Access right escalation / severe permission problems on Raritan Console Servers

Hi, during my research on console servers I've encountered a severe problem on one appliance. Summary: Access right escalation / severe permission problems on Raritan Console Servers Confirmed on DSX32, Software version: 2.4.6 www.raritan.com, more see below Details: DSX Raritan Console Servers...

Remote Desktop Protocol Server Man-in-the-Middle Weakness

The remote version of the Remote Desktop Protocol Server Terminal Service is vulnerable to a man-in-the-middle MiTM attack. The RDP client makes no effort to validate the identity of the server when setting up encryption. An attacker with the ability to intercept traffic from the RDP server can...

[Full-disclosure] D-Link DSL routers authentication bypass

====================== SUMMARY ======================== Title: D-Link DSL routers authentication bypass Date: 19 May 2005 Author: Francesco Orro francesco.orro 4t akhela.com Product: DSL-502T, DSL-504T, DSL-562T, DSL-G604T Vendor: D-Link Vendor URL: http://www.dlink.com Vendor Status: D-Link was...

calicclnt_getconfig.pm

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

Apple Mac OSX - AppleFileServer Remote Denial of Service

/ fm-afp.c - nemo @ felinemenace.org - 2005 Code for afp bug found by Braden Thomas. Again hello to everyone @ irc.pulltheplug.org need a challenge? - http://pulltheplug.org - / include include include include include define UAMSIZE 1022 define AFPVERSIZE 5 define PATHSIZE 30 define UASIZE 30...

PerlDesk 1.x - SQL Injection

!/usr/bin/perl Example: kb.cgi?view=0 UNION SELECT 1,3,password,username,3,7 FROM users Exploit is attached. ./pde.pl www.internethosting4u.com /perldesk/kb.cgi 148.244.150.58:80 use IO::Socket; print ' PerlDesk exploit Usage: ./pdsploit.pl host path proxy Vunerability discovered by deluxe89 and...

Mercury/32 Mail Server 4.01a - 'check' Buffer Overflow

===== Start Mercury32Overflow.pl ===== Usage: Mercury32Overflow.pl Mercury32Overflow.pl 127.0.0.1 hello moto Mercury/32, v4.01a, Dec 8 2003 Download: http://www.pmail.com/ use IO::Socket; use strict; my$socket = ""; if $socket = IO::Socket::INET-newPeerAddr = $ARGV0, PeerPort = "143", Proto = "TC...

ShixxNote 6.net Remote Buffer Overflow Exploit

Exploit for unknown platform in category dos / poc ============================================== ShixxNote 6.net Remote Buffer Overflow Exploit ============================================== / by Luigi Auriemma / include include include ifdef WIN32 include include "winerr.h" define close...

NetworkActive Web Server Resource Exhaustion DoS

Binary data 2348.prm...

D-Link DCS-900 Camera Remote IP Address Changer Exploit

Exploit for hardware platform in category remote exploits ======================================================= D-Link DCS-900 Camera Remote IP Address Changer Exploit ======================================================= / dlinkdown.c - miscname.com change ip address on all dlink dcs-900...

OverByte ICS FTP Server Remote Denial of Service Exploit

No description provided by source. --Exploit: //=========================================================== include winsock2.h include stdio.h pragma commentlib, \"ws232.lib\" char Nonnullterminatedstring = \"AAAAAAAAAAAAAAAAAA\"; int mainint argc, char argv WSADATA wsaData; WORD...

BT Voyager 2000 Wireless ADSL Router - SNMP Community String Information Disclosure

BT Voyager 2000 Wireless ADSL Router - SNMP Community String Information Disclosure source: https://www.securityfocus.com/bid/10589/info BT Voyager 2000 Wireless ADSL Router is reported prone to a sensitive information disclosure vulnerability. It is reported that 'public' SNMP MIB community...

Lexmark / Dell Printer Unauthenticated Access

The remote printer has no password set. This allows anyone to change its IP or potentially to intercept print jobs sent to it. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid12236; scriptversion "$Revision: 1.14 $"; scriptcvsdate"$Date: 2013/01/25 01:19:09 $";...

Avaya Argent Office uses weak authentication for TFTP-based administrative control

Overview The Avaya Argent Office contains a weak authentication mechanism for administrative access. Description The Avaya Argent Office uses a TFTP-based mechanism to accept requests for administrative functions. By requesting "files" from the device via its internal interface, administrators ca...

Cfengine2 cfservd remote stack overflow

============================================================================== Background ========== Cfengine www.cfengine.org automates the configuration and maintenance of large computer networks. A common setup involves running the cfservd daemon on TCP port 5308 on a central master server, wi...

Oracle XDB FTP Service UNLOCK Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits ===================================================== Oracle XDB FTP Service UNLOCK Buffer Overflow Exploit ===================================================== + vulnerabilities network level/stack based buffer overflow + special network...

The PACKET 0' DEATH FastTrack network vulnerability

The PACKET 0' DEATH FastTrack network vulnerability =================================================== Vulnerability Overview ---------------------- There exists a vulnerability in the FastTrack network core that can be used by an attacker to take control of all FastTrack network supernodes. The...

Kerio Personal Firewall 2.1.4 - Remote Code Execution

Kerio Personal Firewall 2.1.4 - Remote Code Execution / Kerio Personal Firewall v2.1.4 remote code execution exploit Tested on Windows XP with SP1 In order to exploit, for ease of mind, set the firewall to permit all traffic, or allow a connection to port 44334 from your testing unix shell ip. It...

Apache HTTP Server 2.x Memory Leak Exploit

Exploit for unknown platform in category dos / poc ========================================== Apache HTTP Server 2.x Memory Leak Exploit ========================================== / apache-massacre.c Test code for Apache 2.x Memory Leak By Matthew Murphy DISCLAIMER: This exploit tool is provided...

Apache 2.x - Memory Leak

/ apache-massacre.c Test code for Apache 2.x Memory Leak By Matthew Murphy DISCLAIMER: This exploit tool is provided only to test networks for a known vulnerability. Do not use this tool on systems you do not control, and do not use this tool on networks you do not own without appropriate consent...