dislocate 1.3 - Local i386 Exploit

No description provided by source. / MasterSecuritY www.mastersecurity.fr dislocate.c - Local i386 exploit in v1.3 Secure Locate v2.3 Copyright C 2000 Michel MaXX Kaempf [email protected] Updated versions of this exploit and the corresponding advisory will be made available at:...

Sudo 1.5/1.6 Heap Corruption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2829/info Sudo superuser do is a security utility that allows administrator to give 'restricted' superuser privileges to certain users. Sudo contains a locally exploitable buffer overrun vulnerability. The overrun conditi...

BSD-Games 2.x Monop Player Name Local Buffer Overrun Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/8501/info Monop included in bsd-games is prone to a locally exploitable buffer overrun vulnerability. This is due to insufficient bounds checking of player names. Monop is typically installed setgid games, so it is possib...

Password Door 8.4 Local Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/33634/info Password Door is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Attackers may leverage this issue to execute arbitrary code in the...

BitchX <= 1.0c20 Local Buffer Overflow Exploit

No description provided by source. / Tested on BitchX-1.0c19 /str0ke / / P.o.C Exploit Code for BitchX made for Version BitchX-1.0c20cvs -- Date 20020325 C 2004. GroundZero Security Research and Software Development http://www.groundzero-security.com released under the GNU GPL -...

AIMP2 Audio Converter <= 2.53b330 (.pls/.m3u) Unicode Crash PoC

No description provided by source. !/usr/bin/python AIMP2 Audio Converter = 2.53 build 330 .pls/.m3u Unicode local crash PoC Found & exploited by: mrme Download: ftp://www.catode.ru/AIMP/aimp2.51.330.zip Tested on: Wind0ws XP SP3 Unicode overflow, maybe someone with better skills can exploit this...

HexChat 2.9.4 - Local Exploit

No description provided by source. !/usr/bin/python HexChat 2.9.4 Local Exploit Bug found by Jules Carter @iMulitia Exploit by Matt hostess Andreko mandreko at accuvant.com http://www.mattandreko.com/2013/04/buffer-overflow-in-hexchat-294.html junk1 = B30 shellcode = msfvenom -p windows/messagebo...

IRCnet IRCD 2.10 Local Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8817/info IRCnet IRCD has been reported prone to a buffer overflow vulnerability that may be exploited by local users. This issue may be exploited to crash the affected server. Although unconfirmed, due to the nature of...

Oracle Solaris - 'su' Local Solaris Vulnerability

No description provided by source. From http://cvs.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/cmd/su/su.c 521 for j = 0; initenvj != 0; j++ 1 522 if initvar = getenvinitenvj 2 ... 535 else 536 var = char 537 mallocstrleninitenvj 3 538 + strleninitvar 539 + 2; 540 void strcpyvar, initenvj;...

Acoustica Mixcraft <= 4.2 Universal Stack Overflow Exploit (SEH)

No description provided by source. !/usr/bin/perl Acoustica Mixcraft = 4.2 Universal Stack Overflow Exploit SEH ------------------------------------------------------ Found/Exploit by SkD [email protected] MixCraft Download = http://www.acoustica.com/mixcraft/download.htm A local exploit for the...

Sendfile 1.x/2.1 - Local Privileged Arbitrary Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2645/info Sendfile is an implementation of the SAFT simple asynchronous file transfer protocol for UNIX systems. Due to a problem dropping privileges completely before running user-specified post-processing commands in th...

Publish-It 3.6d - Buffer Overflow Vulnerability

No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Publish-It Buffer Overflow Vulnerability 1. Advisory Information Title: Publish-It Buffer Overflow Vulnerability Advisory ID: CORE-2014-0001 Advisory URL:...

MS HyperV Persistent DoS Vulnerability

No description provided by source. Core Security Technologies - Corelabs Advisory http://corelabs.coresecurity.com/ MS HyperV Persistent DoS Vulnerability 1. Advisory Information Title: MS HyperV Persistent DoS Vulnerability Advisory ID: CORE-2011-0203 Advisory URL:...

Linux Kernel < 2.6.19 udp_sendmsg Local Root Exploit

No description provided by source. / hoagieudpsendmsg.c LOCAL LINUX KERNEL ROOT EXPLOIT 2.6.19 - CVE-2009-2698 udpsendmsg bug exploit via output callback function used in dstentry / rtable Bug reported by Tavis Ormandy and Julien Tinnes of the Google Security Team Tested with Debian Etch r0 $ cat...

CVE-2014-0012

CVE-2014-0012 affects Jinja2 2.7.2: FileSystemBytecodeCache does not securely create temporary directories, allowing a local user to gain privileges by pre-creating a temp directory with that user’s UID. The issue exists due to an incomplete prior fix for CVE-2014-1402. Several connected advisori...

CVE-2014-0135

CVE-2014-0135 affects Kafo before 0.3.17 and 0.4.x before 0.5.2 (as used by Foreman). The issue is that default_values.yaml is world-readable, allowing local users to read passwords and other sensitive information. Remediation is to upgrade Kafo to 0.3.17+ or 0.4.x to 0.5.2+ (where fixed). If not...

CVE-2014-0470

CVE-2014-0470 affects the Super package (version 3.30.0) where the setuid() return value is not checked when the -F flag is used, enabling local privilege escalation via an RLIMIT_NPROC scenario. Root cause: failure to verify setuid() result. Public references (e.g., Debian security advisory DSA-...

CVE-2011-4089

The CVE-2011-4089 entry concerns the bzexe command in bzip2 1.0.5 and earlier. The vulnerability arises because extraction does not properly handle temporary files, allowing a local attacker to execute arbitrary code by precreating a temporary directory. Affected component: bzexe (bzip2). Root ca...

DEBIAN-CVE-2014-2678

The rdsiwladdrcheck function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports...

CVE-2014-1496

CVE-2014-1496 affects Mozilla Firefox (up to 28.0) and related Mozilla suite components (Firefox ESR 24.x up to 24.4, Thunderbird up to 24.4, SeaMonkey up to 2.25). The vulnerability allows local users to gain privileges by modifying the extracted Mar contents during an update, constituting a loc...