Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers Privileged EXEC Mode Root Shell Access Vulnerability

A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperl...

WMI Exec

A similar approach to psexec but executing commands through WMI. Module Options msf use auxiliary/scanner/smb/impacket/wmiexec msf undefinedwmiexec show actions ...actions... msf undefinedwmiexec set ACTION msf undefinedwmiexec show options ...show and set options... msf undefinedwmiexec run...

Node.js third-party modules: `fs-path` concatenates unsanitized input into exec()/execSync() commands

I would like to report command injection in fs-path. It allows to inject and execute arbitrary shell commands while performing various operations from fs-path API like copying files. Module module name: fs-path version: 0.0.24 npm page: https://www.npmjs.com/package/fs-path Module Description...

PT-2018-3449

Name of the Vulnerable Software and Affected Versions: corosync versions prior to 2.4.4 Description: The issue is caused by an integer overflow in the exec/totemcrypto.c function of the corosync system, which can be exploited by a remote attacker to impact the confidentiality, integrity, and...

zsh buffer overflow vulnerability

zsh is an interactive command interpreter and command programming language used on Linux systems. A buffer overflow vulnerability exists in the exec.c file in versions of zsh prior to 5.0.7. An attacker could exploit this vulnerability to execute code or cause a denial of service...

Node.js third-party modules: `whereis` concatenates unsanitized input into exec() command

I would like to report command injection in whereis It allows to inject arbitrary shell commands by trying to locate crafted filenames. Module module name: whereis version: 0.4.0 npm page: https://www.npmjs.com/package/whereis Module Description Simply get the first path to a bin on any system...

Node.js third-party modules: `macaddress` concatenates unsanitized input into exec() command

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report code injection i...

Code injection

GEAR Software CD DVD Filter driver aka GEARAspiWDM.sys, as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System Recovery 2011, Norton 360, and Norton Ghost, allows local users to cause a denial of service system crash via unspecified vectors...

CVE-2011-3477

GEAR Software CD DVD Filter driver aka GEARAspiWDM.sys, as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System Recovery 2011, Norton 360, and Norton Ghost, allows local users to cause a denial of service system crash via unspecified vectors...

CVE-2011-3477

GEAR Software CD DVD Filter driver aka GEARAspiWDM.sys, as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System Recovery 2011, Norton 360, and Norton Ghost, allows local users to cause a denial of service system crash via unspecified vectors...

CVE-2011-3477

CVE-2011-3477 concerns the GEAR Software CD/DVD Filter driver (GEARAspiWDM.sys) as used in several Symantec products (Backup Exec System Recovery 8.5 and BESR 2010, System Recovery 2011, Norton 360, Norton Ghost). According to the linked records, the vulnerability enables a local attacker to caus...

CVE-2011-3477: Improper Input Validation

GEAR Software CD DVD Filter driver aka GEARAspiWDM.sys, as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System Recovery 2011, Norton 360, and Norton Ghost, allows local users to cause a denial of service system crash via unspecified vectors...

PT-2018-4033

Name of the Vulnerable Software and Affected Versions GEAR Software CD DVD Filter driver versions affected versions not specified Symantec Backup Exec System Recovery version 8.5 Symantec Backup Exec System Recovery version 2010 Symantec System Recovery version 2011 Norton 360 affected versions n...

CVE-2017-17424

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUScheduleSet Get method requests. The issue results...

Exodus Wallet (ElectronJS Framework) Remote Code Execution

window.location = 'exodus://aaaaaaaaa" --gpu-launcher="cmd" --aaaaa='...

Exodus Wallet (ElectronJS Framework) - Remote Code Execution

Exodus Wallet ElectronJS Framework - Remote Code Execution window.location = 'exodus://aaaaaaaaa" --gpu-launcher="cmd" --aaaaa='...

GitStack 2.3.10 Remote Code Execution

Exploit: GitStack 2.3.10 Unauthenticated Remote Code Execution Date: 18.01.2018 Software Link: https://gitstack.com/ Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: remote 1. Description $SERVER'PHPAUTHPW' is directly passed t...

GitStack 2.3.10 - Remote Code Execution

GitStack 2.3.10 - Remote Code Execution Exploit: GitStack 2.3.10 Unauthenticated Remote Code Execution Date: 18.01.2018 Software Link: https://gitstack.com/ Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: remote 1. Description...

BSD/x86 - setreuid(geteuid(), geteuid()) + execve(/bin/sh) Shellcode (36 bytes)

/ bsd/x86 setreuid/exec shellcode setreuidgeteuid, geteuid and execve"/bin/sh", "/bin/sh", 0 shellcode based on hkpco's setreuid/exec shellcode for linux Tested on FreeBSD / include include char shellcode = "\x31\xc0\xb0\x19\x50\xcd\x80\x50" "\x50\x31\xc0\xb0\x7e\x50\xcd\x80" // setreuidgeteuid,...

Advantech WebAccess webvrpcs drawsrv Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x2780 IOCTL in the webvrpcs process. The issue results...