CVE-2017-0089

CVE-2017-0089 affects Microsoft Windows Uniscribe (USP10) used by the Uniscribe font processing path in user32.dll. The vulnerability arises from a memory corruption in USP10!MergeLigRecords, enabling remote code execution when a user visits a crafted web page. Affected platforms listed in the in...

CVE-2017-0091

CVE-2017-0091 is an information-disclosure vulnerability in Microsoft Windows, affecting the Uniscribe (usp10.dll) font‑handling component used by DrawText and related text-rendering paths. The root cause is memory access issues in Uniscribe’s handling of complex TrueType/OpenType typography tabl...

CVE-2017-0042

Windows Media Player in Microsoft Windows 8.1; Windows Server 2012 R2; Windows RT 8.1; Windows 7 SP1; Windows 2008 SP2 and R2 SP1, Windows Server 2016; Windows Vista SP2; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information via a crafted web site, aka "Windo...

CVE-2017-0126

CVE-2017-0126 is an Uniscribe (usp10.dll) information-disclosure vulnerability affecting Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, and Windows 7 SP1. The issue arises when untrusted or crafted web content triggers Uniscribe code paths via user32’s DrawText flow, enabling a remote attacke...

CVE-2017-0144

CVE-2017-0144 is the SMBv1 Remote Code Execution vulnerability in Windows SMB server (EternalBlue). Connected sources confirm exploitation activity (e.g., DLTMiner/WannaCry-era campaigns) and identification as a high-severity network-based RCE affecting multiple Windows editions. The root cause i...

Windows DVD Maker 6.1.7 XXE Injection

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-DVD-MAKER-XML-EXTERNAL-ENTITY-FILE-DISCLOSURE.txt + ISR: ApparitionSec Vendor: ================= www.microsoft.com Product: ================= Windows DVD Maker...

Disk Savvy Enterprise long URI in GET request buffer overflow

Added: 03/16/2017 CVE: CVE-2017-6187 BID: 96401 Background Disk Savvy Enterprise is a disk space usage analyzer. Problem A buffer overflow in the built-in web server in Disk Savvy Enterprise could allow remote code execution when handling a long URI in a GET request. Resolution Contact the vendor...

Disk Savvy Enterprise long URI in GET request buffer overflow

Added: 03/16/2017 CVE: CVE-2017-6187 BID: 96401 Background Disk Savvy Enterprise is a disk space usage analyzer. Problem A buffer overflow in the built-in web server in Disk Savvy Enterprise could allow remote code execution when handling a long URI in a GET request. Resolution Contact the vendor...

Cerberus FTP Server 8.0.10.3 - MLST Buffer Overflow (PoC)

Cerberus FTP Server 8.0.10.3 - MLST Buffer Overflow PoC + Title: Cerberus FTP Server 8.0.10.3 – 'MLST' Remote Buffer Overflow + Credits / Discovery: Nassim Asrir + Author Contact: [email protected] || https://www.linkedin.com/in/nassim-asrir-b73a57122/ + Author Company: Henceforth + CVE:...

Disk Savvy Enterprise long URI in GET request buffer overflow

Added: 03/16/2017 CVE: CVE-2017-6187 BID: 96401 Background Disk Savvy Enterprise is a disk space usage analyzer. Problem A buffer overflow in the built-in web server in Disk Savvy Enterprise could allow remote code execution when handling a long URI in a GET request. Resolution Contact the vendor...

Cerberus FTP Server 8.0.10.3 - 'MLST' Buffer Overflow (PoC)

Title: Cerberus FTP Server 8.0.10.3 – 'MLST' Remote Buffer Overflow + Credits / Discovery: Nassim Asrir + Author Contact: [email protected] || https://www.linkedin.com/in/nassim-asrir-b73a57122/ + Author Company: Henceforth + CVE: CVE-2017-6880 Vendor: ===============...

Debugging domain join problems in Windows 7

Debugging domain join problems in Windows 7...

Dup Scout Enterprise GET Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in the web interface of Dup Scout Enterprise versions use exploit/windows/http/dupscts/bof msf undefinedbof show actions ...actions... msf undefinedbof set ACTION msf undefinedbof show options ...show and set options... msf...

Disk Sorter Enterprise GET Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in the web interface of Disk Sorter Enterprise v9.5.12, caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server. This module has been tested successfully on Windows 7 SP1 x86. Modu...

FTPShell Client 6.53 Buffer Overflow

!/usr/bin/python FTPShell Client 6.53 buffer overflow By NA , NAattutanota.com Tested on Windows 7 Professional Credit to Peter Baris for finding the vulnerability and also submitting the CVE and public exploit. CVE: CVE-2017-6465 Vendor Homepage: http://www.saptech-erp.com.au Tested on: Microsof...

VX Search Enterprise GET Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in the web interface of VX Search Enterprise v9.5.12, caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server. This module has been tested successfully on Windows 7 SP1 x86. Module...

Sync Breeze Enterprise GET Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in the web interface of Sync Breeze Enterprise v9.4.28, v10.0.28, and v10.1.16, caused by improper bounds checking of the request in HTTP GET and POST requests sent to the built-in web server. This module has been tested successfull...

Microsoft Windows Multiple Vulnerabilities (4013078)

This host is missing a critical security update according to Microsoft Bulletin MS17-012. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2016-8008

Privilege escalation vulnerability in Windows 7 and Windows 10 in McAfee Security Scan Plus SSP 3.11.376 allows attackers to load a replacement of the version.dll file via McAfee McUICnt.exe onto a Windows system...

CVE-2016-8008

CVE-2016-8008 affects McAfee Security Scan Plus (SSP) on Windows 7/10, where SSP version 3.11.376 is vulnerable to privilege escalation. The root cause is a local DLL-loading issue in McUICnt.exe that allows loading a replacement version.dll, enabling a local attacker to gain SYSTEM privileges. M...