CVE-2013-3125

Microsoft Internet Explorer 10 is affected by CVE-2013-3125 (Memory corruption) via a crafted web site, distinct from CVE-2013-3118 and CVE-2013-3120. The vulnerability concerns MSHTML/IE10 memory corruption that could allow remote code execution or DoS. Related exploits/documentation exist for o...

Microsoft Internet Explorer HTML Use After Free Memory Corruption (MS13-047; CVE-2013-3139)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer...

Java Applet Driver Manager Privileged toString() Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class Metasploit3 false def initialize inf...

PayPal Cross Site Scripting

====================================================================== | | | | | | \ \ / / | | | | | |/' | \ V / | | | | ' | /| \ \ /\ / / ' \ / \ | || | | | \ |/ /\ V V /| | | | / /^\ \ /|| ||/ // || || / / || ======================================================================= Hello I...

IBM SPSS SamplePower C1Tab ActiveX Heap Overflow

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 HttpClients::IE,...

Microsoft Internet Explorer CVE-2013-1311 Use-After-Free Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

USAID a Target of DoL Watering Hole Attackers

One of the nine sites serving malware tied to the recent watering hole attack on the U.S. Department of Labor was located in Cambodia and has ties to the United States Agency for International Development USAID. Speculation has it that the DoL attack was targeting downstream employees at the...

金蝶网站可执行任意命令，root权限

简要描述： 金蝶网站可执行任意命令，root权限。 详细说明： 金蝶网站用户登录的地方http://id.kingdee.com/存在命令执行漏洞，借助struts2的私有变量class.classLoader.jarPath可以执行任意命令（并且是root权限），很可能获得webshell（当然我没有尝试获取），进而可能威胁到用户的数据安全。因为是以root权限执行任意命令，可获得服务器完全控制权，并且可能以这台服务器为跳板威胁周围其它服务器的安全。 漏洞证明： 用IE浏览器访问如下链接：...

Microsoft Patch Zero Day Used to Attack Deptartment of Labor

Microsoft will ship 10 bulletins in the May edition of Patch Tuesday. The company considers just two of the patches critical, one of which supplements the currently available “Fix it” tool that resolved the IE zero-day vulnerability exploited recently in a watering-hole attack targeting the U.S...

Microsoft Fix It a Temporary Patch for IE 8 Zero Day Flaw

Microsoft has released a Fix-It to address an Internet Explorer 8 zero-day that was exploited in a watering hole attack against the U.S. Department of Labor website last week. The Fix It is a temporary mitigation until a patch is released. Microsoft’s next scheduled Patch Tuesday security updates...

Microsoft Internet Explorer Remote Code Execution Vulnerability (2847140)

This host is missing a critical security update according to Microsoft Bulletin MS13-038. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Immunity Canvas: JAVA_DYNAMICBINDING

Name| javaDynamicBinding ---|--- CVE| CVE-2013-2423 Exploit Pack| CANVAS Description| javaDynamicBinding Notes| CVE Name: CVE-2013-2423 VENDOR: Sun Notes: A vulnerability in MethodHandle allows to overwrite public final fields. This can be abused in order to disable Java Sandbox. The current...

Google Chrome Frame Plugin For Microsoft IE Denial Of Service Vulnerability - Windows

google chrome frame plugin for microsoft ie is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Google Chrome Frame Plugin For Microsoft IE Denial Of Service Vulnerability (Windows)

This host is installed with google chrome frame plugin for microsoft ie and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbgooglechromeframedosvulnwin.nasl 6093 2017-05-10 09:03:18Z teissa $ Google Chrome Frame Plugin For Microsoft IE Denial Of Service Vulnerabilit...

Critical IE, Windows Kernel Flaws Patched

For the second month in a row, Microsoft has released a cumulative update for Internet Explorer, patching a number of critical remote code execution vulnerabilities in the browser, including one previously disclosed. It also patched a serious kernel mode driver vulnerability that could enable...

Microsoft to Ship 7 Bulletins in March Patch Tuesday Release

Software giant Microsoft plans to ship seven bulletins in the March 2013 edition of Patch Tuesday. Four of the bulletins are receiving high-severity, critical ratings. Three of the four critically rated bulletins that affect Microsoft Windows, Internet Explorer, Silverlight, Office, and Server...

IE generic JSON hijacking vulnerabilities-vulnerability warning-the black bar safety net

Brief description: Due to the certain resource container data improper handling lead to json hijacking vulnerabilities. Detailed description: Since ie supports vbscript,so the script elements may be specified to the vbscript language: script language=vbscript/script When but we specify that a js...

Microsoft Patches Critical IE Vulnerabilities

Internet Explorer continues to dominate Microsoft’s 2013 security updates. Among the 12 bulletins and 57 vulnerabilities patched in today’s release was a cumulative update for the maligned browser and another fix for a bug being exploited in the wild. Last month, an out-of-band fix for IE 6-8...

Report: Malvertising Campaign Thrives on Dynamic DNS

A malvertising campaign that’s lasted almost half a year is staying alive thanks to infected web advertisements being circulated by otherwise clean ad networks. The campaign, now in its fifth month, relies on the Dynamic Domain Name System DDNS to keep it from being caught according to a report...

Microsoft XML Core Services XSLT解析漏洞（MS13-002)

CVECAN ID: CVE-2013-0007 Microsoft Windows是微软公司推出的一系列操作系统。 Microsoft XML Core Services在解析 XSLT 内容时存在不明细节错误，可被利用导致内存破坏,甚至执行任意代码。 0 Microsoft Office 2007 Microsoft Office Office 2003 Professional Edi Microsoft Office 2003 Student and Teacher Edi Microsoft Office 2003 Standard Edition Microsoft Offi...