Yealink VoIP Phone SIP-T38G - Local File Inclusion

Title: Yealink VoIP Phone SIP-T38G Local File Inclusion Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5756, CVE-2013-5757 Description: Web interface contain a vulnerability that allow any...

CVE-2014-0644

EMC Cloud Tiering Appliance CTA 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, as demonstrated by reading the /etc/shadow fi...

Xangati - '/servlet/Installer?file' Directory Traversal

source: https://www.securityfocus.com/bid/66817/info Xangati XSR And XNR are prone to a multiple directory-traversal vulnerabilities. A remote attacker could exploit these vulnerabilities using directory-traversal characters '../' to access or read arbitrary files that contain sensitive...

Quantum DXi V1000 2.2.1 - Static SSH Key

Quantum DXi® V-Series is a virtual deduplication backup appliance that protects physical and virtual data across remote sites, the datacenter and cloud deployments. Details: ---------- 0x01 - Default root user The root user has a hardcoded password that is unknown and not changeable. Normally...

Design/Logic Flaw

/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow...

QNX 6.4.x6.5.x pppoectl - Information Disclosure

QNX 6.4.x6.5.x pppoectl - Information Disclosure QNX 6.4.x/6.5.x pppoectl disclose /etc/shadow by cenobyte 2013 - vulnerability description: QNX setuid root /sbin/pppoectl allows any user to gain access to privileged information such as the root password hash. The vulnerability exists because of ...

QNX 6.4.x/6.5.x pppoectl - Information Disclosure

QNX 6.4.x/6.5.x pppoectl disclose /etc/shadow by cenobyte 2013 - vulnerability description: QNX setuid root /sbin/pppoectl allows any user to gain access to privileged information such as the root password hash. The vulnerability exists because of a failure to drop privileges or check the...

CVE-2013-3713

The image creation configuration in aaabase before 16.26.1 for openSUSE 13.1 KDE adds the root user to the "users" group when installing from a live image, which allows local users to obtain sensitive information and possibly have other unspecified impacts, as demonstrated by reading /etc/shadow...

CVE-2013-3713

The CVE-2013-3713 issue affects openSUSE 13.1 KDE with aaa_base prior to 16.26.1. The image creation configuration erroneously adds the root user to the 'users' group when installing from a Live image, enabling local users to read sensitive files such as /etc/shadow and potentially other impacts....

CVE-2013-3713

The image creation configuration in aaabase before 16.26.1 for openSUSE 13.1 KDE adds the root user to the "users" group when installing from a live image, which allows local users to obtain sensitive information and possibly have other unspecified impacts, as demonstrated by reading /etc/shadow...

Solaris 10 Patch Cluster File Clobber

Solaris 10 patch cluster suffers from a file clobber vulnerability in /tmp. File clobbering vulnerability in Solaris 10 patch cluster 3/27/2013 Larry W. Cashdollar @larry0 Hello, The 147147-26 patch creates a CLEANUP file in /tmp that is vulnerable to symlink attacks: The contents of the file...

SEC Consult SA-20130122-0 :: F5 BIG-IP XML External Entity Injection vulnerability

SEC Consult Vulnerability Lab Security Advisory 20130122-0 ======================================================================= title: XML External Entity Injection XXE product: F5 BIG-IP vulnerable version: =11.2.0 fixed version: 11.2.0 HF3 11.2.1 HF3 CVE number: CVE-2012-2997 impact: Medium...

linux/x86 execve-chmod 0777 /etc/shadow 58 bytes

Linux/x86 execve-chmod 0777 /etc/shadow 58 bytes Author: Hamza Megahed Twitter: @HamzaMega blog: hamza-megadotblogspotdotcom E-mail: hamzadotmegahedatgmaildotcom xor %eax,%eax push %eax pushl $0x776f6461 pushl $0x68732f2f pushl $0x6374652f movl %esp,%esi push %eax pushl $0x37373730 movl %esp,%ebp...

Centrify Deployment Manager v2.1.0.283

Centrify Deployment Manager v2.1.0.283 While at a training session for centrify, I noticed poor handling of files in /tmp. I was able to overwrite /etc/shadow with the contents of adcheckDMoutput. I am sure there are more vulnerabilities to be exploit, maybe a local root - but being this is a...

Centrify Deployment Manager 2.1.0.283 Local Root Vulnerability

Centrify Deployment Manager version 2.1.0.283 suffers from a race condition in /tmp that allows for local root privilege escalation. Centrify Deployment Manager v2.1.0.283 local root 12/7/2012 Taking a little longer look at the software, I managed to win a race condition and get root with files i...

Centrify Deployment Manager v2.1.0.283 File Overwrite Vulnerability

Centrify Deployment Manager v2.1.0.283 version 2.1.0.283 appears to suffer from a root-level file overwrite vulnerability due to an insecure use of /tmp. Centrify Deployment Manager v2.1.0.283 While at a training session for centrify, I noticed poor handling of files in /tmp. I was able to...

linux/ARM - chmod("/etc/shadow", 0777) - 41 bytes

/ Title: Linux/ARM - chmod"/etc/shadow", 0777 - 41 bytes Date: 2012-09-08 Tested on: ARM1176JZF-S v6l Author: midnitesnake 00008054 : 8054: e28f6001 add r6, pc, 1 8058: e12fff16 bx r6 805c: 4678 mov r0, pc 805e: 3012 adds r0, 18 8060: 21ff movs r1, 255 ; 0xff 8062: 31ff adds r1, 255 ; 0xff 8064:...

Raspberry Pi Linux/ARM - chmod"/etc/shadow", 0777 41 bytes

Raspberry Pi Linux/ARM - chmod"/etc/shadow", 0777 41 bytes. Shellcode exploit for arm platform / Title: Linux/ARM - chmod"/etc/shadow", 0777 - 41 bytes Date: 2012-09-08 Tested on: ARM1176JZF-S v6l Author: midnitesnake 00008054 : 8054: e28f6001 add r6, pc, 1 8058: e12fff16 bx r6 805c: 4678 mov r0,...

Linux x86 - chmod 666 /etc/passwd & /etc/shadow 57 bytes

Linux x86 - chmod 666 /etc/passwd & /etc/shadow 57 bytes. Shellcode exploit for linx86 platform / Title: Linux x86 chmod 666 /etc/passwd & /etc/shadow - 57 bytes Author: Jean Pascal Pereira Web: http://0xffe4.org Disassembly of section .text: 08048060 : 8048060: 31 c0 xor %eax,%eax 8048062: 66 b9...

linux/x86 - execve(/bin/cat, /etc/shadow, NULL) - 42 bytes

/ Title: linux/x86 execve/bin/cat, /etc/shadow, NULL - 42 bytes Type: Shellcode Author: antrhacks Platform: Linux X86 / / ASSembly 31 c0 xor %eax,%eax 50 push %eax 68 2f 63 61 74 push $0x7461632f 68 2f 62 69 6e push $0x6e69622f 89 e3 mov %esp,%ebx 50 push %eax 68 61 64 6f 77 push $0x776f6461 68 2...