CVE-2021-40960: Improper Limitation of a Pathname to a Restricted Directory

Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow...

Galera WebTemplate 路径遍历漏洞

Galera WebTemplate is a web template. A path traversal vulnerability exists in Galera WebTemplate 1.0 that could disclose information from /etc/passwd and /etc/shadow...

PT-2021-23018

Name of the Vulnerable Software and Affected Versions Galera WebTemplate version 1.0 Description The issue is a directory traversal vulnerability that could reveal sensitive information from files such as /etc/passwd and /etc/shadow. Recommendations For Galera WebTemplate version 1.0, consider...

Haserl Arbitrary File Reader

This module exploits haserl prior to 0.9.36 to read arbitrary files. The most widely accepted exploitation vector is reading /etc/shadow, which will reveal root's hash for cracking. Module Options msf use post/linux/gather/haserlread msf posthaserlread show actions ...actions... msf posthaserlrea...

Linux/x64 - execve (cat /etc/shadow) Shellcode (66 bytes)

Exploit Title: Linux/x64 - execve "cat /etc/shadow" Shellcode 66 bytes Author: Felipe Winsnes Tested on: Debian x64 Shellcode Length: 66 / global start start: xor rax, rax ; Zeroes out RAX. xor rbp, rbp ; Zeroes out RBP. push rax ; Pushes RAX's NULL-DWORD. mov rbp, 0x776f646168732f63 ; Moves valu...

Design/Logic Flaw

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...

CVE-2020-13859

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...

Linux: Get access permissions to configuration files

Get access permissions to relevant Linux config files like /etc/shadow, /etc/passwd and other. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-lat...

Design/Logic Flaw

In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This process has a vulnerability which can be used to take over the administrator account and results in shell access. As the admin user may read the /etc/shadow file, the password...

CVE-2020-29669

In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This process has a vulnerability which can be used to take over the administrator account and results in shell access. As the admin user may read the /etc/shadow file, the password...

PT-2020-17242

Name of the Vulnerable Software and Affected Versions Macally WIFISD2-2A82 Media and Travel Router version 2.000.010 Description The Guest user in the Macally WIFISD2-2A82 Media and Travel Router can reset its own password, which has a vulnerability that can be exploited to take over the...

Linux: Read /etc/shadow

shadow is a file which contains the password information for the system Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

PT-2020-21086

Name of the Vulnerable Software and Affected Versions malicious-do-not-install affected versions not specified Description The issue concerns malicious code in the software that copies sensitive files, specifically /etc/passwd and /etc/shadow, to the local /tmp/ folder. This action compromises...

CVE-2020-13695

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/.db or /etc/shadow file...

CVE-2020-13695

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/.db or /etc/shadow file...

CVE-2020-13695

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/.db or /etc/shadow file...

PT-2020-13653

Name of the Vulnerable Software and Affected Versions QuickBox Community Edition versions 2.5.5 and earlier QuickBox Pro Edition versions 2.1.8 and earlier Description The issue allows an attacker to obtain sensitive information by exploiting the local www-data user's sudo privileges to execute...

Directory traversal

A Local File Inclusion LFI issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow...

PT-2020-13119

Name of the Vulnerable Software and Affected Versions Onkyo TX-NR585 version 1000-0000-000-0008-0000 Description A Local File Inclusion LFI issue allows remote unauthenticated users on the network to read sensitive files via directory traversal, such as reading /etc/shadow. This is achieved by...

WAGO PFC100/200 Web-Based Management (WBM) Authentication Timing Information Disclosure Vulnerability

Summary An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management WBM web application on WAGO PFC100/200 controllers. The WBM application makes use of the PHP crypt function which can be exploited to disclose hashed user credentials...