Symantec Endpoint Protection 11.x, 12.x - Kernel Pool Overflow

No description provided by source. Symantec Endpoint Protection 11.x, 12.x - Kernel Pool Overflow http://www.offensive-security.com Tested on Windows 7 http://www.offensive-security.com/vulndev/symantec-endpoint-protection-0day/ Authors: Matteo 'ryujin' Memelli & Alexandru 'sickness' Uifalvi at...

Symantec Endpoint Protection 11.x/12.x - Kernel Pool Overflow / Local Privilege Escalation

Symantec Endpoint Protection 11.x, 12.x - Kernel Pool Overflow http://www.offensive-security.com Tested on Windows 7 http://www.offensive-security.com/vulndev/symantec-endpoint-protection-0day/ Authors: Matteo 'ryujin' Memelli & Alexandru 'sickness' Uifalvi offensive-security.com from ctypes impo...

winwebmail server 3.8.1.6 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: WinWebMail Server Version: 3.8.1.6 Vendor Site: http://www.winwebmail.net Software Download: http://www.winwebmail.net/email-server-download.html Timeline: 29 May 2012: Vulnerability reported...

smartermail free 9.2 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: SmarterMail Version: Free 9.2 Vendor Site: http://www.smartertools.com Software Download: http://smartertools.com/smartermail/mail-server-software.aspx Timeline: 29 May 2012: Vulnerability...

Audacity <= 1.2 (.gro File) Universal BOF Exploit (egg hunter)

No description provided by source. !/usr/bin/env python Audacity = 1.2 .gro universal buffer overflow exploit Author: mrme Download: http://audacity.sourceforge.net/download/ Tested on Wind0ws XP sp3 & Vist@ Greetz fly to Muts and the offensive-security team also to my wonderful partner Vanessa F...

Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 4.1.X Bypass

Exploit for windows platform in category remote exploits function strtointstr return str.charCodeAt10x10000 + str.charCodeAt0; var free = "EEEE"; while free.length 500 free += free; var string1 = "AAAA"; while string1.length 500 string1 += string1; var string2 = "BBBB"; while string2.length 500...

manageengine service desk plus 8.1 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: ManageEngine Service Desk Plus Windows standard Version: 8.1 Vendor Site: http://www.manageengine.com Software Download: http://www.manageengine.com/products/service-desk/download.html...

Joomla Component com_jfuploader < 2.12 Remote File Upload

No description provided by source. ========================================================================================================= Type : Joomla Component comjfuploader 2.12 Remote File Upload Author : Setr0nix Home : www.Setr0nix.com Contact : [email protected]...

dreamMail e-mail client 4.6.9.2 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: dreamMail e-mail client Version: 4.6.9.2 Vendor Site: http://www.dreammail.eu Software Download: http://www.dreammail.eu/intl/en/download.html Tested on: Windows XP SP3 Eng. Tested on: Window...

QuickZip 4.60.019 Stack BOF - XP SP3

No description provided by source. Exploit Title : QuickZip 4.60.019 Stack BOF - XP SP3 OSVDB-ID : 62781 Date : March 2nd 2010 Author : corelanc0d3r Bug found by : corelanc0d3r Software Link : http://www.quickzip.org/downloads.html Version : 4.60.019 OS : Windows Tested on : XP SP3 En VirtualBox ...

Solarwinds Storage Manager 5.1.0 - Remote SYSTEM SQL Injection Exploit

No description provided by source. !/usr/bin/python Exploit Title: Solarwinds Storage Manager 5.1.0 Remote SYSTEM SQL Injection Exploit Date: May 2nd 2012 Author: muts Version: SolarWinds Storage Manager 5.1.0 Tested on: Windows 2003 Archive Url :...

escon supportportal pro 3.0 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: ESCON SupportPortal Pro Version: 3.0 Vendor Site: http://www.e-supportportal.com Software Download: http://www.e-supportportal.com/download.html Timeline: 29 May 2012: Vulnerability reported ...

Mercur Messaging 2005 <= SP4 - IMAP Remote Exploit (egghunter mod)

No description provided by source. !/usr/bin/python Mercur Messaging 2005 SP3 IMAP service - Egghunter mod [email protected] http://www.offensive-security.com Original exploit by Winny Thomas Thanks Thomas, this code really came in handy ! VMWare seems to alter the stack a bit as the...

eM Client e-mail client 5.0.18025.0 - Stored XSS vulnerability

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Date: 22-08-2013 Product: eM Client for Windows Version: 5.0.18025.0 previous versions and other platforms may be vulnerable Vendor Site: http://www.emclient.com/ Software Download:...

wordpress postie plugin 1.4.3 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: Postie Version: 1.4.3 Software Download: http://wordpress.org/extend/plugins/postie/ Timeline: 29 May 2012: Vulnerability reported to CERT 30 May 2012: Response received from CERT with...

Internet Explorer 8 Bypass

function strtointstr return str.charCodeAt10x10000 + str.charCodeAt0; var free = "EEEE"; while free.length 500 free += free; var string1 = "AAAA"; while string1.length 500 string1 += string1; var string2 = "BBBB"; while string2.length 500 string2 += string2; var fr = new Array; var al = new Array...

Quick TFTP Pro 2.1 - Remote SEH Overflow Exploit (0day)

No description provided by source. !/usr/bin/python Quick TFTP Pro 2.1 SEH Overflow 0day Tested on Windows XP SP2. Coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/quick-tftp-poc.py.txt bt quickftp.py Quick TFTP Pro 2.1 SEH Overflow 0day...

Wordpress Plugin ThreeWP Email Reflector 1.13 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: ThreeWP Email Reflector Version: 1.13 Plugin Site: http://mindreantre.se/ Software Download: http://wordpress.org/extend/plugins/threewp-email-reflector/installation/ Timeline: 29 May 2012:...

[Kali Linux 1.0.6] with LUKS Self-Destruction Feature

Offensive Security, the creator of the famous BackTrack Linux operating system, has announced on January 9 that a new maintenance release for its Kali Linux distribution is now available for download. Kali Linux 1.0.6 is the first release to introduce an amazing feature called "emergency...

NSA Director to Retain Cyber Command Role

Since its inception in 2009, the U.S. Cyber Command has been run by the director of the National Security Agency. The two organizations are intertwined and even share the same space in Maryland. The continuous leaks of NSA documents this year has led some politicians and critics to argue that the...