Adobe to Patch Reader Information Leak Bug

Adobe is planning to patch a fairly low severity security vulnerability in all of the current versions of Reader and Acrobat that could enable an attacker to track which users have opened a certain PDF document. The vulnerability can’t be used for code execution, but researchers say it could be...

Windows Gather Microsoft Office Word UNC Path Injector

This module modifies a remote .docx file that will, upon opening, submit stored netNTLM credentials to a remote host. Verified to work with Microsoft Word 2003, 2007, 2010, and 2013. In order to get the hashes the auxiliary/server/capture/smb module can be used. This module requires Metasploit:...

PsExec via Current User Token

This module uploads an executable file to the victim system, creates a share containing that executable, creates a remote service on each target system using a UNC path to that file, and finally starts the services. The result is similar to psexec but with the added benefit of using the session's...

Microsoft Word UNC Path Injector

This module modifies a .docx file that will, upon opening, submit stored netNTLM credentials to a remote host. It can also create an empty docx file. If emailed the receiver needs to put the document in editing mode before the remote server will be contacted. Preview and read-only mode do not wor...

Microsoft Internet Explorer Domain Policy Bypass Vulnerability

Microsoft Internet Explorer is prone to domain policy bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Internet Explorer Domain Policy Bypass Vulnerability

This host is installed with Microsoft Internet Explorer and is prone to domain policy bypass vulnerability. OpenVAS Vulnerability Test $Id: gbmsiedomainpolicybypassvuln.nasl 6125 2017-05-15 09:03:42Z teissa $ Microsoft Internet Explorer Domain Policy Bypass Vulnerability Authors: Arun Kallavi...

Code injection

Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain data from files, via a UNC share pathname in the SRC attribute of a SCRIPT element, as demonstrated by reading a name-value pair from a local file via a...

CVE-2012-6502

CVE-2012-6502 affects Microsoft Internet Explorer prior to version 10. The vulnerability allows remote attackers to determine the existence of files and read certain data from local files by abusing a UNC share pathname in the SRC attribute of a SCRIPT element, demonstrated via a local file read ...

CVE-2012-6502

Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain data from files, via a UNC share pathname in the SRC attribute of a SCRIPT element, as demonstrated by reading a name-value pair from a local file via a...

CVE-2012-6395

Cisco Adaptive Security Appliances ASA devices with firmware 8.4 do not properly validate unspecified input related to UNC share pathnames, which allows remote authenticated users to cause a denial of service device crash via unknown vectors, aka Bug ID CSCuc65775...

Input validation

Cisco Adaptive Security Appliances ASA devices with firmware 8.4 do not properly validate unspecified input related to UNC share pathnames, which allows remote authenticated users to cause a denial of service device crash via unknown vectors, aka Bug ID CSCuc65775...

Microsoft Internet Explorer UNC路径域策略限制绕过漏洞

Internet Explorer访问本地文件通常使用FILE协议。但也可借助默认共享，使用UNC 路径达到同样效果。如“file:///C:/file.ext”也可以用"\127.0.0.1\C$\file.ext"来访问。 正常情况下，Internet域的页面不允许访问本地资源。如执行脚本，引用图片等。 以下两种情况均无法得到预期结果: code Img Src="file:///C:/x.jpg" Script Language="JavaScript" Src="file:///C:/x.js"/Script /code 但如果使用UNC 路径，则可以成功引用本地资源。...

GE Proficy Historian KeyHelp ActiveX LaunchTriPane Vulnerability

Added: 10/29/2012 CVE: CVE-2012-2516 BID: 54215 OSVDB: 83311 Background GE Proficy Historian collects, organizes, archives and distributes tremendous volumes of real-time production information with a goal of enabling better and faster decisions and increased productivity. Problem GE Proficy...

Sun Java Web Start Double Quote Injection

This module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. Parameters initial-heap-size and max-heap-size in a JNLP file can contain a double quote which is not properly sanitized when creating the command line for javaw.exe. This allows the injection of the...

AP NetWeaver HostControl Command Injection

Exploit for windows platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core'...

GE Proficy Historian KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE Proficy Historian. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

SAP NetWeaver HostControl Command Injection

This module exploits a command injection vulnerability in the SAPHostControl Service, by sending a specially crafted SOAP request to the management console. In order to deal with the spaces and length limitations, a WebDAV service is created to run an arbitrary payload when accessed as a UNC path...

Psexec Via Current User Token

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'rex' require...

Oracle Web Logic Node Manager UNC Path Remote File Execution

Oracle Web Logic Node Manager UNC Path Remote File Execution Posted by admin on 2012/03/16 Leave a comment 0 Go to comments Keep running into old Web Logic installations which have the file traversal http://www.securityfocus.com/bid/37926/info and UNC path remote command execution...

Sun Java Web Start Plugin - Command Line Argument Injection (2012) (Metasploit)

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Sun Java Web...