Cesar Cerrudo

23 exploits Active since Aug 2002
EIP-2026-119549 EXPLOITDB c WORKING POC
Oracle 10g (Windows x86) - 'PROCESS_DUP_HANDLE' Local Privilege Escalation
CVE-2005-0701 EXPLOITDB text WORKING POC
Oracle Database Server 8i and 9i - Directory Traversal via UTL_FILE Functions
Directory traversal vulnerability in Oracle Database Server 8i and 9i allows remote attackers to read or rename arbitrary files via "\\.\\.." (modified dot dot backslash) sequences to UTL_FILE functions such as (1) UTL_FILE.FOPEN or (2) UTL_FILE.frename.
CVE-2002-0982 EXPLOITDB text WORKING POC
Microsoft SQL Server 2000 SP2 - RCE
Microsoft SQL Server 2000 SP2, when configured as a distributor, allows attackers to execute arbitrary code via the @scriptfile parameter to the sp_MScopyscript stored procedure.
CVE-2002-0644 EXPLOITDB text WORKING POC
Microsoft SQL Server and MSDE 2000 - Buffer Overflow in Database Consistency Checker
Buffer overflow in several Database Consistency Checkers (DBCCs) for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows members of the db_owner and db_ddladmin roles to execute arbitrary code.
CVE-2010-0314 EXPLOITDB text WORKING POC
Apple Safari - URL Redirect Target Disclosure via Stylesheet LINK Element
Apple Safari allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value.
CVE-2010-2554 EXPLOITDB HIGH text SUSPICIOUS
Microsoft Windows Vista/Server 2008/7 Privilege Escalation via Registry Key ACL Misconfiguration
The Tracing Feature for Services in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 has incorrect ACLs on its registry keys, which allows local users to gain privileges via vectors involving a named pipe and impersonation, aka "Tracing Registry Key ACL Vulnerability."
CVSS 7.8
CVE-2004-0213 EXPLOITDB HIGH c WORKING POC
Windows 2000 - Privilege Escalation via Utility Manager Shatter Attack
Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908.
CVSS 7.8
CVE-2008-1436 EXPLOITDB text SUSPICIOUS
Microsoft Windows XP-Vista-2003-2008 - Privilege Escalation
Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.
CVE-2005-0047 EXPLOITDB c WORKING POC
Windows 2000, XP, and Server 2003 - Remote Code Execution via COM Structured Storage
Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability."
CVE-2004-0894 EXPLOITDB c++ WORKING POC
Windows 2000/2003 - Privilege Escalation
LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program.
CVE-2005-0058 EXPLOITDB c++ WORKING POC
Microsoft Windows TAPI - Buffer Overflow via Crafted Message
Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to elevate privileges or execute arbitrary code via a crafted message.
CVE-2004-0213 EXPLOITDB HIGH c WORKING POC
Windows 2000 - Privilege Escalation via Utility Manager Shatter Attack
Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908.
CVSS 7.8
CVE-2004-0213 EXPLOITDB HIGH c WORKING POC
Windows 2000 - Privilege Escalation via Utility Manager Shatter Attack
Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908.
CVSS 7.8
CVE-2003-0908 EXPLOITDB c WORKING POC
Microsoft Windows 2000 - Local Privilege Escalation via Utility Manager Shatter Attack
The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that accesses the context sensitive help button in the GUI, as demonstrated using the File Open dialog in the Help window, a different vulnerability than CVE-2004-0213.
CVE-2009-0080 EXPLOITDB text SUSPICIOUS
Windows Vista Gold/SP1 & Server 2008 - Privilege Escalation
The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by leveraging incorrect thread ACLs to access the resources of one of the processes, aka "Windows Thread Pool ACL Weakness Vulnerability."
CVE-2009-0079 EXPLOITDB text SUSPICIOUS
Windows XP SP2-SP3 and Server 2003 SP1-SP2 - Privilege Escalation via RPCSS Service Isolation
The RPCSS service in Microsoft Windows XP SP2 and SP3 and Server 2003 SP1 and SP2 does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by accessing the resources of one of the processes, aka "Windows RPCSS Service Isolation Vulnerability."
CVE-2009-0078 EXPLOITDB text SUSPICIOUS
Microsoft Windows - Privilege Escalation
The Windows Management Instrumentation (WMI) provider in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by accessing the resources of one of the processes, aka "Windows WMI Service Isolation Vulnerability."
CVE-2003-0470 EXPLOITDB text WORKING POC
Symantec Security Check - Buffer Overflow
Buffer overflow in the "RuFSI Utility Class" ActiveX control (aka "RuFSI Registry Information Class"), as used for the Symantec Security Check service, allows remote attackers to execute arbitrary code via a long argument to CompareVersionStrings.
CVE-2003-0117 EXPLOITDB text WORKING POC
Microsoft BizTalk Server 2002 - Buffer Overflow in HTTP Receiver Function
Buffer overflow in the HTTP receiver function (BizTalkHTTPReceive.dll ISAPI) of Microsoft BizTalk Server 2002 allows attackers to execute arbitrary code via a certain request to the HTTP receiver.
CVE-2010-0655 EXPLOITDB html WORKING POC
Google Chrome < 4.0.249.78 - Use-After-Free via Blocked Popup Window
Use-after-free vulnerability in Google Chrome before 4.0.249.78 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving the display of a blocked popup window during navigation to a different web site.
CVE-2010-0315 EXPLOITDB html WORKING POC
Google Chrome < 4.0.249.89 - URL Discovery via Stylesheet LINK Element
WebKit before r53607, as used in Google Chrome before 4.0.249.89, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value, related to an IFRAME element.
CVE-2003-0118 EXPLOITDB text WORKING POC
Microsoft BizTalk Server 2000 and 2002 - SQL Injection via DTA Website Request
SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system commands via a request to (1) rawdocdata.asp or (2) RawCustomSearchField.asp containing an embedded SQL statement.
CVE-2003-0118 EXPLOITDB text WORKING POC
Microsoft BizTalk Server 2000 and 2002 - SQL Injection via DTA Website Request
SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system commands via a request to (1) rawdocdata.asp or (2) RawCustomSearchField.asp containing an embedded SQL statement.