Microsoft Word 2010 - Crash (PoC)

Microsoft Word 2010 - Crash PoC Title : Microsoft Office Word 2010 Stack Overflow Version : Microsoft Office professional Plus 2010 Date : 2012-10-23 Vendor : http://office.microsoft.com Impact : Med/High Contact : coolkaveh at rocketmail.com Twitter : @coolkaveh tested : XP SP3 ENG Bug : ----...

Microsoft Office Word 2010 Stack Overflow

StackOverflow during the handling of the doc files a context-dependent attacker can execute arbitrary code. Title : Microsoft Office Word 2010 Stack Overflow Version : Microsoft Office professional Plus 2010 Date : 2012-10-23 Vendor : http://office.microsoft.com Impact : Med/High Contact :...

Heap overflow

Microsoft Works 9 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a crafted Word .doc file, aka "Works Heap Vulnerability."...

CVE-2012-2550

Microsoft Works 9 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a crafted Word .doc file, aka "Works Heap Vulnerability."...

CVE-2012-2550

Microsoft Works for Windows (Works 9) has a heap overflow/heap memory corruption vulnerability in Word file handling that could allow remote code execution when a user opens a crafted .doc file. An attacker could run arbitrary code subject to the user’s privileges. This is referenced as MS12-065 ...

CVE-2010-5267

Untrusted search path vulnerability in MunSoft Easy Office Recovery 1.1 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .doc, .xls, or .ppt file. NOTE: some of these details are obtained from...

RedHat Update for tetex RHSA-2012:1201-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

J-Doc <= v3.2.7 Arbitrary file upload

Exploit for php platform in category web applications '@'.$filetoupload, ; curlsetopt$curl, CURLOPTPOSTFIELDS, $post; if curlexec$curl echo filegetcontents$baseurl.'divers/'.$folder.'/'.$filetocall; else die'error in the exploit'; 0day.today 2018-04-09...

J-Doc <= v3.2.7 SQL Injection + Arbitrary download file

Exploit for php platform in category web applications 'lol' or idutilisateur = 1 -- ', 'password' = 'lol'; // Connection $curl = curlinit; curlsetopt$curl, CURLOPTURL, $baseurl.$folder.'index.php'; curlsetopt$curl, CURLOPTPOST, true; curlsetopt$curl, CURLOPTCOOKIEJAR, $cookiesfile;...

CVE-2012-1149

Integer overflow in the vclmi.dll module in OpenOffice.org OOo 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JP...

Integer overflow

Integer overflow in the vclmi.dll module in OpenOffice.org OOo 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JP...

骑士cms注入，后台拿shell

简要描述： 0x1 任意用户登录 0x2 盲注 0x3 后台拿shell 0x4 随机函数问题 详细说明： 0x1 任意用户登录 user/login.php elseifempty$SESSION'uid' || empty$SESSION'username' || empty$SESSION'utype' && $COOKIE'QS''username' && $COOKIE'QS''password' && $COOKIE'QS''uid' ifcheckcookie$COOKIE'QS''username',$COOKIE'QS''password'...

PT-2012-1203 · Document Foundation +4 · Libreoffice +5

Name of the Vulnerable Software and Affected Versions: LibreOffice versions prior to 3.5.3 OpenOffice.org versions 3.3, 3.4 Beta, and possibly earlier Description: The issue is related to errors in number processing in the vclmi.dll component of the OpenOffice.org module in LibreOffice...

Microsoft Wordpad '.doc'文件空指针引用拒绝服务漏洞

Microsoft Wordpad是windows系统中自带的写字板程序。 Microsoft Wordpad不正确处理'.doc'文件，可触发空指针引用，攻击者可以构建恶意文件，诱使用户解析使应用程序崩溃。 0 Microsoft WordPad 5.1 厂商解决方案 目前没有详细解决方案提供： http://www.microsoft.com/ http://www.securityfocus.com/data/vulnerabilities/exploits/53751.zip...

IBM Lotus Symphony < 3.0 Fix Pack 3 Multiple Vulnerabilities

The version of IBM Lotus Symphony was found to be less than 3.0 Fix Pack 3. Such versions are affected by multiple vulnerabilities: - Multiple unspecified vulnerabilities. CVE-2011-2884 - Opening a .doc document with a user defined toolbar can cause an application crash. CVE-2011-2885 - Opening a...

Cross site scripting

Cross-site scripting XSS vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the DOC parameter...

Directory traversal

Directory traversal vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the DOC parameter...

CVE-2009-5113

Cross-site scripting XSS vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the DOC parameter...

Microsoft Office 2003 (.doc) Command Exec and local BOF (msf)

Exploit for windows platform in category local exploits 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

IBM Lotus Symphony Image Object Integer Overflow Vulnerability - Linux

IBM Lotus Symphony is prone to an integer overflow vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...