1965 matches found
FreeBSD : ifmail -- unsafe set-user-ID application (746ca1ac-21ec-11d9-9289-000c41e2cdad)
Niels Heinen reports that ifmail allows one to specify a configuration file. Since ifmail runs set-user-ID news', this may allow a local attacker to write to arbitrary files or execute arbitrary commands as the news' user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...
FreeBSD : bmon -- unsafe set-user-ID application (938f357c-16dd-11d9-bc4a-000c41e2cdad)
Jon Nistor reported that the FreeBSD port of bmon was installed set-user-ID root, and executes commands using relative paths. This could allow local user to easily obtain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...
Ubuntu 6.06 LTS / 7.04 / 7.10 : openssh vulnerabilities (USN-649-1)
It was discovered that the ForceCommand directive could be bypassed. If a local user created a malicious /.ssh/rc file, they could execute arbitrary commands as their user id. This only affected Ubuntu 7.10. CVE-2008-1657 USN-355-1 fixed vulnerabilities in OpenSSH. It was discovered that the fixe...
Jinzora name Parameter Local File Inclusion
The remote host is running Jinzora, a web-based media streaming and management system written in PHP. The version of Jinzora installed on the remote host fails to filter user-supplied input to the 'name' variable in the 'index.php' script when 'op' is set before using it to include PHP code...
ZABBIX < 1.6.3 Web Interface locales.php extlang[] Remote Code Execution
Binary data 4951.prm...
Coppermine Photo Gallery keysToSkip Parameter Overwrite
The version of Coppermine Photo Gallery installed on the remote host contains a flaw in the anti-registerglobals protective code in 'include/init.inc.php'. Provided PHP's 'registerglobals' setting is enabled, an unauthenticated, remote attacker can leverage this issue using a specially crafted...
Coppermine Photo Gallery <= 1.4.20 (BBCode IMG) Privilege Escalation
No description provided by source. +--------------------------------------------------------------------------+ | Coppermine Photo Gallery = 1.4.20 BBCode IMG Privilege Escalation PoC | +--------------------------------------------------------------------------+ | by Juri Gianni aka yeat -...
Coppermine Photo Gallery 1.4.20 - BBCode IMG Privilege Escalation
Coppermine Photo Gallery 1.4.20 - BBCode IMG Privilege Escalation +--------------------------------------------------------------------------+ | Coppermine Photo Gallery = 1.4.20 BBCode IMG Privilege Escalation PoC | +--------------------------------------------------------------------------+ | b...
Jaws language Parameter Multiple Local File Includes
Jaws, a Framework and Content Management System for building dynamic websites, is installed on the remote system. The installed version fails to filter input to the 'language' parameter before using it to include PHP code in '/upgrade/index.php' and '/install/index.php'. Regardless of PHP's...
PLE CMS 1.0 Beta 4.2 SQL Injection
--+++==============================================================+++-- --+++====== PLE CMS 1.0 beta 4.2 Blind SQL Injection Exploit ======+++-- --+++==============================================================+++-- ". "\n+ Ex. : php xpl.php localhost /PLECMS root...
OpenX fc.php MAX_type Parameter Traversal Local File Inclusion
The remote host is running OpenX formerly Openads, an open source ad serving application written in PHP. The installed version of OpenX does not validate user-supplied input to the 'MAXtype' parameter of the 'www/delivery/fc.php' script before using it in a PHP 'include' function. Regardless of...
HTTP NULL User ID and Password (deprecated)
Binary data 4842.prm...
Oracle Secure Backup NDMP_CONECT_CLIENT_AUTH Command Buffer Overflow Vulnerability
Oracle Secure Backup NDMPCONECTCLIENTAUTH Command Buffer Overflow Vulnerability 2009.January.13 Fortinet's FortiGuard Global Security Research Team Discovers Vulnerability in Oracle Secure Backup Summary: ======== A Buffer Overflow vulnerability exists Oracle Secure Backup 10.2.0.2 through a...
serv-u7 local exploit (php)-bug warning-the black bar safety net
Note: since the author is lazy, does not provide the log cleaning function that will leave the log: One, the su7 is the right there are several? There are two forms to get rid of su7 in. 1, login to the Administrator Console page ==get the OrganizationId for Add User ==get the global user of...
XOOPS Multiple Scripts mydirname Parameter Arbitrary Command Injection
The version of XOOPS installed on the remote host fails to filter user-supplied input to the 'mydirname' parameter of the 'onupdate.php', 'notification.php', and 'oninstall.php' scripts under the application's 'xoopslib/modules/protector' directory before passing it to PHP 'eval' functions...
XStandard Lite Plugin for Joomla! X_CMS_LIBRARY_PATH Header Directory Traversal
The version of Joomla! running on the remote host is distributed with a WYSIWYG editor plugin known as XStandard Lite. This plugin is affected by an information disclosure vulnerability in the attachmentlibrary.php script due to improper sanitization of user-supplied input to the XCMSLIBRARYPATH...
kernel: open() call allows setgid bit when user is not in new file's group
fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable...
BSD/x86 - setuid(0) + Break chroot (../ 10x Loop) + Bind TCP (2222/TCP) Shell Shellcode (133 bytes)
BSD/x86 - setuid0 + Break chroot ../ 10x Loop + Bind TCP 2222/TCP Shell Shellcode 133 bytes. Shellcode exploit for BSDx86 platform / The setuid0+chroot+bind shellcode it will: setuid0 put '../' 10 times in chroot open shell on 2222nd port Size 133 bytes OS BSD /rootteam/dev0id rootteam.void.ru...
CMS NetCat 3.12 (password_recovery.php) Blind SQL Injection Exploit
No description provided by source. ? / NetCat Blind SQL Injection exploit by s4avrd0w [email protected] Versions affected 3.12 More info: http://www.netcat.ru/ tested on version 3.12 usage: ./NetCatblindSQLexploit.php -s=NetCatserver -u=UserID The options are required: -u The user identifier number...
Moodle 'filter/tex/texed.php' 'pathname' Parameter Remote Command Execution
The version of Moodle installed on the remote host fails to sanitize user-supplied input to the 'pathname' parameter before using it in the 'filter/tex/texed.php' script in a commandline that is passed to the shell. Provided that PHP's 'registerglobals' setting and the TeX Notation filter has bot...