Microsoft Internet Explorer is prone to multiple security-bypass vulnerabilities because it fails to properly handle encoded values in X.509 certificates. Specifically, it fails to properly distinguish integer sequences that are then recognized as CN (common name) elements. Successful exploits allow attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
The Vivvo Article Manager v 3.4 is vulnerable to remote code execution. By exploiting the './include/db_conn.php' script, an attacker can execute arbitrary code on the server. The vulnerability can be exploited by appending a specially crafted URL parameter 'root' with a shell URL.
This exploit takes advantage of an unquoted variable in the news.php file of webSPELL v4.01.02, allowing for remote SQL injection. The exploit can only be used if the register_globals setting is turned on. It requires the host and path of the target, as well as optional parameters for the user ID and table name. The exploit uses a loop to retrieve the MD5 hash character by character.
This exploit allows an attacker to execute arbitrary code by injecting a malicious script through the 'ht_pfad' parameter in the 'generate.php' file.
This is a remote file inclusion vulnerability in the VS-Link-Partner version 2.1. The vulnerability allows an attacker to include a remote file by exploiting the 'script_pfad' parameter in the 'functions_inc.php' file. By manipulating the 'gb_pfad' parameter, an attacker can execute arbitrary code on the server.
This exploit allows an attacker to include remote files in the VS-News-System version 1.2.1. The vulnerability is present in the 'newsordner' parameter of the 'show_news_inc.php' file. By manipulating the 'newsordner' parameter, an attacker can include a remote file hosted on a different server. This can lead to remote code execution or disclosure of sensitive information.
This module exploits a vulnerability found in the ActiveX component of Adobe Flash Player before 12.0.0.43. By supplying a specially crafted swf file it is possible to trigger an integer underflow in several avm2 instructions, which can be turned into remote code execution under the context of the user, as exploited in the wild in February 2014. This module has been tested successfully with Adobe Flash Player 11.7.700.202 on Windows XP SP3, Windows 7 SP1 and Adobe Flash Player 11.3.372.94 on Windows 8 even when it includes rop chains for several Flash 11 versions, as exploited in the wild.
The vulnerability exists in the pop_profile.asp script in Snitz Forums 2000 Version 3.1 SR4. An attacker can inject malicious SQL code through the 'id' parameter, which can lead to unauthorized access to the database.
This exploit targets a vulnerability in Mail Enable Professional version 2.35 for Windows. It allows an attacker to execute remote code on the vulnerable system.
This exploit targets Solaris 2.5.1 /usr/bin/ps command. It takes advantage of a buffer overflow vulnerability in the program. The exploit code is written in C and it overflows the target buffer for optargs, modifies the environ pointer, and fills the _ctype table with a specific value. It also builds up the _iob[0] structure. The exploit is designed for Solaris 2.5.1.
Services By CQR