CVE-2010-3357

CVE-2010-3357 affects gnome-subtitles 1.0 , where a zero-length directory name in the LD_LIBRARY_PATH allows local users to gain privileges via a Trojan horse shared library in the current working directory. Root cause: manipulation of LD_LIBRARY_PATH. Impact: local privilege escalation (as descr...

CVE-2010-3369

The CVE-2010-3369 issue affects mono-debugger:2.4.3 and earlier than 2.8.1, where a zero-length directory name placed in LD_LIBRARY_PATH by the mdb and mdb-symbolreader scripts can let a local user load a Trojan horse shared library from the current working directory and gain privileges. Affected...

Design/Logic Flaw

Untrusted search path vulnerability in Lhasa 0.19 and earlier allows local users to gain privileges via a Trojan horse executable file in the current working directory...

MS OpenType CFF Parsing Vulnerability

Core Security - CoreLabsMS OpenType CFF Parsing Vulnerability 1. Advisory Information Title: MS OpenType CFF Parsing Vulnerability Advisory Id: CORE-2010-0624 Advisory URL: http://www.coresecurity.com/content/ms-opentype-cff-parsing-vulnerability Date published: 2010-10-12 Date of last update:...

cPassMan 1.07 Multiple Vulnerabilities

Exploit for php platform in category web applications ====================================== cPassMan 1.07 Multiple Vulnerabilities ====================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/...

μTorrent (uTorrent) 2.0.3 - DLL Hijacking

μTorrent uTorrent 2.0.3 - DLL Hijacking Title: uTorrent =2.0.3 Dll Hijacking Local Exploits By: DrIDE Tested: Windows 7RC Note: These are additional DLL's with unsafe Load Paths Reference: http://www.exploit-db.com/exploits/14726/ If the payload .DLL file is renamed to any of these files and plac...

CVE-2010-2384: Solaris wbem unsafe use of temporary files

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Below is the full disclosure information for CVE-2010-2384. It was reported to [email protected] on 3 January, 2010 and assigned Sun bug 6913886. This vulnerability was addressed by Sun/Oracle in the July 2010 Critical Patch Update...

Ruby 'ARGF.inplace_mode' Buffer Overflow Vulnerability

Ruby is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ruby-lang:ruby"; ifdescription...

GSM SIM Utility Local Exploit Direct Ret ver

Exploit for windows platform in category local exploits ============================================ GSM SIM Utility Local Exploit Direct Ret ver ============================================ Exploit Title : GSM SIM Utility Local Exploit Direct Ret ver. Date : July 07, 2010 Author : chap0...

Linux Kernel 2.2.x<= 25 – 2.4.x<21 ptrace/kmod Local Root Exploit

No description provided by source. / Linux kernel ptrace/kmod local root exploit This code exploits a race condition in kernel/kmod.c, which creates kernel thread in insecure manner. This bug allows to ptrace cloned process, allowing to take control over privileged modprobe binary. Should work...

Mp3 Digitalbox 2.7.2.0 - '.mp3' Local Stack Overflow (PoC)

!/usr/bin/perl Mp3 Digitalbox 2.7.2.0 .mp3 Local Stack Overflow POC Author : v3n0m Site : http://yogyacarderlink.web.id/ Group : YOGYACARDERLINK Date : July, 02-2010 INDONESIA Software : Mp3 Digitalbox Version : 2.7.2.0 Other versions may also be affected Download : http://www.tsoft.aplus.pl/...

UltraISO 9.3.6.2750 Buffer Overflow

/ DISCLAIMER THIS PROGRAM IS NOT INTENDED TO BE USED ON OTHER COMPUTERS AND IT IS DESTINED FOR PERSONAL RESEARCH ONLY!!!! The programs are provided as is without any guarantees or warranty. The author is not responsible for any damage or losses of any kind caused by the use or misuse of the...

Scite Text Editor Buffer Overflow

Exploit Title: 0 Days Scite text editor :Local Buffer Overflow PoC Date: 28/06/2010 Author: kmkz Version: Scite 1.76 lastest version Tested on: Linux 2.6.31-22 Code : Proof of Concept !/usr/bin/perl -wU 0-Days PoC Local BoF Scite 1.76 use strict; use diagnostics; use English '-nomatchvars'; use...

TitanFTP Server COMB directory traversal

Accensus Security Advisory L-01 TitanFtp Server Arbitrary File Download/Delete Details ============= Product: TitanFTPd Security-Risk: high Remote-Exploit: maybe, assuming anonymous ftp access Local-Exploit: yes Vendor URL: http://www.southrivertech.com/ Found By: Bill Finlayson...

PowerZip 7.21 Stack Buffer Overflow

/ DISCLAIMER THIS PROGRAM IS NOT INTENDED TO BE USED ON OTHER COMPUTERS AND IT IS DESTINED FOR PERSONAL RESEARCH ONLY!!!! The programs are provided as is without any guarantees or warranty. The author is not responsible for any damage or losses of any kind caused by the use or misuse of the...

TitanFtp Server 8.10.1125 Arbitrary File Download / Delete

Accensus Security Advisory L-01 TitanFtp Server Arbitrary File Download/Delete Details ============= Product: TitanFTPd Security-Risk: high Remote-Exploit: maybe, assuming anonymous ftp access Local-Exploit: yes Vendor URL: http://www.southrivertech.com/ Found By: Bill Finlayson...

TitanFtp Server File Disclosure

Accensus Security Advisory L-02 TitanFtp Server Arbitrary File Disclosure Details ============= Product: TitanFTP Server Security-Risk: high Remote-Exploit: maybe, assuming anonymous ftp access Local-Exploit: yes Vendor URL: http://www.southrivertech.com/ Found By: Bill Finlayson...

Linux kernel 2.6.34-rc5 find_keyring_by_name()函数本地内存破坏漏洞

BUGTRAQ ID: 39719 CVE ID: CVE-2010-1437 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的findkeyringbyname函数可能获得已经释放的密钥环，之后再访问该密钥环就会触发内存破坏，导致拒绝服务的情况。 Linux kernel 2.6.34-rc5 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://patchwork.kernel.org/patch/94038/ !/bin/sh LOOP=100000...

IDEAL Administration 2010 10.2 Buffer Overflow

!/usr/bin/env python IDEAL Administration 2010 v10.2 Local Buffer Overflow Exploit Found By: DrIDE Usage: Migrate - Open Migration Project - Bind Shell Download: www.pointdev.com Tested On: Windows XPSP3 windows/shellbindtcp - 696 bytes Encoder: x86/alphamixed EXITFUNC=seh, LPORT=4444 sc =...

ASX To MP3 Converter 3.0.0.100 Stack Overflow

!/usr/bin/python import time ASX to MP3 Converter Version 3.0.0.100 = Local stack overflow exploit Author: Hazem Mofeed PoC: http://www.exploit-db.com/exploits/11930 Tested On: Windows Xp Home Edition SP3 Home: http://hakxer.wordpress.com print ' Exploited by Hazem Mofeed \n' print ' ASX to MP3...