EasyMail ActiveX Control (emsmtp.dll) that included into Oracle Document Capture distrib can be used to read any file in the target system. Vulnerable method is "ImportBodyText()".
This exploit allows remote attackers to bypass ASLR and DEP protections in ProSSHD 1.2, leading to unauthorized access.
VMrc vulnerable to format string attacks. Exploitation of this issue may lead to arbitrary code execution on the system where VMrc is installed.
This bug was found by Patrik Karlsson and sold to ZDI. IBM make fix for this bug, but not enough. So this sploit can make auth. bypass in Lotus Domino Controller even with patch from IBM. So still 0day. Details can be found at http://dsecrg.com/pages/pub/show.php?id=41. The exploit involves making a port-fwd from 127.0.0.1:2050 to REMOTE_TARGET:2050, injecting XML into IIS log file, and running a script from a local web-server.
Directory Traversal vulnerability was found in Jetty web server that is used by VMware Update manager. With this vulnerability, an non-authenticated attacker can read any file on the server (with rights of the process).
This module exploits a stack buffer overflow in Musick Maker 16 When opening a malicious .MMM file in Music Maker, a stack buffer occurs, resulting in arbitrary code execution via SEH. This exploit bypasses DEP & ASLR and works on XP, Vista & Windows 7. LTKRN14n.dll and LTDIS14n.dll used for ROP.
This exploit uses JIT-SPRAY for DEP and ASLR bypass. The exploit uses 0x09090101 address for CALL JITed shellcode and the shellcode is system("notepad"). The exploit is triggered by navigating from START.htm to iff.htm to if1.htm and finally to 0day.html.
An attacker may inject JavaScript code into url. Example: https://[VMware_Portal_IP]/not_a_real_page<SCRIPT>alert(/XSS/.source)</SCRIPT>
The BladeCenter management module is a hot-swappable hardware device plugged into the BladeCenter chassis management bay. The management module functions as a system-management processor (service processor) and keyboard, video, and mouse (KVM) multiplexor for blade servers. This device can be remotely rebooted by sending a malformed TCP packets.
Insecure method was founded in SAPBExCommonResources (class BExGlobal) activeX control component which is a part of SAP GUI. One of the methods (Execute) can be used to execute files on users system. Attacker can construct html page which call vulnerable function 'Execute' from ActiveX Object BExGlobal.
Services By CQR