Novell ZENworks Configuration Management Remote Execution

This module exploits a code execution flaw in Novell ZENworks Configuration Management 10.2.0. By exploiting the UploadServlet, an attacker can upload a malicious file outside of the TEMP directory and then make a secondary request that allows for arbitrary code execution. Module Options msf use...

Novell ZENworks Configuration Management Preboot Service 0x21 Buffer Overflow

This module exploits a remote buffer overflow in the ZENworks Configuration Management 10 SP2. The vulnerability exists in the Preboot service and can be triggered by sending a specially crafted packet with the opcode 0x21 PROXYCMDFTPFILE to port 998/TCP. The module has been successfully tested o...

Shadow Stream Recorder 3.0.1.7 Buffer Overflow

This module exploits a buffer overflow in Shadow Stream Recorder 3.0.1.7. Using the application to open a specially crafted asx file, a buffer overflow may occur to allow arbitrary code execution under the context of the user. Module Options msf use...

UoW IMAPd Server - LSUB Buffer Overflow (Metasploit)

$Id: imapuwlsub.rb 8932 2010-03-26 19:00:23Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

UltraISO CCD File Parsing Buffer Overflow

$Id: ultraisoccd.rb 8900 2010-03-24 19:35:29Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Orbital Viewer buffer overflow

Added: 03/24/2010 CVE: CVE-2010-0688 BID: 38436 OSVDB: 62580 Background Orbital Viewer is a program for viewing atomic and molecular orbitals. Problem A buffer overflow vulnerability in Orbital Viewer allows command execution when a user opens a specially crafted .orb file. Resolution Do not open...

Orbital Viewer buffer overflow

Added: 03/24/2010 CVE: CVE-2010-0688 BID: 38436 OSVDB: 62580 Background Orbital Viewer is a program for viewing atomic and molecular orbitals. Problem A buffer overflow vulnerability in Orbital Viewer allows command execution when a user opens a specially crafted .orb file. Resolution Do not open...

Adobe Reader Libtiff TIFFFetchShortPair Stack Buffer Overflow

Added: 03/22/2010 CVE: CVE-2010-0188 BID: 38195 OSVDB: 62526 Background Adobe Reader is free software for viewing PDF documents. Problem A stack buffer overflow vulnerability allows command execution when a user opens a PDF file with an embedded TIFF image that has one of several fields encoded a...

VariCAD 2010-2.05 EN (DWB File) Stack Buffer Overflow

This module exploits a stack-based buffer overflow in VariCAD 2010-2.05 EN. An attacker must send the file to victim and the victim must open the file. Module Options msf use exploit/windows/fileformat/varicad/dwb msf undefineddwb show actions ...actions... msf undefineddwb set ACTION msf...

Adobe Acrobat Bundled LibTIFF Integer Overflow

$Id: adobelibtiff.rb 8833 2010-03-16 18:06:50Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

QuickZip 4.60.019 (Windows XP SP3) - Local Stack Buffer Overflow

Exploit Title : QuickZip 4.60.019 Stack BOF - XP SP3 OSVDB-ID : 62781 Date : March 2nd 2010 Author : corelanc0d3r Bug found by : corelanc0d3r Software Link : http://www.quickzip.org/downloads.html Version : 4.60.019 OS : Windows Tested on : XP SP3 En VirtualBox - offset is 297. You may have to...

Novell eDirectory 8.8.5 - DHost Weak Session Cookie Session Hijacking (Metasploit)

source: https://www.securityfocus.com/bid/38782/info Novell eDirectory is prone to a session-hijacking vulnerability. An attacker can exploit this issue to gain access to the affected application. Novell eDirectory 8.8.5 is vulnerable; other versions may also be affected. $Id:...

RhinoSoft Serv-U FTP Server - Session Cookie Buffer Overflow (Metasploit)

$Id: servusessioncookie.rb 8762 2010-03-10 05:58:01Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption

This module exploits a memory corruption vulnerability in the Internet Explorer Tabular Data ActiveX Control. Microsoft reports that version 5.01 and 6 of Internet Explorer are vulnerable. By specifying a long value as the "DataURL" parameter to this control, it is possible to write a NUL byte...

WebEx UCF atucfobj.dll ActiveX NewObject Method Buffer Overflow

$Id: webexucfnewobject.rb 8712 2010-03-04 17:41:26Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Microsoft Office PowerPoint Viewer TextBytesAtom Record Buffer Overflow

Added: 03/04/2010 CVE: CVE-2010-0033 BID: 38107 OSVDB: 62241 Background Microsoft PowerPoint Viewer 2003 is a free tool which allows viewing of Microsoft PowerPoint presentations without requiring Microsoft PowerPoint itself. Problem A stack overflow vulnerability in the handling of TextBytesAtom...

Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption

$Id: ms09043owcmsdso.rb 8686 2010-03-02 07:50:25Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

IE Winhlp32.exe MsgBox F1

$Id: iewinhlp32.rb 8688 2010-03-02 12:23:17Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

JBoss JMX Console Deployer Upload and Execute

$Id: jbossmaindeployer.rb 8575 2010-02-21 01:44:34Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Qbik WinGate WWW Proxy Server URL Processing Overflow

$Id: qbikwingatewwwproxy.rb 8547 2010-02-18 15:58:26Z patrickw $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...