Microsoft Internet Explorer ShowSaveFileDialog DLL Loading Arbitrary Code Execution Vulnerability

Microsoft Internet Explorer is a web browser from Microsoft. Microsoft Internet Explorer suffers from an arbitrary code execution vulnerability in its implementation, which can be exploited by an attacker who places a file in a remotely accessible UNC or WebDAV share location to execute arbitrary...

KLA10473 Code execution vulnerability in Microsoft products

Lack of authentication control was found in Microsoft products. By exploiting this vulnerability malicious users execute arbitrary code. This vulnerability can be exploited remotely via a specially designed UNC share. Original advisories MS advisory CVE-2015-0008 Related products...

Microsoft Windows Shell LNK Code Execution

This module exploits a vulnerability in the MS10-046 patch to abuse again the handling of Windows Shortcut files .LNK that contain an icon resource pointing to a malicious DLL. This module creates the required files to exploit the vulnerability. They must be uploaded to an UNC path accessible by...

Nvidia Mental Ray Satellite Service Arbitrary DLL Injection Vulnerability

The Nvidia Mental Ray Satellite Service listens for control commands on port 7414. When it receives the command to load a DLL via an UNC path it will try to connect back to the host on port 7514. If a TCP connection is successful it will then attempt to load the DLL. This Metasploit module has be...

Nvidia Mental Ray Satellite Service Arbitrary DLL Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nvidia Mental Ray Satellite Service Arbitrary DLL Injection', 'Description' = %q The Nvidia Mental Ray Satellite Service listens for...

SolarWinds Server and Application Monitor Buffer Overflow Vulnerability (CNVD-2015-01241)

SolarWinds Server and Application Monitor is a server and application monitor from SolarWinds USA. The monitor provides monitoring, alerts, reports and more for server hardware and applications. A security vulnerability in the SolarWinds Server and Application Monitor TSUnicodeGraphEditorControl...

CVE-2015-1501

The factory.loadExtensionFactory function in TSUnicodeGraphEditorControl in SolarWinds Server and Application Monitor SAM allow remote attackers to execute arbitrary code via a UNC path to a crafted binary...

Server side request forgery (ssrf)

The factory.loadExtensionFactory function in TSUnicodeGraphEditorControl in SolarWinds Server and Application Monitor SAM allow remote attackers to execute arbitrary code via a UNC path to a crafted binary...

CVE-2015-1501

The CVE-2015-1501 flaw affects SolarWinds Server and Application Monitor (SAM) in the TSUnicodeGraphEditorControl: factory.loadExtensionFactory accepts a UNC path to a crafted binary, enabling remote code execution. Multiple sources (e.g., ZDI-15-043, CPAI-2015-0429, CNVD-2015-01241) describe rem...

CVE-2015-1501

The factory.loadExtensionFactory function in TSUnicodeGraphEditorControl in SolarWinds Server and Application Monitor SAM allow remote attackers to execute arbitrary code via a UNC path to a crafted binary...

Microsoft Windows domain-configured client Group Policy fails to authenticate servers

Overview Microsoft Windows domain-configured client Group Policy fails to authenticate servers over Universal Naming Convention UNC paths. Description Microsoft has released MS15-011, detailing a critical flaw in which Windows domain-configured client Group Policy fails to authenticate servers ov...

CVE-2015-0008

The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remot...

Remote code execution

The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remot...

CVE-2015-0008

CVE-2015-0008 affects Windows clients/servers (Windows Server 2003 SP2, Vista SP2, Server 2008 SP2/R2, 7 SP1, 8/8.1, Server 2012/2012 R2, RT/RT 8.1) where UNC-based policy data transfers during Group Policy processing allow remote code execution due to lack of server-to-client authentication. The...

CVE-2015-0008

The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remot...

SolarWinds Server and Application Monitor TSUnicodeGraphEditorControl factory.loadExtensionFactory Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Server and Application Monitor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exis...

Design/Logic Flaw

The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname...

Authentication Capture: SMB

This module provides a SMB service that can be used to capture the challenge-response password NTLMv1 & NTLMv2 hashes used with SMB1, SMB2, or SMB3 client systems. Responses sent by this service by default use a random 8 byte challenge string. A specific value such as 1122334455667788 can be set...

Winamp <= 5.12 - (.pls) Remote Buffer Overflow Exploit (meta)

No description provided by source. This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artisti...

Mozilla Firefox < 3.0.14 Multiplatform RCE via pkcs11.addmodule

No description provided by source. Fix announce: http://www.mozilla.org/security/announce/2009/mfsa2009-48.html Bug history: https://bugzilla.mozilla.org/showbug.cgi?id=326628 So, Firefox up through 3.0.13 had an obscure little function under window.pkcs11: long addmodulein DOMString moduleName, ...