Nine:Situations:Group

52 exploits Active since Jun 2008
CVE-2009-1677 EXPLOITDB php WORKING POC
bitweaver <= 2.6 - Authenticated PHP Code Injection via Display Name
Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking boards/boards_rss.php, and might allow (2) remote attackers to inject arbitrary PHP code into files via the HTTP Host header in a request to boards/boards_rss.php.
CVE-2009-1669 EXPLOITDB php WORKING POC
Smarty 2.6.22 - Remote Code Execution via Math Function Equation Attribute
The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. NOTE: some of these details are obtained from third party information.
CVE-2009-4668 EXPLOITDB php WORKING POC
jetAudio <7.5.3.15 - Buffer Overflow
Stack-based buffer overflow in JetCast.exe 2.0.4.1109 in jetAudio 7.5.2 and 7.5.3.15 allows remote attackers to execute arbitrary code via a long ID3 tag in an MP3 file. NOTE: some of these details are obtained from third party information.
CVE-2009-1743 EXPLOITDB php WORKING POC
Pinnacle Studio 12 - Path Traversal and Arbitrary File Write via Hollywood FX Archive Filename
Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to create and overwrite arbitrary files via a filename containing a ..\ (dot dot backslash) sequence in a Hollywood FX Compressed Archive (.hfz) file. NOTE: this can be leveraged for code execution by decompressing a file to a Startup folder. NOTE: some of these details are obtained from third party information.
CVE-2009-1282 EXPLOITDB php WORKING POC
glFusion <= 1.1.2 - SQL Injection via glf_session Cookie Parameter
SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the glf_session cookie parameter.
CVE-2008-6936 EXPLOITDB html WORKING POC
Exodus 0.10 - Argument Injection via Encoded Spaces in pres:// URI
Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in a pres:// URI, a different vector than CVE-2008-6935.
CVE-2008-6935 EXPLOITDB html WORKING POC
Exodus 0.10 - Argument Injection via Encoded Spaces in im:// URI
Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in an im:// URI.
CVE-2008-6935 EXPLOITDB text WORKING POC
Exodus 0.10 - Argument Injection via Encoded Spaces in im:// URI
Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in an im:// URI.
CVE-2008-5749 EXPLOITDB html WORKING POC
Google Chrome <1.0.154.36 - Command Injection
Argument injection vulnerability in Google Chrome 1.0.154.36 on Windows XP SP3 allows remote attackers to execute arbitrary commands via the --renderer-path option in a chromehtml: URI. NOTE: a third party disputes this issue, stating that Chrome "will ask for user permission" and "cannot launch the applet even [if] you have given out the permission.
CVE-2008-4471 EXPLOITDB html WORKING POC
Autodesk Design Review and DWF Viewer - Path Traversal and Arbitrary File Write via SaveAS Method
Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control (AdView.dll 9.0.0.96), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to overwrite arbitrary files via "..\" sequences in the argument to the SaveAS method.
CVE-2008-6922 EXPLOITDB php WORKING POC
CMailServer 5.4.6 - Stack-Based Buffer Overflow via Multiple CMailCOM.dll Methods
Multiple stack-based buffer overflows in CMailCOM.dll in CMailServer 5.4.6 allow remote attackers to execute arbitrary code via a long argument to the (1) CreateUserPath, (2) Logout, (3) DeleteMailByUID, (4) MoveToInbox, (5) MoveToFolder, (6) DeleteMailEx, (7) GetMailDataEx, (8) SetReplySign, (9) SetForwardSign, and (10) SetReadSign methods, which are not properly handled by (a) the POP3 Class ActiveX control (CMailCom.POP3); or a long argument to the (11) AddAttach, (12) SetSubject, (13) SetBcc, (14) SetBody, (15) SetCc, (16) SetFrom, (17) SetTo, and (18) SetFromUID methods, which are not properly handled by the Class ActiveX control (CMailCOM.SMTP), as demonstrated via the indexOfMail parameter to mwmail.asp.
CVE-2009-1087 EXPLOITDB text WORKING POC
PPLive < 1.9.21 - Remote Code Execution via URI Handler Argument Injection
Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute arbitrary code via a UNC share pathname in the LoadModule argument to the (1) synacast, (2) Play, (3) pplsv, or (4) ppvod URI handler. NOTE: some of these details are obtained from third party information.
