kpopup 0.9.x Privileged Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8915/info It has been alleged that it is possible for local attackers to gain root privileges through kpopup, which is is installed setuid root by default. According to the report, kpopup uses the system3 C-library functi...

Courier-IMAP <= 3.0.2-r1 auth_debug() Remote Format String Exploit

No description provided by source. / courier-imap = 3.0.2-r1 Remote Format String Vulnerability exploit Author: ktha at hush dot com Tested on FreeBSD 4.10-RELEASE with courier-imap-3.0.2 Special thanks goes to andrewg for providing the FreeBSD box. Greetings: all the guys from irc pulltheplug co...

polkit, Spice-Gtk, systemd, HPLIP, libvirt: Privilege escalation

Background polkit is a toolkit for managing policies relating to unprivileged processes communicating with privileged processes. Description polkit has a race condition which potentially allows a process to change its UID/EUID via suid or pkexec before authentication is completed. Impact A local...

Linux Kernel 3.13 - SGID Privilege Escalation

/ CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC Vitaly Nikolenko http://hashcrack.org Usage: ./poc filepath where filepath is the file on which you want to set the sgid bit / define GNUSOURCE include include include include include include include include include define STACKSIZE 1024...

Cetil Cross Site Scripting

Post Cross Site Scripting on Cetil - Demonstrativo de Pagamento de Salário + Date: 27/05/2014 + Risk: LOW + CWE number: CWE-79 + Author: Felipe Andrian Peixoto + Vendor Homepage: http://www.cetil.com.br/ + Contact: [email protected] + Tested on: Windows 7 and Linux + Vulnerable File:...

CVE-2013-6770

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then...

CVE-2013-6770

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then...

Discuz attachment download permission bypass method-vulnerability warning-the black bar safety net

Ultra vires download contain a“Read permissions”plug-in, download plug-in free snap coin To reproduce the steps of: 1, Using the administrator account, Upload a high reading permissions of the attachment 2, The use of low-privileged user account, download the attachment, this time, Discuz will...

Dexter (CasinoLoader) Panel - SQL Injection Exploit

Exploit for multiple platform in category web applications import pycurl import urllib import cStringIO import base64 import argparse import sys import string import pygeoip version = "0.1-httpbots-PoC" def PrintHelp: global version print "usage: dexter.PoC.py -h action gateway url" print "" prin...

kernel: net: permissions flaw in /proc/sys/net

The netctlpermissions function in net/sysctlnet.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application...

Discuz附件下载权限绕过

简要描述： 绕过附件下载权限只是漏洞的一个应用，还可以免费下载附件，其他的应用还没发掘.. 详细说明： 在下载附件的时候，附件所设置的“阅读权限”可以被绕过。 Discuz的附件下载地址是类似 forum.php?mod=attachment&aid=Nzg4fDQwNGQzYjMxfDEzODk2OTM4Mzh8MzEyNTR8MjY3Mw%3D%3D 这样的地址，其中的aid参数是一串base64，解码后是： 788|404d3b31|1389693838|31254|2673 这串aid在source/module/forum/forumattachment.php 中被这样解析...

IBM Lotus Notes Sametime User Enumeration

This module extracts usernames using the IBM Lotus Notes Sametime web interface using either a dictionary attack which is preferred, or a bruteforce attack trying all usernames of MAXDEPTH length or less. Module Options msf use auxiliary/gather/ibm/sametimeenumerateusers msf...

php云人才系统任意文件删除漏洞

简要描述： 一处代码逻辑有问题,导致任意文件删除漏洞. 2.5版本测试成功 3.0最新版本测试成功 算通用吧? 直接删除了 wafphp. 导致后面的注入 详细说明： 问题出在 /model/model/index.class.php delfiledir 这个function就不详细看了 就传个路径过去 直接删除. 利用很简单. 看下$this-uid 的获取方式 /model/class/common.php 22行. $this-uid=$COOKIE'uid'; 直接在cookie里面取. 虽然自己写的有过滤器 但是利用的数据根本不在过滤的范围内. 漏洞证明： 利用方法: 1...

CVE-2013-4270

The netctlpermissions function in net/sysctlnet.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application...

CVE-2013-4270

The netctlpermissions function in net/sysctlnet.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application...

CVE-2013-4270

CVE-2013-4270 affects the Linux kernel: the net_ctl_permissions function in net/sysctl_net.c may misdetermine uid/gid, allowing a local user to bypass /proc/sys/net restrictions. Affected: kernels before 3.11.5 (reported in EulerOS advisories and Nessus/OpenVAS listings). Impact is local privileg...

Scientific Linux Security Update : pacemaker on SL6.x i386/x86_64 (20131121)

A denial of service flaw was found in the way Pacemaker performed authentication and processing of remote connections in certain circumstances. When Pacemaker was configured to allow remote Cluster Information Base CIB configuration or resource management, a remote attacker could use this flaw to...

Android 4.3 Superuser Root Privilege Escalation

Current releases of the CyanogenMod/ClockWorkMod/Koush Superuser package may allow restricted local users to execute arbitrary commands as root in certain, non-default device configurations. Android 4.3 introduced the concept of "restricted profiles," created through the Settings - Users menu. A...

Paypal Shipping Cross Site Scripting

Document Title: =============== Paypal Inc Bug Bounty 105 MOS - Multiple Persistent Print Layout Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1039 PayPal Security UID: xE1128lV Release Date: ============= 2013-10-15 Vulnerability...

DEBIAN-CVE-2013-4291

The virSecurityManagerSetProcessLabel function in libvirt 0.10.2.7, 1.0.5.5, and 1.1.1, when the domain has read an uid:gid label, does not properly set group memberships, which allows local users to gain privileges...