Linux Kernel 2.x - sock_sendpage() Local Ring0 Root Exploit

Linux...

Sybase Advantage Data Architect - "*.SQL" Format Heap Oveflow

No description provided by source. Exploit Title: Sybase Advantage Data Architect .SQL Format Heap Oveflow RCE Date: 2010-10-16 Author: d0lc3 @rmallof - http://elotrolad0.blogspot.com/ Software Link: http://www.sybase.com/products/databasemanagement/advantagedatabaseserver/data-architect-utility...

Telnetd encrypt_keyid: Remote Root function pointer overwrite

No description provided by source. / telnetd-encryptkeyid.c Mon Dec 26 20:37:05 CET 2011 Copyright 2011 Jaime Penalba Estebanez NighterMan Copyright 2011 Gonzalo J. Carracedo BatchDrake [email protected] - [email protected] [email protected] - [email protected] / / // / / / // /\ \...

CVE-2014-1371: Improper Restriction of Operations within the Bounds of a Memory Buffer

Array index error in Dock in Apple OS X before 10.9.4 allows attackers to execute arbitrary code or cause a denial of service incorrect function-pointer dereference and application crash by leveraging access to a sandboxed application for sending a message...

ComSndFTP 1.3.7 Beta - USER Format String (Write4) Vulnerability

No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit...

PcVue 10.0 SV.UIGrdCtrl.1 'LoadObject()/SaveObject()' Trusted DWORD Vulnerability

No description provided by source. $Id: pcvuefunc.rb 13889 2011-10-12 10:57:31Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Microsoft Publisher Function Pointer Overwrite (MS11-091) - Ver2 (CVE-2011-1508)

A memory corruption vulnerability has been reported in Microsoft Publisher. The vulnerability is due to the way Microsoft Publisher does not properly handle memory for function pointers while parsing specially crafted Publisher files. A remote attacker may exploit this vulnerability by enticing a...

Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.10) - 'CONFIG_X86_X32' Arbitrary Write (2)

/ Local root exploit for CVE-2014-0038. https://raw.github.com/saelo/cve-2014-0038/master/timeoutpwn.c Bug: The X86X32 recvmmsg syscall does not properly sanitize the timeout pointer passed from userspace. Exploit primitive: Pass a pointer to a kernel address as timeout for recvmmsg, if the...

Microsoft - Tagged Image File Format '.TIFF' Integer Overflow (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' require 'nokogiri' module ::Nokogiri module XML class Builder Some XML documents don't declare the namespace before referencing, but...

CVE-2013-2477

The CSN.1 dissector in Wireshark 1.8.x before 1.8.6 does not properly manage function pointers, which allows remote attackers to cause a denial of service application crash via a malformed packet...

CVE-2013-2477

The CSN.1 dissector in Wireshark 1.8.x before 1.8.6 does not properly manage function pointers, which allows remote attackers to cause a denial of service application crash via a malformed packet...

HP Application Lifecycle Management XGO.ocx ActiveX SetShapeNodeType() Remote Code Execution

Exploit for windows platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

Microsoft Internet Explorer multiple security vulnerabilities

Memory corruptions, integer overflow, function pointer corruption...

CVE-2012-4354

TCPIPSStory.dll in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allows remote attackers to execute arbitrary code via a port-46824 TCP packet with a crafted positive integer after the opcode, triggering incorrect function-pointer processing that can lead to ...

Buffer overflow

TCPIPSStory.dll in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allows remote attackers to execute arbitrary code via a port-46824 TCP packet with a crafted positive integer after the opcode, triggering incorrect function-pointer processing that can lead to ...

AOL dnUpdater ActiveX dnu.exe Init() Method Remote Code Execution

The remote host has an install of the AOL dnUpdater ActiveX control dnu.exe prior to version 1.1.25.1. As such, it reportedly does not properly verify the function pointer passed by the 'pData' argument of the control's 'Init' method. A remote attacker could exploit this vulnerability by tricking...

ComSndFTP 1.3.7 Beta - USER Format String (Write4) (Metasploit)

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'ComSndFTP v1.3.7 Beta USER Buffe...

MS12-038: Vulnerability in .NET Framework Could Allow Remote Code Execution (2706726)

The version of the .NET Framework installed on the remote host is affected by a code execution vulnerability due to the improper execution of a function pointer. A remote, unauthenticated attacker could execute arbitrary code on the remote host subject to the privileges of the user running the...

Microsoft .NET Framework Function Pointer Remote Code Execution (MS12-038; CVE-2012-1855)

A remote code execution vulnerability has been reported in the Microsoft .NET Framework. The vulnerability is due to the improper execution of a function pointer by .NET Framework. A remote attacker could trigger this vulnerability by enticing an unsuspecting victim to open a specially crafted we...

ComSndFTP v1.3.7 Beta USER Format String (Write4) Vulnerability

This module exploits the ComSndFTP FTP Server version 1.3.7 beta by sending a specially crafted format string specifier as a username. The crafted username is sent to the server to overwrite the hardcoded function pointer from Ws232.dll!WSACleanup. Once this function pointer is triggered, the cod...