CVE-2008-2143

CVE-2008-2143 affects unspecified Microsoft Outlook Web Access (OWA) versions. The underlying issue is that OWA uses Cache-Control: no-cache instead of no-store, which may allow browsers following RFC-2616 to cache sensitive information. Impact is potential exposure of cached data; no exploitatio...

Microsoft Outlook Web Access not may use correct HTTP directive

Overview Some versions of Outlook Web Access OWA may use the no-cache instead of the no-store HTTP 1.1 directive. This results in web browsers caching sensitive information. Description Some versions of Outlook Web Access may use the Cache-Control: no-cache HTTP 1.1 directive. From RFC 2616: If t...

GroupWise 7 attached bugs

Product: GroupWise 7 OS: Windows xp Find two types of vulnerabilities in this client is a correo.Una xss and the other a denial of service but I am also appears to be run arbitrary code. XSS in web access You can run Javascript code to send an attachment with poorly trained jpg extension. Denial ...

IBM Domino Web Access Upload Module - Overwrite (SEH)

IBM Domino Web Access Upload Module - Overwrite SEH IBM Domino Web Access Upload Module Universal BoF Exploit function Check // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 =...

IBM Domino Web Access Upload Module - Overwrite (SEH)

IBM Domino Web Access Upload Module Universal BoF Exploit function Check // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" +...

IBM Domino Web Access Upload Module SEH Overwrite Exploit

Exploit for unknown platform in category remote exploits ========================================================= IBM Domino Web Access Upload Module SEH Overwrite Exploit ========================================================= IBM Domino Web Access Upload Module Universal BoF Exploit function...

CVE-2008-0585

sysmgt.websm.webaccess in IBM AIX 5.2 and 5.3 has world writable permissions for unspecified WebSM Remote Client files, which allows local users to "alter the behavior of" this client by overwriting these files...

IBM Domino Web Access Upload Module inotes6.dll BoF Exploit

No description provided by source. !-- written by e.b. IBM Domino Web Access Upload Module inotes6.dll SEH Overwrite Exploit Bad chars: 0x80+ CVE-2007-4474 Tested on Windows XP SP2fully patched English, IE6, inotes6.dll version 6.0.40.0 and version 6.0.48.0...

IBM Domino Web Access Upload Module dwa7w.dll BoF Exploit

No description provided by source. !-- written by e.b. IBM Domino Web Access Upload Module dwa7w.dll SEH Overwrite Exploit CVE-2007-4474 Tested on Windows XP SP2fully patched English, IE6, dwa7w.dll version 7.0.34.1 Thanks to h.d.m. and the Metasploit crew -- html head titleIBM Domino Web Access...

IBM Lotus Domino Web Access multiple ActiveX components security vulnerabilities

inotes6.dll, dwa7w.dll, inotes6w.dll buffer overflows...

[Full-disclosure] IBM Domino Web Access Upload Module inotes6w.dll SEH Overwrite Exploit

This one is the same offset as dwa7w and the same class id as inotes6. Basically inotes6 and inotes6w share the same class id, except that inotes6w is unicode. dwa7w is unicode and has a different class id. Code is inline, I would attach it except for the fact that I set off way to many av scanne...

[Full-disclosure] IBM Domino Web Access Upload Module dwa7w.dll SEH Overwrite Exploit

This one is unicode based, so is inotes6w. Exploitation for inotes6w is probably the same just with a different offset. Code is inline and attached. --------------------- !-- written by e.b. IBM Domino Web Access Upload Module dwa7w.dll SEH Overwrite Exploit CVE-2007-4474 Tested on Windows XP...

[Full-disclosure] IBM Domino Web Access inotes6.dll SEH Overwrite Exploit

My first attempt at an SEH overwrite exploit. Anyhow, I first posted about this issue regarding version 7 of this control, Will Dormann of the CERT/CC discovered versions 6 and 6.5 are vulnerable too, see http://www.kb.cert.org/vuls/id/963889. Dwa7w.dll and inotes6w.dll are unicode, thats my next...

Lotus Domino Web Access ActiveX control dwa7w.dll buffer overflow

Added: 12/31/2007 CVE: CVE-2007-4474 BID: 26972 OSVDB: 40954 Background Lotus Domino Web Access provides capabilities similar to those of the Lotus Notes client, delivered through a web browser. Problem A buffer overflow vulnerability in the Lotus Domino Web Access ActiveX control in the dwa7w.dl...

Lotus Domino Web Access ActiveX control dwa7w.dll buffer overflow

Added: 12/31/2007 CVE: CVE-2007-4474 BID: 26972 OSVDB: 40954 Background Lotus Domino Web Access provides capabilities similar to those of the Lotus Notes client, delivered through a web browser. Problem A buffer overflow vulnerability in the Lotus Domino Web Access ActiveX control in the dwa7w.dl...

inotes6w2-overwrite.txt

This one is the same offset as dwa7w and the same class id as inotes6. Basically inotes6 and inotes6w share the same class id, except that inotes6w is unicode. dwa7w is unicode and has a different class id. Code is inline, I would attach it except for the fact that I set off way to many av scanne...

Lotus Domino Web Access ActiveX control dwa7w.dll buffer overflow

Added: 12/31/2007 CVE: CVE-2007-4474 BID: 26972 OSVDB: 40954 Background Lotus Domino Web Access provides capabilities similar to those of the Lotus Notes client, delivered through a web browser. Problem A buffer overflow vulnerability in the Lotus Domino Web Access ActiveX control in the dwa7w.dl...

Lotus Domino Web Access ActiveX control dwa7w.dll buffer overflow

Added: 12/31/2007 CVE: CVE-2007-4474 BID: 26972 OSVDB: 40954 Background Lotus Domino Web Access provides capabilities similar to those of the Lotus Notes client, delivered through a web browser. Problem A buffer overflow vulnerability in the Lotus Domino Web Access ActiveX control in the dwa7w.dl...

dwa7w-overwrite.txt

This one is unicode based, so is inotes6w. Exploitation for inotes6w is probably the same just with a different offset. Code is inline and attached. --------------------- IBM Domino Web Access Upload Module dwa7w.dll SEH Overwrite Exploit function Check var buf = unescape"%u4141"; while buf.lengt...

inotes6-overwrite.txt

My first attempt at an SEH overwrite exploit. Anyhow, I first posted about this issue regarding version 7 of this control, Will Dormann of the CERT/CC discovered versions 6 and 6.5 are vulnerable too, see http://www.kb.cert.org/vuls/id/963889. Dwa7w.dll and inotes6w.dll are unicode, thats my next...