2541 matches found
Linux Kernel Local Elevation of Privilege Vulnerability (CNVD-2016-12204)
The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A security vulnerability exists in the arch/arm64/kernel/sys.c file in Linux kernel versions prior to 4.0. A local attacker can exploit this vulnerability with write access to...
Android system_server Code Loading Bypass Vulnerability
Exploit for Android platform in category local exploits Android: Code loading bypasses in systemserver As of Android Nougat, a new set of SELinux rules have been added which are designed to prevent systemserver from loading arbitrary code into its address-space. This has been enforced by adding t...
Linux Kernel 2.6.22 < 3.9 - Dirty COW PTRACE_POKEDATA Race Condition PoC (Write Access) Exploit
Exploit for linux platform in category local exploits // $ echo pikachu|sudo tee pokeball;ls -l pokeball;gcc -pthread pokemon.c -o d;./d pokeball miltank;cat pokeball include //// pikachu include //// -rw-r--r-- 1 root root 8 Apr 4 12:34 pokeball include //// pokeball include //// include //// o ...
CVE-2016-9639
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...
SIEMENS SIMATIC CP 1543-1 Device Denial of Service Vulnerability
The SIEMENS SIMATIC CP 1543-1 is a communication processor with integrated firewall, VPN, security protocols, data encryption, and other security features that provides network connectivity and secure communication for s7-1500 controllers. A denial of service vulnerability exists in the SIEMENS...
CVE-2016-6450
A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access to some files in the underlying operating system. This vulnerability affects the following products if they are running a vulnerable release of Cisco IOS XE...
CVE-2016-6450
A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access to some files in the underlying operating system. This vulnerability affects the following products if they are running a vulnerable release of Cisco IOS XE...
CVE-2016-6450
CVE-2016-6450 affects Cisco IOS XE Software where the unbundle utility contains an input validation flaw. An authenticated, local attacker with privilege level 15 can abuse the installation utility to write to files on the underlying OS, potentially compromising system integrity and obtaining a s...
Cisco IOS XE Software Directory Traversal Vulnerability
A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access to some files in the underlying operating system. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced source...
Cisco IOS XE Software Directory Traversal Vulnerability
A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access to some files in the underlying operating system. The vulnerability is due to insufficient validation of files submitted to the affected installation utility...
Phoenix Contact ILC Security Bypass Vulnerability
Phoenix Contact ProConOs and MultiProg are programmable logic controllers PLCs for use in industrial PCs from the Phoenix Contact group. A security bypass vulnerability exists in the Phoenix Contact ILC PLCs, which can be exploited by an unauthenticated attacker to access read and write PLC...
NVIDIA Driver - Unchecked User-Provided Pointer in Escape 0x5000027
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=937 The DxgkDdiEscape handler for 0x5000027 accepts a user provided pointer, but does no checks on it before using it. ... DWORD userptr = escape5000027data-userptr; v32 = userptr2; v33 = userptr + 3; if v32 != -1 v33 = DWORD v32;...
Linux Kernel 2.6.22 3.9 - Dirty COW PTRACE_POKEDATA Race Condition (Write Access Method)
Linux Kernel 2.6.22 3.9 - Dirty COW PTRACEPOKEDATA Race Condition Write Access Method // $ echo pikachu|sudo tee pokeball;ls -l pokeball;gcc -pthread pokemon.c -o d;./d pokeball miltank;cat pokeball include //// pikachu include //// -rw-r--r-- 1 root root 8 Apr 4 12:34 pokeball include ////...
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method)
// $ echo pikachu|sudo tee pokeball;ls -l pokeball;gcc -pthread pokemon.c -o d;./d pokeball miltank;cat pokeball include //// pikachu include //// -rw-r--r-- 1 root root 8 Apr 4 12:34 pokeball include //// pokeball include //// include //// o o/ include //// @@ \ include //// \ , /miltank include...
Linux Kernel 2.6.22 3.9 - Dirty COW procselfmem Race Condition (Write Access Method)
Linux Kernel 2.6.22 3.9 - Dirty COW procselfmem Race Condition Write Access Method / dirtyc0w.c $ sudo -s echo this is not a test foo chmod 0404 foo $ ls -lah foo -r-----r-- 1 root root 19 Oct 20 15:23 foo $ cat foo this is not a test $ gcc -pthread dirtyc0w.c -o dirtyc0w $ ./dirtyc0w foo...
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method)
/ dirtyc0w.c $ sudo -s echo this is not a test foo chmod 0404 foo $ ls -lah foo -r-----r-- 1 root root 19 Oct 20 15:23 foo $ cat foo this is not a test $ gcc -pthread dirtyc0w.c -o dirtyc0w $ ./dirtyc0w foo m00000000000000000 mmap 56123000 madvise 0 procselfmem 1800000000 $ cat foo...
CVE-2016-4386
HPE Network Automation Software 10.10 allows local users to write to arbitrary files via unspecified vectors...
DEBIAN-CVE-2016-5418
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file...
openSUSE Security Update : php5 (openSUSE-2016-1095)
This update for php5 fixes the following security issues : - CVE-2016-7124: Create an Unexpected Object and Don't Invoke wakeup in Deserialization - CVE-2016-7125: PHP Session Data Injection Vulnerability - CVE-2016-7126: selectcolors write out-of-bounds - CVE-2016-7127: imagegammacorrect allowed...
SUSE-SU-2016:2328-1 Security update for php53
This update for php53 fixes the following security issues: CVE-2014-3587: Integer overflow in the cdfreadpropertyinfo affecting SLES11 SP3 bsc987530 CVE-2016-6297: Stack-based buffer overflow vulnerability in phpstreamzipopener bsc991426 CVE-2016-6291: Out-of-bounds access in...