CensorNet crossite scripting
Published:		24.10.2003
Source:		BUGTRAQ
SecurityVulns ID:		3202
Type:		remote
Level:		5/10
Description:		Crossite scripting in dansguardian.pl.

Affected:

CENSORNET : Censornet 3.0

Original document

Richard Maudsley, CensorNet: Cross Site Scripting Vulnerability (24.10.2003)

Discuss:

Read or add your comments to this news (0 comments)

Win32 'Shatter' attacks updated since 22.08.2002
Published:		24.10.2003
Source:		BUGTRAQ
SecurityVulns ID:		2241
Type:		local
Level:		7/10
Description:		Is priveleged application doesn't check system messages data it may be possible to execute code in application context by setting callback functions or excluding limits causing buffer overflws.

Affected:		MICROSOFT : Windows NT 4.0 Workstation
		MICROSOFT : Windows NT 4.0 Server
		MICROSOFT : Windows 2000 Server
		MICROSOFT : Windows 2000 Advanced Server
		MICROSOFT : Windows 2000 Professional
		VNC : VNC 3.3
		MICROSOFT : Windows XP
		TIGHTVNC : tightvnc 1.2
		NAI : VirusScan 4.5
		TRIDIAVNC : TridiaVNC 1.5
		DAMEWARE : DameWare Mini Remote Control Server 3.70

Original document		xenophi1e, Shatter XP (24.10.2003)
		ash_(at)_felinemenace.org, DameWare Mini-RC Shatter (14.08.2003)
		Brett Moore, Shattering SEH II (30.07.2003)
		MICROSOFT, Microsoft Security Bulletin MS02-071:Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation (328310) (14.12.2002)
		MICROSOFT, Microsoft Security Bulletin MS02-071 (12.12.2002)
		EXT-Bellers, Chris, Win32 API 'shatter' vulnerability found in VNC-based products (22.08.2002)

Files:		Exploiting design flaws in the Win32 API for privilege escalation.
		Winlogon NetDDE Agent window WM_TIMER exploit
		Tab Control Shatter Attack Exploit
		Win32 'shatter' exploit
		Demonstrates the use of listview messages to inject shellcode to known location; overwrite 4 bytes of a critical memory address
		Microsoft Utility Manager Local Privilege Escalation
		Win32 Message Vulnerabilities Redux
Discuss:		Read or add your comments to this news (0 comments)

HTML help privilege escalation updated since 24.10.2003
Published:		12.01.2004
Source:		FULL-DISCLOSURE
SecurityVulns ID:		3201
Type:		library
Level:		5/10
Description:		HtmlHelp() call doesn't drop system privileges.

Affected:		MICROSOFT : Windows 2000 Server
		MICROSOFT : Windows XP
		MICROSOFT : Windows 2003 Server
		MICROSOFT : Windows 2000 Profiessional
		SYMANTEC : Norton Internet Security 2004

Original document		Kevin Finisterre, SRT2004-01-9-1022 - Symantec LiveUpdate allows local users to become SYSTEM (12.01.2004)
		Brett Moore, [Full-Disclosure] HTML Help API - Privilege Escalation (24.10.2003)

Discuss:

Read or add your comments to this news (0 comments)