1473 matches found
X.Org xorg-x11-xfs <= 1.0.2-3.1 - Local Race Condition Exploit
No description provided by source. !/bin/sh Xorg-x11-xfs Race Condition Vuln local root exploit CVE-2007-3103 Another lame xploit by vl4dZ : works on redhat el5 and before $ id uid=1001kecos gid=1001user groups=1001user $ sh xfs-RaceCondition-root-exploit.sh Generate large data file in...
Ubuntu PAM 1.1.0 MOTD - Local Root Exploit
No description provided by source. !/bin/bash Exploit Title: Ubuntu PAM MOTD local root Date: July 9, 2010 Author: Anonymous Software Link: http://packages.ubuntu.com/ Version: pam-1.1.0 Tested on: Ubuntu 9.10 Karmic Koala, Ubuntu 10.04 LTS Lucid Lynx CVE: CVE-2010-0832 Patch Instructions: sudo...
Linux pam_lib_smb < 1.1.6 /bin/login Remote Exploit
No description provided by source. / Linux pamlibsmb 1.1.6 /bin/login exploit by vertex Tested on Redhat 8.0, 9.0 Advisory at http://us2.samba.org/samba/ftp/pamsmb/ code based on : UClogin.c SunOS 5.6,5.7,5.8 remote /bin/login root exploit mikecc/unixclan...
Linux/ARM - polymorphic chmod("/etc/shadow", 0777) - 84 Bytes
No description provided by source. / | Title: Linux/ARM - polymorphic chmod/etc/shadow, 0777 - 84 Bytes | Type: Shellcode | Author: Florian Gaultier [email protected] | Platform: Linux ARM ARM926EJ-S rev 5 v51 | + http://www.shell-storm.org / include stdio.h char shellcode =...
SCO Unixware 7.1 pkginstall Buffer Overflow
No description provided by source. source: http://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in...
solaris/x86 setuid(0), execve(/bin/cat, /etc/shadow), exit(0) 59 bytes
No description provided by source. / ; sm4x 2008 ; /bin/cat /etc/shadow ; 59 bytes ; SunOS sol01 5.11 snv86 i86pc i386 i86pc Solaris ; port to SunOS to pwn a b0x - thank god for that default unix CRYPTDEFAULT!!!! ; this is what happens when ur work takes away root pirv on a SunOS box :-/ global...
Joomla Component wmi (com_wmi) LFI Vulnerability
No description provided by source. ================================================================================================ Title : Joomla Component wmi comwmi LFI Vulnerability Vendor : http://www.paysyspro.com/ Download : http://www.paysyspro.com/jotloader/files.download/3 Date : Sunday...
[Raspberry Pi] Linux/ARM - chmod("/etc/shadow", 0777) - 41 bytes
No description provided by source. / Title: Linux/ARM - chmod/etc/shadow, 0777 - 41 bytes Date: 2012-09-08 Tested on: ARM1176JZF-S v6l Author: midnitesnake 00008054 start: 8054: e28f6001 add r6, pc, 1 8058: e12fff16 bx r6 805c: 4678 mov r0, pc 805e: 3012 adds r0, 18 8060: 21ff movs r1, 255 ; 0xff...
change mode 0777 of "/etc/shadow" with sys_chmod syscall
No description provided by source. / 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ /'\ \ /\ \ \ \ /'\ 0 0 \ \ /\ /\ \ \ \ /\ \ \ /\ /\ \ \ \ \ \ \ / 1 1 \ \ \ \\ \ \ /\ \...
Linux/x86 pwrite("/etc/shadow", hash, 32, 8) Shellcode 83
No description provided by source. / | Title: Linux/x86 pwrite/etc/shadow, hash, 32, 8 Shellcode 83 Bytes | Description: replace root's password with hash of agix in MD5 | Type: Shellcode | Author: agix | Platform: Linux X86 / 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-...
Help Center Live 2.1.2 Module.PHP Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/19256/info Help Center Live is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to retrieve arbitrary files from the vulnerable...
CVE-2014-4039
ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf...
Yealink VoIP Phone SIP-T38G - Local File Inclusion
Title: Yealink VoIP Phone SIP-T38G Local File Inclusion Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5756, CVE-2013-5757 Description: Web interface contain a vulnerability that allow any...
openSUSE Security Update : ncpfs (openSUSE-SU-2011:0985-1)
Following issues are fixed by this update: The ncpfs mount and umount programs were affected by the /etc/mtab truncation problems on RLIMITFSIZE. CVE-2011-1679 Also on errors, the mtab lock was not removed, blocking other applications from modifying /etc/mtab. CVE-2011-1680 %NASLMINLEVEL 70300 C...
openSUSE Security Update : sudo (openSUSE-SU-2012:0652-1)
sudo did not always honor the HostList setting in /etc/sudoers properly %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-293. The text description of this plugin is C SUSE LLC...
Fedora 19 : openssh-6.2p2-8.fc19 (2014-6569)
environment variables with embedded '=' or '0' characters are now ignored - prevents a server from skipping SSHFP lookup and forcing a new-hostkey dialog by offering only certificate keys - /etc/ssh/moduli is readable by all now - ssh-copy-id is run in so called legacy mode when SSHCOPYIDLEGACY...
CVE-2013-4223
The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file...
CVE-2014-0189
virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file...
CVE-2014-0189
virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file...
Updated cups-filters packages fix security vulnerability
Updated cups-filters packages fix security vulnerability: Sebastian Krahmer discovered it was possible to use malicious broadcast packets to execute arbitrary commands on a server running the cups- browsed daemon CVE-2014-2707. Note that only systems that have enabled the affected feature by usin...