Rick2600

21 exploits Active since Nov 2009
CVE-2024-55656 NOMISEC HIGH WORKING POC
RedisBloom 2.2.0-2.2.18, 2.4.0-2.4.11, 2.6.0-2.6.13, 2.8.0-2.8.1 - Integer Overflow in CMS.INITBYDIM
RedisBloom adds a set of probabilistic data structures to Redis. There is an integer overflow vulnerability in RedisBloom, which is a module used in Redis. The integer overflow vulnerability allows an attacker (a redis client which knows the password) to allocate memory in the heap lesser than the required memory due to wraparound. Then read and write can be performed beyond this allocated memory, leading to info leak and OOB write. The integer overflow is in CMS.INITBYDIM command, which initialize a Count-Min Sketch to dimensions specified by user. It accepts two values (width and depth) and uses them to allocate memory in NewCMSketch(). This vulnerability is fixed in 2.2.19, 2.4.12, 2.6.14, and 2.8.2.
CVSS 8.8
CVE-2012-10055 EXPLOITDB CRITICAL ruby WORKING POC
ComSndFTP FTP Server <1.3.7 Beta - Code Injection
ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (specifically WSACleanup from Ws2_32.dll). This allows the attacker to redirect execution flow and bypass DEP protections using a ROP chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and affects default configurations.
CVE-2011-10024 EXPLOITDB HIGH ruby WORKING POC
MJM Core Player 2011 - Buffer Overflow
MJM Core Player (likely now referred to as MJM Player) 2011 is vulnerable to a stack-based buffer overflow when parsing specially crafted .s3m music files. The vulnerability arises from improper bounds checking in the file parser, allowing an attacker to overwrite memory on the stack and execute arbitrary code. Exploitation is triggered when a user opens a malicious .s3m file, and the exploit bypasses DEP and ASLR protections using a ROP chain.
CVE-2011-10023 EXPLOITDB HIGH ruby WORKING POC
MJM QuickPlayer 2010 - Stack-based Buffer Overflow via Malicious S3M File
MJM QuickPlayer (also known as MJM Player) version 2010 contains a stack-based buffer overflow vulnerability triggered by opening a malicious .s3m music file. The flaw occurs due to improper bounds checking in the file parser, allowing an attacker to overwrite memory and execute arbitrary code. Exploitation is achieved via a crafted payload that bypasses DEP and ASLR protections using ROP techniques, and requires user interaction to open the file.
CVE-2010-5333 EXPLOITDB CRITICAL ruby WORKING POC
Integard Pro/Home <2.0.0.9037 & 2.2.x <2.2.0.9037 - RCE
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable software. This CVE is to track an alternate exploitation method, utilizing an EIP-overwrite buffer overflow.
CVSS 9.8
CVE-2010-5333 EXPLOITDB CRITICAL ruby WORKING POC
Integard Pro/Home <2.0.0.9037 & 2.2.x <2.2.0.9037 - RCE
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable software. This CVE is to track an alternate exploitation method, utilizing an EIP-overwrite buffer overflow.
CVSS 9.8
CVE-2010-10014 EXPLOITDB HIGH ruby WORKING POC
Odin Secure FTP <= 4.1 - Buffer Overflow
Odin Secure FTP <= 4.1 is vulnerable to a stack-based buffer overflow when parsing directory listings received in response to an FTP LIST command. A malicious FTP server can send an overly long filename in the directory listing, which overflows a fixed-size stack buffer in the client and overwrites the Structured Exception Handler (SEH). This allows remote attackers to execute arbitrary code on the client system.
CVE-2010-5333 METASPLOIT CRITICAL ruby WORKING POC
Integard Pro/Home <2.0.0.9037 & 2.2.x <2.2.0.9037 - RCE
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable software. This CVE is to track an alternate exploitation method, utilizing an EIP-overwrite buffer overflow.
