3037 matches found
Wordpress <= 1.5.1.3 Remote Code Execution 0-Day Exploit
Exploit for unknown platform in category web applications ======================================================== Wordpress = 1.5.1.3 Remote Code Execution 0-Day Exploit ======================================================== ?php echo "Wordpress = 1.5.1.3 - remote code execution 0-DDAAYY...
Wordpress <= 1.5.1.3 Remote Code Execution 0-Day Exploit
No description provided by source. ?php echo "Wordpress = 1.5.1.3 - remote code execution 0-DDAAYY exploit\n"; echo "C Copyright 2005 Kartoffelguru\n\n"; echo "! info: requires registerglobals turned on on target host\n\n"; if !extensionloaded'curl' die "- you need the curl extension...
Linux Add User
Create a new user with UID 0 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework AddUser ------- Adds a UID 0 user to /etc/passwd. module MetasploitModule CachedSize = 97 include Msf::Payload::Single include...
[ Suresec Advisories ] - Linux kernel ia32 compatibility (ia64/x86-64) race condition
Suresec Security Advisory - 00004 10/07/05 Linux kernel ia32 compatibility race condition Advisory: http://www.suresec.org/advisories/adv4.pdf http://www.suresec.org/advisories/adv3.pdf Description: A race condition vulnerability has been found in the ia32 compatibility execve systemcall. The rac...
[SA16011] PPA "config[ppa_root_path]" File Inclusion Vulnerability
---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...
CVE-2004-2193
The CVE-2004-2193 issue affects CJOverkill’s trade.php (versions older than 4.0.4) with a cross-site scripting (XSS) vulnerability. The flaw arises from insufficient sanitization of user-supplied input, enabling remote attackers to inject script via the tms[0] or url parameters. OpenVAS entries c...
Local Root exploit (Fedora Core 4)
Local Root Exploit under Fedora Core 4 stable Advisory Florian Strankowski [email protected] www.bildunxxluecke.de/usr/florian/advisory/advisory-05-048.txt Vulnerable System : This vulnerability affects Fedora Core 4.0 stable with the kernelversion 2.6.11-1.1369FC4 1 Thu Jun 2 22:53:35...
Fedora Core 2 : gftp-2.0.18-0.FC2 (2005-310)
Fri Feb 18 2005 Warren Togami 2.0.18-0.FC2 - FC2 including CVE-2005-0372 - Thu Feb 10 2005 Warren Togami 2.0.18-1 - 2.0.18 - Tue Jun 15 2004 Elliot Lee - rebuilt Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable...
SHA family hash functions cryptographic weakness
Cryptographic weakness found making real strength against coliisions: collisions in the the full SHA-1 in 269 hash operations, much less than the brute-force attack of 280 operations based on the hash length. Collisions in SHA-0 in 239 operations. Collisions in 58-round SHA-1 in 233 operations...
SHA-1 Broken
HA-1 Broken SHA-1 has been broken. Not a reduced-round version. Not a simplified version. The real thing. The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu mostly from Shandong University in China have been quietly circulating a paper describing their results: collisions in the the...
CVE-1999-1572
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O archive or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files...
Immunity Canvas: MYSQL_AUTH_BYPASS
Name| mysqlauthbypass ---|--- CVE| CVE-2004-0627 Exploit Pack| CANVAS Description| MySQL authentication bypass Notes| CVE Name: CVE-2004-0627 OSVDB: http://www.osvdb.org/displayvuln.php?osvdbid=7475 Notes: Mysql authentication can be bypass by a special crafted password with zeroed-strings...
CDRecord's ReadCD Local Root Privileges
Exploit for linux platform in category local exploits ======================================= CDRecord's ReadCD Local Root Privileges ======================================= !/bin/bash echo "readcd-exp.sh -- ReadCD local exploit Test on cdrecord-2.01-0.a27.2mdk" echo "Author : newbug at chroot.or...
linux/SPARC portbind port 8975 284 bytes
Exploit for linux/sparc platform in category shellcode ======================================== linux/SPARC portbind port 8975 284 bytes ======================================== / 0-day portbind shellcode for all those Sun machines running linux.. Coded from scratch, so i take all the credits. It...
CVE-2003-0818
Multiple integer overflows in Microsoft ASN.1 library MSASN1.DLL, as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with 1 very large length fields that cause...
CVE-2003-0397
CVE-2003-0397 describes a buffer overflow in the FastTrack (FT) network code used by Kazaa 2.0.2 (and possibly other versions) that can be triggered by a specially crafted packet containing a large list of supernodes, allowing remote code execution. The vulnerability affects the FastTrack network...
CVE-2003-0335
rc.M in Slackware 9.0 calls quotacheck with the -M option, which causes the filesystem to be remounted and possibly reset security-relevant mount flags such as nosuid, nodev, and noexec...
CVE-2003-0238
CVE-2003-0238 impacts Mirabilis ICQ Pro 2003a and earlier. The flaw resides in ICQ’s Message Session HTML rendering library used by the ADS/advertising component. By spoofing the ADS server and sending malformed HTML, an attacker can trigger a denial-of-service condition, consuming CPU and freezi...
The SUPER Bug
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 / SAVE DEFCON..HELP GOBBLES..SAVE DEFCON..HELP GOBBLES When GOBBLES say he and he security team are non-profit. He really mean NON-profit. This means GOBBLES and he GOBBLES Security Labs GSL friends do not have much funds. GOBBLES was hoping to receiv...
CVE-2001-1322
The CVE-2001-1322 issue concerns xinetd up to version 2.1.8 (and earlier) running with a default umask of 0, allowing local users to read or modify files created by processes started by xinetd that don’t set a safe umask. Public sources in the connected docs identify this as a local-privilege ris...