg$GETcmd.' '.dirname$SERVERSCRIPTFILENAME.'/suntzoi.txt'; $suntzoi=file"suntzoi.txt"; for $i=0; $i milw0rm.com 2007-03-07...

PHP-MIP 0.1 - 'top.php?laypath' Remote File Inclusion

PHP Module Implementationtop.php laypathRemote File Include Vul ^ Downlaoad S : http://sourceforge.net/projects/phpmip/ ^ Author: GolDM = Mahmoodali && Contact: [email protected] ^ In: /path/top.php ^ Vulnerable Code: ^ include"$laypath/body.php"; Line : 23 ^ Exploit: ^...

Unfixed XSS vulnerability at www.zirve100.com

Security researcher FujKeR, has submitted on 22/02/2007 a cross-site-scripting XSS vulnerability affecting www.zirve100.com, which at the time of submission ranked 32044 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/03/2007. It is currentl...

Unfixed XSS vulnerability at www.lider100.com

Security researcher FujKeR, has submitted on 22/02/2007 a cross-site-scripting XSS vulnerability affecting www.lider100.com, which at the time of submission ranked 208665 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/03/2007. It is current...

EasyMail Objects IMAP4 Component Connect Method Remote Overflow

EasyMail Objects, a set of COM objects for supporting email protocols, is installed on the remote Windows host. The IMAP4 component of the version of the DjVu Browser Plug-in installed on the remote host reportedly is affected by a stack buffer overflow in the 'Connect' method that can be trigger...

Internet Explorer IMJPCKSI COM对象实例化内存破坏漏洞（MS07-016）

Internet Explorer是微软发表的非常流行的WEB浏览器。 Internet Explorer使用某些Imjpcksid.dll的COM对象作为ActiveX控件。攻击者可能通过构建特制网页来利用此漏洞，如果用户查看了该网页，则可能允许远程执行代码。成功利用此漏洞的攻击者可以完全控制受影响的系统。 Microsoft Internet Explorer 7.0 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.0.1 SP4...

Fixed XSS vulnerability at www.bill88.com

Security researcher SCRiPToRiuM, has submitted on 16/02/2007 a cross-site-scripting XSS vulnerability affecting www.bill88.com, which at the time of submission ranked 3202227 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 17/02/2007. It is...

Internet Explorer COM Object Instantiation Memory Corruption (MS07-016; CVE-2007-0219; CVE-2007-4697)

Component Object Models COM Objects are used to enable data exchange between processes and the creation of dynamic object in different programming languages.Microsoft Internet Explorer is prone to multiple remote code execution vulnerabilities. The vulnerabilities are due to a memory corruption...

Microsoft Internet Explorer multiple security vulnerabilities

Memory corruptions on COM objects instantiation and FTP server response parsing can be used for hidden malware installation...

Unfixed XSS vulnerability at www.spor3.com

Security researcher Hacxer, has submitted on 14/02/2007 a cross-site-scripting XSS vulnerability affecting www.spor3.com, which at the time of submission ranked 20689 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 15/02/2007. It is currently...

Microsoft Internet Explorer vulnerable to remote code execution

Overview A vulnerability in the way Microsoft Internet Explorer instantiates COM objects may lead to execution of arbitrary code. Description Component Object Model, or COM objects, are used to enable interprocess communication and dynamic object creation within Microsoft Windows. Microsoft...

Code injection

Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from 1 Msb1fren.dll, 2 Htmlmm.ocx, and 3 Blnmgrps.dll as ActiveX controls, which allows remote attackers to execute arbitrary code via unspecified vectors, a different issue than CVE-2006-4697...

Microsoft Internet Explorer fails to properly instantiate COM objects

Overview A vulnerability in the way Microsoft Internet Explorer instantiates COM objects may lead to execution of arbitrary code. Description Component Object Model, or COM objects are used to enable interprocess communication and dynamic object creation within Microsoft Windows. Microsoft Intern...