X.Org xorg-x11-xfs 1.0.2-3.1 - Local Race Condition

X.Org xorg-x11-xfs 1.0.2-3.1 - Local Race Condition !/bin/sh Xorg-x11-xfs Race Condition Vuln local root exploit CVE-2007-3103 Another lame xploit by vl4dZ : works on redhat el5 and before $ id uid=1001kecos gid=1001user groups=1001user $ sh xfs-RaceCondition-root-exploit.sh Generate large data...

CVE-2008-6426

CVE-2008-6426 covers multiple heap-based buffer overflows in EMC RepliStor (6.2 SP2, possibly earlier) where crafted compressed data can cause remote code execution with SYSTEM privileges. Exploitation requires reachable TCP ports 7144/7145, no authentication. Remediation per connected sources: u...

CVE-2007-6426

CVE-2007-6426 refers to multiple heap-based buffer overflows in EMC RepliStor 6.2 SP2 (and possibly earlier versions) that could allow a remote attacker to execute arbitrary code by sending crafted compressed data. Affected software is EMC RepliStor Server; the root cause is heap-based overflows ...

CVE-2008-0836

Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 9 and 10 on x86 architectures allows local users to cause a denial of service panic via unspecified vectors that trigger a NULL pointer dereference in the vuid3ps2 module, a different issue than CVE-2007-5319...

CVE-2008-0836

CVE-2008-0836 describes an unspecified vulnerability in the vuidmice STREAMS modules on Sun Solaris 8–10 (x86) that allows local users to cause a denial of service (panic) via vectors triggering a NULL pointer dereference in the vuid3ps2 module. The issue is categorized as a local access problem ...

xorg-disclose.txt

!/bin/sh Xorg file disclosure vulnerability CVE-2007-5958 Lame xploit by vl4dZ : sh-3.1$ whoami uid=1001kecos gid=1001user groups=1001user sh-3.1$ ./Xorg-File-Existence-PoC.sh /root/.ssh/iddsa ... FILE /root/.ssh/iddsa EXIST !! Vulnerable: xorg-server " exit 1 fi -f $XEXEC || echo "$XEXEC not...

SYMSA-2008-001: Lyris ListManager - Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Symantec Vulnerability Research http://www.symantec.com/research Security Advisory Advisory ID: SYMSA-2008-001 Advisory Title: Lyris ListManager - Multiple Vulnerabilities Author: Tyler Shields [email protected] Release Date: Wednesday, Januar...

Microsoft Windows OLE自动化堆溢出漏洞（MS08-008）

BUGTRAQ ID: 27661 CVECAN ID: CVE-2007-0065 Microsoft Windows是微软发布的非常流行的操作系统。 对象链接和嵌入（OLE）自动化处理特制脚本请求的方式存在堆溢出漏洞，如果用户受骗访问了恶意站点的话，就可能触发这个溢出，导致以登录用户的权限对系统进行更改。如果用户以管理权限登录的话，攻击者就可以完全控制受影响的系统。 Microsoft Office 2004 for Mac Microsoft Visual Basic 6.0 SP6 Microsoft Windows XP SP2 Microsoft Windows Vista...

Debian DSA-1498-1 : libimager-perl - buffer overflow

It was discovered that libimager-perl, a Perl extension for generating 24-bit images, did not correctly handle 8-bit compressed images, which could allow the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin we...

Apache 2.2.x < 2.2.8 Multiple Vulnerabilities (XSS, DoS)

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.8. It is, therefore, affected by the following vulnerabilities : - A cross-site scripting issue involving modimagemap CVE-2007-5000. - A cross-site scripting issue involving 413 error pages via a...

Samba "send_mailslot()" function buffer overflow

Overview The Samba "sendmailslot" function contains a stack-based buffer overflow vulnerability which could be exploited by a remote, unauthenticated attacker to execute arbitrary code. Description Samba is a widely used open-source implementation of Server Message Block SMB/Common Internet File...

CVE-2007-6319

CVE-2007-6319 affects Lyris ListManager 8.x (before 8.95d), 9.2 (before 9.2c), and 9.3 (before 9.3b). Multiple issues allow remote attackers to (1) gain list administrator privileges or (2) access arbitrary mailing lists by modifying client-side information, and (3) remote authenticated administr...

[SECURITY] [DSA 1498-1] New libimager-perl packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1498-1 [email protected] http://www.debian.org/security/ Steve Kemp February 19, 2008 http://www.debian.org/security/faq -...

X.Org xorg-server <= 1.1.1-48.13 Probe for Files Exploit PoC

Exploit for multiple platform in category dos / poc ============================================================ X.Org xorg-server " exit 1 fi -f $XEXEC || echo "$XEXEC not found"; exit 1 echo -e "\n Xorg file disclosure vulnerability PoC CVE-2007-5958 \n" echo "A second X server is going to be...

X.Org xorg-server 1.1.1-48.13 - Probe for Files (PoC)

X.Org xorg-server 1.1.1-48.13 - Probe for Files PoC !/bin/sh Xorg file disclosure vulnerability CVE-2007-5958 Lame xploit by vl4dZ : sh-3.1$ whoami uid=1001kecos gid=1001user groups=1001user sh-3.1$ ./Xorg-File-Existence-PoC.sh /root/.ssh/iddsa ... FILE /root/.ssh/iddsa EXIST !! Vulnerable:...

CVE-2007-6258

CVE-2007-6258 relates to multiple stack-based buffer overflows in legacy mod_jk2 (Apache module, versions 2.0.3-DEV and earlier). The vulnerability is exploitable via a long Host header or a Host header hostname, allowing a remote attacker to execute arbitrary code with the privileges of the Apac...

CVE-2007-6258

Multiple stack-based buffer overflows in the legacy modjk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary code via a long 1 Host header, or 2 Hostname within a Host header...

CVE-2007-6313

CVE-2007-6313 affects MySQL Server 5.1.x before 5.1.23 and 6.0.x before 6.0.4. The root cause is that BINLOG execution rights are not checked for the entity performing BINLOG, allowing remote authorized users to execute arbitrary BINLOG statements. The impact is partial confidentiality/integrity/...

Fedora 7 : scponly-4.6-10.fc7 (2008-1728)

Wed Feb 13 2008 Tomas Hoger - 4.6-10 - Add patch to prevent restriction bypass using OpenSSH's scp options -F and -o CVE-2007-6415, 426072 - Mon Feb 11 2008 Warren Togami - 4.6-9 - rebuild with gcc-4.3 - Tue Dec 11 2007 Toshio Kuratomi - 4.6-8 - Disable rsync support due to security concerns: RH...

DESlock+ <= 3.2.6 DLMFENC.sys Local Kernel ring0 link list zero PoC

Exploit for unknown platform in category dos / poc =================================================================== DESlock+ DESlock+ include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xDEADBEEF define ZEROMEM 0xDEADBEEF define ARGSIZEa a-sizeof int2/sizeof void struct ioctlreq...