Cisco Unified Computing System on C-Series Rack Servers Cross-Frame Scripting Vulnerability

The Cisco Unified Computing System is an all-in-one platform for computing, virtualization, and networking. A cross-framework scripting vulnerability in Cisco Unified Computing System on C-Series Rack Servers allows attackers to hijack an attack via crafted website behavior...

K7 Computing (Multiple Products) - Arbitrary Write Privilege Escalation

/ Exploit Title - K7 Computing Multiple Products Arbitrary Write Privilege Escalation Date - 04th February 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.k7computing.co.uk/ Tested Version - 14.2.0.240 Driver Version - 12.8.0.104 - K7Sentry.sys Tested on OS - 32bit...

K7 Computing Multiple Products Arbitrary Write Privilege Escalation Exploit

Exploit for windows platform in category local exploits / Exploit Title - K7 Computing Multiple Products Arbitrary Write Privilege Escalation Date - 04th February 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.k7computing.co.uk/ Tested Version - 14.2.0.240 Driver Versio...

K7 Computing (Multiple Products) - Arbitrary Write Privilege Escalation

K7 Computing Multiple Products - Arbitrary Write Privilege Escalation / Exploit Title - K7 Computing Multiple Products Arbitrary Write Privilege Escalation Date - 04th February 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.k7computing.co.uk/ Tested Version - 14.2.0.240...

CVE-2015-0599

The web interface in Cisco Integrated Management Controller in Cisco Unified Computing System UCS on C-Series Rack Servers does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web...

libvncserver: server stacked-based buffer overflow flaws in file transfer handling

Two stack-based buffer overflow flaws were found in the way LibVNCServer handled file transfers. A remote attacker could use this flaw to crash the VNC server using a malicious VNC client...

K7 Ultimate Security Privilege Escalation Vulnerabilities (Feb 2015) - Windows

K7 Ultimate Security is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Shuts Down Patch Tuesday Advanced Notifications

Microsoft today pulled the plug on its Advanced Notification Service ANS, offering it going forward only to paying Premier customers. ANS preceded the release of Microsoft’s monthly Patch Tuesday security bulletins; on the Thursday prior, Microsoft would provide users via its security website a...

CVE-2014-8608

The K7Sentry.sys kernel mode driver aka K7AV Sentry Device Driver before 12.8.0.119, as used in multiple K7 Computing products, allows local users to cause a denial of service NULL pointer dereference as demonstrated by a filename containing "crashme$$"...

CVE-2014-7136

Heap-based buffer overflow in the K7FWFilt.sys kernel mode driver aka K7Firewall Packet Driver before 14.0.1.16, as used in multiple K7 Computing products, allows local users to execute arbitrary code with kernel privileges via a crafted parameter in a DeviceIoControl API call...

Null pointer dereference

The K7Sentry.sys kernel mode driver aka K7AV Sentry Device Driver before 12.8.0.119, as used in multiple K7 Computing products, allows local users to cause a denial of service NULL pointer dereference as demonstrated by a filename containing "crashme$$"...

Stack overflow

Stack-based buffer overflow in the K7Sentry.sys kernel mode driver aka K7AV Sentry Device Driver before 12.8.0.119, as used in multiple K7 Computing products, allows local users to execute arbitrary code with kernel privileges via unspecified vectors...

Heap overflow

Heap-based buffer overflow in the K7FWFilt.sys kernel mode driver aka K7Firewall Packet Driver before 14.0.1.16, as used in multiple K7 Computing products, allows local users to execute arbitrary code with kernel privileges via a crafted parameter in a DeviceIoControl API call...

CVE-2014-8608

The K7Sentry.sys kernel mode driver aka K7AV Sentry Device Driver before 12.8.0.119, as used in multiple K7 Computing products, allows local users to cause a denial of service NULL pointer dereference as demonstrated by a filename containing "crashme$$"...

CVE-2014-8956

CVE-2014-8956: A stack-based buffer overflow in the K7Sentry.sys kernel-mode driver (K7AV Sentry Device Driver) before version 12.8.0.119 allows local users to execute arbitrary code with kernel privileges. The vulnerability affects K7 Computing products that incorporate this driver. Exploitation...

CVE-2014-8003

Cisco Integrated Management Controller in Cisco Unified Computing System 2.22cA and earlier allows local users to obtain shell access via a crafted map-nfs command, aka Bug ID CSCup05998...

Command injection

Cisco Integrated Management Controller in Cisco Unified Computing System 2.22cA and earlier allows local users to obtain shell access via a crafted map-nfs command, aka Bug ID CSCup05998...

CVE-2014-8009

CVE-2014-8009 affects Cisco Unified Computing System Manager (UCSM) up to version 2.1(3f). The issue is an information-disclosure vulnerability where remote, unauthenticated attackers can read log files to obtain sensitive system information. Exploitation details are not provided in the cited doc...

CVE-2014-8003

Cisco Integrated Management Controller in Cisco UCS 2.2(2c)A and earlier is affected by CVE-2014-8003 due to improper input validation in the map-nfs command. This allows an authenticated, local attacker to gain shell-level access to the device. The issue is tied to Bug CSCup05998. Cisco’s adviso...

Cisco Unified Computing System B-Series Servers Privilege Escalation Vulnerability

Cisco Unified Computing System B-Series Blade Servers could allow an authenticated, local attacker to gain shell-level access to the affected device. The vulnerability is due to improper input validation in the ping6 and the traceroute6 commands. An attacker could exploit this vulnerability by...