CVE-2019-14483

AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. Every user can read the BSD, Linux, MacOS and Solaris private keys, private keys' passwords, and root passwords stored in the credential manager. Every administrator can read the ESX and Windows passwords stored in the credential manager...

CVE-2019-14483

The CVE-2019-14483 entry concerns AdRem NetCrunch 10.6.0.4587, where the credential manager stores private keys and passwords (BSD/Linux/MacOS/Solaris keys, private keys and root passwords) readable by any user, and ESX/Windows passwords readable by any administrator. This is a credentials-disclo...

SunSSH 11.0 x86 - libpam Remote Root Exploit

Exploit Title: Solaris SunSSH 11.0 x86 - libpam Remote Root Exploit Author: Hacker Fantastic Vendor Homepage: https://www.oracle.com/solaris/technologies/solaris11-overview.html Version: 11 Tested on: SunOS solaris 5.11 11.0 / SunSSH Solaris 10-11.0 x86 libpam remote root exploit CVE-2020-14871...

Solaris SunSSH 11.0 x86 libpam Remote Root

Exploit Title: Solaris SunSSH 11.0 x86 - libpam Remote Root Exploit Author: Hacker Fantastic Vendor Homepage: https://www.oracle.com/solaris/technologies/solaris11-overview.html Version: 11 Tested on: SunOS solaris 5.11 11.0 / SunSSH Solaris 10-11.0 x86 libpam remote root exploit CVE-2020-14871...

Solaris SunSSH 11.0 x86 - libpam Remote Root

Exploit Title: Solaris SunSSH 11.0 x86 - libpam Remote Root Exploit Author: Hacker Fantastic Vendor Homepage: https://www.oracle.com/solaris/technologies/solaris11-overview.html Version: 11 Tested on: SunOS solaris 5.11 11.0 / SunSSH Solaris 10-11.0 x86 libpam remote root exploit CVE-2020-14871...

XSS Vulnerability in YzmCMS

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture, YzmCMS can run on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMS has an XSS vulnerability. Attackers can use the vulnerability to obtain sensitive information such as user cookies...

Xerox DocuShare Bugs Allow Data Leaks

Xerox issued a fix for two vulnerabilities impacting its market-leading DocuShare enterprise document management platform. The bugs, if exploited, could expose DocuShare users to an attack resulting in the loss of sensitive data. On Wednesday, the Cybersecurity and Infrastructure Security Agency...

shadowbroker

This repository contains a collection of exploits and tools, including the "Lost In Translation" leak from the Shadow Brokers. The repository includes exploits for various vulnerabilities, such as RedHat 7.0-7.1 Sendmail 8.11.x, Solaris 6, 7, 8, 9 & 10, and Samba 3.0.x Linux. The exploits are...

libpam parse_user_name function Solaris Full Control

The vulnerability of the parseusername function in the libpam library, a plugin for the Pluggable Authentication Module of the Solaris operating system, is related to an operation that goes beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor, operating remotel...

Oracle Solaris Kernel Unauthorized Access

The vulnerability of the Kernel component in Oracle Solaris operating systems is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures...

Filesystem Component DoS

The vulnerability of the Filesystem component in Oracle Solaris is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to cause service failures...

Oracle Solaris Utility Data Access

The vulnerability of the Utility component in Oracle Solaris systems is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data using the SSH network protocol...

Oracle Solaris Kernel Data Access

The vulnerability of the Kernel component of the Oracle Solaris operating system is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to modify, add, or delete data...

openSUSE Security Update : java-11-openjdk (openSUSE-2020-1994)

"This update for java-11-openjdk fixes the following issues : - Update to upstream tag jdk-11.0.9-11 October 2020 CPU, bsc1177943 - New features + JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector - Security fixes + JDK-8233624: Enhance JNI linkage + JDK-8236196: Improve string pooling ...

Release Information for Veeam Agent for Oracle Solaris 2.1

The latest version of Veeam Agent for Oracle Solaris can be found here: https://www.veeam.com/oracle-solaris-agent-download.html This update supersedes Veeam Agent for Oracle Solaris 2.0. Requirements Upgrade from v1 is not supported, clean installation is required. Upgrade from Veeam Agent for...

Oracle Solaris PAM parse_user_name() buffer overflow (CVE-2020-14871)

Binary data solarissshpamcve-2020-14871.nbin...

Oracle Solaris Buffer Overflow (CVE-2020-14871)

A buffer overflow vulnerability exists in Oracle Solaris. Successful exploitation of this vulnerability could result in a denial of service or execution of arbitrary code into the affected system...

In Wild Critical Buffer Overflow Vulnerability in Solaris Can Allow Remote Takeover — CVE-2020-14871

FireEye Mandiant has been investigating compromised Oracle Solaris machines in customer environments. During our investigations, we discovered an exploit tool on a customer’s system and analyzed it to see how it was attacking their Solaris environment. The FLARE team’s Offensive Task Force analyz...

Oracle Solaris Zero-Day Attack Revealed

A previously known threat group, called UNC1945, has been compromising telecommunications companies and targeting financial and professional consulting industries, by exploiting a security flaw in Oracle’s Solaris operating system. Researchers said that the group was exploiting the bug when it wa...

Live off the Land? How About Bringing Your Own Island? An Overview of UNC1945

Through Mandiant investigation of intrusions, the FLARE Advanced Practices team observed a group we track as UNC1945 compromise managed service providers and operate against a tailored set of targets within the financial and professional consulting industries by leveraging access to third-party...