Omni-NFS Server Buffer Overflow

This module exploits a stack buffer overflow in Xlink Omni-NFS Server 5.2 When sending a specially crafted nfs packet, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/nfs/xlink/nfsd msf undefinednfsd show actions ...actions... msf undefinednfsd set ACTION...

Novell eDirectory/iMonitor HTTPSTK栈缓冲区溢出漏洞

Novell eDirectory是一个的跨平台的目录服务器。 Novell eDirectory在处理用户请求构造回应时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 Novell的HTTP协议栈（httpstk）没有检查客户端所提供的HTTP Host请求头（如Host: www.host.com）的值。当服务器在准备HTTP重新定向响应调用snprintf时可能会触发这个漏洞，导致以加载httpstk库进程的权限执行任意指令。C++伪代码如下： define HTTPHDRHOSTFIELD 211 char szHttp = "HTTP"; char...

US-CERT Vulnerability Note VU#416092

Vulnerability Note VU416092 Microsoft Internet Explorer VML stack buffer overflow Overview Microsoft Internet Explorer IE fails to properly handle Vector Markup Language tags. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. I...

Ipswitch IMail SMTP Server code execution

Stack buffer overflow on oversized hostname string within characters '@' and ':'...

MaxDB WebDBM Database Parameter Overflow

This module exploits a stack buffer overflow in the MaxDB WebDBM service. By sending a specially-crafted HTTP request that contains an overly long database name. A remote attacker could overflow a buffer and execute arbitrary code on the system with privileges of the wahttp process. This module h...

DSA-1137-1 tiff - several vulnerabilities

Bulletin has no description...

McAfee Subscription Manager Stack Buffer Overflow

This module exploits a flaw in the McAfee Subscription Manager ActiveX control. Due to an unsafe use of vsprintf, it is possible to trigger a stack buffer overflow by passing a large string to one of the COM-exposed routines, such as IsAppExpired. This vulnerability was discovered by Karl Lynn of...

eIQNetworks ESA Topology DELETEDEVICE Overflow

This module exploits a stack buffer overflow in eIQnetworks Enterprise Security Analyzer. During the processing of long arguments to the DELETEDEVICE command in the Topology server, a stack-based buffer overflow occurs. This module has only been tested against ESA v2.1.13. Module Options msf use...

eIQNetworks ESA License Manager LICMGR_ADDLICENSE Overflow

This module exploits a stack buffer overflow in eIQnetworks Enterprise Security Analyzer. During the processing of long arguments to the LICMGRADDLICENSE command, a stack-based buffer overflow occurs. This module has only been tested against ESA v2.1.13. Module Options msf use...

Microsoft Excel 2003 - Hlink Stack Buffer Overflow (SEH)

Microsoft Excel 2003 - Hlink Stack Buffer Overflow SEH !perl "Microsoft Office Excel 2003" Hlink Stack/SEH Overflow Exploit Author: Manuel Santamarina Suarez The vulnerability was discovered by 'kcope'. First click on the link and then on the "Yes" button to cause the stack overflow. fixed...

MS06-025 Microsoft RRAS Service RASMAN Registry Overflow

This module exploits a registry-based stack buffer overflow in the Windows Routing and Remote Access Service. Since the service is hosted inside svchost.exe, a failed exploit attempt can cause other system services to fail as well. A valid username and password is required to exploit this flaw on...

Cesar FTP 0.99g MKD Command Buffer Overflow

This module exploits a stack buffer overflow in the MKD verb in CesarFTP 0.99g. You must have valid credentials to trigger this vulnerability. Also, you only get one chance, so choose your target carefully. Module Options msf use exploit/windows/ftp/cesarftp/mkd msf undefinedmkd show actions...

Novell Messenger Server 2.0 Accept-Language Overflow

This module exploits a stack buffer overflow in Novell GroupWise Messenger Server v2.0. This flaw is triggered by any HTTP request with an Accept-Language header greater than 16 bytes. To overwrite the return address on the stack, we must first pass a memcpy operation that uses pointers we supply...

Mercur Messaging 2005 IMAP Login Buffer Overflow

This module exploits a stack buffer overflow in Atrium Mercur IMAP 5.0 SP3. Since the room for shellcode is small, using the reverse ordinal payloads yields the best results. Module Options msf use exploit/windows/imap/mercur/login msf undefinedlogin show actions ...actions... msf undefinedlogin...

PeerCast URL Handling Buffer Overflow

This module exploits a stack buffer overflow in PeerCast use exploit/windows/http/peercast/url msf undefinedurl show actions ...actions... msf undefinedurl set ACTION msf undefinedurl show options ...show and set options... msf undefinedurl run This module requires Metasploit:...

Microsoft Internet Explorer isComponentInstalled Overflow

This module exploits a stack buffer overflow in Internet Explorer. This bug was patched in Windows 2000 SP4 and Windows XP SP1 according to MSRC. Module Options msf use exploit/windows/browser/ie/iscomponentinstalled msf undefinediscomponentinstalled show actions ...actions... msf...

ZDI-06-002: Adobe Macromedia ShockWave Code Execution

ZDI-06-002: Adobe Macromedia ShockWave Code Execution http://www.zerodayinitiative.com/advisories/ZDI-06-002.html February 23, 2006 -- CVE ID: CVE-2005-3525 -- Affected Vendor: Adobe Macromedia -- Affected Products: Macromedia Shockwave Installer -- TippingPointTM IPS Customer Protection:...

[Full-disclosure] SUSE Security Announcement: CASA remote code execution (SUSE-SA:2006:010)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUSE Security Announcement Package: CASA Announcement ID: SUSE-SA:2006:010 Date: Wed, 22 Feb 2006 12:00:00 +0000 Affected Products: Novell Linux Desktop 9 Open Enterprise Server 1 Vulnerability Type: remote code execution Severity 1-10: 10 SUSE Defaul...

KarjaSoft Sami FTP Server 2.0.1 - Remote Stack Buffer Overflow

!/usr/bin/perl Sami FTP Server v2.0.1 Remote notepad.exe execution PoC by Critical Security research http://www.critical.lt Tested on Windows XP SP2, Windows XP SP0 and even on FreeBSD 6.0-RELEASE Wine 0.9.6 : use Net::FTP; - jo, að tinginys : use Switch; if @ARGV 3 print...

KarjaSoft Sami FTP Server v2.0.2 USER Overflow

This module exploits an unauthenticated stack buffer overflow in KarjaSoft Sami FTP Server version 2.0.2 by sending an overly long USER string during login. The payload is triggered when the administrator opens the application GUI. If the GUI window is open at the time of exploitation, the payloa...