CVE-2020-8920

CVE-2020-8920 describes an information-leak in Gerrit where an over-optimization in the FilteredRepository wrapper bypasses access checks on All-Users repositories, allowing read access to users’ personal information. Affected versions are Gerrit before 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, ...

sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword

A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...

Powershell Profile Persistence

This module establishes persistence by modifying a PowerShell profile script, which is automatically executed when PowerShell starts. The module supports multiple profile scopes current user or all users and safely backs up any existing profile prior to modification, enabling clean removal by...

sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword

A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...

Oracle MySQL (Windows) - FILE Privilege Abuse (Metasploit)

Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Oracle MySQL for Microsoft Windows FILE Privilege Abuse', 'Description' = %q This module takes advantage of a file privilege misconfiguration problem specifically against Windows MySQL servers. Th...

Oracle MySQL for Microsoft Windows FILE Privilege Abuse

Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Oracle MySQL for Microsoft Windows FILE Privilege Abuse', 'Description' = %q This module takes advantage of a file privilege misconfiguration problem specifically against Windows MySQL servers. Th...

Persits XUpload ActiveX MakeHttpRequest Directory Traversal

No description provided by source. $Id: persitsxuploadtraversal.rb 10998 2010-11-11 22:43:22Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...

Oracle MySQL for Microsoft Windows FILE Privilege Abuse

This module takes advantage of a file privilege misconfiguration problem specifically against Windows MySQL servers. This module abuses the FILE privilege to write a payload to Microsoft's All Users Start Up directory which will execute every time a user logs in. The default All Users Start Up...

USN-1230-1: Quassel vulnerability

Felix Geyer discovered that the quassel-core post installation script created data and logging directories which were readable by all users. The post installation script also generated a certificate, in the data directory, which was readable by all users...

Foxit PDF Reader 4.2 Javascript File Write

This module exploits an unsafe Javascript API implemented in Foxit PDF Reader version 4.2. The createDataObject Javascript API function allows for writing arbitrary files to the file system. This issue was fixed in version 4.3.1.0218. Note: This exploit uses the All Users directory currently, whi...

plugin: enable QUEUE_ALL_USERS_TRUSTED for Submit/Hold/Release/Remove ops

The installation documentation for Red Hat Enterprise Messaging, Realtime and Grid MRG 1.3 recommends that Condor should be configured so that the MRG Management Console cumin can submit jobs for users, which creates a trusted channel with insufficient access control that allows local users with...

plugin: enable QUEUE_ALL_USERS_TRUSTED for Submit/Hold/Release/Remove ops

The installation documentation for Red Hat Enterprise Messaging, Realtime and Grid MRG 1.3 recommends that Condor should be configured so that the MRG Management Console cumin can submit jobs for users, which creates a trusted channel with insufficient access control that allows local users with...

Can not UPDATE the "Viewable By" field of an issue

After the creation of an issue it is by default viewable by "All Users". It is not possible to change the value after re-editing that issue. After changing it and clicking the "Update" button, the viewable by entry stays "All Users"...

Persits XUpload ActiveX MakeHttpRequest Directory Traversal

$Id: persitsxuploadtraversal.rb 7760 2009-12-08 21:24:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Ez Poll Hoster XSS / XSRF

----------------------------------------------------------------------------------------------- Title: Ez Poll Hoster Multiple XSS and XSRF Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 14. December 2009...

Persits XUpload ActiveX MakeHttpRequest Directory Traversal

This module exploits a directory traversal in Persits Software Inc's XUpload ActiveX controlversion 3.0.0.3 that's included in HP LoadRunner 9.5. By passing a string containing ".." sequences to the MakeHttpRequest method, an attacker is able to write arbitrary files to arbitrary locations on...

PHPortal 1.0 - Insecure Cookie Handling

PHPortal 1.0 - Insecure Cookie Handling PhpPortal v1 Insecure Cookie Handling Vulnerability Author : KnocKout Special Thankz : CW All users Script : http://phportal.mertindualari.com Exploit; javascript:document.cookie="kulladi=Username;path=/"; Enter.. Go To;...

CSPartner 1.0 (Delete All Users/SQL Injection) Remote Exploit

No description provided by source. ?php / CSPartner 1.0 Delete All Users/SQL Injection Remote Exploit ---------------------------------------------------------------- By StAkeRathotmaildotit http://www.easy-script.com/scripts-dl/cspartne-01.zip...

CSPartner 1.0 - Delete All Users SQL Injection

CSPartner 1.0 - Delete All Users SQL Injection ?php / CSPartner 1.0 Delete All Users/SQL Injection Remote Exploit ---------------------------------------------------------------- By StAkeRathotmaildotit http://www.easy-script.com/scripts-dl/cspartne-01.zip...

CSPartner 1.0 (Delete All Users/SQL Injection) Remote Exploit

Exploit for unknown platform in category web applications ============================================================= CSPartner 1.0 Delete All Users/SQL Injection Remote Exploit ============================================================= ?php / CSPartner 1.0 Delete All Users/SQL Injection...