QNX Neutrino RTOS 6.3 'phgrafx' Local Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/30024/info QNX Neutrino RTOS is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. This issue affects the 'phgrafx' utility. Attackers can exploit...

IBM AIX 5.2/5.3 FTP Client Local Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/25077/info The IBM AIX FTP application is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. A...

Sun xVM VirtualBox 2.0/2.1 Local Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/34080/info Sun xVM VirtualBox is prone to a local privilege-escalation vulnerability. An attacker can exploit this vulnerability to run arbitrary code with superuser privileges. The following versions for the Linux platfo...

Novell Identity Manager Arbitrary Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/19688/info Novell Identity Manager is prone to an arbitrary command-execution vulnerability. A local attacker can exploit this issue to execute arbitrary commands with superuser privileges. Exploiting this issue allows...

EMC Documentum D2 Privilege Escalation (ESA-2014-045)

The remote host is running EMC Documentum D2. It is, therefore, affected by a privilege escalation vulnerability due to a flaw in the Documentum Query Language DQL engine. A remote, authenticated attacker can exploit this vulnerability to execute arbitrary DQL queries with superuser privileges. C...

ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability

ESA-2014-045.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability EMC Identifier: ESA-2014-045 CVE Identifier: CVE-2014-2504 Severity: CVSSv2 Base Score: 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Affected products: • EMC Documentum D2...

FreeBSD-SA-14:07.devfs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:07.devfs Security Advisory The FreeBSD Project Topic: devfs rules not applied by default for jails Category: core Module: etcrc.d Announced: 2014-04-30...

CVE-2013-6774

Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an...

CVE-2013-6769

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android allows attackers to gain privileges via shell metacharacters in the -c option to /system/xbin/su...

CVE-2013-6768

Untrusted search path vulnerability in the CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier allows attackers to trigger the launch of a Trojan horse appprocess program via a crafted PATH environment variable for a /system/xbin/su process...

Design/Logic Flaw

Untrusted search path vulnerability in the CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier allows attackers to trigger the launch of a Trojan horse appprocess program via a crafted PATH environment variable for a /system/xbin/su process...

Code injection

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then...

Design/Logic Flaw

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android allows attackers to gain privileges via shell metacharacters in the -c option to /system/xbin/su...

Design/Logic Flaw

Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an...

CVE-2013-6770

CVE-2013-6770 affects CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 on Android 4.3/4.4. The flaw lets any user with ADB shell access and a suitable Linux UID exploit /system/xbin/su --daemon to gain root privileges and create a Trojan script, due to inadequate restriction of who can ru...

CVE-2013-6768

The CVE-2013-6768 entry describes an untrusted search path vulnerability in CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier. A crafted PATH for /system/xbin/su can trigger the Dalvik VM to launch a Trojan horse app_process, enabling privilege-related risk. C...

CVE-2013-6769

The CVE-2013-6769 entry concerns CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android. It describes a privilege-escalation vulnerability where attackers can gain root privileges by injecting shell metacharacters into the -c argument of /system/xbin/su. The root cause is improper h...

CVE-2013-6774

Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an...

CVE-2013-6768

Untrusted search path vulnerability in the CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier allows attackers to trigger the launch of a Trojan horse appprocess program via a crafted PATH environment variable for a /system/xbin/su process...

CVE-2013-6774

CVE-2013-6774 describes an untrusted search path vulnerability in Android Superuser implementations (ChainsDD Superuser 3.1.3, CyanogenMod/ClockWorkMod/Koush Superuser 1.0.2.1, Chainfire SuperSU before 1.69) on Android 4.2.x and earlier. The issue arises because BOOTCLASSPATH can be crafted to lo...