CVE-2011-1231

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer...

CVE-2009-5064

ldd in the GNU C Library aka glibc or libc6 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LDTRACELOADEDOBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion...

CVE-2011-0532

The 1 backup and restore scripts, 2 main initialization script, and 3 ldap-agent script in 389 Directory Server 1.2.x aka Red Hat Directory Server 8.2.x place a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the...

LifeType 1.2.10 - HTTP Referer Persistent Cross-Site Scripting

LifeType 1.2.10 - HTTP Referer Persistent Cross-Site Scripting Exploit Title: lifetype 1.2.10 http referer XSS Date: 11-1-2010 Author: Saif El-Sherei Software Link: http://lifetype.net/page/downloads Version: 1.2.10 Tested on: firefox 3.0.15 failure to sanitize the http referer header in index.ph...

Microsoft Windows Vista7 - Local Privilege Escalation (UAC Bypass)

Microsoft Windows Vista7 - Local Privilege Escalation UAC Bypass A Design Flaw in Windows Kernel API can Lead to privilege escalation. Mirror of Original Post: http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ PoC:...

Microsoft Windows Vista/7 - Local Privilege Escalation (UAC Bypass)

A Design Flaw in Windows Kernel API can Lead to privilege escalation. Mirror of Original Post: http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ PoC: http://www.codeproject.com/KB/vista-security/uac.aspx not available mirror:...

CVE-2010-3363

roarify in roaraudio 0.3 places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

CVE-2010-3357

gnome-subtitles 1.0 places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

CVE-2010-3382

TAU (Tuning and Analysis Utilities) version 2.16.4 contains a vulnerability where a zero-length directory name is placed in LD_LIBRARY_PATH, allowing a local user to gain privileges via a Trojan horse shared library loaded from the current working directory. The issue is triggered by manipulating...

win32/xp sp3 (ru) add local administrator in 74 bytes

Exploit for win32 platform in category shellcode ===================================================== win32/xp sp3 ru add local administrator in 74 bytes ===================================================== win32/xp sp3 ru add local administrator in 74 bytes...

[SECURITY] Fedora 11 Update: sudo-1.7.2p6-2.fc11

Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...

CVE-2010-2059

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable 1...

Linux kernel 2.6.34-rc5 find_keyring_by_name()函数本地内存破坏漏洞

BUGTRAQ ID: 39719 CVE ID: CVE-2010-1437 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的findkeyringbyname函数可能获得已经释放的密钥环，之后再访问该密钥环就会触发内存破坏，导致拒绝服务的情况。 Linux kernel 2.6.34-rc5 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://patchwork.kernel.org/patch/94038/ !/bin/sh LOOP=100000...

Design/Logic Flaw

Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to the Create User privilege...

CVE-2010-0860

Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to the Create User privilege...

AdaptCMS Lite 1.5 - Arbitrary Add Admin

=========================================================================== Topic : AdaptCMSLite1.5 2009-07-07 Bug type : change admin user,passwd & add new admin user exploit Download : http://sourceforge.net/projects/adaptcms/files/AdaptCMS%20Lite%20v1/1.5/AdaptCMSLite1.5.zip/download Advisory ...

Internet Explorer Nested Object Tag Handling Memory Corruption (MS06-021; CVE-2006-1992)

Microsoft Internet Explorer IE is the most widely used web browser application. The browser is capable of processing HTML, scripting languages, and interpretation of various other popular Internet specifications. There exists a memory corruption vulnerability in Microsoft Internet Explorer. The...

CVE-2010-0443

HP OpenVMS RMS on ALPHA platforms (Record Management Services) contains a local privilege-escalation vulnerability in patch kits for RMS, specifically affecting patch kits VMS83A_RMS-V1000 and UPDATE-V1100. The security bulletin notes a local escalation of privilege via unknown vectors, with CVSS...

CVE-2010-0232

The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly...

MySQL Malformed Password Authentication (CVE-2004-0627)

MySQL is an open-source implementation of a relational database management system. MySQL supports the SQL Structured Query Language database query language. The database product allows remote network connections from client applications over the proprietary MySQL network protocol in addition to...