CVE-2009-0811 EXPLOITDB html WORKING POC
SopCast SopCore ActiveX <3.0.3.501 - RCE
Insecure method vulnerability in the SopCast SopCore ActiveX control in sopocx.ocx 3.0.3.501 allows remote attackers to execute arbitrary programs via an executable file name in the argument to the SetExternalPlayer method.
CVE-2008-4342 EXPLOITDB html WORKING POC
BurnAware - Arbitrary File Write via NMSDVDX.DVDEngineX ActiveX Control
NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other products, allows remote attackers to overwrite and create arbitrary files via calls to the EnableLog and LogMessage methods. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.
CVE-2009-2570 EXPLOITDB html WORKING POC
Symantec WinFax Pro 10.03 - Buffer Overflow
Stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control in WinFax\DCCFAXVW.DLL in Symantec WinFax Pro 10.03 allows remote attackers to execute arbitrary code via a long argument to the AppendFax method.
CVE-2008-2910 EXPLOITDB html WORKING POC
muvee autoProducer 6.0 and 6.1 - Buffer Overflow via DXTTextOutEffect ActiveX FontSetting Property
Buffer overflow in the DXTTextOutEffect ActiveX control (aka the Text-Effect DXT Filter), as distributed in TextOut.dll 6.0.18.1 and mvtextout.dll, in muvee autoProducer 6.0 and 6.1 allows remote attackers to execute arbitrary code via a long FontSetting property value.
EIP-2026-119176 EXPLOITDB html WORKING POC
SupportSoft DNA Editor Module - 'dnaedit.dll' Code Execution
CVE-2008-7070 EXPLOITDB html WORKING POC
KVIrc 3.4.2 - Remote Code Execution via URI Handler Argument Injection
Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary commands via a " (quote) followed by command line switches in a (1) irc:///, (2) irc6:///, (3) ircs:///, or (4) and ircs6:/// URI. NOTE: this might be due to an incomplete fix for CVE-2007-2951.
CVE-2008-6748 EXPLOITDB html WORKING POC
Megacubo 5.0.7 - Remote Code Execution via mega:// URI Play Action
Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the play action in a mega:// URI.
CVE-2008-4493 EXPLOITDB html WORKING POC
Microsoft Digital Image 2006 Starter Edition - Arbitrary File Upload via PicturePusher ActiveX Control
Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Edition, allows remote attackers to force the upload of arbitrary files by using the AddString and Post methods and a modified PostURL to construct an HTTP POST request. NOTE: this issue might only be exploitable in limited environments or non-default browser settings.
CVE-2009-1092 EXPLOITDB html WORKING POC
GeoVision LIVEAUDIO.LiveAudioCtrl.1 ActiveX Control 7.0 - Use-After-Free via GetAudioPlayingTime Method
Use-after-free vulnerability in the LIVEAUDIO.LiveAudioCtrl.1 ActiveX control in LIVEAU~1.OCX 7.0 for GeoVision DVR systems allows remote attackers to execute arbitrary code by calling the GetAudioPlayingTime method with certain arguments.
CVE-2009-0865 EXPLOITDB html WORKING POC
GeoVision LiveX ActiveX Control 8.1.2 and 8.2.0 - Path Traversal via SnapShotToFile Method
Directory traversal vulnerability in the SnapShotToFile method in the GeoVision LiveX (aka LiveX_v8200) ActiveX control 8.1.2 and 8.2.0 in LIVEX_~1.OCX allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument, possibly involving the PlayX and SnapShotX methods.
CVE-2008-6937 EXPLOITDB html WORKING POC
Exodus 0.10 - Argument Injection via Encoded Spaces in xmpp:// URI
Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in an xmpp:// URI, a different vector than CVE-2008-6935 and CVE-2008-6936. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2008-2551 EXPLOITDB html WORKING POC
Icona Instant Messenger 1.0.0.1 - Remote Code Execution via DownloaderActiveX Control
The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and execution of arbitrary files via a URL in the propDownloadUrl parameter with the propPostDownloadAction parameter set to "run."
CVE-2008-6937 EXPLOITDB text WORKING POC
Exodus 0.10 - Argument Injection via Encoded Spaces in xmpp:// URI
Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in an xmpp:// URI, a different vector than CVE-2008-6935 and CVE-2008-6936. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.