286 matches found
CVE-2015-5673
eventapp/lib/gcloud.rb in the ISUCON5 qualifier portal aka eventapp web application before 2015-10-30 makes improper popen calls, which allows remote attackers to execute arbitrary commands via an HTTP request that includes shell metacharacters in an argument to a "gcloud compute" command...
CVE-2009-3294
The popen API function in TSRM/tsrmwin32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service crash via a crafted 1 "e" or 2 "er" string in the second argument aka mode, possibly related t...
Microsoft HTML Help Compiler 4.74.8702.0 - Local Overflow (SEH)
!/usr/bin/env python Exploit Title: Microsoft HTML Help Compiler SEH Based Overflow Date: 2015-08-13 Exploit Author: St0rn Twitter: st0rnpentest Vendor Homepage: www.microsoft.com Software Link:...
tnftp "savefile" Arbitrary Command Execution Exploit
This module exploits an arbitrary command execution vulnerability in tnftp's handling of the resolved output filename - called "savefile" in the source - from a requested resource. If tnftp is executed without the -o command-line option, it will resolve the output filename from the last component...
FreeBSD -- Remote command execution in ftp(1)
Problem Description: A malicious HTTP server could cause ftp1 to execute arbitrary commands. Impact: When operating on HTTP URIs, the ftp1 client follows HTTP redirects, and uses the part of the path after the last '/' from the last resource it accesses as the output filename if '-o' is not...
tnftp "savefile" Arbitrary Command Execution
This module exploits an arbitrary command execution vulnerability in tnftp's handling of the resolved output filename - called "savefile" in the source - from a requested resource. If tnftp is executed without the -o command-line option, it will resolve the output filename from the last component...
BSD bmon <= 1.2.1_2 - Local Exploit
No description provided by source. !/usr/local/bin/bash Written by Idan Nahoum. [email protected] local exploit for FreeBSD/OpenBSD with bmon 1.2.12 installed. when bmon is executed with the -n parameter it popens netcat but fail to provide an absoluth path. some bsds are configured with acls that...
Sun VirtualBox <= 3.0.6 - Privilege Escalation
No description provided by source. !/bin/sh CVE-2009-3692 Sun VirtualBox = 3.0.6 local root exploit ======================================================== Exploits popen meta char shell injection vulnerability in Sun VirtualBox. E.g. admin@sundevil:/test$ id uid=101admin gid=10staff...
VMWare Setuid vmware-mount Unsafe popen(3)
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require...
Cacti <= 0.8.6i cmd.php popen() Remote Injection Exploit
No description provided by source. ?php printr' -------------------------------------------------------------------------------- Cacti = 0.8.6i cmd.php popen injection by rgod dork: intitle:login to cacti mail: retrog at alice dot it site: http://retrogod.altervista.org...
PHP <= 3.0.13 'safe_mode' Failure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/911/info PHP Version 3.0 is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web...
SGI IRIX 6.x rpc.xfsmd Remote Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5075/info Throghout the implementation of the supported remote procedure calls, the server uses the popen libc function. When popen is used, arguments passed to the RPC are included in the command string. These arguments...
Srun3000命令执行第4弹
简要描述： 第4弹 详细说明： getonlineuser.php 这回有个key需算MD5 不用登陆。 $key = "oeit&^df"; $uname = $GET'uname'; $action = $GET'action'; if $GET'k' != md5 $action.$uname.$key //有个验证 算一下就好。 exit ; switch $action case "show4" : $pfd = popen "/srun3/bin/onlineuser -4 -u ".$uname, "r" ; //这里 if $pfd while $con = fgets...
VMWare Setuid vmware-mount Unsafe popen(3)
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...
VMware - Setuid VMware-mount Unsafe popen(3) (Metasploit)
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...
VMWare Setuid vmware-mount Unsafe popen(3)
VMWare Workstation up to and including 9.0.2 build-1031769 and Player have a setuid executable called vmware-mount that invokes lsbrelease in the PATH with popen3. Since PATH is user-controlled, and the default system shell on Debian-derived distributions does not drop privs, we can put an...
VMWare Setuid vmware-mount Unsafe popen(3)
VMWare Workstation up to and including 9.0.2 build-1031769 and Player have a setuid executable called vmware-mount that invokes lsbrelease in the PATH with popen3. Since PATH is user-controlled, and the default system shell on Debian-derived distributions does not drop privs, we can put an...
CVE-2013-1662
vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsbrelease binary in a directory in the PATH, related to use of the popen library function...
Design/Logic Flaw
vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsbrelease binary in a directory in the PATH, related to use of the popen library function...
CVE-2013-1662
vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsbrelease binary in a directory in the PATH, related to use of the popen library function...