MS11-006 Microsoft Windows CreateSizedDIBSECTION Stack Buffer Overflow

This module exploits a stack-based buffer overflow in the handling of thumbnails within .MIC files and various Office documents. When processing a thumbnail bitmap containing a negative 'biClrUsed' value, a stack-based buffer overflow occurs. This leads to arbitrary code execution. In order to...

Java - 'Statement.invoke()' Trusted Method Chain (Metasploit)

$Id: javatrustedchain.rb 11345 2010-12-15 22:46:22Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Trixbox langChoice PHP Local File Inclusion

$Id: $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ -- coding: utf-8 -- require 'msf/core' class...

Oracle Secure Backup Administration preauth variable command injection

Added: 12/06/2010 CVE: CVE-2010-0906 BID: 41597 OSVDB: 67128 Background Oracle Secure Backup is a centralized tape backup management solution for Oracle Database. Problem A vulnerability in the Administration server allows remote, authenticated attackers to execute arbitrary commands which are...

UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit)

$Id: unrealircd3281backdoor.rb 11227 2010-12-05 15:08:22Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Dradis v2.6 - Tool for sharing information during security testing !

"Dradis is a tool for sharing information during security testing. While plenty of tools exist to help in the different stages of the test, not so many exist to share interesting information captured. When a team of testers is working on the same set of targets, having a common repository of...

Image Viewer CP Gold v5.5 Image2PDF() Buffer Overflow (msf)

Exploit for windows platform in category remote exploits =========================================================== Image Viewer CP Gold v5.5 Image2PDF Buffer Overflow msf =========================================================== Image Viewer CP gold v5.5 Buffer Overflow Found by: bz1p AT...

Microsoft Windows - (Authenticated) User Code Execution (Metasploit)

$Id: psexec.rb 11204 2010-12-02 17:29:26Z todb $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ =begin...

Pandora FMS v3.1 Auth Bypass and Arbitrary File Upload Vulnerability

This module exploits an authentication bypass vulnerability in Pandora FMS v3.1 as disclosed by Juan Galiana Lara. It also integrates with the built-in pandora upload which allows a user to upload arbitrary files to the '/images/' directory. This module was created as an exercise in the Metasploi...

DATAC RealWin SCADA Server SCPC_TXTEVENT Buffer Overflow

$Id: realwinscpctxtevent.rb 11125 2010-11-24 13:44:46Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Adobe RoboHelp Server 8 - Arbitrary File Upload / Execution (Metasploit)

$Id: adoberobohelperauthbypass.rb 11127 2010-11-24 19:35:38Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

America Online ICQ - ActiveX Control Arbitrary File Download and Execute (Metasploit)

$Id: aolicqdownloadagent.rb 11127 2010-11-24 19:35:38Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Novell NetIdentity Agent - XTIERRPCPIPE Named Pipe Buffer Overflow (Metasploit)

$Id: netidentityxtierrpcpipe.rb 11127 2010-11-24 19:35:38Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Oracle 8i - TNS Listener 'ARGUMENTS' Remote Buffer Overflow (Metasploit)

$Id: tnsarguments.rb 11122 2010-11-24 06:10:13Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Oracle 8i - TNS Listener SERVICE_NAME Buffer Overflow (Metasploit)

$Id: tnsservicename.rb 11128 2010-11-24 19:43:49Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

Realtek Media Player Playlist - Remote Buffer Overflow (Metasploit)

$Id: realtekplaylist.rb 11127 2010-11-24 19:35:38Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Symantec Altiris Deployment Solution - ActiveX Control Arbitrary File Download and Execute (Metasploit)

$Id: symantecaltirisdeploymentdownloadandinstall.rb 11127 2010-11-24 19:35:38Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Symantec AppStream LaunchObj - ActiveX Control Arbitrary File Download and Execute (Metasploit)

$Id: symantecappstreamunsafe.rb 11127 2010-11-24 19:35:38Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Hewlett-Packard (HP) Power Manager Administration - Remote Buffer Overflow (Metasploit)

$Id: hppowermanagerlogin.rb 11127 2010-11-24 19:35:38Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) - SCPC_TXTEVENT Buffer Overflow (Metasploit)

$Id: realwinscpctxtevent.rb 11125 2010-11-24 13:44:46Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...