551 matches found
Sql injection
Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via 1 the cat parameter to albmgr.php, and possibly 2 the gid parameter to usermgr.php; 3 the start parameter to dbecard.php; and the...
CVE-2006-5871
smbfs in Linux kernel 2.6.8 and other versions, and 2.4.x before 2.4.34, when UNIX extensions are enabled, ignores certain mount options, which could cause clients to use server-specified uid, gid and mode settings...
HP-UX 11i - 'swmodify' Local Stack Overflow / Local Privilege Escalation
/ HP-UX swmodify buffer overflow exploit ======================================= HP-UX 'swmodify' contains an exploitable stack overflow in the handling of command line arguements. Specifically the problem occurs due to insufficent bounds checking in the "-S" optional arguement. 'swmodify' is...
Linux Kernel 2.4/2.6 bluez Local Root Privilege Escalation Exploit (update)
Exploit for linux platform in category local exploits =========================================================================== Linux Kernel 2.4/2.6 bluez Local Root Privilege Escalation Exploit update =========================================================================== / Due to many...
XMail 1.21 - '-t' Command Line Option Local Buffer Overflow / Local Privilege Escalation
/ XMail 1.21 'sendmail' local exploit ret-into-libc Yields uid root || gid mail By qaaz at centrum dot cz, 2005 / include include include include include include include include define TARGET "/var/MailRoot/bin/sendmail" define NM "nm" define GREP "grep" define MKDIR "mkdir" define TMP "/tmp"...
DEBIAN-CVE-2005-3148
StoreBackup before 1.19 does not properly set the uid and guid for symbolic links 1 that are backed up by storeBackup.pl, or 2 recovered by storeBackupRecover.pl, which could cause files to be restored with incorrect ownership...
ntpd incalid gid usage
Invalid processing of -u parameter causes ntpd to start with invalid gid...
Lantronix Secure Console Server (edituser) Local Root Exploit
Exploit for unknown platform in category local exploits ============================================================= Lantronix Secure Console Server edituser Local Root Exploit ============================================================= !/bin/sh Lantronix Secure Console Server edituser root...
HP-UX Security patch : PHNE_9504
The remote host is missing HP-UX Security Patch number PHNE9504 . Vulnerability with Large UID's and GID's in HP-UX 10.20 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid17428;...
HP-UX Security patch : PHSS_9343
The remote host is missing HP-UX Security Patch number PHSS9343 . Vulnerability with Large UID's and GID's in HP-UX 10.20 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid17097;...
Debian DSA-034-1 : ePerl - remote root exploit
Fumitoshi Ukai and Denis Barbier have found several potential buffer overflow bugs in our version of ePerl as distributed in all of our distributions. When eperl is installed setuid root, it can switch to the UID/GID of the scripts owner. Although Debian doesn't ship the program setuid root, this...
Debian DSA-354-1 : xconq - buffer overflows
Steve Kemp discovered a buffer overflow in xconq, in processing the USER environment variable. In the process of fixing this bug, a similar problem was discovered with the DISPLAY environment variable. This vulnerability could be exploited by a local attacker to gain gid 'games'. %NASLMINLEVEL...
Debian DSA-215-1 : cyrus-imapd - buffer overflow
Timo Sirainen discovered a buffer overflow in the Cyrus IMAP server, which could be exploited by a remote attacker prior to logging in. A malicious user could craft a request to run commands on the server under the UID and GID of the cyrus server. %NASLMINLEVEL 70300 C Tenable Network Security,...
Debian DSA-462-1 : xitalk - missing privilege release
Steve Kemp from the Debian Security Audit Project discovered a problem in xitalk, a talk intercept utility for the X Window System. A local user can exploit this problem and execute arbitrary commands under the GID utmp. This could be used by an attacker to remove traces from the utmp file...
Debian DSA-356-1 : xtokkaetama - buffer overflows
Steve Kemp discovered two buffer overflows in xtokkaetama, a puzzle game, when processing the -display command line option and the XTOKKAETAMADIR environment variable. These vulnerabilities could be exploited by a local attacker to gain gid 'games'. %NASLMINLEVEL 70300 C Tenable Network Security,...
Solaris dtmail format string bug
format string bug in argv0 allows privilege escalation to gid group...
RHEL 2.1 : wu-ftpd (RHSA-2004:096)
An updated wu-ftpd package that fixes two security issues is now available. The wu-ftpd package contains the Washington University FTP File Transfer Protocol server daemon. FTP is a method of transferring files between machines. Glenn Stewart discovered a flaw in wu-ftpd. When configured with...
CVE-2004-0148
wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead...
CVE-2004-0148
wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead...