Exploits 100 - exploit.company

Persits XUpload ActiveX MakeHttpRequest Directory Traversal

This module exploits a directory traversal in Persits Software Inc's XUpload ActiveX control(version 3.0.0.3) that's included in HP LoadRunner 9.5. By passing a string containing ".." sequences to the MakeHttpRequest method

an attacker is able to write arbitrary files to arbitrary locations on disk. Code execution occurs by writing to the All Users Startup Programs directory. You may want to combine this module with the use of multi/handler since a user would have to log for the payload to execute."

CVSS

7.5

Directory Traversal

CVE-2009-3693

CWE

Affected Version

hdm, Aviv Raff, Trirat Puttaraksa, Mr.Niega, M. Shirk

vendor:

Microsoft

Internet Explorer VML Fill Method Code Execution

This module exploits a code execution vulnerability in Microsoft Internet Explorer using a buffer overflow in the VML processing code (VGX.dll). This module has been tested on Windows 2000 SP4, Windows XP SP0, and Windows XP SP2.

Affected Version

Norton AntiSpam 2004 SymSpamHelper ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Norton AntiSpam 2004. When sending an overly long string to the LaunchCustomRuleWizard() method of symspam.dll (2004.1.0.147) an attacker may be able to execute arbitrary code.

7.5

CVSS

HIGH

Stack Buffer Overflow

Affected Version

Norton AntiSpam 2004 (2004.1.0.147)

To:

Norton AntiSpam 2004 (2004.1.0.147)

Adobe Shockwave rcsL Memory Corruption

This module exploits a weakness in the Adobe Shockwave player's handling of Director movies (.DIR). A memory corruption vulnerability occurs through an undocumented rcsL chunk.

Affected Version

natron, xort, redsand, MC, Didier Stevens

vendor:

Adobe

Adobe JBIG2Decode Memory Corruption Exploit

This module exploits a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier. This module relies upon javascript for the heap spray.

7.8

CVSS

HIGH

Heap-based pointer corruption

Windows XP SP3 English, Windows XP SP2 English

Affected Version

From:

Adobe Reader 9.0.0

To:

Adobe Reader 9.0.0 and earlier

RealPlayer rmoc3260.dll ActiveX Control Heap Corruption

This module exploits a heap corruption vulnerability in the RealPlayer ActiveX control. By sending a specially crafted string to the 'Console' property in the rmoc3260.dll control, an attacker may be able to execute arbitrary code.

Affected Version

Symantec BackupExec Calendar Control Buffer Overflow

This module exploits a stack buffer overflow in Symantec BackupExec Calendar Control. By sending an overly long string to the "_DOWText0" property located in the pvcalendar.ocx control, an attacker may be able to execute arbitrary code.

Affected Version

Oracle Document Capture 10g ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Oracle Document Capture 10g (10.1.3.5.0). Oracle Document Capture 10g comes bundled with a third party ActiveX control emsmtp.dll (6.0.1.0). When passing a overly long string to the method 'SubmitToExpress' an attacker may be able to execute arbitrary code.

9.3

CVSS

CRITICAL

Stack Buffer Overflow

119

CWE

Product Name

Oracle Document Capture

Platforms Tested

Windows

Affected Version

From:

Oracle Document Capture 10g (10.1.3.5.0)

To:

Oracle Document Capture 10g (10.1.3.5.0)

SAP AG SAPgui EAI WebViewer3D Buffer Overflow

This module exploits a stack buffer overflow in Siemens Unigraphics Solutions Teamcenter Visualization EAI WebViewer3D ActiveX control that is bundled with SAPgui. When passing an overly long string the SaveViewToSessionFile() method, arbitrary code may be executed.

7.5

CVSS

HIGH

Stack Buffer Overflow

Affected Version