36 matches found
CVE-2019-12775
An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. Furthermore, the user account that controls the web...
CVE-2018-1903
CVE-2018-1903 affects IBM Sterling Connect:Direct for UNIX versions 6.0.0, 4.3.0, and 4.2.0. The IBM bulletin describes an elevation-of-privilege path where a user with restricted sudo access can manipulate the Connect:Direct UNIX component to gain full sudo privileges. Root cause: exploiting sud...
CVE-2018-1903
IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNIX to gain full sudo access. IBM X-Force ID: 152532...
BlueCoat CAS 1.3.7.1 Privilege Escalation
Exploit Title: OS Command Injection Vulnerability in BlueCoat ASG and CAS Date: April 3, 2017 Exploit Authors: Chris Hebert, Peter Paccione and Corey Boyd Contact: chrisdhebertatgmail.com Vendor Security Advisory: https://bto.bluecoat.com/security-advisory/sa138 Version: CAS 1.3 prior to 1.3.7.4 ...
Umbrella - A Phishing Dropper designed to Pentest
Umbrella is a file dropper dedicated to pentest, its download files on target system are execute them without a double execution of exe, only of embed. To compromise the same target again, you need delete this folder on target system : - C:\Users\Public\Libraries\Intel - because dropper checks th...
Information disclosure
sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw ...
Low: Red Hat Security Advisory: sudo security, bug fix, and enhancement update
An update for sudo is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
Western Digital My Cloud 04.01.03-421, 04.01.04-422 - Command Injection Vulnerability
Exploit for hardware platform in category web applications Exploit Title: Western Digital My Cloud Command Injection Vendor Homepage: http://www.wdc.com Firmware tested: 04.01.03-421 and 04.01.04-422 for the Personal Cloud devices Firmware link:...
USN-2533-1 sudo vulnerability
Jakub Wilk and Stephane Chazelas discovered that Sudo incorrectly handled the TZ environment variable. An attacker with Sudo access could possibly use this issue to open arbitrary files, bypassing intended permissions...
Debian Security Advisory DSA 3167-1 (sudo - security update)
Jakub Wilk reported that sudo, a program designed to provide limited super user privileges to specific users, preserves the TZ variable from a user OpenVAS Vulnerability Test $Id: deb3167.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3167-1 using nvtgen 1.0 Script...
Astium VoIP PBX 2.1 build 25399 - Multiple VulnerabilitiesRemote Command Execution
Astium VoIP PBX 2.1 build 25399 - Multiple VulnerabilitiesRemote Command Execution !/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Astium VoIP PBX 0x90.nl Software link :...
Fedora 15 : oprofile-0.9.6-21.fc15 (2011-8076)
When opcontrol was run by a normal user with sudo access it was possible for the user to craft options to opcontrol that would allow commands to be run with root privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory...
Fedora 14 : oprofile-0.9.6-21.fc14 (2011-8087)
When opcontrol was run by a normal user with sudo access it was possible for the user to craft options to opcontrol that would allow commands to be run with root privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory...
[SECURITY] Fedora 12 Update: sudo-1.7.4p4-2.fc12
Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...
sudo -- arbitrary command execution
Tavis Ormandy reports: The bash shell uses the value of the PS4 environment variable after expansion as a prefix for commands run in execution trace mode. Execution trace mode xtrace is normally set via bash's -x command line option or interactively by running "set -o xtrace". However, it may als...
