312 matches found
MS Windows Plug-and-Play (Umpnpmgr.dll) DoS Exploit (MS05-047) (2)
No description provided by source. // tested and approved /str0ke / Program: Denial of Service attack for MS UMPNPMGR PNPGetDeviceList Author: Winny Thomas Vulnerability: no length checking on passed parameter to PNPGetDeviceList in UMPNPMGR.dll Note: The code crashes services.exe on the target,...
ZDI-07-074: Microsoft Internet Explorer Node Manipulation Memory Corruption
ZDI-07-074: Microsoft Internet Explorer Node Manipulation Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-074.html December 11, 2007 -- CVE ID: CVE-2007-3903 -- Affected Vendor: Microsoft -- Affected Products: Internet Explorer 6 Internet Explorer 7 --...
Unfixed XSS vulnerability at www.thomasmoser.com
Security researcher CoNqUeRoR, has submitted on 11/08/2007 a cross-site-scripting XSS vulnerability affecting www.thomasmoser.com, which at the time of submission ranked 1106453 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It is...
Unfixed XSS vulnerability at booking12.thomascook.de
Security researcher Venom23, has submitted on 10/10/2007 a cross-site-scripting XSS vulnerability affecting booking12.thomascook.de, which at the time of submission ranked 62181 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/10/2007. It is...
Toms Gstebuch 1.00 - XSS
Software: Guestbook Title: Toms Gдstebuch 1.00 Version: 1.0 Type: XSS Date: Sat Aug 11 21:52:08 CEST 2007 Vendor: Fitz Thomas Page: http://www.toms-seiten.at/ vulnerability: ---------------------------- http://example.com/form.php?action=show&homepage=XSS&mail=XSS&name=XSS...
tomsgb10-xss.txt
Software: Guestbook Title: Toms Gästebuch 1.00 Version: 1.0 Type: XSS Date: Sat Aug 11 21:52:08 CEST 2007 Vendor: Fitz Thomas Page: http://www.toms-seiten.at/ vulnerability: ---------------------------- http://example.com/form.php?action=show&homepage=XSS&mail=XSS&name=XSS...
Lotus Domino IMAP4 Server 6.5.4 Remote Buffer Overflow Exploit
No description provided by source. Lotus Domino IMAP4 Server Release 6.5.4 / Windows 2000 Advanced Server x86 Remote Exploit Vulnerable: IBM Lotus Domino = 7.0.2 && 6.5.5 FP2 tested 6.5.4 Authors: Dominic Chell [email protected] & prdelka Exploitation steps:...
CVE-2007-2449.txt
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2007-2449: Apache Tomcat XSS vulnerabilities in the JSP examples Severity: low cross-site scripting Vendor: The Apache Software Foundation Versions Affected: Tomcat 4.0.0 to 4.0.6 Tomcat 4.1.0 to 4.1.36 Tomcat 5.0.0 to 5.0.30 Tomcat 5.5.0 to 5.5.2...
ultra-noob.txt
/ Date : May 28th 2007. UltraISO executes calc.Don't forget you need to have the bin and cue file in the same Directory special thanks to Thomas Pollet also. / include include //Calc shellcode unsigned char shellcode = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"...
UltraISO 8.6.2.2011 - .cue.bin Local Buffer Overflow (1)
UltraISO 8.6.2.2011 - .cue.bin Local Buffer Overflow 1 / Date : May 28th 2007. UltraISO executes calc.Don't forget you need to have the bin and cue file in the same Directory special thanks to Thomas Pollet also. / include include //Calc shellcode unsigned char shellcode =...
tinyidentd-overflow.txt
tinyidentd exploit code by thomas . pollet at gmail . com bug by Maarten Boone usage: python exploit.py target import socket,sys jmp into nop sled payload = '\xeb\x20' ident crap payload += ', 28 : USERID : UNIX : ' nop sled payload +='XXXX' jmp %esi payload += '\x77\x13\x83\x7c' XP kernel32.dll...
TinyIdentD远程栈缓冲区溢出漏洞
Tiny IdentD是一款小型的Win32 ident服务器，用于验证用户名。 Tiny IdentD在处理查询请求时存在栈溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 如果攻击者向默认的113/TCP端口发送了超过512字节的超长查询请求的话，就可以触发这个溢出，导致执行任意指令。 TinyIRC TinyIdentD 2.2 临时解决方法： 限制对113/TCP端口端口的访问。 厂商补丁： TinyIRC ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
TinyIdentD <= 2.2 Remote Buffer Overflow Exploit
Exploit for unknown platform in category remote exploits ================================================ TinyIdentD = 2.2 Remote Buffer Overflow Exploit ================================================ tinyidentd exploit code by thomas . pollet at gmail . com bug by Maarten Boone usage: python...
McAfee Security Center IsOldAppInstalled - ActiveX Buffer Overflow
McAfee Security Center IsOldAppInstalled - ActiveX Buffer Overflow / McAfee Security Center IsOldAppInstalled ActiveX Buffer Overflow Vulnerability Peel the frame from axis,Thanks Test on Windows2000 and dll version Mcsubmgr.dll 6.0.0.15 Greetz to OYXin, sowhat, Winny Thomas and 0x557 team /...
Mercur Messaging 2005 <= SP4 IMAP Remote Exploit (egghunter mod)
Exploit for unknown platform in category remote exploits ================================================================ Mercur Messaging 2005 import os import sys import time import socket import struct Place our w00tw00t egghunter in nop heaven shellcode = "\x90" 92 shellcode...
Mercur Messaging 2005 <= SP4 IMAP Remote Exploit (egghunter mod)
No description provided by source. !/usr/bin/python Mercur Messaging 2005 SP3 IMAP service - Egghunter mod [email protected] http://www.offensive-security.com Original exploit by Winny Thomas Thanks Thomas, this code really came in handy ! VMWare seems to alter the stack a bit as the...
caid-msgeng.txt
!/usr/bin/python This one was listed in the SANS TOP 20 and I needed an exploit for analysis. I couldnt find a reliable exploit for my analysis and so came up with this. Remote exploit for the CA BrightStor msgeng.exe service stack overflow vulnerability as described in LS-20060330.pdf on...
CA BrightStor ARCserve - msgeng.exe Remote Stack Overflow
CA BrightStor ARCserve - msgeng.exe Remote Stack Overflow !/usr/bin/python This one was listed in the SANS TOP 20 and I needed an exploit for analysis. I couldnt find a reliable exploit for my analysis and so came up with this. Remote exploit for the CA BrightStor msgeng.exe service stack overflo...
CVE-2007-1192
Thomas R. Pasawicz HyperBook Guestbook 1.30 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an admin password hash via a direct request for data/gbconfiguration.dat...
CVE-2007-1192
Thomas R. Pasawicz HyperBook Guestbook 1.30 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an admin password hash via a direct request for data/gbconfiguration.dat...