469 matches found
Security Updates for Microsoft Office Products (January 2019)
The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitrary code in the context of the current...
KB4480961: Windows 10 Version 1607 and Windows Server 2016 January 2019 Security Update
The remote Windows host is missing security update 4480961. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtai...
PT-2019-1121
Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 9 through 11 Microsoft Office affected versions not specified Microsoft Office Word Viewer affected versions not specified Microsoft Excel Viewer affected versions not specified Office 365 ProPlus affected versions...
CVE-2019-0541
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka “MSHTML Engine Remote Code Execution Vulnerability.” This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer,...
KB4480962: Windows 10 January 2019 Security Update
The remote Windows host is missing security update 4480962. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtai...
KLA11397 Multiple vulnerabilities in Microsoft Browsers
Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges. Below is a complete list of vulnerabilities: 1. A memory corruption vulnerability in Microsoft Edge can be exploited remotely via specially...
Microsoft Windows 10 - WLDP/MSHTML CLSID UMCI Bypass Exploit
Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1328 Windows: WLDP/MSHTML CLSID UMCI Bypass Platform: Windows 10 S thought should be anything with UMCI Class: Security Feature Bypass Summary: The enlightened lockdown policy chec...
Microsoft Windows Device Guard Local Security Bypass Vulnerability(CVE-2017-11823)
Windows: WLDP/MSHTML CLSID UMCI Bypass Platform: Windows 10 S thought should be anything with UMCI Class: Security Feature Bypass Summary: The enlightened lockdown policy check for COM Class instantiation can be bypassed in MSHTML hosts leading to arbitrary code execution on a system with UMCI...
Microsoft Windows 10 - WLDP/MSHTML CLSID UMCI Bypass
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1328 Windows: WLDP/MSHTML CLSID UMCI Bypass Platform: Windows 10 S thought should be anything with UMCI Class: Security Feature Bypass Summary: The enlightened lockdown policy check for COM Class instantiation can be bypassed in...
Microsoft Internet Explorer 111 CMarkup::DestroySplayTree Use-After-Free
body background-color:black; font-color:red; ; / Exploit Title: Internet Explorer 11 CMarkup::DestroySplayTree Use-After-Free Google Dork: n/a Date: 03.05.2017 Exploit Author: Marcin Ressel TT: @resselm Vendor Homepage: www.microsoft.com Software Link: n/a Version: 11.0.9600.18638 Tested on:...
Microsoft Internet Explorer 11 - CMarkup::DestroySplayTree Use-After-Free
Microsoft Internet Explorer 11 - CMarkup::DestroySplayTree Use-After-Free body background-color:black; font-color:red; ; / Exploit Title: Internet Explorer 11 CMarkup::DestroySplayTree Use-After-Free Google Dork: n/a Date: 03.05.2017 Exploit Author: Marcin Ressel TT: @resselm Vendor Homepage:...
Microsoft IE: textarea.defaultValue memory disclosure (CVE-2017-0059)
There is an use-after-free bug in IE which can lead to info leak / memory disclosure. The bug was confirmed on Internet Explorer version 11.0.9600.18537 update version 11.0.38 PoC: function run var textarea = document.getElementById"textarea"; var frame = document.createElement"iframe";...
Microsoft Internet Explorer - textarea.defaultValue Memory Disclosure (MS17-006) Exploit
Exploit for windows platform in category dos / poc function run var textarea = document.getElementById"textarea"; var frame = document.createElement"iframe"; textarea.appendChildframe; frame.contentDocument.onreadystatechange = eventhandler; form.reset; function eventhandler...
Microsoft Edge / Internet Explorer HandleColumnBreakOnColumnSpanningElement Type Confusion Exploit
Microsoft Edge and Internet Explorer suffer from a type confusion in HandleColumnBreakOnColumnSpanningElement. Microsoft Edge and IE: Type confusion in HandleColumnBreakOnColumnSpanningElement CVE-2017-0037 PoC: .class1 float: left; column-count: 5; .class2 column-span: all; columns: 1px; table...
Microsoft Internet Explorer 11 - MSHTML CPasteCommand::ConvertBitmaptoPng Heap Buffer Overflow (MS14-056)
Microsoft Internet Explorer 11 - MSHTML CPasteCommand::ConvertBitmaptoPng Heap Buffer Overflow MS14-056 Security Settings - Choose a zone - Scripting should prevent websites from programmatically copy/pasting an image. Disabling execution of scripts on web-pages altogether will have the same...
Microsoft Internet Explorer 11 - MSHTML CPasteCommand::ConvertBitmaptoPng Heap Buffer Overflow (MS14-056)
Security Settings - Choose a zone - Scripting should prevent websites from programmatically copy/pasting an image. Disabling execution of scripts on web-pages altogether will have the same effect. Please note that neither option prevents a website from social engineering the user into typing a...
Microsoft Internet Explorer 11 MSHTML - CSpliceTreeEngine::RemoveSplice Use-After-Free (MS14-035)
Exploit for windows platform in category dos / poc document.addEventListener"DOMNodeRemoved", function document.open; // free // attempt to modify freed memory here // because it will be reused after th...
Microsoft Internet Explorer 11 - MSHTML CSpliceTreeEngine::RemoveSplice Use-After-Free (MS14-035)
document.addEventListener"DOMNodeRemoved", function document.open; // free // attempt to modify freed memory here // because it will be reused after this function returns. , true; window.onload = function docume...
Microsoft Internet Explorer 9 MSHTML - CMarkup::ReloadInCompatView Use-After-Free Exploit
Exploit for windows platform in category dos / poc document.designMode = "on"; !-- Details By switching the a document's designMode property to on in a deferred script, MSIE 9 can be made to reload a web page using CMarkup::ReloadInCompatView. This method calls CDoc::CompatViewRefresh, whi...
Microsoft Internet Explorer 9 - MSHTML CMarkup::ReloadInCompatView Use-After-Free
document.designMode = "on"; !-- Details By switching the a document's designMode property to on in a deferred script, MSIE 9 can be made to reload a web page using CMarkup::ReloadInCompatView. This method calls CDoc::CompatViewRefresh, which indirectly calls...