The vulnerability of the vi command-line editor for system data storage, Backup Manager, allows a hacker to obtain root privileges.

The vulnerability of the vi script service for the system data storage, Backup Manager, is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to obtain root privileges and compromise the integrity of the critical /etc/passwd file by executing a speci...

MetalGenix GeniXCMS 'forgotpassword.php' File Denial of Service Vulnerability

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A security vulnerability exists in the forgotpassword.php file in MetalGenix GeniXCMS version 1.0.2. A...

Privilege Escalation

github.com/opencontainers/runc is vulnerable to privilege escalation attacks. These attacks are possible because github.com/opencontainers/runc treats a numeric UID as a potential username. This allows local users to gain privileges though a numeric username in the password file. This transitivel...

Zyxel EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection Vulnerability

Exploit for hardware platform in category remote exploits Exploit Title: Zyxel, EMG2926 /expert/maintenance/diagnostic/nslookup?nslookupbutton=nslookupbutton&pingip=google.ca%3b%20cat%20/etc/passwd&serverip= HTTP/1.1 Host: 192.168.0.1 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh...

Zyxel / EMG2926 Command Injection

Exploit Title: Zyxel, EMG2926 /expert/maintenance/diagnostic/nslookup?nslookupbutton=nslookupbutton&pingip=google.ca%3b%20cat%20/etc/passwd&serverip= HTTP/1.1 Host: 192.168.0.1 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10124 AppleWebKit/537.36 KHTML, like Geck...

Wonder CMS Information Disclosure Vulnerability

Wonder CMS is an open source content management system CMS. An information disclosure vulnerability exists in Wonder CMS version 2014. A remote attacker can exploit this vulnerability to obtain sensitive information by viewing /files/password...

Binom3 Web Management Login Scanner, Config and Password File Dump

This module scans for Binom3 Multifunctional Revenue Energy Meter and Power Quality Analyzer management login portals, and attempts to identify valid credentials. There are four 4 default accounts - 'root'/'root', 'admin'/'1', 'alg'/'1', 'user'/'1'. In addition to device config, 'root' user can...

Huawei P9 Lock Screen Bypass Vulnerability

Huawei P9 is a smartphone product of Huawei, China. Huawei P9 suffers from a lock screen bypass vulnerability. An unauthenticated attacker can force the phone into fastboot mode and delete the user's password file during a phone reboot. The lock screen password disappears after the phone reboots...

UBUNTU-CVE-2013-1430

An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file /.vnc/sesman$usernamepasswd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key...

DEBIAN-CVE-2013-1430

An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file /.vnc/sesman$usernamepasswd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key...

The vulnerability of the microprogrammed software of the D–Link DSR–500 router allows a malicious individual to gain access to user account information.

In the D-Link DSR-500 router, all users are given the right to read the system password file...

DEBIAN-CVE-2016-3697

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container...

CVE-2016-3697

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container...

UBUNTU-CVE-2016-3697

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container...

CVE-2016-3697

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container...

Info-ZIP UnZip Heap Buffer Overflow Vulnerability

Info-ZIP UnZip is a set of Unix-based tools for decompressing the ".zip" file format. Info-ZIP UnZip suffers from a heap buffer overflow vulnerability that allows an attacker to construct a special decompression file containing a password that can be parsed by an application, crashing the...

LOYTEC Router Information Exposure Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified a password file vulnerability in LOYTEC’s LIP-3ECTB routers. LOYTEC has produced a firmware update to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following LOYTEC routers are affected:...

libuser: Security flaw in handling /etc/passwd file

A flaw was found in the way the libuser library handled the /etc/passwd file. A local attacker could use an application compiled against libuser for example, userhelper to manipulate the /etc/passwd file, which could result in a denial of service or possibly allow the attacker to escalate their...

D-Link DSL-2750u / DSL-2730u - (Authenticated) Local File Disclosure

Author: SATHISH ARTHAR + Exploit Title: Dlink Wireless Router Password File Access Exploit Local File Inclusion + Date: 07-07-2015 + Platform: Hardware + Tested on: linux + Vendor: http://www.dlink.co.in + Product web page: http://www.dlink.co.in + Affected version: DSL-2750u firmware: IN1.08...

UBUNTU-CVE-2014-5015

bozotic HTTP server aka bozohttpd before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path...