ZDI-10-144: Apple Webkit Rendering Counter Remote Code Execution Vulnerability

ZDI-10-144: Apple Webkit Rendering Counter Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-144 August 9, 2010 -- CVE ID: CVE-2010-1784 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Apple -- Affected Products: Apple WebKit -- Vulnerability...

ZDI-10-149: Adobe Flash Player LocalConnection Memory Corruption Remote Code Execution Vulnerability

ZDI-10-149: Adobe Flash Player LocalConnection Memory Corruption Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-149 August 10, 2010 -- CVE ID: CVE-2010-2188 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Adobe -- Affected Products: Adobe Flash...

Mediacoder 0.7.5.4710 Buffer Overflow Exploit

Exploit for windows platform in category local exploits ============================================= Mediacoder 0.7.5.4710 Buffer Overflow Exploit ============================================= media coder 0.7.5.4710 0 day buffer overflow exploit vulnerble application link...

ZDI-10-150: Microsoft Office Word sprmCMajority Record Parsing Remote Code Execution Vulnerability

ZDI-10-150: Microsoft Office Word sprmCMajority Record Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-150 August 11, 2010 -- CVE ID: CVE-2010-1900 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Microsoft -- Affected Products: Microsoft...

ZDI-10-148: Microsoft Cinepak Codec CVDecompress Remote Code Execution Vulnerability

ZDI-10-148: Microsoft Cinepak Codec CVDecompress Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-148 August 10, 2010 -- CVE ID: CVE-2010-2553 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Microsoft -- Affected Products: Microsoft File Format...

Advanced File Vault(eSellerateControl350.dll) Activex Heap Spray 0-day

No description provided by source. // Exploit Title: Advanced File VaulteSellerateControl350.dll Activex Heap Spray 0-day // Date: 08-08-2010 // Author: ThE g0bL!N // Version: 0-day // Tested on: xp sp2 html script language="JavaScript" defer var sCode =...

Another Windows 7 Zero-Day Released

Microsoft’s security response team is investigating the release of a new zero-day flaw that exposes Windows 7 users to blue-screen crashes or code execution attacks. The flaw could be exploited by local attackers to cause a denial-of-service or potentially gain elevated privileges, according to a...

ZDI-10-140: Novell iPrint Client Browser Plugin operation Parameter Remote Code Execution Vulnerability

ZDI-10-140: Novell iPrint Client Browser Plugin operation Parameter Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-140 August 5, 2010 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Novell -- Affected Products: Novell iPrint -- TippingPointTM I...

Advanced File Vault(eSellerateControl350.dll) Activex Heap Spray

Exploit for windows platform in category remote exploits ================================================================ Advanced File VaulteSellerateControl350.dll Activex Heap Spray ================================================================ // Exploit Title: Advanced File...

ZDI-10-142: Apple Webkit SVG First-Letter Style Remote Code Execution Vulnerability

ZDI-10-142: Apple Webkit SVG First-Letter Style Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-142 August 5, 2010 -- CVE ID: CVE-2010-1785 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Apple -- Affected Products: Apple WebKit -- TippingPointT...

Advanced File Vault - eSellerateControl350.dll ActiveX HeapSpray

Advanced File Vault - eSellerateControl350.dll ActiveX HeapSpray // Exploit Title: Advanced File VaulteSellerateControl350.dll Activex Heap Spray 0-day // Date: 08-08-2010 // Author: ThE g0bL!N // Version: 0-day // Tested on: xp sp2 var sCode =...

Advanced File Vault - 'eSellerateControl350.dll' ActiveX HeapSpray

// Exploit Title: Advanced File VaulteSellerateControl350.dll Activex Heap Spray 0-day // Date: 08-08-2010 // Author: ThE g0bL!N // Version: 0-day // Tested on: xp sp2 var sCode = unescape"%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +...

Examining Zero Day Vulnerability Myths

Another month, another zero day flaw has been reported, with malicious attackers logically taking advantage of the window of opportunity, by launching malware serving attacks using it. Read the full article. ZDNet...

Novell GroupWise Internet Agent IMAP Service Stack Buffer Overflow

Added: 08/03/2010 CVE: CVE-2010-2777 BID: 41704 OSVDB: 66623 Background Novell GroupWise is an e-mail and collaboration product suite. Problem A buffer overflow vulnerability exists within the IMAP component of the Novell GroupWise Internet Agent service and is due to a boundary error while...

Zeus Botnet Using Windows LNK Flaw

Isolated strains of mainstream malware that took advantage of how the zero-day Windows flaw first exploited by the sophisticated Stuxnet worm began appearing late last week. The same approach has since been applied by the dodgy sorts behind Zeus, a family of sophisticated toolkits frequently used...

PunBB 1.3.x / Pun_PM 1.2.6 Blind SQL Injection

!/usr/bin/perl 0-Day PunBB 526 function punpmeditmessage global $forumdb, $forumuser, $langpunpm; $errors = array; // Verify input data $query = array 'SELECT' = 'm.id as id, m.senderid as senderid, m.status as status, u.username as username, m.subject as subject, m.body as body', 'FROM' =...

ZDI-10-133: Mozilla Firefox CSS font-face Remote Code Execution Vulnerability

ZDI-10-133: Mozilla Firefox CSS font-face Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-133 July 20, 2010 -- CVE ID: CVE-2010-2752 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Mozilla Firefox -- Affected Products: Mozilla Firefox 3.6.x --...

ZDI-10-134: Mozilla Firefox DOM Attribute Cloning Remote Code Execution Vulnerability

ZDI-10-134: Mozilla Firefox DOM Attribute Cloning Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-134 July 20, 2010 -- CVE ID: CVE-2010-1208 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Mozilla Firefox -- Affected Products: Mozilla Firefox...

Dino Dai Zovi on Return-Oriented Exploitation and Bug Bounties

Dennis Fisher talks with independent security researcher Dino Dai Zovi about his upcoming Black Hat talk on return-oriented exploitation, the value of exploit mitigations such as DEP and ASLR, the new crop of vendor bug bounties and why we don’t have any good data on zero-day attacks. Podcast aud...

ZDI-10-136: Novell Teaming ajaxUploadImageFile Remote Code Execution Vulnerability

ZDI-10-136: Novell Teaming ajaxUploadImageFile Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-136 July 21, 2010 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Novell -- Affected Products: Novell Access Manager -- TippingPointTM IPS Customer...