1813 matches found
MikroTik RouterOS - sshd (ROSSSH) Remote Heap Corruption
During an audit the Mikrotik RouterOS sshd ROSSSH has been identified to have a remote previous to authentication heap corruption in its sshd component. Exploitation of this vulnerability will allow full access to the router device. This analysis describes the bug and includes a way to get...
CVE-2013-4124 samba nttrans dos private exploit
Hi Forks! It's my samba private exploit and article of it. the security bug occurs while nttrans reply in samba daemon source code tree. the remote dos exploit that i copied from another nttrans exploit in 2003. and can't test it yet, check it out! CVE-2013-4124 samba dos private exploit: -...
Samba 3.5.223.6.174.0.8 - nttrans Reply Integer Overflow
Samba 3.5.223.6.174.0.8 - nttrans Reply Integer Overflow Exploitation: samba nttrans reply integer overflow / \ / \ | || | | | \ / / . || | | | / | handlenttrans +- callnttransactcreate // transact! - readnttrnsealistvulnerable function security bug analyze smbd/nttrans.c ---- snip ---- snip ----...
Mozilla Firefox 3.6 - Integer Overflow Exploit
This exploit leverages WOFF heap corruption due to an integer overflow in Mozilla Firefox versions 3.6, 3.6 Beta 1, 3, 4, and 5, 3.6 RC1 and RC2. include include include include / x90c WOFF 1day exploit MFSA2010-08 WOFF Heap Corruption due to Integer Overflow 1day exploit CVE-ID: CVE-2010-1028 Fu...
Linux Kernel 'MSR' Driver Local Privilege Escalation
Exploit for linux platform in category local exploits // PoC exploit for /dev/cpu//msr, 32bit userland on a 64bit host // can do whatever in the commented area, re-enable module support, etc // requires CONFIGX86MSR and just uid 0 // a small race exists between the time when the MSR is written to...
Fedora 17 : fdupes-1.51-1.fc17 (2013-13202)
Upstream - Added support for 64-bit file offsets on 32-bit systems. - Using tty for interactive input instead of regular stdin. This is to allow feeding filenames via stdin in future versions of fdupes without breaking interactive deletion feature. - Fixed some typos in --help. - Turned C++ style...
Nikon CoolPix L Series Fw1.0 - Information Disclosure Bug
Document Title: =============== Nikon CoolPix L Series Fw1.0 - Information Disclosure Bug References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1014 Release Date: ============= 2013-07-15 Vulnerability Laboratory ID VL-ID: ====================================...
Oracle Linux 3 / 4 : evolution (ELSA-2007-0509)
From Red Hat Security Advisory 2007:0509 : Updated evolution packages that fix a security bug are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. Evolution is the GNOME collection of personal...
Oracle Linux 3 / 4 : evolution (ELSA-2007-0353)
From Red Hat Security Advisory 2007:0353 : Updated evolution packages that fix a security bug are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Evolution is the GNOME collection of personal...
Oracle Linux 5 : Unbreakable Enterprise kernel (ELSA-2010-2009)
The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-2009 advisory. - rds fix access issue with rds Chris Mason CVE-2010-3904 Tenable has extracted the preceding description block directly from the Oracle Linux security...
Google Chrome 25.0.1364.152 HTTP Referer Header Faking
Advisory: XMLHttpRequest HTTP Referer Header Faking Author: Liad Mizrachi Vendor URL: http://www.chromium.org/ Vulnerability Status: Fixed Application Version: Google Chrome v25.0.1364.152 ========================== Vulnerability Description ========================== Chromium is the open source...
APK duplicate file
Android does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file APK that is modified in a way that does not violate the cryptographic signature. Android security bug 8219321...
Microsoft PowerPoint 2007 - Crash (PoC)
Microsoft PowerPoint 2007 - Crash PoC Title : Microsoft Office PowerPoint 2007 Crash PoC Date: 2013-01-12 Software Link: http://office.microsoft.com/ Author: Asesino04 Tested on: Windows XP SP2 Special Thanks To : Ness Oum El Bouaghi Bug Description: when you insert a sound to Microsoft office...
Google Chrome Inbuilt Flash player allows Webcam Hacking
No longer limited to Hollywood movies about cybercrime, webcam hacking has stealthily and aggressively broken into average households "I've heard a hacker could access my webcam and watch me in front of my computer. Could this really happen?" YES, other than using a Remote administration tools, i...
Google Chrome Inbuilt Flash player allows Webcam Hacking
No longer limited to Hollywood movies about cybercrime, webcam hacking has stealthily and aggressively broken into average households "I've heard a hacker could access my webcam and watch me in front of my computer. Could this really happen?" YES, other than using a Remote administration tools, i...
Linux Kernel 2.6.32 3.x (CentOS 56) - PERF_EVENTS Local Privilege Escalation (1)
Linux Kernel 2.6.32 3.x CentOS 56 - PERFEVENTS Local Privilege Escalation 1 / linux 2.6.37-3.x.x x8664, 100 LOC gcc-4.6 -O2 semtex.c && ./a.out 2010 [email protected], salut! update may 2013: seems like centos 2.6.32 backported the perf bug, lol. jewgold to 115T6jzGrVMgQ2Nt1Wnua7Ch1EuL9WXT2g if yo...
nginx 'ngx_http_close_connection()'远程整数溢出漏洞
BUGTRAQ ID: 59496 nginx是HTTP及反向代理服务器，同时也用作邮件代理服务器，由Igor Sysoev编写。 nginx在实现上存在远程整数溢出漏洞，当 r-count 小于0或大于255时，Nginx ngxhttpcloseconnection函数会存在整数溢出错误，远程攻击者通过恶意http请求利用此漏洞，可能在应用上下文中执行任意代码。 0 Igor Sysoev nginx 1.1.19 Igor Sysoev nginx 1.1.17 Igor Sysoev nginx 1.0.9 Igor Sysoev nginx 1.0.8 Igor Sysoev...
CVE-2013-1940
X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device, which might allow physically proximate attackers to obtain sensitive information, as demonstrated by reading passwords from a tty...
CVE-2013-0879
Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly implement web audio nodes, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via unknown vectors...
