{PRL} Microsoft Windows Outlook Express and Windows Mail Integer Overflow

Application: Microsoft Outlook Express Microsoft Windows Mail Platforms: Windows 2000 Windows XP Windows Vista Windows server 2003 Windows Server 2008 SR2 Exploitation: Remote Exploitable CVE Number: CVE-2010-0816 Discover Date: 2009-09-11 Author: Francis Provencher Protek Research Lab's Website:...

{PRL} Microsoft Windows Outlook Express and Windows Mail Integer Overflow

Application: Microsoft Outlook Express Microsoft Windows Mail Platforms: Windows 2000 Windows XP Windows Vista Windows server 2003 Windows Server 2008 SR2 Exploitation: Remote Exploitable CVE Number: CVE-2010-0816 Discover Date: 2009-09-11 Author: Francis Provencher Protek Research Lab's Website:...

Multiple Cross-site Scripting Vulnerabilities in GetSimple CMS

High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in GetSimple CMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting vulnerability in GetSimple CMS: CVE-2010-5052 The vulnerability exists due to input sanitation error in the "val"...

ESET Smart Security 4.2 and NOD32 AntiVirus 4.2 (x86x64) - LZH archive parsing (PoC)

ESET Smart Security 4.2 and NOD32 AntiVirus 4.2 x86x64 - LZH archive parsing PoC ESET Smart Security 4.2 and NOD32 Antivirus 4.2 x32-x64 LZH archive parsing PoC exploit. Scanning of malicious file causes heap corruption in context of the service process ekrn.exe. See Dr. Watson log drwtsn32.log f...

ESET Smart Security 4.2 and NOD32 AntiVirus 4.2 (x86/x64) - LZH archive parsing (PoC)

ESET Smart Security 4.2 and NOD32 Antivirus 4.2 x32-x64 LZH archive parsing PoC exploit. Scanning of malicious file causes heap corruption in context of the service process ekrn.exe. See Dr. Watson log drwtsn32.log for details. USAGE: python esetlzh.py TEST.LZH will be created c 2010 eSage Lab...

Multiple Vulnerabilities in LiSK CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in LiSK CMS which could be exploited to perform cross-site scripting attacks and execute arbitrary SQL commands in applications database. 1 Cross-site scripting XSS vulnerability in LiSK CMS: CVE-2010-2013 The...

Wing FTP Server 3.4.3 Directory Traversal

+------------------------------------------------------------------------+ | ....... | | ..''xxxxxxxxxxxxxxx'... | | ..'xxxxxxxxxxxxxxxxxxxxxxxxxxx.. | | ..'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'. | | .'xxxxxxxxxxxxxxxxxxxxxxxxxxxx'''.......'. | | .'xxxxxxxxxxxxxxxxxxxxx''...... ... .. | |...

Seattle Lab Mail (SLmail) 5.5 - POP3 'PASS' Remote Buffer Overflow (Metasploit)

$Id: seattlelabpass.rb 9179 2010-04-30 08:40:19Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

Cross-site Scripting (XSS) Vulnerability in Advanced Poll

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Advanced Poll which could be exploited to perform cross-site scripting XSS attacks. 1 Cross-site scripting vulnerability in Advanced Poll: CVE-2010-2003 An input sanitation error was found in the "mysqlhost" parameter in...

EDraw Flowchart ActiveX Control 2.3 (EDImage.ocx) DoS Exploit (IE)

Exploit for windows platform in category dos / poc ========================================================================= EDraw Flowchart ActiveX Control 2.3 EDImage.ocx Remote DoS Exploit IE ========================================================================= EDraw Flowchart ActiveX...

EDraw Flowchart ActiveX Control 2.3 - EDImage.ocx Remote Denial of Service (IE)

EDraw Flowchart ActiveX Control 2.3 - EDImage.ocx Remote Denial of Service IE EDraw Flowchart ActiveX Control 2.3 EDImage.ocx Remote DoS Exploit IE Vendor: EdrawSoft - http://www.edrawsoft.com Platform Used: MS Win XP Pro SP3 en / IE 8.0 CompanyName EDrawSoft FileDescription EDraw Flowchart Activ...

EDraw Flowchart ActiveX Control 2.3 (EDImage.ocx) Remote DoS Exploit (IE)

Summary Do you want to learn how to draw? Now you can online! Learn how to draw like a local application with Edraw Flowchart ActiveX Control that lets you quickly build basic flowcharts, organizational charts, business charts, hr diagram, work flow, programming flowchart and network diagrams...

EDraw Flowchart ActiveX Control 2.3 - 'EDImage.ocx' Remote Denial of Service (IE)

EDraw Flowchart ActiveX Control 2.3 EDImage.ocx Remote DoS Exploit IE Vendor: EdrawSoft - http://www.edrawsoft.com Platform Used: MS Win XP Pro SP3 en / IE 8.0 CompanyName EDrawSoft FileDescription EDraw Flowchart ActiveX Control Module FileVersion 2, 3, 0, 6 InternalName EDrawSoft LegalCopyright...

[slackware-security] kdebase-workspace

New kdebase-workspace packages are available for Slackware 13.0 and -current to fix a security issue with KDM. Here are the details from the Slackware 13.0 ChangeLog: patches/packages/kdebase-workspace-4.2.4-i486-2slack13.0.txz: Rebuilt. Patched a security issue with KDM. For more information, se...

MultiThreaded HTTP Server v1.1 Directory Traversal

Exploit for multiple platform in category remote exploits ================================================== MultiThreaded HTTP Server v1.1 Directory Traversal ================================================== Exploit Title: MultiThreaded HTTP Server v1.1 Directory Traversal Date: Apr 21, 2010...

AVTECH Software (AVC781Viewer.dll) ActiveX Multiple Remote Vulnerabilities

Summary AVTECH Software, a private corporation founded in 1988, is a computer software and hardware manufacturer specializing in providing Windows NT/2K/XP/2K3 products to monitor multi-OS computers and network issues throughout a department or an entire enterprise. Once issues or events occur,...

Multiple vulnerabilities in Zikula Application Framework

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Zikula Application Framework, which can be exploited to perform cross-site scripting XSS and cross-site request forgery CSRF attacks. 1 XSRF CSRF in Zikula Application Framework: CVE-2010-1732 The vulnerability...

Aladdin eToken PKI Client 4.5 - Virtual File Handling Memory Corruption (PoC)

Aladdin eToken PKI Client 4.5 - Virtual File Handling Memory Corruption PoC !/usr/bin/perl -w Title: Aladdin eToken PKI Client v4.5 Virtual File Handling Unspecified Memory Corruption PoC Summary: The eToken PKI Client is the software that enables eToken USB operation and the implementation of...

Multiple vulnerabilities in AdaptCMS Lite

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in AdaptCMS Lite which could be exploited to perform cross-site request forgery and cross-site scripting attacks. 1 Cross-site request forgery CSRF in AdaptCMS Lite The vulnerability exists due to insufficient...

[slackware-security] seamonkey

New seamonkey packages are available for Slackware 12.2, 13.0, and -current to fix security issues. Here are the details from the Slackware 13.0 ChangeLog: patches/packages/seamonkey-2.0.4-i486-1slack13.0.txz: Upgraded. This release fixes some more security vulnerabilities. For more information,...