CVE-2008-3910

dns2tcp before 0.4.1 does not properly handle negative values in a certain length field in the input argument to the 1 dnssimpledecode or 2 dnsdecode function, which allows remote attackers to overwrite a buffer and have unspecified other impact...

Youngzsoft CMailServer 5.4.6 - 'CMailCOM.dll' Remote Overwrite (SEH)

0 strUID = arrStringi objPOP3.MoveToFolder strUID ' ---------------- bof ... By attaching olly to the w3wp.exe sub-process you will see the usual dump with ecx and eip owned, with a buffer of approxymately 13000 chars. Exploitation is post-auth but you can have a user account by sim...

Code injection

The NNSTAT aka SYSPROC.NNSTAT procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter...

Apple QuickTime 7.27.3 - RTSP Response Remote Overwrite (SEH)

Apple QuickTime 7.27.3 - RTSP Response Remote Overwrite SEH !/usr/bin/python Apple QuickTime 7.3 RTSP Response 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on: Apple QuickTime Player 7.3 / XP SP2 Polish Details:.. RTSP Content-Type: A 995 + B 4096\r\n...

Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH)

!/usr/bin/python Apple QuickTime 7.3 RTSP Response 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on: Apple QuickTime Player 7.3 / XP SP2 Polish Details:.. RTSP Content-Type: A 995 + B 4096\r\n 0x41414141 Pointer to next SEH record 0x42424242 SE handler...

star directory traversal vulnerability

Directory traversal vulnerability in extract.c in star before 1.5a84 allows user-assisted remote attackers to overwrite arbitrary files via certain //.. slash slash dot dot sequences in directory symlinks in a TAR archive...

tar directory traversal vulnerability

Directory traversal vulnerability in the containsdotdot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. slash slash dot dot sequences in directory symlinks in a TAR archive...

SAP DB 7.4 - WebTools Remote Overwrite (SEH)

SAP DB 7.4 - WebTools Remote Overwrite SEH / Dreatica-FXP crew ---------------------------------------- Target : SAP DB 7.4 WebTools Site : http://www.sapdb.org Found by : NGSSoftware Insight Security Research ---------------------------------------- Exploit : SAP DB 7.4 WebTools Remote SEH...

SAP DB 7.4 - WebTools Remote Overwrite (SEH)

/ Dreatica-FXP crew ---------------------------------------- Target : SAP DB 7.4 WebTools Site : http://www.sapdb.org Found by : NGSSoftware Insight Security Research ---------------------------------------- Exploit : SAP DB 7.4 WebTools Remote SEH overwrite exploit Exploit date : 07.07.2007...

ViRC 2.0 - JOIN Response Remote Overwrite (SEH)

ViRC 2.0 - JOIN Response Remote Overwrite SEH !/usr/bin/python ViRC 2.0 'JOIN Response' 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on Visual IRC 2.0 / 2k SP4 Polish Shellcode type: Windows Execute Command calc.exe How stuff works ? .. ViRC ----- ..JOIN...

ViRC 2.0 - JOIN Response Remote Overwrite (SEH)

!/usr/bin/python ViRC 2.0 'JOIN Response' 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on Visual IRC 2.0 / 2k SP4 Polish Shellcode type: Windows Execute Command calc.exe How stuff works ? .. ViRC ----- ..JOIN.. ------------- exploittunnel...

TEC-IT TBarCode OCX ActiveX Remote Arbitrary File Overwrite Exploit

No description provided by source. pre codespan style="font: 10pt Courier New;"span class="general1-symbol"----------------------------------------------------------------------------------------------------------------- bTEC-IT TBarCode OCX ActiveX Control TBarCode7.ocx v. 7.0.2.3524 "SaveImage"...

Eudora 7.1.0.9 - IMAP FLAGS Remote Overwrite (SEH)

Eudora 7.1.0.9 - IMAP FLAGS Remote Overwrite SEH !/usr/bin/python Eudora 7.1 IMAP FLAGS 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on Eudora 7.1.0.9 / 2k SP4 Polish Shellcode type: Windows Execute Command calc.exe Details:.. Eudora -- SELECT IMBOX...

Eudora 7.1.0.9 - IMAP FLAGS Remote Overwrite (SEH)

!/usr/bin/python Eudora 7.1 IMAP FLAGS 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on Eudora 7.1.0.9 / 2k SP4 Polish Shellcode type: Windows Execute Command calc.exe Details:.. Eudora -- SELECT IMBOX --------- IMAP server Eudora -- FLAGS ..AAAA... ----...

FutureSoft TFTP Server 2000 - Remote Overwrite (SEH)

FutureSoft TFTP Server 2000 - Remote Overwrite SEH !/usr/bin/perl =============================================================================================== FutureSoft TFTP Server 2000 Remote SEH Overwrite Exploit By Umesh Wanve...

FutureSoft TFTP Server 2000 - Remote Overwrite (SEH)

!/usr/bin/perl =============================================================================================== FutureSoft TFTP Server 2000 Remote SEH Overwrite Exploit By Umesh Wanve =============================================================================================== Date : 22-03-2007...

DEBIAN-CVE-2007-0898

Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to overwrite arbitrary files via a .. dot dot in the id MIME header parameter in a multi-part message...

CVE-2006-2366

ircpio.c in libopenobex for ircp 1.2, when ircp is run with the -r option, does not prompt the user when overwriting files, which allows user-assisted remote attackers to overwrite dangerous files via an arbitrary destination file name in an OBEX File Transfer session...

CVE-2006-0890

Directory traversal vulnerability in SpeedProject Squeez 5.1, as used in 1 ZipStar 5.1 and 2 SpeedCommander 11.01.4450, allows remote attackers to overwrite arbitrary files via unspecified manipulations in a 1 JAR or 2 ZIP archive...

DEBIAN-CVE-2004-1487

wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences...