Dangling pointer vulnerability in LookupGetterOrSetter — Mozilla

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that when window.lookupGetter is called with no arguments the code assumes the top JavaScript stack value is a property name. Since there were no arguments passed into the function, the top value could represent...

Vermillion FTP Daemon - 'PORT' Memory Corruption (Metasploit)

$Id: vermillionftpdport.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Avast! 5.0 aswFW.sys kernel driver IOCTL Memory Pool Corruption

Exploit for windows platform in category dos / poc ================================================================================= Avast! Internet Security 5.0 aswFW.sys kernel driver IOCTL Memory Pool Corruption =================================================================================...

Avast! Internet Security 5.0 - aswFW.sys Kernel Driver IOCTL Memory Pool Corruption

Avast! Internet Security 5.0 - aswFW.sys Kernel Driver IOCTL Memory Pool Corruption +-------------------------------------------------------------------------------------+ | Avast! Internet Security 5.0 'aswFW.sys' kernel driver IOCTL Memory Pool Corruption |...

Avast! Internet Security 5.0 Denial Of Service

+-------------------------------------------------------------------------------------+ | Avast! Internet Security 5.0 'aswFW.sys' kernel driver IOCTL Memory Pool Corruption | +-------------------------------------------------------------------------------------+ Tested Platform: Avast! Internet...

Dangling pointer crash regression from plugin parameter array fix — Mozilla

Mozilla developer Daniel Holbert reported that the fix to the plugin parameter array crash that was fixed in Firefox 3.6.7 caused a crash showing signs of memory corruption. In certain circumstances, properties in the plugin instance's parameter array could be freed prematurely leaving a dangling...

nsCSSValue::Array index integer overflow — Mozilla

Security researcher J23 reported via TippingPoint's Zero Day Initiative that an array class used to store CSS values contained an integer overflow vulnerability. The 16 bit integer value used in allocating the size of the array could overflow, resulting in too small a memory buffer being created...

Adobe Flash Player AVM2 getouterscope Opcode Remote Code Execution Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Adobe Flash Player. User interaction is required in that a target must visit a malicious web page. The specific vulnerability exists within the parsing of an undocumented opcode within Adobe's ActionScrip...

Microsoft Office Excel SxView Record Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Excel. User interaction is required to exploit this vulnerability in that the target must open a malicious document. The specific flaw exists in the parsing of SXVIEW records in an...

Micropoint Proactive Denfense privilege escalation

User-controlled kernel memory access on IOCTL processing...

Microsoft VBS code execution

If F1 is pressed in dialog window, help file controlled by attacker...

Simply Classified 0.2 Cross Site Request Forgery / Cross Site Scripting

Simply Classified 0.2 XSS & CSRF Vulnerabilities Download: http://www.hotscripts.com/listing/simplyclassifieds/ Found by: mrme Tested On: Windows Vista Note: For educational purposes only Author contact date: 16th December 2009 Advisory:...

Simply Classified 0.2 - Cross-Site Scripting / Cross-Site Request Forgery

Simply Classified 0.2 XSS & CSRF Vulnerabilities Found by: mrme Tested On: Windows Vista Note: For educational purposes only Author contact date: 16th December 2009 Advisory: http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-002-simply-classifieds-v0.2-xss-and-csrf/ Greetz...

CVE-2009-4419

Intel Q35, GM45, PM45 Express, Q45, and Q43 Express chipsets in the SINIT Authenticated Code Module ACM, which allows local users to bypass the Trusted Execution Technology protection mechanism and gain privileges by modifying the MCHBAR register to point to an attacker-controlled region, which...

Firefox Add-on Spies on Google Search Results

Security researchers have intercepted a fake Flash Player update creating a Firefox add-on that spies on the user’s Google search results. The malicious Firefox extension, called “Adobe Flash Player 0.2,” injects ads into the user’s Google search results pages and even has the capability to monit...

Design/Logic Flaw

Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site...

GLSA-200907-16 : Python: Integer overflows

The remote host is affected by the vulnerability described in GLSA-200907-16 Python: Integer overflows Chris Evans reported multiple integer overflows in the expandtabs method, as implemented by 1 the stringexpandtabs function in Objects/stringobject.c and 2 the unicodeexpandtabs function in...

JavaScript chrome privilege escalation — Mozilla

Mozilla security researcher mozbugra4 reported a vulnerability which allows scripts from page content to run with elevated privileges. Using this vulnerability, an attacker could cause a chrome privileged object, such as the browser sidebar or the FeedWriter, to interact with web content in such ...

Cross site request forgery (csrf)

Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an...

TemaTres 1.0.3 SQL Injection / XSS

--------------------------------------------------- MULTIPLE REMOTE VULNERABILITIES--TemaTres 1.0.3-- --------------------------------------------------- CMS INFORMATION: --WEB: http://www.r020.com.ar/tematres/ --DOWNLOAD: http://sourceforge.net/projects/tematres/ --DEMO:...