CVE-2013-3956

The NICM.SYS kernel driver (version 3.1.11.0) is vulnerable to local privilege escalation across multiple operating systems, including Windows XP , Windows Vista , Windows 7 , Windows 8 , and various Windows Server versions. The root cause is a failure to validate pointers from user-mode buffers ...

CVE-2013-3956

The NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003; Novell Client 2 SP2 on Windows Vista and Windows Server 2008; and Novell Client 2 SP3 on Windows Server 2008 R2, Windows 7, Windows 8, and Windows Server 2012 allows local users to gain privileges...

HP LoadRunner magentproc.exe Overflow

This module exploits a stack buffer overflow in HP LoadRunner before 11.52. The vulnerability exists on the LoadRunner Agent Process magentproc.exe. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. Module Options msf use...

Cogent DataHub HTTP Server Buffer Overflow

This module exploits a stack based buffer overflow on Cogent DataHub 7.3.0. The vulnerability exists in the HTTP server. While handling HTTP headers, a strncpy function is used in a dangerous way. This module has been tested successfully on Cogent DataHub 7.3.0 Demo on Windows XP SP3. Module...

Chasys Draw IES Buffer Overflow

This module exploits a buffer overflow vulnerability found in Chasys Draw IES version 4.10.01. The vulnerability exists in the module fltBMP.dll, while parsing BMP files, where the ReadFile function is used to store user provided data on the stack in an insecure way. It results in arbitrary code...

HP LoadRunner lrFileIOService ActiveX WriteFileString Remote Code Execution

This module exploits a vulnerability on the lrFileIOService ActiveX, as installed with HP LoadRunner 11.50. The vulnerability exists in the WriteFileString method, which allow the user to write arbitrary files. It's abused to drop a payload embedded in a dll, which is later loaded through the Ini...

HP LoadRunner lrFileIOService ActiveX Remote Code Execution

This module exploits a vulnerability on the lrFileIOService ActiveX, as installed with HP LoadRunner 11.50. The vulnerability exists in the WriteFileBinary method where user provided data is used as a memory pointer. This module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7,...

Microsoft DirectShow - Arbitrary Memory Overwrite (MS13-056)

Microsoft DirectShow - Arbitrary Memory Overwrite MS13-056 Introduction: The Microsoft DirectShow application programming interface API is a media-streaming architecture for Microsoft Windows. Using DirectShow, your applications can perform high-quality video and audio playback or capture...

Super Player 3500 - .m3u Local Stack Buffer Overflow

Super Player 3500 - .m3u Local Stack Buffer Overflow !/usr/bin/perl SuperPlayer3500 Local stack based buffer overflow Author:jun Email:[email protected] Date:Tue Jul 22 2013 Vendor Link:http://www.haojie.cn Software Link:http://www.haojie.cn/download/setup3500.exe App Version:3500 Tested...

Super Player 3500 - '.m3u' Local Stack Buffer Overflow

!/usr/bin/perl SuperPlayer3500 Local stack based buffer overflow Author:jun Email:[email protected] Date:Tue Jul 22 2013 Vendor Link:http://www.haojie.cn Software Link:http://www.haojie.cn/download/setup3500.exe App Version:3500 Tested on:windows xp sp3 $file = "superplay3500exp.M3U"; $junk = "...

VbsEdit 5.9.3 - .smi Buffer Overflow (PoC)

VbsEdit 5.9.3 - .smi Buffer Overflow PoC Exploit Title: VbsEdit 5.9.3.smi file handling Buffer overflow vulnerability Date: 22.7.2013 Exploit Author: d3b4g Vendor Homepage:http://www.vbsedit.com/ Software Link: http://www.vbsedit.com/ Tested on: Windows XP SP3 Twitter: @schaba !/usr/bin/python...

Apple Quicktime 7 Invalid Atom Length Buffer Overflow

Exploit for windows platform in category remote exploits require 'msf/core' class Metasploit4 "Apple Quicktime 7 Invalid Atom Length Buffer Overflow", 'Description' = %q This module exploits a vulnerability found in Apple Quicktime. The flaw is triggered when Quicktime fails to properly handle th...

PCMan FTP Server 2.0.7 - Remote Exploit (msf)

Exploit for windows platform in category remote exploits require 'msf/core' class Metasploit3 'PCMan's FTPD V2.0.7 Username Overflow', 'Description' = %q This module exploits a buffer overflow found in the USER command of PCMan's FTPD. , 'Author' = 'MSJ ', 'License' = MSFLICENSE, 'DefaultOptions'...

PCMan FTP Server 2.0.7 - Remote (Metasploit)

PCMan FTP Server 2.0.7 - Remote Metasploit Exploit-DB Note: Ret needs adjustment for Windows XP SP3 English This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and term...

VbsEdit 5.9.3 Buffer Overflow

Exploit Title: VbsEdit 5.9.3.smi file handling Buffer overflow vulnerability Date: 22.7.2013 Exploit Author: d3b4g Vendor Homepage:http://www.vbsedit.com/ Software Link: http://www.vbsedit.com/ Tested on: Windows XP SP3 Twitter: @schaba !/usr/bin/python Tested on: win XPsp3 chars = "A"90000 crush...

PCMan FTP Server 2.0.7 Buffer Overflow

Exploit-DB Note: Ret needs adjustment for Windows XP SP3 English This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require...

PCMan FTP Server 2.0.7 - Remote (Metasploit)

Exploit-DB Note: Ret needs adjustment for Windows XP SP3 English This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require...

VbsEdit 5.9.3 - '.smi' Buffer Overflow (PoC)

Exploit Title: VbsEdit 5.9.3.smi file handling Buffer overflow vulnerability Date: 22.7.2013 Exploit Author: d3b4g Vendor Homepage:http://www.vbsedit.com/ Software Link: http://www.vbsedit.com/ Tested on: Windows XP SP3 Twitter: @schaba !/usr/bin/python Tested on: win XPsp3 chars = "A"90000 crush...

Symantec Workspace Virtualization 6.4.1895.0 Local Kernel Mode Privilege Escalation

Exploit for windows platform in category local exploits Symantec Workspace Virtualization 6.4.1895.0 Local Kernel Mode Privilege Escalation Exploit Date: 2013-7-17 Author : MJ0011 Version: Symantec Workspace Virtualization 6.4.1895.0 Tested on: Windows XP SP3 DETAILS: In fslx.sys 's hook function...

HP Managed Printing Administration jobAcct Remote Command Execution

This Metasploit module exploits an arbitrary file upload vulnerability on HP Managed Printing Administration 2.6.3 and before. The vulnerability exists in the UploadFiles function from the MPAUploader.Uploader.1 control, loaded and used by the server. The function can be abused via directory...