PCMan FTP Server 2.07 - 'PASS' Remote Buffer Overflow

!/usr/bin/python2.7 -- coding: utf-8 -- """ PCMAN FTPD 2.07 PASS Command Buffer Overflow Author: Ottomatik Date: 2013-07-31 Software : PCMAN FTPD Version : 2.07 Tested On: Windows 7 SP1 - French; Description: The PASS Command is vulnerable to a buffer overflow; Other commads may be vulnerable; ""...

Chasys Draw IES Buffer Overflow

This module exploits a buffer overflow vulnerability found in Chasys Draw IES version 4.10.01. The vulnerability exists in the module fltBMP.dll, while parsing BMP files, where the ReadFile function is used to store user provided data on the stack in an insecure way. It results in arbitrary code...

Buffer overflow

Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to cause a denial of service system hang via a crafted application that leverages...

Design/Logic Flaw

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain...

ERS Viewer 2013 ERS File Handling Buffer Overflow

Exploit for windows platform in category local exploits require 'msf/core' class Metasploit3 "ERS Viewer 2013 ERS File Handling Buffer Overflow", 'Description' = %q This module exploits a buffer overflow vulnerability found in ERS Viewer 2013. The vulnerability exists in the module ermapperu.dll,...

ERS Viewer 2013 ERS File Handling Buffer Overflow

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "ERS Viewer 2013 E...

FileCOPA 7.01 Denial Of Service

!/usr/bin/python Exploit Title: FileCOPA V7.01 HTTP POST Denial Of Service Date: 2013/7/1 Exploit Author: Chako Vendor Homepage: http://www.filecopa.com/ Software Download Link: http://www.filecopa.com/download.php Version: V7.01 Tested on: Windows 7 SP1 English import socket import sys PAYLOAD =...

Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation

Exploit for windows platform in category local exploits require 'msf/core' require 'rex' require 'msf/core/post/common' require 'msf/core/post/windows/priv' require 'msf/core/post/windows/process' class Metasploit3 'Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation', 'Description' = %q...

Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...

PCMan's FTP Server 2.0 - Remote Buffer Overflow Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python Exploit Title: PCMan's FTP Server 2.0 Remote Buffer Overflow Exploit Date: 2013/6/26 Exploit Author: Chako Vendor Homepage: http://pcman.openfoundry.org/ Software Download Link: https://files.secureserver.net/1sMltFOsytirTG...

Novell Client 2 SP3 - 'nicm.sys' Local Privilege Escalation (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...

Novell Client 2 SP3 nicm.sys Local Privilege Escalation

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...

Mozilla Firefox 14.01 Memory Exhaustion DoS Exploit

--------------------------------------------------- Mozilla Firefox 14.01 Memory Exhaustion DoS Exploit --------------------------------------------------- Credit: Jean Pascal Pereira [email protected] Description: Mozilla Firefox is prone to a memory exhaustion vulnerability. The issue has been...

CVE-2013-3958

The login implementation in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, has a hardcoded account, which makes it easier for remote attackers to obtain access via an unspecified request...

Code injection

The Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, exhibits different behavior for NetBIOS user names depending on whether the user account exists, which allows remote authenticated users to enumerate account names via crafted U...

CVE-2013-3957

SQL injection vulnerability in the login screen in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

MS13-009 Microsoft Internet Explorer COALineDashStyleArray Integer Overflow

Exploit for windows platform in category remote exploits require 'msf/core' class Metasploit3 HttpClients::IE, :uaminver = "8.0", :uamaxver = "8.0", :javascript = true, :osname = OperatingSystems::WINDOWS, :rank = Rank def initializeinfo= superupdateinfoinfo, 'Name' = "MS13-009 Microsoft Internet...

Dedecms v57 sp1 plus/download.php SQL注入漏洞

起因是全局变量$GLOBALS可以被任意修改，随便看了下，漏洞一堆，我只找了一处。 codeinclude/dedesql.class.php ifisset$GLOBALS'arrs1' $v1 = $v2 = ''; for$i=0;isset$arrs1$i;$i++ $v1 .= chr$arrs1$i; for$i=0;isset$arrs2$i;$i++ $v2 .= chr$arrs2$i; //解码ascii $GLOBALS$v1 .= $v2; //注意这里不是覆盖，是+ function SetQuery$sql $prefix="@"; $sql =...

AdobeCollabSync Buffer Overflow Adobe Reader X Sandbox Bypass

Exploit for windows platform in category local exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core'...

AdobeCollabSync - Local Buffer Overflow / Adobe Reader X Sandbox Bypass (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/windows/registry'...