2681 matches found
Microsoft Windows图形设备接口附加库拒绝服务
No description provided by source. !/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to...
CVE-2006-6125: Improper Restriction of Operations within the Bounds of a Memory Buffer
Heap-based buffer overflow in the wireless driver WG311ND5.SYS 2.3.1.10 for NetGear WG311v1 wireless adapter allows remote attackers to execute arbitrary code via an 802.11 management frame with a long SSID...
NetGear wireless driver fails to properly process specially-crafted 802.11 management frames
Overview A buffer overflow vulnerability exists in the Netgear WG311ND5.SYS wireless driver. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code, or cause a denial-of-service condition. Description The WG311ND5.SYS driver is a wireless 802.11g device driv...
CVE-2006-6059
Buffer overflow in MA521nd5.SYS driver 5.148.724.2003 for NetGear MA521 PCMCIA adapter allows remote attackers to execute arbitrary code via 1 beacon or 2 probe 802.11 frame responses with an long supported rates information element. NOTE: this issue was reported as a "memory corruption" error, b...
CVE-2006-6059
The CVE-2006-6059 issue affects Netgear MA521 PCMCIA adapter’s MA521nd5.SYS driver (version 5.148.724.2003). A buffer overflow in the driver can be triggered by 802.11 management frames (beacon or probe responses with long supported rates element), allowing remote attackers to execute arbitrary c...
CVE-2006-6059: Undefined Security Weakness
Buffer overflow in MA521nd5.SYS driver 5.148.724.2003 for NetGear MA521 PCMCIA adapter allows remote attackers to execute arbitrary code via 1 beacon or 2 probe 802.11 frame responses with an long supported rates information element. NOTE: this issue was reported as a "memory corruption" error, b...
TORQUE: Insecure temporary file creation
Background TORQUE is a resource manager providing control over batch jobs and distributed compute nodes. Description TORQUE creates temporary files with predictable names. Please note that the TORQUE package shipped in Gentoo Portage is not vulnerable in the default configuration. Only systems wi...
CVE-2006-5972: Undefined Security Weakness
Stack-based buffer overflow in WG111v2.SYS in NetGear WG111v2 wireless adapter USB allows remote attackers to execute arbitrary code via a long 802.11 beacon request...
CVE-2006-5882
Stack-based buffer overflow in the Broadcom BCMWL5.SYS wireless device driver 3.50.21.10, as used in Cisco Linksys WPC300N Wireless-N Notebook Adapter before 4.100.15.5 and other products, allows remote attackers to execute arbitrary code via an 802.11 response frame containing a long SSID field...
CVE-2006-5882
Stack-based buffer overflow in the Broadcom BCMWL5.SYS wireless device driver 3.50.21.10, as used in Cisco Linksys WPC300N Wireless-N Notebook Adapter before 4.100.15.5 and other products, allows remote attackers to execute arbitrary code via an 802.11 response frame containing a long SSID field...
CVE-2006-5882
CVE-2006-5882 describes a stack-based overflow in the Broadcom BCMWL5.SYS wireless device driver (version 3.50.21.10), used by Cisco Linksys WPC300N Wireless-N Notebook Adapter before 4.100.15.5 and other products. The vulnerability allows remote attackers within an adjacent network to execute ar...
CVE-2006-5882: Improper Restriction of Operations within the Bounds of a Memory Buffer
Stack-based buffer overflow in the Broadcom BCMWL5.SYS wireless device driver 3.50.21.10, as used in Cisco Linksys WPC300N Wireless-N Notebook Adapter before 4.100.15.5 and other products, allows remote attackers to execute arbitrary code via an 802.11 response frame containing a long SSID field...
Broadcom wireless driver fails to properly process 802.11 probe response frames
Overview A buffer overflow vulnerability exists in the Broadcom BCMWL5.SYS wireless driver. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code, or cause a denial-of-service condition. Description The BCMWL5.SYS driver is a wireless 802.11 device driver...
Solaris 9 (sparc) : 113801-12
Sun Cluster 3.1: Core/Sys Admin Patch. Date this patch was last updated by Sun : May/20/04 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...
Solaris Runtime Linker (ld.so.1) Buffer Overflow Exploit (SPARC version
No description provided by source. / ld.so.1 exploit SPARC coded by: osker178 bjr213 psu.edu Alright, so this exploits a fairly standard buffer overflow in the default Solaris runtime linker ld.so.1 discovery by Jouko Pynnonen Only real deviation here from the standard overflow and return into li...
[Reversemode Advisory] Symantec Antivirus Engine Privilege Escalation
Symantec Antivirus Engine is prone to a local privilege escalation vulnerability. Two Device Drivers are affected: NAVEX15.sys, NAVENG.sys. NAVEX15.sys LOW CONSTANT VALUE PAGE:0004B611 sub edx, 222AD3h PAGE:0004B617 push esi PAGE:0004B618 jz short loc4B63C loc4B63C: mov edx, ecx+3Ch PAGE:0004B63F...
CVE-2006-4927: Undefined Security Weakness
The a NAVENG NAVENG.SYS and b NAVEX15 NAVEX15.SYS device drivers 20061.3.0.12 and later, as used in Symantec AntiVirus and security products, allow local users to gain privileges by overwriting critical system addresses using a crafted Irp to the IOCTL functions 1 0x222AD3, 2 0x222AD7, and 3...
Apple Mac OSX 10.4.7 - Mach Exception Handling Privilege Escalation
/ excploit.c - 28 Nov 2005 - [email protected] Exploitable Mach Exception Handling Affected: Mac OS X 10.4.6 darwin 8.6.0 and older When a process executes a setuid executable, all existing rights to the task port are invalidated, to make sure unauthorized processes do not retain control o...
Solaris 9 (sparc) : 121316-02
SunOS 5.9: kernel/sys/doorfs Patch. Date this patch was last updated by Sun : Aug/10/06 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...