The vulnerability is caused due to a boundary error when processing TTF font names and can be exploited to cause a stack-based buffer overflow via a specially crafted font file.
This module exploits a remote buffer overflow in the Citrix Provisioning Services 5.6 SP1 (without Hotfix CPVS56SP1E043) by sending a malformed packet with the opcode 0x40020002 (GetFooterRequest) to the 6905/UDP port. The module, which allows code execution under the context of SYSTEM, has been successfully tested on Windows Server 2003 SP2 and Windows XP SP3.
This module exploits a remote buffer overflow in the Citrix Provisioning Services 5.6 SP1 (without Hotfix CPVS56SP1E043) by sending a malformed packet with the opcode 0x40020006 (GetObjetsRequest) to the 6905/UDP port. The module, which allows code execution under the context of SYSTEM, has been successfully tested on Windows Server 2003 SP2 and Windows XP SP3.
This module exploits a remote buffer overflow in the Citrix Provisioning Services 5.6 SP1 (without Hotfix CPVS56SP1E043) by sending a malformed packet with the opcode 0x40020004 (GetBootRecordRequest) to the 6905/UDP port. The module, which allows code execution under the context of SYSTEM, has been successfully tested on Windows Server 2003 SP2 and Windows XP SP3.
The vulnerability is caused due to insufficient validation when decompressing an ECW images and can be exploited to cause a heap-based buffer overflow via a specially crafted file.
A buffer overflow vulnerability exists in Sorensoft Power Media 6.0 due to improper bounds checking of user-supplied input. An attacker can exploit this vulnerability by crafting a malicious ASzf file with a large amount of data and sending it to the application. This will cause the application to crash due to an out of memory error.
Supernews version 2.6.1 is vulnerable to a remote SQL injection vulnerability due to insufficient sanitization of user-supplied input. The vulnerable code is located in the noticias.php file, where the variable $idcategoria is not properly sanitized before being used in an SQL query. This can be exploited to inject arbitrary SQL code via the 'cat' parameter in a GET request. The filter function formatDados() can be bypassed by using strings such as 'uniunionon' and 'seleselectct' which will replace to clean 'union' and 'select' respectively. An example of a malicious request is http://www.example.com/noticias.php?cat=-1+uniunionon+seleselectct+1,version()--
NewsAdd version 1.0 is vulnerable to a remote SQL injection attack due to lack of validation or any filter to variable $id. An attacker can inject a malicious SQL query by using the $id variable in the URL. For example, http://www.example.com/newsadd/lerNoticia.php?id=-0'+union+all+select+1,2,VERSION(),4,5+from+usuarios--+
This exploit allows an attacker to navigate third-party documents to resources served with Content-Disposition: attachment, which can lead to a rogue download prompt attached to an unsuspecting page that never wanted the user to download the file. This is closely related to many other fundamental, open issues with browser UI design.
This module exploits a vulnerability found in PHP Volunteer Management System, version v1.0.2 or prior. This application has an upload feature that allows an authenticated user to upload anything to the 'uploads' directory, which is actually reachable by anyone without a credential. An attacker can easily abuse this upload functionality first by logging in with the default credential (admin:volunteer), upload a malicious payload, and then execute it by sending another GET request.
Services By CQR