Quantum DXi V1000 2.2.1 - Static SSH Key

Quantum DXi® V-Series is a virtual deduplication backup appliance that protects physical and virtual data across remote sites, the datacenter and cloud deployments. Details: ---------- 0x01 - Default root user The root user has a hardcoded password that is unknown and not changeable. Normally...

Design/Logic Flaw

/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow...

CVE-2014-2534: Undefined Security Weakness

/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow...

PT-2014-4766

Name of the Vulnerable Software and Affected Versions BlackBerry QNX Neutrino RTOS versions 6.4.x through 6.5.x Description The issue allows local users to obtain sensitive information by reading error messages from /sbin/pppoectl. This can be exploited to read the root password hash in...

QNX 6.4.x6.5.x pppoectl - Information Disclosure

QNX 6.4.x6.5.x pppoectl - Information Disclosure QNX 6.4.x/6.5.x pppoectl disclose /etc/shadow by cenobyte 2013 - vulnerability description: QNX setuid root /sbin/pppoectl allows any user to gain access to privileged information such as the root password hash. The vulnerability exists because of ...

QNX 6.4.x/6.5.x pppoectl - Information Disclosure

QNX 6.4.x/6.5.x pppoectl disclose /etc/shadow by cenobyte 2013 - vulnerability description: QNX setuid root /sbin/pppoectl allows any user to gain access to privileged information such as the root password hash. The vulnerability exists because of a failure to drop privileges or check the...

CVE-2013-3713

The image creation configuration in aaabase before 16.26.1 for openSUSE 13.1 KDE adds the root user to the "users" group when installing from a live image, which allows local users to obtain sensitive information and possibly have other unspecified impacts, as demonstrated by reading /etc/shadow...

CVE-2013-3713

The CVE-2013-3713 issue affects openSUSE 13.1 KDE with aaa_base prior to 16.26.1. The image creation configuration erroneously adds the root user to the 'users' group when installing from a Live image, enabling local users to read sensitive files such as /etc/shadow and potentially other impacts....

CVE-2013-3713

The image creation configuration in aaabase before 16.26.1 for openSUSE 13.1 KDE adds the root user to the "users" group when installing from a live image, which allows local users to obtain sensitive information and possibly have other unspecified impacts, as demonstrated by reading /etc/shadow...

CVE-2013-3713: Exposure of Sensitive Information to an Unauthorized Actor

The image creation configuration in aaabase before 16.26.1 for openSUSE 13.1 KDE adds the root user to the "users" group when installing from a live image, which allows local users to obtain sensitive information and possibly have other unspecified impacts, as demonstrated by reading /etc/shadow...

PT-2014-2704

Name of the Vulnerable Software and Affected Versions aaa base versions prior to 16.26.1 Description The issue in the image creation configuration allows local users to obtain sensitive information and possibly have other unspecified impacts by reading /etc/shadow, as demonstrated in openSUSE 13....

Solaris 10 Patch Cluster File Clobber

Solaris 10 patch cluster suffers from a file clobber vulnerability in /tmp. File clobbering vulnerability in Solaris 10 patch cluster 3/27/2013 Larry W. Cashdollar @larry0 Hello, The 147147-26 patch creates a CLEANUP file in /tmp that is vulnerable to symlink attacks: The contents of the file...

SEC Consult SA-20130122-0 :: F5 BIG-IP XML External Entity Injection vulnerability

SEC Consult Vulnerability Lab Security Advisory 20130122-0 ======================================================================= title: XML External Entity Injection XXE product: F5 BIG-IP vulnerable version: =11.2.0 fixed version: 11.2.0 HF3 11.2.1 HF3 CVE number: CVE-2012-2997 impact: Medium...

linux/x86 execve-chmod 0777 /etc/shadow 58 bytes

Linux/x86 execve-chmod 0777 /etc/shadow 58 bytes Author: Hamza Megahed Twitter: @HamzaMega blog: hamza-megadotblogspotdotcom E-mail: hamzadotmegahedatgmaildotcom xor %eax,%eax push %eax pushl $0x776f6461 pushl $0x68732f2f pushl $0x6374652f movl %esp,%esi push %eax pushl $0x37373730 movl %esp,%ebp...

Centrify Deployment Manager v2.1.0.283

Centrify Deployment Manager v2.1.0.283 While at a training session for centrify, I noticed poor handling of files in /tmp. I was able to overwrite /etc/shadow with the contents of adcheckDMoutput. I am sure there are more vulnerabilities to be exploit, maybe a local root - but being this is a...

Centrify Deployment Manager 2.1.0.283 Local Root Vulnerability

Centrify Deployment Manager version 2.1.0.283 suffers from a race condition in /tmp that allows for local root privilege escalation. Centrify Deployment Manager v2.1.0.283 local root 12/7/2012 Taking a little longer look at the software, I managed to win a race condition and get root with files i...

Centrify Deployment Manager v2.1.0.283 File Overwrite Vulnerability

Centrify Deployment Manager v2.1.0.283 version 2.1.0.283 appears to suffer from a root-level file overwrite vulnerability due to an insecure use of /tmp. Centrify Deployment Manager v2.1.0.283 While at a training session for centrify, I noticed poor handling of files in /tmp. I was able to...

Raspberry Pi Linux/ARM - chmod"/etc/shadow", 0777 41 bytes

Raspberry Pi Linux/ARM - chmod"/etc/shadow", 0777 41 bytes. Shellcode exploit for arm platform / Title: Linux/ARM - chmod"/etc/shadow", 0777 - 41 bytes Date: 2012-09-08 Tested on: ARM1176JZF-S v6l Author: midnitesnake 00008054 : 8054: e28f6001 add r6, pc, 1 8058: e12fff16 bx r6 805c: 4678 mov r0,...

linux/ARM - chmod("/etc/shadow", 0777) - 41 bytes

/ Title: Linux/ARM - chmod"/etc/shadow", 0777 - 41 bytes Date: 2012-09-08 Tested on: ARM1176JZF-S v6l Author: midnitesnake 00008054 : 8054: e28f6001 add r6, pc, 1 8058: e12fff16 bx r6 805c: 4678 mov r0, pc 805e: 3012 adds r0, 18 8060: 21ff movs r1, 255 ; 0xff 8062: 31ff adds r1, 255 ; 0xff 8064:...

Linux x86 - chmod 666 /etc/passwd & /etc/shadow 57 bytes

Linux x86 - chmod 666 /etc/passwd & /etc/shadow 57 bytes. Shellcode exploit for linx86 platform / Title: Linux x86 chmod 666 /etc/passwd & /etc/shadow - 57 bytes Author: Jean Pascal Pereira Web: http://0xffe4.org Disassembly of section .text: 08048060 : 8048060: 31 c0 xor %eax,%eax 8048062: 66 b9...