1240 matches found
CVE-1999-0864
UnixWare programs that dump core allow a local user to modify files via a symlink attack on the ./core.pid file...
CVE-2000-0433
The SuSE aaabase package installs some system accounts with home directories set to /tmp, which allows local users to gain privileges to those accounts by creating standard user startup scripts such as profiles...
CVE-1999-0782
KDE kppp allows local users to create a directory in an arbitrary location via the HOME environmental variable...
CVE-2000-0276
BeOS 4.5 and 5.0 allow local users to cause a denial of service via malformed direct system calls using interrupt 37...
CVE-2000-0247
Unknown vulnerability in Generic-NQS GNQS allows local users to gain root privileges...
CVE-2000-0163
asmon and ascpu in FreeBSD allow local users to gain root privileges via a configuration file...
CVE-1999-0860
Solaris chkperm allows local users to read files owned by bin via the VMSYS environmental variable and a symlink attack...
CVE-2000-0077
The October 1998 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the ps and grep commands...
CVE-1999-0840
Buffer overflow in CDE dtmail and dtmailpr programs allows local users to gain privileges via a long -f option...
CVE-1999-0708
Buffer overflow in cfingerd allows local users to gain root privileges via a long GECOS field...
CVE-1999-0979
The SCO UnixWare privileged process system allows local users to gain root privileges by using a debugger such as gdb to insert traps into init before the privileged process is executed...
CVE-2000-0077
The October 1998 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the ps and grep commands...
CVE-1999-1386
Perl 5.00404 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file...
unixware.rtpm.txt
Greetings, OVERVIEW Any local users can exploit a bug in rtpm to gain "sys" privileges. A root compromise is then trivial. BACKGROUND As usual, I've only tested UnixWare 7.1, all others should be assumed vulnerable. UnixWare has a slightly different system of managing the password database than...
Majordomo 1.94.41.94.5 - Local -C Parameter (2)
Majordomo 1.94.41.94.5 - Local -C Parameter 2 // source: https://www.securityfocus.com/bid/903/info It is possible for a local user to gain majordomo privileges through a vulnerability which allows privileged arbitrary commands to be executed. If the -C parameter is passed to majordomo or one of...
CVE-2000-0032
Solaris dmicmd allows local users to crash the dmispd daemon by adding a malformed file to the /var/dmi/db database...
FreeBSD 3.3 - Seyon SetGID Dialer
source: https://www.securityfocus.com/bid/838/info FreeBSD 3.3-RELEASE ships with Seyon, a communications program which is known to have several vulnerabilities which can allow for a malicious user to elevate priviliges. The vulnerability, however, is that seyon is still installed setgid dialer i...
Eric Allman Sendmail 8.8.x - Socket Hijack
// source: https://www.securityfocus.com/bid/774/info Through exploiting a combination of seemingly low-risk vulnerabilities in sendmail, it is possible for a malicious local user to have an arbitrary program inherit or "hijack" the file descriptor for the socket listening on priviliged port 25...