wordpress 3.0.3 - Stored XSS (ie7,6 ns8.1)

No description provided by source. Exploit Title: Wordpress 3.0.3 stored XSS IE7,6 NS8.1 Date: 27 december 2010 Author: Saif Software Link:wordpress.org Version: 3.0.3 Tested on: IE 6 a stored XSS vulnerability using CSS styles affecting users surfing the malicious post using IE6, IE7, NS 8.1 POC...

SAMSUNG NET-i Viewer 1.37 SEH Overwrite

No description provided by source. html object classid='clsid:FA6E2EA9-D816-4F00-940B-609C9E8847A4' id='target' /object script language='vbscript' ' Exploit Title: SAMSUNG NET-i viewer ActiveX SEH Overwrite ' Date: April 30 2012 ' Author: Blake ' Software Link:...

Apple QuickTime 7.7.2 TeXML Style Element font-table Field Stack Buffer Overflow

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

RealNetworks Realplayer QCP Parsing Heap Overflow

No description provided by source. $Id: realplayerqcp.rb 13745 2011-09-17 06:48:33Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of...

SPlayer XvidDecoder 3.3 - ActiveX Remote Exec 0day PoC

No description provided by source. Author: superli Tested on: xpsp3 ie6 Code : object id=TestObj classid=CLSID:E5960BC4-A76B-4211-BEEC-9AEE2AF8AAE6 style=width:100;height:350/object...

Novell GroupWise Client gwcls1.dll ActiveX Remote Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

DESTOON 20140625版本站内信XSS

简要描述： 只测试了ie6，弹了个框框。 详细说明： function dsafe$string ifisarray$string return arraymap'dsafe', $string; else $string = pregreplace"//", "", $string; $string = pregreplace"//\s\S?\//", "", $string; $string = pregreplace"/&a-z0-9+;/i", "", $string; ifpregmatch"/&a-z0-9+;/i", $string return...

openSUSE Security Update : namazu (openSUSE-2011-79)

bnc732323 pretty bug number! - CVE-2011-4345 XSS flaw for IE6/7 in japanese locale %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2011-79. The text description of this plugin is C...

绕过startbbs防御继续盲打管理员(两种方法)

简要描述： startbbs已经对xss有过滤措施，但是有办法绕过。这里我依然以官方为demo作为测试，因为官方的是最新版。 详细说明： 问题出现在发帖的正文文本框：盲打的概率非常高的。 测试了常规的html代码，发现只剩下img标签，其他的都被过滤了，因此可以在img上能发挥作用的只有on系列的事件了。 测试尝试和之前那样 发布上面的代码，发现过滤成下面这样： 尝试用javascript:伪协议去触发：但是又被过滤成这样： 也就是常规的在敏感字符那加入x 来让事件等功能失效。 到了这一步，暂时没有了头绪。 过了几天之后忽然想到之前新浪邮箱的过滤方式也是如此。...

SIEMENS Solid Edge ST4 SEListCtrlX - ActiveX Remote Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 HttpClients::IE,...

SIEMENS Solid Edge ST4 SEListCtrlX ActiveX Remote Code Execution Vulnerability

This Metasploit module exploits the SEListCtrlX ActiveX installed with the SIEMENS Solid Edge product. The vulnerability exists on several APIs provided by the control, where user supplied input is handled as a memory pointer without proper validation, allowing an attacker to read and corrupt...

HP LoadRunner lrFileIOService ActiveX Remote Code Execution

This Metasploit module exploits a vulnerability on the lrFileIOService ActiveX, as installed with HP LoadRunner 11.50. The vulnerability exists in the WriteFileBinary method where user provided data is used as a memory pointer. This Metasploit module has been tested successfully on IE6-IE9 on...

HP LoadRunner lrFileIOService ActiveX Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 HttpClients::IE,...

HP LoadRunner lrFileIOService ActiveX Remote Code Execution

This module exploits a vulnerability on the lrFileIOService ActiveX, as installed with HP LoadRunner 11.50. The vulnerability exists in the WriteFileBinary method where user provided data is used as a memory pointer. This module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7,...

Siemens Solid Edge ST4 SEListCtrlX ActiveX Remote Code Execution

This module exploits the SEListCtrlX ActiveX installed with the Siemens Solid Edge product. The vulnerability exists on several APIs provided by the control, where user supplied input is handled as a memory pointer without proper validation, allowing an attacker to read and corrupt memory from th...

Mitsubishi MX Component Active-X Code Execution

//Payload is a windows/bindshell that is spawned on LPORT=5500 shellcode =...

Mitsubishi MX ActiveX Component 3 - ActUWzd.dll WzTitle Remote Heap Spray

Mitsubishi MX ActiveX Component 3 - ActUWzd.dll WzTitle Remote Heap Spray //Payload is a windows/bindshell that is spawned on LPORT=5500 shellcode =...

MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access

This module exploits a vulnerability in Microsoft Silverlight. The vulnerability exists on the Initialize method from System.Windows.Browser.ScriptObject, which access memory in an unsafe manner. Since it is accessible for untrusted code user controlled it's possible to dereference arbitrary memo...

Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule EOS def initializeinfo= superupdateinfoinfo, 'Name' = "MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access",...

Novell GroupWise Client gwcls1.dll ActiveX Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 HttpClients::IE,...