ASAN/SUID - Local Privilege Escalation

!/bin/bash unsanitary.sh - ASAN/SUID Local Root Exploit Exploits er, unsanitized env var passing in ASAN which leads to file clobbering as root when executing setuid root binaries compiled with ASAN. Uses an overwrite of /etc/ld.so.preload to get root on a vulnerable system. Supply your own targe...

TWiki bin/statistics cross-site scripting vulnerability

TWiki is a WIKI encyclopedia program. A cross-site scripting vulnerability exists in TWiki bin/statistics. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

PT-2019-10047

Name of the Vulnerable Software and Affected Versions: ChinaMobile PLC Wireless Router GPN2.4P21-C-CN version W2001EN-00 Description: The issue concerns a problem with the cgi-bin/webproc endpoint, specifically the getpage parameter, where the var:subpage parameter is vulnerable. This allows for...

CVE-2018-20326: Improper Neutralization of Input During Web Page Generation

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpage=html/index.html var:subpage parameter...

CVE-2018-20576

Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phonetest.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan...

CVE-2018-20577

Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...

CVE-2018-20577: Cross-Site Request Forgery (CSRF)

Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewallSPI.exe, cgi-bin/setupremotemgmt.exe, cgi-bin/setuppass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T...

PT-2018-15447

Name of the Vulnerable Software and Affected Versions Orange Livebox 00.96.320S devices Description The issue is related to several CGI binaries, including cgi-bin/restore.exe, cgi-bin/firewall SPI.exe, cgi-bin/setup remote mgmt.exe, cgi-bin/setup pass.exe, and cgi-bin/upgradep.exe, which are...

PT-2018-15446

Name of the Vulnerable Software and Affected Versions Orange Livebox 00.96.320S devices affected versions not specified Description The issue allows for CSRF attacks through cgi-bin/autodialing.exe and cgi-bin/phone test.exe, leading to arbitrary outbound telephone calls to an attacker-specified...

CVE-2018-20576: Cross-Site Request Forgery (CSRF)

Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phonetest.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan...

PT-2018-9581

Name of the Vulnerable Software and Affected Versions log-user-session versions 0.7 and earlier Description The issue allows for a Directory Traversal vulnerability in the Main SUID-binary /usr/local/bin/log-user-session, potentially resulting in User to root privilege escalation. This can be...

PT-2018-15393

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 3.1.1 Description The issue allows attackers to cause a denial-of-service, resulting in an application crash due to an out-of-bounds read, by crafting a specific input file. This is related to the r bin dyldcache...

Linux/x86 - execve(/usr/bin/ncat -lvp 1337 -e /bin/bash)+Null-Free Shellcode (95 bytes)

/ Linux/x86-execve/usr/bin/ncat -lvp 1337 -e/bin/bash+NULL-FREE Shellcode95 bytes Author : T3jv1l Contact: email protected Twitter:https://twitter.com/T3jv1l Shellcode len : 119 bytes Compilation: gcc shellcode.c -o shellcode Compilation for x64 : gcc -m32 shellcode.c -o shellcode Tested On: Ubun...

[ASA-201812-4] texlive-bin: arbitrary code execution

Arch Linux Security Advisory ASA-201812-4 ========================================= Severity: High Date : 2018-12-08 CVE-ID : CVE-2018-17407 Package : texlive-bin Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-770 Summary ======= The package texlive-bin befo...

PT-2018-2930

Name of the Vulnerable Software and Affected Versions ncurses-bin affected versions not specified Description The issue is related to the strlen sse2 pminub function in the infotocap utility of the ncurses-bin package, which is associated with null pointer dereference errors. Exploitation of this...

PT-2018-2931

Name of the Vulnerable Software and Affected Versions ncurses-bin affected versions not specified Description The issue is related to the strlen sse2 pminub function in the infotocap utility of the ncurses-bin package, which is associated with null pointer dereference errors. Exploitation of this...

PT-2018-15026

Name of the Vulnerable Software and Affected Versions OpenWrt versions through 18.06.1 LEDE versions through 17.01 Description The issue is related to unauthenticated reflected XSS via the URI. This can be demonstrated by a cgi-bin/?XSS URI, where an attacker can inject malicious code...

Cross site request forgery (csrf)

ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS...

CVE-2017-17550

ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS...

CVE-2017-17550

ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS...