532 matches found
PT-2019-10019
Name of the Vulnerable Software and Affected Versions: Teracue ENC-400 devices with firmware 2.56 and below Description: An issue allows attackers to bypass authentication on the device's web administration panel. After successful authentication, the device sends an authentication cookie to the e...
CVE-2018-20219: Use of Hard-coded Credentials
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the device sends an authentication cookie to the end user such that they can access the devices web administration panel. This token is hard-coded to a string in the source code...
PT-2019-10018
Name of the Vulnerable Software and Affected Versions: Teracue ENC-400 devices version 2.56 and below Description: An issue was discovered where the login form passes user input directly to a shell command without escaping or validation in the /usr/share/www/check.lp file. This allows an attacker...
Amazon Linux 2 : setup (ALAS-2019-1158)
Setup in Amazon Linux 2 added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pamshells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to...
ASAN/SUID - Local Privilege Escalation
!/bin/bash unsanitary.sh - ASAN/SUID Local Root Exploit Exploits er, unsanitized env var passing in ASAN which leads to file clobbering as root when executing setuid root binaries compiled with ASAN. Uses an overwrite of /etc/ld.so.preload to get root on a vulnerable system. Supply your own targe...
CVE-2018-20131: Incorrect Permission Assignment for Critical Resource
The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory. This allows a user to manipulate symbolic links to escalate privileges, or show the contents of sensitive files that a regular user would...
PT-2019-9999
Name of the Vulnerable Software and Affected Versions Code42 for Enterprise versions prior to 6.8.4 Description The issue allows a user to manipulate symbolic links to escalate privileges or access sensitive files due to overly permissive permissions on the /usr/local/crashplan/log directory...
PT-2018-9581
Name of the Vulnerable Software and Affected Versions log-user-session versions 0.7 and earlier Description The issue allows for a Directory Traversal vulnerability in the Main SUID-binary /usr/local/bin/log-user-session, potentially resulting in User to root privilege escalation. This can be...
Emacs - movemail Privilege Escalation Exploit
This Metasploit module exploits a SUID installation of the Emacs movemail utility to run a command as root by writing to 4.3BSD's /usr/lib/crontab.local. The vulnerability is documented in Cliff Stoll's book The Cuckoo's Egg. This module requires Metasploit: https://metasploit.com/download Curren...
Emacs movemail Privilege Escalation
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Emacs movemail Privilege Escalation', 'Description' = %q This module exploits a SUID installation of the Emacs movemail utility to run a command ...
FLIR AX8 Thermal Camera 1.32.16 - Arbitrary File Disclosure Vulnerability
Exploit for hardware platform in category web applications Exploit Title: FLIR AX8 Thermal Camera 1.32.16 - Arbitrary File Disclosure Auhor: Gjoko 'LiquidWorm' Krstic Date: 2018-10-14 Vendor: FLIR Systems, Inc. Product web page: https://www.flir.com Affected version: Firmware: 1.32.16, 1.17.13 OS...
CVE-2018-1113
setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pamshells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstance...
CVE-2018-12640
CVE-2018-12640 affects Insteon HD IP Camera White 2864-222. The webService binary is vulnerable to a buffer overflow triggered by crafted pid, pwd, or usr keys in a GET request on port 34100. The vulnerability is documented in multiple sources (NVD entry and CNVD/CNVD-related advisories). A relat...
PT-2018-1380
Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.13.5 iOS versions prior to 11.4 tvOS versions prior to 11.4 watchOS versions prior to 4.3.1 Description The issue involves a buffer overflow in the mptcp usr connectx function of the kernel, which can be exploited by...
CVE-2018-11481
TP-LINK IPC TL-IPC223P-6, TL-IPC323K-D, TL-IPC325KP-, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr/lib/lua/luci/torchlight/validator.lua does not block various punctuation characters...
PT-2018-10600
Name of the Vulnerable Software and Affected Versions TP-LINK IPC versions TL-IPC223P-6, TL-IPC323K-D, TL-IPC325KP-, and TL-IPC40A-4 Description The issue allows authenticated remote code execution via crafted JSON data. This is because the /usr/lib/lua/luci/torchlight/validator.lua file does not...
PT-2018-10601
Name of the Vulnerable Software and Affected Versions TP-LINK IPC devices affected versions not specified Description A hardcoded password zMiVw8Kw0oxKXL0 is present in the /usr/lib/lua/luci/websys.lua file on certain TP-LINK IPC devices. Recommendations For TP-LINK IPC devices, consider changing...
Solaris 10 (sparc) : 141014-01
SunOS 5.10: /usr/bin/dircmp patch. Date this patch was last updated by Sun : Mar/19/09 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...
Solaris 10 (sparc) : 148423-01
SunOS 5.10: /usr/ccs/bin/error patch. Date this patch was last updated by Sun : Feb/06/13 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...
