antMan < 0.9.1a - Authentication Bypass

Exploit Title: antMan and the password to a url-encoded linefeed %0a, we can force the authentication script to produce return values not anticipated by the developer. To exploit these defects, use a web proxy to intercept the login attempt and modify the POST parameters as follows:...

SUSE-SU-2018:0309-1 Security update for rubygem-passenger

This update for rubygem-passenger fixes the following issues: Security issue fixed: - CVE-2017-1000384: Introduces a new check that logs a vulnerability warning if Passenger is run with root permissions while the directory permissions of parts of its root dir allow modifications by non-root users...

Meinberg LANTIME Web Configuration Utility 6.16.008 Arbitrary File Read

Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Read Author: Jakub Palaczynski CVE: CVE-2017-16787 Exploit tested on: ================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects: ====================== All LTOS6 firmware releases before 6.24.004...

Meinberg LANTIME Web Configuration Utility 6.16.008 - Arbitrary File Read

Meinberg LANTIME Web Configuration Utility 6.16.008 - Arbitrary File Read Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Read Author: Jakub Palaczynski CVE: CVE-2017-16787 Exploit tested on: ================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability...

Memory corruption

The TEEOS module in Huawei Mate 7 Mate7-TL10 smartphones before V100R001CHNC00B126SP03 allows local users with root permissions to gain privileges or cause a denial of service memory corruption via a crafted application...

CVE-2015-4422

CVE-2015-4422 concerns Huawei Mate 7 devices (Mate7-TL10) in the TEEOS module. A local attacker with root permissions can escalate privileges or trigger memory corruption leading to denial of service via a crafted app. The affected product is described as the Mate 7 with TEEOS, before the patch v...

Astaro Security Gateway 7 Remote Code Execution

!/usr/bin/python Astaro Security Gateway v7 - Unauthenticated Remote Code Execution Exploit Authors: Jakub Palaczynski and Maciej Grabiec Tested on versions: 7.500 and 7.506 Date: 13.12.2016 Vendor Homepage: https://www.sophos.com/ CVE: CVE-2017-6315 import socket import sys import os import...

Astaro Security Gateway 7 - Remote Code Execution

Astaro Security Gateway 7 - Remote Code Execution !/usr/bin/python Astaro Security Gateway v7 - Unauthenticated Remote Code Execution Exploit Authors: Jakub Palaczynski and Maciej Grabiec Tested on versions: 7.500 and 7.506 Date: 13.12.2016 Vendor Homepage: https://www.sophos.com/ CVE:...

REDDOXX Appliance Build 2032 / 2.0.625 - Arbitrary File Disclosure Vulnerability

Exploit for jsp platform in category web applications Arbitrary File Disclosure with root Privileges via RdxEngine-API in REDDOXX Appliance RedTeam Pentesting discovered an arbitrary file disclosure vulnerability in the REDDOXX appliance software, which allows unauthenticated attackers to list...

REDDOXX Appliance Build 2032 2.0.625 - Arbitrary File Disclosure

REDDOXX Appliance Build 2032 2.0.625 - Arbitrary File Disclosure Advisory: Arbitrary File Disclosure with root Privileges via RdxEngine-API in REDDOXX Appliance RedTeam Pentesting discovered an arbitrary file disclosure vulnerability in the REDDOXX appliance software, which allows unauthenticated...

CVE-2015-1323

The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to...

CVE-2015-1323

CVE-2015-1323 affects aptdaemon's simulate dbus method, enabling a local attacker to obtain sensitive information or access files with root permissions. Ubuntu packages were affected across multiple releases (12.04 LTS through 15.04) prior to fixed versions (e.g., 1.1.1+bzr982-0ubuntu32.1 and rel...

CVE-2015-1323

The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to...

FreeBSD : Dropbear -- two vulnerabilities (60931f98-55a7-11e7-8514-589cfc0654e1)

Matt Johnston reports : Fix double-free in server TCP listener cleanup A double-free in the server could be triggered by an authenticated user if dropbear is running with -a Allow connections to forwarded ports from any host This could potentially allow arbitrary code execution as root by an...

Linux Gather TOR Hidden Services

This module collects the hostnames name and private keys of any TOR Hidden Services running on the target machine. It will search for torrc and if found, will parse it for the directories of Hidden Services. However, root permissions are required to read them as they are owned by the user that TO...

Samba remote code execution vulnerability(CVE-2017-7494)analysis-vulnerability warning-the black bar safety net

Author: cyg07 && redrain Overview 2017 5 May 24, Samba released a 4. 6. 4 version, in the middle fix a serious remote code execution vulnerability, the vulnerability number CVE-2017-7494, the vulnerability affects Samba 3.5.0 and including 4. 6. 4/4. 5. 10/4. 4. 14 the intermediate version. 360...

BSA-2017-267

Security Advisory ID : BSA-2017-267 Component : NTP Revision : 1.0: Interim Thecronjobscript bundled withntppackage is intended to perform cleanup on statistics files produced by NTP daemon running with statistics enabled. The script is run as root during the dailycronjobsall operations on...

RSSMON / BEAM (Red Star OS 3.0) Shellshock

!/usr/bin/env python RedStar OS 3.0 Server BEAM & RSSMON shellshock exploit ======================================================== BEAM & RSSMON are Webmin based configuration utilities that ship with RSS server 3.0. These packages are the recommended GUI configuration components and listen on ...

RedStar 3.0 Server - 'Shellshock' 'BEAM' / 'RSSMON' Command Injection

!/usr/bin/env python RedStar OS 3.0 Server BEAM & RSSMON shellshock exploit ======================================================== BEAM & RSSMON are Webmin based configuration utilities that ship with RSS server 3.0. These packages are the recommended GUI configuration components and listen on ...

CVE-2016-2877

IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses weak permissions for unspecified directories under the web root, which allows local users to modify data by writing to a file...