FreshView is vulnerable to an unspecified buffer overflow when processing a crafted .PSP file. This exploit runs calc.exe or binds shell to port 4444.
ABC-View Manager is vulnerable to an unspecified buffer overflow when processing a crafted .TTF file. This exploit runs calc.exe or binds shell to port 4444.
An access violation was observed in Microsoft Office 2007 (Word document) due to a memcpy with an invalid source buffer. The crash occurs because of an invalid size being used in a pointer calculation in wwlib.dll.
This is a basic exploit for the Alessandro Lulli wavewoo application that allows remote file inclusion. The exploit uses a specific path and file name to include a shell script hosted on a remote server.
This exploit allows an attacker to perform a remote buffer overflow in Easy File Sharing Web Server v6.9. The vulnerability was discovered by Tracy Turben and reported to the vendor.
The AWBS v2.4.0 application is vulnerable to remote file inclusion. An attacker can include a remote file in the 'workdir' parameter of the 'cart2.php' script. This can lead to arbitrary code execution or information disclosure.
The vulnerability exists in the /user/download.php script of the USP FOSS Distribution 1.01. By manipulating the 'dnld' parameter, an attacker can disclose arbitrary files from the system, such as /etc/passwd.
OpenX is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
There is a buffer overflow in Adobe products that can be triggered while processing a malformed BMP, DIB or RLE file.
The maintenance service creates a log file in a user writable location. It’s possible to change the log file to a hardlink to another file to cause file corruption or elevation of privilege. When the maintenance service starts, it creates a log file under c:programdatamozillalogs. This directory it creates the file in has fairly permissive permissions which allows a normal user to create new files underneath that directory. It’s possible to race the creation of the log file during the service initialization to drop a hardlink to an existing file on the same drive (which is probably the system drive) which when opened by the maintenance service running as local system will cause the file to be overwritten by the log data. At the very least this would corrupt the target file, however as the user has some control over bits of the contents, such as the updater path, it’s possible to get some user controlled contents in there. This might be used to elevate privileges by overwriting a script file which has a permissive parser, such as powershell, batch or HTA which subsequently gets executed by a privileged process. The only slight difficulty in exploitation is that the user cannot directly delete the log file to replace it with a hardlink. However, this isn’t a significant issue as before opening the log file the service backs up the log to a new name leaving the directory entry for “maintenanceservice.log” free. Therefore there’s a race condition between the log file being moved out of the way and the new log file being created. So to exploit this you perform the following operations: 1. Start a thread which creates a hard link in the log directory to the file
Services By CQR