Apple Safari Webkit libxslt Arbitrary File Creation

Exploit for macOS platform in category remote exploits $Id: safarixsltoutput.rb 13987 2011-10-18 07:39:50Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on...

GLSA-201110-10 : Wget: User-assisted file creation or overwrite

The remote host is affected by the vulnerability described in GLSA-201110-10 Wget: User-assisted file creation or overwrite It was discovered that Wget was unsafely trusting server-provided filenames. This allowed attackers to overwrite or create files on the user's system by sending a redirect...

CentOS Update for bash CESA-2011:1073 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for bash CESA-2011:1073 centos5 i386

Check for the Version of bash OpenVAS Vulnerability Test CentOS Update for bash CESA-2011:1073 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

Moyea FLV Player(.flv)Local Crash Poc

Exploit for windows platform in category dos / poc !/usr/bin/python print "" print " Name: Moyea FLV Player.flvLocal Crash Poc " print " Author: Angel Injection " print " Email: email protected " print " home page: http://club-h.co.cc http://sec-krb.org " print "" try : junk = "\x41" 10000 f =...

CentOS Update for xmlsec1 CESA-2011:0486 centos5 i386

Check for the Version of xmlsec1 OpenVAS Vulnerability Test CentOS Update for xmlsec1 CESA-2011:0486 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

SuSE 11.1 Security Update : libwebkit (SAT Patch Number 4917)

This update of libwebkit fixes : - XSLT file creation allowed webpages evaluating XSLT code to create files. CVE-2011-1774 - ZDI-11-139 Webkit Anonymous Frame remote code exec %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

Word List Builder Buffer Overflow Exploit (SEH)

No description provided by source. Exploit Title: Word List Builder Buffer Overflow ExploitSEH Software Link: http://download.cnet.com/Word-List-Builder/3000-185414-10398336.html Version: 1.0 triggering details : open .dic file Tested on: Win XP SP3 French Date: 31/03/2011 Author: h1ch4m Hicham...

CVE-2011-2473

CVE-2011-2473 concerns do_dump_data in utils/opcontrol of OProfile (0.9.6 and earlier). The flaw allows local users to create or overwrite arbitrary files via a crafted --session-dir argument combined with a symlink attack on the opd_pipe file, and is described as a different vulnerability from C...

HP Intelligent Management Center Multiple Vulnerabilities

The version of HP Intelligent Management Center running on the remote host contains a number of vulnerabilities that can be exploited remotely without authentication, including code execution and arbitrary file creation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"xmlpars...

HP Intelligent Management Center TFTP Multiple Vulnerabilities

A TFTP server belonging to HP Intelligent Management Center is running on the remote host. This is a collection point for any HP Intelligent Management Center clients on the network. The installed version of this server contains a number of vulnerabilities, including code execution and arbitrary...

Forticlient SSL VPN Symlink Overwrite

forticlientsslvpn suffers from an insecure lock file creation issue. Upon starting the forticlientsslvpn, the file 'forticlientsslvpn.lock' is created under the /tmp directory with octal permissions 0666. The client does not first check if this file exists, or if it is even currently owned by the...

HP Intelligent Management Center < 5.0 E0101-L02 Multiple Vulnerabilities

According to its version number, the HP Intelligent Management Center install on the remote host is potentially affected by multiple vulnerabilities : - A stack-based buffer overflow vulnerability exists in the 'img.exe' component. CVE-2011-1848 - A flaw exists in the 'tftpserver.exe' component...

HP Intelligent Management Center < 5.0 E0101-L02 Multiple Vulnerabilities

Binary data 5927.prm...

ZDI-11-161: HP 3COM/H3C Intelligent Management Center tftpserver WRQ Remote Code Execution Vulnerability

ZDI-11-161: HP 3COM/H3C Intelligent Management Center tftpserver WRQ Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-161 May 10, 2011 -- CVE ID: CVE-2011-1849 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Hewlett-Packard -- Affected Products:...

kernel: inotify memory leak

Memory leak in the inotifyinit1 function in fs/notify/inotify/inotifyuser.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service memory consumption via vectors involving failed attempts to create files...

xmlsec1: arbitrary file creation when verifying signatures

xslt.c in XML Security Library aka xmlsec before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification...

Google Chrome 10.0.648.205 Stack Overflow

!/usr/bin/ruby +Exploit Title: Google Chrome 10.0.648.205 Stack Overflow Vulnerability +Date: 17\04\2011 +Author: C4SS!0 G0M3S +Software Link: http://www.google.com/chrome +Version: 10.0.648.205 +Teste On: WIN-XP SP3 Brazilian Portuguese +CVE: N/A About: This is a bug of the Stack Overflow that...

Wordtrainer 3.0 - .ord Local Buffer Overflow

Wordtrainer 3.0 - .ord Local Buffer Overflow !/usr/bin/python +Exploit Title: Wordtrainer V3.0 .ORD File Buffer Overflow Vulnerability +Date: 12\04\2011 +Author: C4SS!0 G0M3S +Software Link: http://www.wordtrainer.net/software/files/wt307shwexe/wt307shw.exe +Version: 3.0 +Tested On: WIN-XP SP3...

kernel security and bug fix update

2.6.32-71.24.1.el6 - fs Revert 'fs inotify: stop kernel memory leak on file creation failure' Eric Paris 656831 656832 CVE-2010-4250 2.6.32-71.23.1.el6 - x86 Revert 'x86 mtrr: Assume SYSCFGTom2ForceMemTypeWB exists on all future AMD CPUs' Frank Arnold 683813 652208 2.6.32-71.22.1.el6 - rebuild...