This exploit allows an attacker to perform a remote buffer overflow in Easy File Sharing Web Server v6.9. The vulnerability was discovered by Tracy Turben and reported to the vendor.
The AWBS v2.4.0 application is vulnerable to remote file inclusion. An attacker can include a remote file in the 'workdir' parameter of the 'cart2.php' script. This can lead to arbitrary code execution or information disclosure.
The vulnerability exists in the /user/download.php script of the USP FOSS Distribution 1.01. By manipulating the 'dnld' parameter, an attacker can disclose arbitrary files from the system, such as /etc/passwd.
OpenX is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
There is a buffer overflow in Adobe products that can be triggered while processing a malformed BMP, DIB or RLE file.
The maintenance service creates a log file in a user writable location. It’s possible to change the log file to a hardlink to another file to cause file corruption or elevation of privilege. When the maintenance service starts, it creates a log file under c:programdatamozillalogs. This directory it creates the file in has fairly permissive permissions which allows a normal user to create new files underneath that directory. It’s possible to race the creation of the log file during the service initialization to drop a hardlink to an existing file on the same drive (which is probably the system drive) which when opened by the maintenance service running as local system will cause the file to be overwritten by the log data. At the very least this would corrupt the target file, however as the user has some control over bits of the contents, such as the updater path, it’s possible to get some user controlled contents in there. This might be used to elevate privileges by overwriting a script file which has a permissive parser, such as powershell, batch or HTA which subsequently gets executed by a privileged process. The only slight difficulty in exploitation is that the user cannot directly delete the log file to replace it with a hardlink. However, this isn’t a significant issue as before opening the log file the service backs up the log to a new name leaving the directory entry for “maintenanceservice.log” free. Therefore there’s a race condition between the log file being moved out of the way and the new log file being created. So to exploit this you perform the following operations: 1. Start a thread which creates a hard link in the log directory to the file
The Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files. This results in a PAGE_FAULT_IN_NONPAGED_AREA error with the memory referenced being a3a3a3db. The crash occurs when attempting to write to the memory address eax+38h in the ATMFD module.
This Perl script is used to perform a SIP flooding attack. It creates a UDP socket and sends a crafted SIP INVITE request to the specified target IP address. The script generates random user IDs and sends the request repeatedly every 90 seconds. The purpose of this attack is to overwhelm the target server with a high volume of SIP requests, causing it to become unresponsive or crash.
The win32k!itrp_IUP function in Windows kernel crashes while processing corrupted TTF font files due to memory corruption. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service.
The win32k!scl_ApplyTranslation function in the Windows kernel crashes while processing corrupted TTF font files. This can lead to a PAGE_FAULT_IN_NONPAGED_AREA with an invalid memory reference, causing system instability.
Services By CQR