CVE-2019-19521

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/authsubr.c and gen/authenticate.c in libc and login/login.c and xenocara/app/xenodm/greeter/verify.c...

Authentication flaw

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/authsubr.c and gen/authenticate.c in libc and login/login.c and xenocara/app/xenodm/greeter/verify.c...

Stack overflow

An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy, which can cause a stack-based buffer overflow...

CVE-2018-16743

An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy, which can cause a stack-based buffer overflow...

CVE-2018-16743

An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy, which can cause a stack-based buffer overflow...

PonyOS 0.4.99-mlp - Multiple Vulnerabilities

Exploit for linux platform in category local exploits Introduction ------------ Like countless others, I was pretty excited about PonyOS yesterday April 1st 2013 and decided to give it a go. After wasting a lot of time nyan'ing, I knew this was the future of desktop OSes. However, I wondered how...

PonyOS 0.4.99-mlp Privilege Escalation Vulnerability

PonyOS version 0.499-mlp suffers from privilege escalation due to the cat binary being executed with escalated privileges and file permissions do not work. It also has a kernel compromise vulnerability. PonyOS 0.4.99-mlp Privilege Escalation Vulnerability John Cartwright Introduction ------------...

util-linux-ng登录远程日志注入漏洞

BUGTRAQ ID: 28983 CVECAN ID: CVE-2008-1926 util-linux-ng是增强版本的Util-linux软件包，包含有多种linux工具和应用。 util-linux-ng软件包的login.c在记录登录尝试时存在参数注入漏洞，远程攻击者可以在登录名称中添加addr=语句在审计日志中修改部分日志事件，从而隐藏其登录尝试等行为。 Karel Zak util-linux-ng 2.13.1.1 Karel Zak --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...