pam_krb5: Privilege escalation

Background pamkrb5 is a a Kerberos v5 PAM module. Description The following vulnerabilities were discovered: pamkrb5 does not properly initialize the Kerberos libraries for setuid use CVE-2009-0360. Derek Chan reported that calls to pamsetcred are not properly handled when running setuid...

Apple Mac OSX xnu 1228.x - 'hfs-fcntl' Kernel Privilege Escalation

!/bin/bash xnu-hfs-fcntl-v2.sh Copyright c 2008 by Apple MACOS X 792.0 \n" \ "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n" if ! -f $EXPFILE ; then echo -n " compiling exploit..." gcc -Wall $EXPFILE.c -o $EXPFILE 2 /dev/null if $? != 0 ; then echo " failed" exit $? else echo " done" fi f...

Gentoo Security Advisory GLSA 200903-24 (shadow)

The remote host is missing updates announced in advisory GLSA 200903-24. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Ganglia: Execution of arbitrary code

Background Ganglia is a scalable distributed monitoring system for clusters and grids. Description Spike Spiegel reported a stack-based buffer overflow in the processpath function when processing overly long pathnames in gmetad/server.c. Impact A remote attacker could send a specially crafted...

Kaspersky AntiVirus Buffer Overflow Vulnerability

This host is running Kaspersky AntiVirus or Workstation and is prone to Buffer Overflow Vulnerability. OpenVAS Vulnerability Test $Id: gbkasperskyavbofvuln.nasl 6516 2017-07-04 12:20:47Z cfischer $ Kaspersky AntiVirus Buffer Overflow Vulnerability Authors: Sujit Ghosal Copyright: Copyright c 2009...

CVE-2009-0449

CVE-2009-0449 corresponds to a buffer overflow in klim5.sys within Kaspersky Anti-Virus for Workstations 6.0 and Anti-Virus 2008, enabling local privilege escalation via an IOCTL 0x80052110 call. The OpenVAS/NVD entries describe the affected driver and the local-exploit condition; CVSS v2 base sc...

Kaspersky klim5.sys驱动本地权限提升漏洞

BUGTRAQ ID: 33561 Kaspersky Internet Security套件是一套完整的解决方案，用于保护计算机抵御几乎所有来自互联网的主要的威胁。 Internet Security及其他Kaspersky产品中所发布的klim5.sys内核驱动在处理来自用户的数据时没有执行充分边界的检查，本地攻击者可以触发溢出，导致执行任意内核态指令。 Kaspersky Labs Kaspersky Antivirus 6.0 for Windows Kaspersky Labs Kaspersky Antivirus 2008 厂商补丁： Kaspersky Labs...

[Wintercore Research WS02-0209] Kaspersky Products Klim5.sys local privilege escalation

HTML VERSION http://www.wintercore.com/advisories/advisoryW020209.html exploit code http://kartoffel.reversemode.com/downloads.php Background Non-technical description Technical Description Exploiting it References Products Affected Credits Disclosure Timeline Contact 1. Background Founded in 199...

Solaris 9 (x86) : 138578-01

SunOS 5.9x86: kernel/sys/kaio patch. Date this patch was last updated by Sun : Jan/07/09 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

Solaris 9 (sparc) : 138577-01

SunOS 5.9: kernel/sys/kaio patch. Date this patch was last updated by Sun : Jan/07/09 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Phosheezy 2.0 Command Execution

!/usr/bin/perl phosheezy 2.0 http://www.ryneezy.net/apps/phosheezy/phosheezy-v0.2.tar.gz Remote Command Execution Exploit by Osirys osirysatlivedotit osirys.org Greets: HaVoC, x0r, jay, BlackLight lol at athos -------------------------------------------------------------- Exploit in action :D...

miniweb20-sql.txt

Miniweb 2.0 Admin bypass Type: 'union select 1 in the username field and press login, you are admin! download: http://www.miniweb2.com/ Found by bizzit and cybernetic Contact: bizzitatlive.de Greetz to: Suicide, ReED, h0yt3r, J0hn^x3r, tmh, n00bor, Five-Three-Nine, electron1x, Nazrek, Free-Hack a...

DDL-Speed Script - acpbackup Admin Backup Bypass

DDL-Speed Script - acpbackup Admin Backup Bypass DDL-Speed Script RFI Vulnerabilities ======================================================================================================================= Critical Level : Dangerous Vendor site : http://ddl-speed.org/ Will be back soon Download :...

FreeBSD/x86 - execv(/bin/sh) Shellcode (23 bytes)

FreeBSD/x86 - execv/bin/sh Shellcode 23 bytes. Shellcode exploit for FreeBSDx86 platform / -------------- FreeBSD/x86 - execv"/bin/sh" 23 bytes ------------------------- AUTHOR : Tosh OS : BSDx86 Tested on FreeBSD 8.1 EMAIL : [email protected] / include include char shellcode =...

DDL-Speed Script - 'acp/backup' Admin Backup Bypass

DDL-Speed Script RFI Vulnerabilities ======================================================================================================================= Critical Level : Dangerous Vendor site : http://ddl-speed.org/ Will be back soon Download :...

cleancms-blindsql.txt

Clean CMS 1.5 fulltxt.php id Blind SQL Injection Exploit url: http://www.4yoursite.nl/scriptcleancms.php Author: JosS mail: sys-projectathotmaildotcom site: http://hack0wn.com && spanish-hackers.com team: Spanish Hackers Team - SHT This was written for educational purpose. Use it at your own risk...

Team SHATTER Security Advisory: Oracle Database SQL Injection in SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory Oracle Database SQL Injection in SYS.DBMSCDCPUBLISH.ALTERAUTOLOGCHANGESOURCE November 12, 2008 Risk Level: Medium Affected versions: Oracle Database Server versions 10gR1, 10gR2 and 11gR1 Remote exploitable: Yes...

Team SHATTER Security Advisory: Oracle Database multiple SQL Injection vulnerabilities in Workspace Manager

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory Oracle Database multiple SQL Injection vulnerabilities in Workspace Manager November 12, 2008 Risk Level: High Affected versions: Oracle Database Server versions 9iR2, 10gR1, 10gR2 and 11gR1 Remote exploitable: Yes...

Linux Kernel < 2.4.36.9/2.6.27.5 Unix Sockets Local Kernel Panic Exploit

No description provided by source. include sys/socket.h include sys/un.h include unistd.h include assert.h include err.h include stdlib.h static int ownchildint us int pid; int s2; struct msghdr mh; char crap1024; struct iovec iov; struct cmsghdr c; int fd; int rc; pid = fork; if pid == -1 err1,...

Linux Kernel __scm_destroy()本地拒绝服务漏洞

BUGTRAQ ID: 32154 CVECAN ID: CVE-2008-5029 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的net/core/scm.c文件中的scmdestroy函数可能通过调用fput函数间接地递归调用其本身，本地攻击者可以通过UNIX域套接字发送SCMRIGHTS消息并关闭文件描述符导致拒绝服务的情况。 Linux kernel 2.6.27.4 Linux kernel 2.6.26 Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...