CVSS 9.8
CVE-2012-10053 METASPLOIT CRITICAL ruby WORKING POC
Simple Web Server 2.2 rc2 - Buffer Overflow
Simple Web Server 2.2 rc2 contains a stack-based buffer overflow vulnerability in its handling of the Connection HTTP header. When a remote attacker sends an overly long string in this header, the server uses vsprintf() without proper bounds checking, leading to a buffer overflow on the stack. This flaw allows remote attackers to execute arbitrary code with the privileges of the web server process. The vulnerability is triggered before authentication.
CVE-2011-10024 METASPLOIT HIGH ruby WORKING POC
MJM Core Player 2011 - Buffer Overflow
MJM Core Player (likely now referred to as MJM Player) 2011 is vulnerable to a stack-based buffer overflow when parsing specially crafted .s3m music files. The vulnerability arises from improper bounds checking in the file parser, allowing an attacker to overwrite memory on the stack and execute arbitrary code. Exploitation is triggered when a user opens a malicious .s3m file, and the exploit bypasses DEP and ASLR protections using a ROP chain.
CVE-2011-10023 METASPLOIT HIGH ruby WORKING POC
MJM QuickPlayer 2010 - Stack-based Buffer Overflow via Malicious S3M File
MJM QuickPlayer (also known as MJM Player) version 2010 contains a stack-based buffer overflow vulnerability triggered by opening a malicious .s3m music file. The flaw occurs due to improper bounds checking in the file parser, allowing an attacker to overwrite memory and execute arbitrary code. Exploitation is achieved via a crafted payload that bypasses DEP and ASLR protections using ROP techniques, and requires user interaction to open the file.
CVE-2010-10014 METASPLOIT HIGH ruby WORKING POC
Odin Secure FTP <= 4.1 - Buffer Overflow
Odin Secure FTP <= 4.1 is vulnerable to a stack-based buffer overflow when parsing directory listings received in response to an FTP LIST command. A malicious FTP server can send an overly long filename in the directory listing, which overflows a fixed-size stack buffer in the client and overwrites the Structured Exception Handler (SEH). This allows remote attackers to execute arbitrary code on the client system.
CVE-2012-10055 METASPLOIT CRITICAL ruby WORKING POC
ComSndFTP FTP Server <1.3.7 Beta - Code Injection
ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (specifically WSACleanup from Ws2_32.dll). This allows the attacker to redirect execution flow and bypass DEP protections using a ROP chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and affects default configurations.
EIP-2026-119075 EXPLOITDB ruby WORKING POC
Race River Integard Home/Pro - LoginAdmin Password Stack Buffer Overflow (Metasploit)
CVE-2010-1597 EXPLOITDB python WORKING POC
ZipGenius 6.3.1.2552 - Stack-Based Buffer Overflow via Long Filename in ZIP Entry
Stack-based buffer overflow in zgtips.dll in ZipGenius 6.3.1.2552 allows user-assisted remote attackers to execute arbitrary code via a ZIP file containing an entry with a long filename.
EIP-2026-118115 EXPLOITDB perl WORKING POC
Windisc 1.3 - Local Stack Buffer Overflow
EIP-2026-117930 EXPLOITDB perl WORKING POC
SOMPL Player 1.0 - Local Buffer Overflow
EIP-2026-117886 EXPLOITDB ruby WORKING POC
S.O.M.P.L 1.0 Player - Local Buffer Overflow (Metasploit)
CVE-2009-4097 EXPLOITDB python WORKING POC
Serenity Audio Player <3.2.3 - Buffer Overflow
Stack-based buffer overflow in the MplayInputFile function in Serenity Audio Player 3.2.3 and earlier allows remote attackers to execute arbitrary code via a long URL in an M3U file. NOTE: some of these details are obtained from third party information.
EIP-2026-117710 EXPLOITDB ruby WORKING POC
Nuance PDF Reader 6.0 - Launch Stack Buffer Overflow (Metasploit)
EIP-2026-116178 EXPLOITDB perl WORKING POC
Remote Help HTTP 0.0.7 - GET Format String Denial of Service