SoftMaker Office 201x Privilege Escalation Vulnerability

SoftMaker Office 201x suffers from a local privilege escalation vulnerability due to an unprotected directory. Hi @ll, the service pack installers for SoftMaker Office 201x, available from , are surprise.- vulnerable. The executable installer OUCH ofw16763.exe, a 7z SFX OUCH, creates an UNPROTECT...

Android system_server Code Loading Bypass Vulnerability

Exploit for Android platform in category local exploits Android: Code loading bypasses in systemserver As of Android Nougat, a new set of SELinux rules have been added which are designed to prevent systemserver from loading arbitrary code into its address-space. This has been enforced by adding t...

XSSER - From XSS to RCE

From XSS to RCE 2.5 - Black Hat Europe Arsenal 2016 Demo Version 2.0 - 2015: https://www.youtube.com/playlist?list=PLIjb28IYMQgqqqApoGRCZO40vP-eKsgf Version 2.5 - 2016: https://www.youtube.com/playlist?list=PLRic6PgcrsWGkgacL6WFnSQKVRZIoofRj Requirements Python 2.7., version 2.7.11 was used for...

SUSE SLES11 Security Update : tar (SUSE-SU-2016:2895-1)

This update for tar fixes the following issues : - Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path names specified on the command line bsc1007188 CVE-2016-6321 Note that Tenable Network...

Ubuntu 14.0415.10 - User Namespace Overlayfs Xattr SetGID Privilege Escalation

Ubuntu 14.0415.10 - User Namespace Overlayfs Xattr SetGID Privilege Escalation Source: http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/ Introduction Problem description: Linux user namespace allows to mount file systems as normal user, including the...

From XSS to RCE: XSSer

From XSS to RCE This demonstrates how an attacker can utilize XSS to execute arbitrary code on the web server when an administrative user inadvertently triggers a hidden XSS payload. Custom tools and payloads integrated with Metasploit’s Meterpreter in a highly automated approach will be...

PT-2021-5492 · Saltstack +3 · Saltstack Salt +3

Name of the Vulnerable Software and Affected Versions: SaltStack Salt versions prior to 3002.5 Description: An issue was discovered in SaltStack Salt where the minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any...

php: ZipArchive:: extractTo allows for directory traversal when creating directories

Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/phpzip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/extzip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive...

OpenDoor - OWASP Directory Access Scanner

This application scans the site directories and find all possible ways to login, empty directories and entry points. Scans conducted in the dictionary that is included in this application. This software is written for informational purposes and is an open source product under the GPL license...

CVE-2016-8565

Siemens Automation License Manager ALM before 5.3 SP3 allows remote attackers to write to files, rename files, create directories, or delete directories via crafted packets...

File Upload Vulnerability in Siemens Automation License Manager

Siemens Automation License Manager ALM is a software that centrally manages license keys for various Siemens software products. A file upload vulnerability exists in Siemens Automation License Manager. A remote attacker could use the vulnerability to send specially crafted packets to upload files...

Arbitrary File Read Vulnerability in zzcms 7.2 Version

ZZCMS highlights the investment and supply and demand functions, you can quickly build a product investment website. ZZCMS v7.1 has an arbitrary file read vulnerability that can be exploited by an attacker to access restricted directories and execute commands outside the root directory of the web...

tomcat: directory disclosure

It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that...

MYSQL Directory Write Test

Enumerate writeable directories using the MySQL SELECT INTO DUMPFILE feature, for more information see the URL in the references. Note: For every writable directory found, a file with the specified FILENAME containing the text test will be written to the directory. This module requires Metasploit...

CVE-2016-4620

The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app...

Design/Logic Flaw

The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app...

CVE-2016-4620

CVE-2016-4620 affects Apple iOS prior to 10, in the Sandbox Profiles component. The issue is an access control flaw in SMS draft directories that allowed a crafted app to discover text-message recipients by stat-ing these directories. Apple’s remediation tightened directory access so apps cannot ...

CVE-2016-4620

The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app...

swarm - A Modular Distributed Penetration Testing Tool

Swarm is an open source modular distributed penetration testing Tool that use distributed task queue to implement communication in the master-slave mode system and use MongoDB for data storage. It consists of a distributed framework and function modules. The function module can be an entirely new...

CodeWarrior - Just Another Manual Code Analysis Tool And Static Analysis Tool

Just another manual code analysis tool and static analysis tool Codewarrior runs at HTTPd with TLS, uses KISS principle https://en.wikipedia.org/wiki/KISSprinciple Directories: web/ = local of javascripts and html and css sources src/ = C source code, this code talking with web socket eggs/ =...