CVE-2007-0819: Undefined Security Weakness

HP Network Node Manager NNM Remote Console 7.50, 7.51, and 7.53 assigns Everyone Full Control permission for the %PROGRAMFILES%\HP OpenView directory tree, which allows local users to gain privileges via a Trojan horse executable file or ActiveX component, or a modified bin\ovtrcsvc.exe for the H...

solaris/sparc executes command after setreuid (92 bytes + cmd)

No description provided by source. / bunkersparcexec.c V1.0 - Sat Oct 21 17:45:27 CEST 2006 Solaris/sparc bytecode that executes command after setreuid 92 bytes + cmd setreuid0, 0 + execve"/bin/sh", "/bin/sh","-c","cmd", NULL; bunker - http://rawlab.mindcreations.com...

MySQL 4.x/5.0 User-Defined Function Command Execution Exploit (win)

Exploit for unknown platform in category remote exploits =================================================================== MySQL 4.x/5.0 User-Defined Function Command Execution Exploit win =================================================================== -- raptorwinudf.sql - A MySQL UDF...

MySQL 4.x5.0 (Windows) - User-Defined Function Command Execution

MySQL 4.x5.0 Windows - User-Defined Function Command Execution -- raptorwinudf.sql - A MySQL UDF backdoor kit for Windows -- Copyright c 2007 Marco Ivaldi -- -- This is a MySQL backdoor kit for Windows based on the UDFs User Defined -- Functions mechanism. Use it to spawn a reverse shell netcat U...

USN-410-2: teTeX vulnerability

USN-410-1 fixed vulnerabilities in the poppler PDF loader library. This update provides the corresponding updates for a copy of this code in tetex-bin in Ubuntu 5.10. Versions of tetex-bin after Ubuntu 5.10 use poppler directly and do not need a separate update. Original advisory details: The...

CVE-2007-0482: Undefined Security Weakness

cgi-bin/main in Sun Ray Server Software 2.0 and 3.0 before 20070123 allows local users to obtain the utadmin password by reading a web server's log file, or by conducting a different, unspecified local attack...

CVE-2007-0404: Undefined Security Weakness

bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a 1 .po or 2 .mo file...

Teach you to retrieve Windows NT Admin rights on the method-vulnerability warning-the black bar safety net

One, by modifying the registry Those who have logged on NT the machine of the user, for example, IUSRmachine, have to HKEYLOCALMACHINE\SOFTWARE\MICROSOFT\WINDOWS\CurrentVersion\Run item Read and write permissions, the user can remotely access This item. For example, he can create a bat file, the...

OpenLDAP <= 2.4.3 (KBIND) Remote Buffer Overflow Exploit

No description provided by source. / openldap-kbind-p00f.c - OpenLDAP kbind remote exploit Only works on servers compiled with --enable-kbind enable LDAPv2+ Kerberos IV bind deprecated no by Solar Eclipse [email protected] Shoutouts to LSD for their l33t asm code and to all 0dd people...

CVE-2006-5607: Undefined Security Weakness

Directory traversal vulnerability in /cgi-bin/webcm in INCA IM-204 allows remote attackers to read arbitrary files via a "/./." modified dot dot sequences in the getpage parameter...

expect (/usr/bin/expect) buffer overflow

No description provided by source. / hhp-expectsmash.c 12/11/00 expect /usr/bin/expect buffer overflow. Tested 5.31.8 and 5.28.1, slackware 7.x Maybe others. By: isox Site: www.hhp-programming.net Advisory: www.hhp-programming.net/ouradvisories/hhp-expectadv%2317.txt / include stdio.h include...

GLIBC (via /bin/su) Local Root Exploit

No description provided by source. / Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of /bin/su program with the address of the shellcode, so, the program executes it when main returns or exit is called Thanks a lot to rwxrwxr...

Solaris Runtime Linker (ld.so.1) Buffer Overflow Exploit (SPARC version

No description provided by source. / ld.so.1 exploit SPARC coded by: osker178 bjr213 psu.edu Alright, so this exploits a fairly standard buffer overflow in the default Solaris runtime linker ld.so.1 discovery by Jouko Pynnonen Only real deviation here from the standard overflow and return into li...

UNIX 7th Edition /bin/mkdir Local Buffer Overflow Exploit

No description provided by source. / Exploit for /bin/mkdir Unix V7 PDP-11. mkdir has a buffer overflow when checking if the directory in /arg/with/slashes/fname exists. This will run /bin/sh with euid 0, but not uid 0. Since the shell doesn't do anything special about this, we don't really care...

AIX 4.2 /usr/dt/bin/dtterm Local Buffer Overflow Exploit

No description provided by source. include stdio.h include stdlib.h include string.h char prog100="/usr/dt/bin/dtterm"; char prog230="dtterm"; extern int execv; char createvarchar name,char value char c; int l; l=strlenname+strlenvalue+4; if ! c=mallocl perror"error allocating";exit2;;...

CVE-2006-5537: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in cgi-bin/webcm in D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allow remote attackers to inject arbitrary web script or HTML via the 1 upnp:settings/state or 2 upnp:settings/connection parameters...

CVE-2006-5536: Undefined Security Weakness

Directory traversal vulnerability in cgi-bin/webcm in D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allows remote attackers to read arbitrary files via a .. dot dot in the getpage parameter...

CVE-2006-5538: Undefined Security Weakness

D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allows remote attackers to list contents of the cgi-bin directory via unspecified vectors, probably a direct request...

BIND 8.2.x (TSIG) Remote Root Stack Overflow Exploit (3)

No description provided by source. / copyright LAST STAGE OF DELIRIUM feb 2001 poland ://lsd-pl.net/ / / bind 8.2 8.2.1 8.2.2 8.2.2-PX Solaris 2.7 x86 / / The code establishes a TCP connection with port 53 of a target system. / / It makes use of the "infoleek" bug through UDP to obtain the base /...

Aix execve /bin/sh 88 bytes

No description provided by source. / Aix execve of /bin/sh Georgi Guninski [email protected] / unsigned int code= 0x7c0802a6 , 0x9421fbb0 , 0x90010458 , 0x3c60f019 , 0x60632c48 , 0x90610440 , 0x3c60d002 , 0x60634c0c , 0x90610444 , 0x3c602f62 , 0x6063696e , 0x90610438 , 0x3c602f73 , 0x60636801 ...