116 matches found
Windows Manage Local Microsoft SQL Server Authorization Bypass
When this module is executed, it can be used to add a sysadmin to local SQL Server instances. It first attempts to gain LocalSystem privileges using the "getsystem" escalation methods. If those privileges are not sufficient to add a sysadmin, then it will migrate to the SQL Server service process...
View PDF Macro in Office Connector makes http fetch from Adobe from https session
The View PDF macro within the Office Connector plugin provides the following http URL even for https sessions when a user's browser fails the Flash installed test. http://www.adobe.com/images/shared/downloadbuttons/getflashplayer.gif It's bad form to mix http urls in with secured https sessions a...
View PDF Macro in Office Connector makes http fetch from Adobe from https session
The View PDF macro within the Office Connector plugin provides the following http URL even for https sessions when a user's browser fails the Flash installed test. http://www.adobe.com/images/shared/downloadbuttons/getflashplayer.gif It's bad form to mix http urls in with secured https sessions a...
Nmap NSE net: ms-sql-hasdbaccess
Queries Microsoft SQL Server ms-sql for a list of databases a user has access to. The script needs an account with the sysadmin server role to work. It needs to be fed credentials through the script arguments or from the scripts 'mssql-brute' or 'mssql-empty- password'. When run, the script...
Nmap NSE net: ms-sql-empty-password
Attempts to authenticate using an empty password for the sysadmin sa account. SYNTAX: mssql.timeout: How long to wait for SQL responses. This is a number followed by 'ms' for milliseconds, 's' for seconds, 'm' for minutes, or 'h' for hours. Default: '30s'. OpenVAS Vulnerability Test $Id:...
ms-sql-xp-cmdshell NSE Script
Attempts to run a command using the command shell of Microsoft SQL Server ms-sql. SQL Server credentials required: Yes use ms-sql-brute, ms-sql-empty-password and/or mssql.username & mssql.password Run criteria: Host script: Will run if the mssql.instance-all, mssql.instance-name or...
ms-sql-empty-password NSE Script
Attempts to authenticate to Microsoft SQL Servers using an empty password for the sysadmin sa account. SQL Server credentials required: No will not benefit from mssql.username & mssql.password. Run criteria: Host script: Will run if the mssql.instance-all, mssql.instance-name or mssql.instance-po...
Debian DSA-2006-1 : sudo - several vulnerabilities
Several vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0426 It was discovered that sudo when a pseudo-command is enabled,...
Tandberg MXP F7.0 (USER) Remote Buffer Overflow PoC
Exploit for unknown platform in category dos / poc =================================================== Tandberg MXP F7.0 USER Remote Buffer Overflow PoC =================================================== TANDBERG BoF v0.1 - Tandberg MXP F7.0 Buffer Overflow Vulnerability PoC By otokoyama + We...
Nortel Contact Center Manager - Administration Password Disclosure
source: https://www.securityfocus.com/bid/34964/info Nortel Contact Center Manager Administration is prone to a password-disclosure vulnerability caused by a design error. Attackers can exploit this issue to gain access to the 'sysadmin' password. Successfully exploiting this issue may lead to...
Nortel Contact Center Manager - Administration Password Disclosure
Nortel Contact Center Manager - Administration Password Disclosure source: https://www.securityfocus.com/bid/34964/info Nortel Contact Center Manager Administration is prone to a password-disclosure vulnerability caused by a design error. Attackers can exploit this issue to gain access to the...
Scientific Image DataBase 0.41 - Blind SQL Injection
!/usr/bin/perl use strict; use warnings; use LWP::UserAgent; Download: http://sidb.sourceforge.net/ Dork: "Scientific Image DataBase" This exploit retrives the admin username/password via blind mysql injection. print ; my $substr, $done, $chr, $res = 1, 1, 48, ""; my $ua = LWP::UserAgent-new agen...
To xp_cmdshell March-vulnerability warning-the black bar safety net
To xpcmdshell March - Using MSSQLDatastore expansion madeserviceis the management right In MSSQL having sysadmin permission to the user through the xpcmdshell stored extensions to the system permissions to execute arbitrary system commands, and therefore most of the security attention of the...
CVE-1999-1179
CVE-1999-1179 describes a vulnerability in the included man.sh CGI script from SysAdmin Magazine (May 1998) that allows remote attackers to execute arbitrary commands. The NVD notes a CVSSv2 base score of 7.5 (HIGH) with AV:N/AC:L/Au:N/C:P/I:P/A:P. The entry lists no exploitation status and provi...
backhoe.article
backhoe article, by miff 1. what is it? backhoe is a backdoor daemon that copies a rootshell into /tmp periodically, then deletes it. You set the frequency that you want rootshells to appear, and you set the amount of time that they will persist before backhoe deletes them. This gives the user wh...
