CVE-2006-0023

CVE-2006-0023 describes a privilege-elevation vulnerability in Windows XP SP1/SP2 (and possibly other OS) where default service-discretionary access control lists (DACLs) are overly permissive (the so-called Permissive Windows Services DACLs). This allows a low-privileged local user to modify cri...

CVE-2005-3644

PNPGetDeviceList upnpgetdevicelist in UPnP for Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows remote attackers to cause a denial of service memory consumption via a DCE RPC request that specifies a large output buffer size, a variant of CVE-2006-6296, and ...

CVE-2005-3644

PNPGetDeviceList upnpgetdevicelist in UPnP for Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows remote attackers to cause a denial of service memory consumption via a DCE RPC request that specifies a large output buffer size, a variant of CVE-2006-6296, and ...

CVE-2005-3644

CVE-2005-3644 describes a memory exhaustion/DoS condition in the Windows Plug and Play (PnP) service. The issue arises in UPnP handling via RPC calls (PNP_GetDeviceList) in Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, where a remote attacker can request a large output bu...

Microsoft Windows Server 2000 - UPNP getdevicelist Memory Leak Denial of Service

Microsoft Windows Server 2000 - UPNP getdevicelist Memory Leak Denial of Service / Author: Winny Thomas Nevis Labs, Pune, INDIA Details: While working on the exploit for MS05-047 i came across a condition where a specially crafted request to upnpgetdevicelist would cause services.exe to consume...

Microsoft Windows Server 2000 - UPNP 'getdevicelist' Memory Leak Denial of Service

/ Author: Winny Thomas Nevis Labs, Pune, INDIA Details: While working on the exploit for MS05-047 i came across a condition where a specially crafted request to upnpgetdevicelist would cause services.exe to consume memory to a point where the target machines virtual memory gets exhausted. This...

MS Windows 2k UPNP (getdevicelist) Memory Leak DoS Exploit

No description provided by source. / Author: Winny Thomas Nevis Labs, Pune, INDIA Details: While working on the exploit for MS05-047 i came across a condition where a specially crafted request to upnpgetdevicelist would cause services.exe to consume memory to a point where the target machines...

MS Windows 2k UPNP (getdevicelist) Memory Leak DoS Exploit

Exploit for unknown platform in category dos / poc ========================================================== MS Windows 2k UPNP getdevicelist Memory Leak DoS Exploit ========================================================== / Author: Winny Thomas Nevis Labs, Pune, INDIA Details: While working o...

Unchecked Buffer in XP upnp

Unchecked Buffer in Universal Plug and Play Can Lead to System Compromise for Windows XP Q315000 By sending a specially-malformed NOTIFY directive, it would be possible for an attacker to cause code to run in the context of the UPnP service, which runs with system privileges on Windows XP. The UP...

scan for UPNP hosts

Microsoft Universal Plug n Play is running on this machine. This service is dangerous for many different reasons. SPDX-FileCopyrightText: 2005 by John Lampe Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

ZipTorrent1.3.7.3.txt

/================================================================ ZipTorrent 1.3.7.3 Local Proxy Password Disclosure Exploit by Kozan Discovered & Coded by Kozan Credits to ATmaCA Web: www.spyinstructors.com Mail: [email protected] Application: -------------------- ZipTorrent 1.3.7.3 and...

CVE-2005-0833

Belkin 54G F5D7130 wireless router allows remote attackers to access restricted resources by sniffing URIs from UPNP datagrams, then accessing those URIs, which do not require authentication...

CVE-2005-0833

Belkin 54G F5D7130 wireless router allows remote attackers to access restricted resources by sniffing URIs from UPNP datagrams, then accessing those URIs, which do not require authentication...

CVE-2005-0833

CVE-2005-0833 affects the Belkin 54G (F5D7130) wireless router. The issue arises from processing UPnP datagrams where URIs are sniffed and accessed without authentication, enabling remote attackers to reach restricted resources. The core weakness is lack of authentication for accessed URIs expose...

UPNP Traffic Detection

Binary data 1948.prm...

Xavi X7028r DSL Router - UPNP Long Request Denial of Service

Xavi X7028r DSL Router - UPNP Long Request Denial of Service source: https://www.securityfocus.com/bid/8252/info A problem has been reported in the handling of requests of excessive length placed to the service on port 280 by the Xavi X7028r DSL router. This may allow an attacker to crash a...

UPnP TCP Helper Detection

The remote host is running Microsoft UPnP TCP helper. If the tested network is not a home network, you should disable this service. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11765; scriptversion"1.19"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"UPnP TCP...

Another security problem in Netgear FM114P ProSafe Wireless Router firmware

hi, i found another security problem in netgear prosafe wireless router model FM114P: when remote-access and upnp features are enabled, the WAN connection username and password can be retrieved without any authentication using upnp. if remote management is enabled anyone can do this from the web...

CVE-2001-0877

CVE-2001-0877 describes an unchecked buffer in Windows UPnP NOTIFY handling that can allow remote attackers to cause denial of service or execute code with SYSTEM privileges on Windows XP (and related UPnP-enabled Windows 98/ME). Exploitation via specially malformed NOTIFY messages (SSDP) can tri...

CVE-2001-0876

CVE-2001-0876 describes a buffer overflow in the UPnP NOTIFY handling on Windows XP, ME, 98/98SE, exploitable via a long Location URL in NOTIFY directives. OpenVAS and CERT/CC advisories corroborate a remote-code-execution risk with SYSTEM privileges on XP (and similar impacts on ME/98/98SE); a s...