Windows File System Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in the Windows kernel that could allow an attacker to exploit time of check time of use TOCTOU issues in file path-based checks from a low-integrity application. An attacker who successfully exploited this vulnerability could potentially modify files...

Quanta LTE Router Code Execution / Backdoor Accounts

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory Information Title: Multiple vulnerabilities found in Quanta LTE routers backdoor, backdoor accounts, RCE, weak WPS ... Advisory URL: https://pierrekim.github.io/advisories/2016-quanta-0x00.txt Blog URL:...

ATutor 2.2.1 - Directory Traversal / Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'ATutor 2.2.1 Directory Traversal / Remote Code Execution', 'Description' = %q This module exploits a directory traversal...

ATutor 2.2.1 - Directory Traversal / Remote Code Execution (Metasploit)

Exploit for php platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'ATutor 2.2.1 Directory Traversal / Remote Code Execution', 'Description' =...

ATutor 2.2.1 Directory Traversal / Remote Code Execution

This module exploits a directory traversal vulnerability in ATutor on an Apache/PHP setup with displayerrors set to On, which can be used to allow us to upload a malicious ZIP file. On the web application, a blacklist verification is performed before extraction, however it is not sufficient to...

Apple Mac OSX - 'gst_configure' Kernel Buffer Overflow

/ Source: https://code.google.com/p/google-security-research/issues/detail?id=596 The external method 0x206 of IGAccelGLContext is gstconfigure. This method takes an arbitrary sized input structure passed in rsi but doesn't check the size of that structure passed in rcx. text:000000000002A366...

Apple Mac OSX - gst_configure Kernel Buffer Overflow

Exploit for macOS platform in category dos / poc / Source: https://code.google.com/p/google-security-research/issues/detail?id=596 The external method 0x206 of IGAccelGLContext is gstconfigure. This method takes an arbitrary sized input structure passed in rsi but doesn't check the size of that...

Apple Mac OSX - gst_configure Kernel Buffer Overflow

Apple Mac OSX - gstconfigure Kernel Buffer Overflow / Source: https://code.google.com/p/google-security-research/issues/detail?id=596 The external method 0x206 of IGAccelGLContext is gstconfigure. This method takes an arbitrary sized input structure passed in rsi but doesn't check the size of tha...

Gentoo QEMU Local Privilege Escalation

/ == virtfshell == Some distributions make virtfs-proxy-helper from QEMU either SUID or give it CAPCHOWN fs capabilities. This is a terrible idea. While virtfs-proxy-helper makes some sort of flimsy check to make sure its socket path doesn't already exist, it is vulnerable to TOCTOU. This should...

QEMU (Gentoo) - Local Privilege Escalation

/ == virtfshell == Some distributions make virtfs-proxy-helper from QEMU either SUID or give it CAPCHOWN fs capabilities. This is a terrible idea. While virtfs-proxy-helper makes some sort of flimsy check to make sure its socket path doesn't already exist, it is vulnerable to TOCTOU. This should...

QEMU (Gentoo) - Local Privilege Escalation

QEMU Gentoo - Local Privilege Escalation / == virtfshell == Some distributions make virtfs-proxy-helper from QEMU either SUID or give it CAPCHOWN fs capabilities. This is a terrible idea. While virtfs-proxy-helper makes some sort of flimsy check to make sure its socket path doesn't already exist,...

Oracle: Security Advisory (ELSA-2013-1319)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-3246: Time-of-check Time-of-use (TOCTOU) Race Condition

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service inconsistent file state by causing an error during the modification. NOTE: this issue can be combined wi...

Adobe AIR for Mac <= 17.0.0.144 Multiple Vulnerabilities (APSB15-09)

According to its version, the installation of Adobe AIR on the remote Mac OS X host is equal or prior to 17.0.0.144. It is, therefore, affected by multiple vulnerabilities : - An unspecified security bypass vulnerability exists that allows an attacker to disclose sensitive information...

Adobe AIR <= 17.0.0.144 Multiple Vulnerabilities (APSB15-09)

According to its version, the installation of Adobe AIR on the remote Windows host is equal or prior to 17.0.0.144. It is, therefore, affected by multiple vulnerabilities : - An unspecified security bypass vulnerability exists that allows an attacker to disclose sensitive information. CVE-2015-30...

CVE-2015-1743: Time-of-check Time-of-use (TOCTOU) Race Condition

Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1748...

Adobe Flash Player -- critical vulnerabilities

Adobe reports: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the lates...

Chrome, Firefox, Safari and IE – All Browsers Hacked at Pwn2Own Competition

The Annual Pwn2Own Hacking Competition 2015 held in Vancouver is over and participants from all over the world nabbed $557,500 in bug bounties for 21 critical bugs in top four web browsers as well as Windows OS, Adobe Reader and Adobe Flash. During the second and final day of this year’s hacking...

Fedora 20 : pyxdg-0.25-5.fc20 (2014-16357)

Fix CVE-2014-1624 pyxdg: TOCTOU race condition in getruntimedir when strict=False Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 19 : pyxdg-0.25-5.fc19 (2014-16466)

Fix CVE-2014-1624 pyxdg: TOCTOU race condition in getruntimedir when strict=False Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...