1237 matches found
Eudora 7.1 - SMTP ResponseRemote Remote Buffer Overflow
!/usr/bin/python Eudora 7.1 SMTP Response 0day Remote Buffer Overflow PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on Eudora 7.1.0.9 / XP SP2 Polish Shellcode type: Windows Execute Command calc.exe Note:.. This vulnerability can be exploited only if user will ignore warning about...
BitsCast 0.13.0 - invalid string Remote Denial of Service
BitsCast 0.13.0 Remote Denial of Service Credits: gbr Tested on Windows XP SP2 BitsCast crashes when receiving a RSS 2.0 feed item with a invalid string in sub-element 'pubDate'. '../A' x 8, 'A/../' x 8, and others. PoC: Test Remote DoS PoC ../A../A../A../A../A../A../A../A../A../A../A../A...
BitsCast 0.13.0 (invalid string) Remote Denial of Service Exploit
No description provided by source. BitsCast 0.13.0 Remote Denial of Service Credits: gbr Tested on Windows XP SP2 BitsCast crashes when receiving a RSS 2.0 feed item with a invalid string in sub-element 'pubDate'. '../A' x 8, 'A/../' x 8, and others. PoC: ?xml version="1.0"? rss version="2.0"...
VImpX ActiveX (VImpX.ocx 4.7.3.0) - Remote Buffer Overflow
VImpX ActiveX VImpX.ocx 4.7.3.0 - Remote Buffer Overflow ?php / win32adduser - PASS=tzu EXITFUNC=seh USER=sun Size=483 Encoder=PexAlphaNum http://metasploit.com / $shellcode = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"...
VImpX ActiveX (VImpX.ocx 4.7.3.0) - Remote Buffer Overflow
?php / win32adduser - PASS=tzu EXITFUNC=seh USER=sun Size=483 Encoder=PexAlphaNum http://metasploit.com / $shellcode = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49". "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"...
Hewlett Packard 1.0.0.309 - hpqvwocx.dll ActiveX Magview Overflow (PoC)
Hewlett Packard 1.0.0.309 - hpqvwocx.dll ActiveX Magview Overflow PoC Proof of Concept - Hewlett Packard Stack Overflow in hpqvwocx.dll v1.0.0.309 Proof of Concept - Hewlett Packard Stack Overflow in hpqvwocx.dll v1.0.0.309 Tested in Windows XP Service Pack 2 Discovered by Goodfellas Security...
gdivx-dos.txt
' IE 6 / GDivX Zenith Player AviFixer Class fix.dll v. 1.0.0.1 buffer overflow POC by rgod ' tested on xp sp2 EIP= "BBBB" BOF=String264, "A" + EIP + String9999, unescape"%90" target.SetInputFile BOF...
CVE-2007-0947
Use-after-free vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, resulting in accessing deallocated memory of CMarkup objects, aka the second of two "HTML...
Adobe Photoshop CS2 / CS3 Unspecified . BMP File Buffer Overflow-vulnerability warning-the black bar safety net
Ghost boy note: with the last, like, CS3 under the test is successful, but the CS2 is not the test, I had previously been with the CS green version, too lazy to go to the next CS2 test. Source: Security vulnerabilities /\ Adobe Photoshop CS2 / CS3 Unspecified . BMP File Buffer Overflow There is a...
Winamp <= 5.34 .MP4 File Code Execution Exploit
No description provided by source. /\ Winamp = 5.34 .MP4 File Code Execution ...
gimp-overflow.txt
/\ Gimp v2.2.14 .RAS File SUNRAS Plugin Buffer Overflow Gimp uses SUNRAS plugin to process .RAS file. But this module is vulnerable to a buffer overflow in setcolortable which leads to code execution. Vulnerable code, sunras.c:862 int ncols, j; guchar ColorMap2563; ncols = sunhdr-lrasmaplength / ...
photoshop-voverflow.txt
/\ Photoshop CS2/CS3, Paint Shop Pro 11.20 .PNG File Buffer Overflow Like bitmap files, PNG files can do great things =D. In french: "buffer overflow a gogo!" The generated .PNG file will work for: -Photoshop CS2 -Photoshop CS3 -Photoshop Elements 5.0 -Corel Paint Shop Pro 11.20 This sploit runs...
winamp-exec.txt
/\ Winamp / include "stdio.h" include "stdlib.h" / win32exec - EXITFUNC=thread CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com / unsigned char CalcShellcode = "\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"...
irfanview-overflow.txt
/ IrfanView / include "stdio.h" include "stdlib.h" / win32exec - EXITFUNC=process CMD=calc.exe Size=138 Encoder=PexFnstenvSub http://metasploit.com / unsigned char CalcShellcode = "\xfc\xe8\x44\x00\x00\x00\x8b\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b"...
abcview-overflow.txt
/ ABC-View Manager 1.42 .PSP File Buffer Overflow ABC-View Manager is vulnerable to an unspecified buffer overflow when processing a crafted .TTF file. This exploit runs calc.exe or binds shell to port 4444. Tested against Win XP SP2 FR. Have Fun! Coded and discovered by Marsu Note: Open that in...
Winamp <= 5.34 .MP4 File Code Execution Exploit
Exploit for unknown platform in category local exploits =============================================== Winamp = 5.34 .MP4 File Code Execution Exploit =============================================== /\ Winamp = 5.34 .MP4 File Code Execution Winamp MP4's plugin fails to handle exceptional...
Winamp 5.34 - '.mp4' Code Execution
/\ Winamp...
Winamp 5.34 - .mp4 Code Execution
Winamp 5.34 - .mp4 Code Execution /\ Winamp = 5.34 .MP4 File Code Execution Winamp MP4's plugin fails to handle exceptional conditions, which can lead to code execution. However exploitation is hard, firstly because of the return address. This code exploits a call eax, and it might be complicated...
RealPlayer 10 - '.ra' Remote Denial of Service
!/usr/bin/python Real player 10 Gold .Ra file remote Dos. Credits to n00b for finding this bug This bug is a nasty memory leak with in Real player 10 gold please remember if your guna test it out save all your info you need first..Coz your probly guna have to reboot also remember all other...